chore(issues): 更新P5蓝图v3状态(F35,F38)
- F35/F38 标记 DONE（错误文案与改密守卫联动验证通过）
这个提交包含在：
@@ -36,10 +36,10 @@ F31,Delegation Grants API对齐（新增别名/增强响应）,"新增 /api/dele
|
|||||||
F32,前端组织与员工最小运营,"补齐前端最小组织能力：部门列表/创建/归档；在用户管理页支持部门选择与直属上级选择（管理员视角）","admin 可完成部门增改归档（含约束提示）；可创建员工并选择部门与直属上级；typecheck/build 通过","cd client && npm run typecheck && npm run build",manual,TODO,TODO,TODO,"client/src/pages/DepartmentsPage.tsx | client/src/pages/UserManagementPage.tsx | client/src/api/departments.ts | client/src/api/employees.ts | client/src/router/index.tsx","[""F26"",""F27""]","单机试运行优先；部门树可简化为层级列表"
|
F32,前端组织与员工最小运营,"补齐前端最小组织能力：部门列表/创建/归档；在用户管理页支持部门选择与直属上级选择（管理员视角）","admin 可完成部门增改归档（含约束提示）；可创建员工并选择部门与直属上级；typecheck/build 通过","cd client && npm run typecheck && npm run build",manual,TODO,TODO,TODO,"client/src/pages/DepartmentsPage.tsx | client/src/pages/UserManagementPage.tsx | client/src/api/departments.ts | client/src/api/employees.ts | client/src/router/index.tsx","[""F26"",""F27""]","单机试运行优先；部门树可简化为层级列表"
|
||||||
F33,前端行政代提交/代上传入口,"为 administration 增加 owner 选择入口：报销创建可选 owner；票据上传可选 owner；并基于 delegation-grants 限定可选范围","有授权时可为指定员工创建/提交/上传；无授权时提示并阻断；typecheck/build/e2e 通过","cd client && npm run typecheck && npm run build && npm run test:e2e",manual,TODO,TODO,TODO,"client/src/pages/ReimbursementsPage.tsx | client/src/pages/InvoicePoolPage.tsx | client/src/api/reimbursements.ts | client/src/api/invoicePool.ts | client/src/api/delegations.ts | client/src/api/employees.ts","[""F7"",""F8"",""F31"",""F27""]","为 E2E 增加 data-testid（owner selector / submit/upload）"
|
F33,前端行政代提交/代上传入口,"为 administration 增加 owner 选择入口：报销创建可选 owner；票据上传可选 owner；并基于 delegation-grants 限定可选范围","有授权时可为指定员工创建/提交/上传；无授权时提示并阻断；typecheck/build/e2e 通过","cd client && npm run typecheck && npm run build && npm run test:e2e",manual,TODO,TODO,TODO,"client/src/pages/ReimbursementsPage.tsx | client/src/pages/InvoicePoolPage.tsx | client/src/api/reimbursements.ts | client/src/api/invoicePool.ts | client/src/api/delegations.ts | client/src/api/employees.ts","[""F7"",""F8"",""F31"",""F27""]","为 E2E 增加 data-testid（owner selector / submit/upload）"
|
||||||
F34,前端票据中心增强（编辑/归档/解绑/重试/例外）,"补齐票据中心 UI：人工修正/手工归档/解绑重绑/重试 OCR；finance_mgr 判重例外入口；并补 data-testid","上述动作按角色/权限可见；状态与错误码展示清晰；typecheck/build/e2e 通过","cd client && npm run typecheck && npm run build && npm run test:e2e",manual,TODO,TODO,TODO,"client/src/pages/InvoicePoolPage.tsx | client/src/api/invoicePool.ts | client/src/api/errorMessages.ts","[""F28"",""F9"",""F10"",""F11""]","动作按钮必须二次确认并给出不可逆提示（如归档）"
|
F34,前端票据中心增强（编辑/归档/解绑/重试/例外）,"补齐票据中心 UI：人工修正/手工归档/解绑重绑/重试 OCR；finance_mgr 判重例外入口；并补 data-testid","上述动作按角色/权限可见；状态与错误码展示清晰；typecheck/build/e2e 通过","cd client && npm run typecheck && npm run build && npm run test:e2e",manual,TODO,TODO,TODO,"client/src/pages/InvoicePoolPage.tsx | client/src/api/invoicePool.ts | client/src/api/errorMessages.ts","[""F28"",""F9"",""F10"",""F11""]","动作按钮必须二次确认并给出不可逆提示（如归档）"
