记录CEO财务兜底生产收口（07-28-ceo-finance-fallback）
这个提交包含在：
@@ -23,6 +23,58 @@ QA script patterns over new abstractions.
|
||||
- `cd server && ./scripts/regression-workflow-actions.sh`
|
||||
- `cd server && ./scripts/regression-all.sh`
|
||||
|
||||
## Scenario: Prisma Client Defaults In Raw SQL
|
||||
|
||||
### 1. Scope / Trigger
|
||||
|
||||
- Trigger: a script or route uses `$queryRaw`, `pg` or handwritten `INSERT` SQL against a Prisma-managed table whose schema declares `@default(uuid())` or another client-side default.
|
||||
|
||||
### 2. Signatures
|
||||
|
||||
- Prisma signature: `id String @id @default(uuid()) @db.Uuid`.
|
||||
- Database signature may still be `id UUID NOT NULL` without a database `DEFAULT`.
|
||||
- Raw insert must include `id` and bind an explicit UUID, for example `$1::uuid`.
|
||||
|
||||
### 3. Contracts
|
||||
|
||||
- Prisma schema defaults are not assumed to exist in PostgreSQL; inspect the applied migration or live column default before omitting a raw-SQL field.
|
||||
- Raw audit inserts generate a fresh UUID in application code and keep the audit insert in the same transaction as the protected write.
|
||||
- Dry-run may exercise audit inserts, but it must roll the transaction back and report zero committed audit rows.
|
||||
|
||||
### 4. Validation & Error Matrix
|
||||
|
||||
- Raw insert omits a required client-default field with no DB default -> PostgreSQL not-null failure; transaction rolls back.
|
||||
- Explicit UUID has invalid syntax -> PostgreSQL cast failure; transaction rolls back.
|
||||
- Audit insert fails after the business update -> the complete transaction rolls back; no partial rule update is allowed.
|
||||
|
||||
### 5. Good/Base/Bad Cases
|
||||
|
||||
- Good: explicit UUID, request ID, actor, target and JSON audit payload are bound and tested position by position.
|
||||
- Base: Prisma Client `create()` may rely on the Prisma default because the client supplies it.
|
||||
- Bad: infer from `@default(uuid())` that handwritten PostgreSQL may omit `id`.
|
||||
|
||||
### 6. Tests Required
|
||||
|
||||
- Assert the raw SQL column list contains the required ID and the bound value is a valid UUID.
|
||||
- Assert every parameter position maps to its intended DB type.
|
||||
- Assert dry-run begins a serializable transaction and executes `ROLLBACK`; audit failure paths must remain fail-closed.
|
||||
|
||||
### 7. Wrong vs Correct
|
||||
|
||||
#### Wrong
|
||||
|
||||
```sql
|
||||
INSERT INTO audit_logs (request_id, actor_id, extra)
|
||||
VALUES ($1, $2::uuid, $3::jsonb);
|
||||
```
|
||||
|
||||
#### Correct
|
||||
|
||||
```sql
|
||||
INSERT INTO audit_logs (id, request_id, actor_id, extra)
|
||||
VALUES ($1::uuid, $2, $3::uuid, $4::jsonb);
|
||||
```
|
||||
|
||||
## Scenario: Local Regression Migration Drift
|
||||
|
||||
### 1. Scope / Trigger
|
||||
|
||||
@@ -30,15 +30,15 @@
|
||||
|
||||
## 4. Deployment And Production Apply
|
||||
|
||||
- [ ] 提交并推送已验证代码。
|
||||
- [x] 提交并推送已验证代码。
|
||||
- [x] 修复部署脚本已知的数据目录保护缺陷：同步根目录与数据目录任一方向重叠时在 SSH 前阻断，自定义同步树内 `.env` 动态保护；隔离备份/恢复合同通过。
|
||||
- [ ] 部署后核对 `/ready` 构建号、migration 状态、runtime smoke、external deps smoke 和前端 bundle。
|
||||
- [ ] 生产只读冻结规则结构、active `finance`、CEO、角色、binding、历史快照和审计基线。
|
||||
- [ ] 原子更新恰好 3 条启用规则并逐条写脱敏审计；任一预条件漂移则零写入停止。
|
||||
- [ ] 只读解析 CEO 小/中/大额快照均为唯一 `finance`，普通员工链符合目标；不创建真实报销。
|
||||
- [ ] 复核无角色、主管、binding、历史快照或企微写入变化。
|
||||
- [x] 部署后核对 `/ready` 构建号、migration 状态、runtime smoke、external deps smoke 和前端 bundle。
|
||||
- [x] 生产只读冻结规则结构、active `finance`、CEO、角色、binding、历史快照和审计基线。
|
||||
- [x] 原子更新恰好 3 条启用规则并逐条写脱敏审计；任一预条件漂移则零写入停止。
|
||||
- [x] 只读解析 CEO 小/中/大额快照均为唯一 `finance`，普通员工链符合目标；不创建真实报销。
|
||||
- [x] 复核无角色、主管、binding、历史快照或企微写入变化。
|
||||
|
||||
部署执行备注：`3594872` 已通过标准部署、migration、runtime/external-deps smoke、独立公网构建号和前端 bundle 核验；同时将附件从同步树内迁至独立数据目录并保留校验一致的回退副本，自动备份/WARCH3 timer 已刷新运行身份。首次生产 dry-run 因审计表 UUID 缺失失败并完整回滚；需部署后续修复提交后重新完成本节全部勾选。
|
||||
部署执行备注：`3594872` 首次部署通过，并将附件从同步树内迁至独立数据目录、保留校验一致的回退副本；首次生产 dry-run 因审计表 UUID 缺失失败并完整回滚。修复提交 `a74cba1` 随后部署，`/ready`、migration、runtime/external-deps smoke、92 个公网资源扫描通过；4 个自动运维 timer 已刷新运行身份。第二次 dry-run 为 `DRY_RUN_PASS`，apply 原子写入 3 条规则与 3 条脱敏审计，受保护计数稳定；只读解析 CEO 三档均为唯一 `finance`、普通员工链符合目标，0 条真实报销、0 次企微写入。
|
||||
|
||||
## 5. Stop Conditions
|
||||
|
||||
|
||||
@@ -40,8 +40,8 @@
|
||||
- [x] 前端类型、创建/编辑选项和推荐文案支持 `finance`，默认选择 `finance`，typecheck/build 通过。
|
||||
- [x] 种子默认三档规则与目标链一致，相关回归测试通过。
|
||||
- [x] 只读 review 确认权限、自审、状态机、历史快照和生产回填边界无扩大。
|
||||
- [ ] 部署后公网 `/ready` 构建号匹配，runtime smoke 和关联认证/工作流检查通过。
|
||||
- [ ] 生产恰好 3 条启用规则按目标结构回填并留下脱敏审计；active 账号、角色、binding 和历史审批快照计数无意外变化。
|
||||
- [x] 部署后公网 `/ready` 构建号匹配，runtime smoke 和关联认证/工作流检查通过。
|
||||
- [x] 生产恰好 3 条启用规则按目标结构回填并留下脱敏审计；active 账号、角色、binding 和历史审批快照计数无意外变化。
|
||||
- [x] 当前事实源、管理员手册和任务结论不再宣称 `finance_mgr` 是本公司推荐兜底。
|
||||
|
||||
## Test Plan
|
||||
|
||||
在新工单中引用
屏蔽一个用户