track

duxingchen/track

Fork 0

Commit Graph

Author	SHA1	Message	Date
duxingchen	8c54a38f55	security: API鉴权补全 + SQL拼接隐患消除 1. materials.py - get_material_groups和get_material_items补全Depends(get_current_user) - 移除TYPE_FILTER="1=1"死代码及4处f-string SQL拼接 - 全部SQL改为纯参数化text()查询 2. notifications.py - list_notifications废弃user_id查询参数（越权漏洞） - user_id强制从JWT Token解析，防止篡改参数偷看他人通知 - mark_notification_read补全鉴权	2026-08-12 12:03:12 +08:00
duxingchen	60af3b9998	feat: 物料选择全量展示(移除成品/半成品限制)	2026-08-10 11:02:22 +08:00
duxingchen	79583cf8f4	feat(api): 核心端点 — 接收/驳回/转交/打印/上传/用户/物料/记录CRUD 新增端点: - POST /tasks/{id}/receive — 确认接收 (PENDING→WIP) - POST /tasks/{id}/reject — 品质驳回 + 自动返工 - POST /tasks/{id}/transfer — 完工裂变转交 (多路分支+入库) - PATCH /tasks/{id}/records — 追加图文记录 - PATCH /products/scan/{sn}/status — 宏观状态定调 - POST /upload/ + GET /upload/files/{name} — 文件上传 - GET /users/ — MOM用户列表 - GET /materials/groups + /materials/items — BOM物料手风琴 - POST /print/preview + /execute — 标签预览/打印 - PUT/DELETE /records/{id} — 记录编辑/删除 - GET /tasks/ 新增 assignee_id 过滤	2026-08-05 14:00:43 +08:00

Author

SHA1

Message

Date

duxingchen

8c54a38f55

security: API鉴权补全 + SQL拼接隐患消除

1. materials.py
   - get_material_groups和get_material_items补全Depends(get_current_user)
   - 移除TYPE_FILTER="1=1"死代码及4处f-string SQL拼接
   - 全部SQL改为纯参数化text()查询

2. notifications.py
   - list_notifications废弃user_id查询参数（越权漏洞）
   - user_id强制从JWT Token解析，防止篡改参数偷看他人通知
   - mark_notification_read补全鉴权

2026-08-12 12:03:12 +08:00

duxingchen

60af3b9998

feat: 物料选择全量展示(移除成品/半成品限制)

2026-08-10 11:02:22 +08:00

duxingchen

79583cf8f4

feat(api): 核心端点 — 接收/驳回/转交/打印/上传/用户/物料/记录CRUD

新增端点:
- POST /tasks/{id}/receive — 确认接收 (PENDING→WIP)
- POST /tasks/{id}/reject  — 品质驳回 + 自动返工
- POST /tasks/{id}/transfer — 完工裂变转交 (多路分支+入库)
- PATCH /tasks/{id}/records — 追加图文记录
- PATCH /products/scan/{sn}/status — 宏观状态定调
- POST /upload/ + GET /upload/files/{name} — 文件上传
- GET /users/ — MOM用户列表
- GET /materials/groups + /materials/items — BOM物料手风琴
- POST /print/preview + /execute — 标签预览/打印
- PUT/DELETE /records/{id} — 记录编辑/删除
- GET /tasks/ 新增 assignee_id 过滤

2026-08-05 14:00:43 +08:00

3 Commits