|
||||||
F35,前端错误码文案补齐（VALID/AUTH/PERM）,"补齐新增错误码文案与 details 映射：VALID_004/006/007 等；保证 SYS_001 提示可读且可操作","相关错误在页面/Toast 可读；不暴露敏感字段；typecheck/build 通过","cd client && npm run typecheck && npm run build",manual,TODO,TODO,TODO,"client/src/api/errorMessages.ts | client/src/api/http.ts | client/src/api/ApiError.ts","[""F34""]","错误文案遵循：可行动/可定位（建议带 requestId）"
|
F35,前端错误码文案补齐（VALID/AUTH/PERM）,"补齐新增错误码文案与 details 映射：VALID_004/006/007 等；保证 SYS_001 提示可读且可操作","相关错误在页面/Toast 可读；不暴露敏感字段；typecheck/build 通过","cd client && npm run typecheck && npm run build",manual,DONE,DONE,DONE,"client/src/api/errorMessages.ts | client/src/api/http.ts | client/src/api/ApiError.ts","[""F34""]","错误文案遵循：可行动/可定位（建议带 requestId）"
|
||||||
F36,首次登录强制改密（后端）,"落实规格书：首次登录必须修改初始密码；新增 must_change_password 标记与改密接口（校验旧密码+密码策略+tokenVersion 强制下线）；管理员重置密码后仍要求首次改密","首次登录返回 mustChangePassword=true；改密成功后 mustChangePassword=false 且旧会话失效；审计包含改密动作","manual: 创建员工使用初始密码登录->提示改密->改密后可进入系统；管理员重置密码后再次触发改密",manual,DONE,DONE,DONE,"server/src/routes/auth.js | server/src/routes/users.js | server/src/utils/passwordPolicy.js | server/prisma/schema.prisma | server/prisma/migrations/* | server/README.md","[""F1""]","默认策略：允许登录但强制前端在改密前禁止访问业务页（路由守卫）"
|
F36,首次登录强制改密（后端）,"落实规格书：首次登录必须修改初始密码；新增 must_change_password 标记与改密接口（校验旧密码+密码策略+tokenVersion 强制下线）；管理员重置密码后仍要求首次改密","首次登录返回 mustChangePassword=true；改密成功后 mustChangePassword=false 且旧会话失效；审计包含改密动作","manual: 创建员工使用初始密码登录->提示改密->改密后可进入系统；管理员重置密码后再次触发改密",manual,DONE,DONE,DONE,"server/src/routes/auth.js | server/src/routes/users.js | server/src/utils/passwordPolicy.js | server/prisma/schema.prisma | server/prisma/migrations/* | server/README.md","[""F1""]","默认策略：允许登录但强制前端在改密前禁止访问业务页（路由守卫）"
|
||||||
F37,登录失败锁定与解锁（AUTH_002）,"落实规格书：15分钟内失败5次锁定30分钟；返回 AUTH_002(423)；system.users 可解锁；所有动作写审计","锁定窗口/次数/时长按配置生效；锁定期间无法登录；解锁后可登录；审计可检索","manual: 连续输错触发锁定->验证423与AUTH_002；管理员解锁->恢复登录",manual,DONE,DONE,DONE,"server/src/routes/auth.js | server/src/routes/users.js | server/src/config.js | server/prisma/schema.prisma | server/prisma/migrations/* | server/README.md","[""F1""]","优先用 DB 字段记录失败窗口与锁定截止时间；避免引入外部缓存"
|
F37,登录失败锁定与解锁（AUTH_002）,"落实规格书：15分钟内失败5次锁定30分钟；返回 AUTH_002(423)；system.users 可解锁；所有动作写审计","锁定窗口/次数/时长按配置生效；锁定期间无法登录；解锁后可登录；审计可检索","manual: 连续输错触发锁定->验证423与AUTH_002；管理员解锁->恢复登录",manual,DONE,DONE,DONE,"server/src/routes/auth.js | server/src/routes/users.js | server/src/config.js | server/prisma/schema.prisma | server/prisma/migrations/* | server/README.md","[""F1""]","优先用 DB 字段记录失败窗口与锁定截止时间；避免引入外部缓存"
|
||||||
F38,首次登录改密与锁定提示（前端）,"适配 mustChangePassword 流程：新增改密页面/强制守卫；对 AUTH_002 锁定提示与倒计时文案；保持现有刷新/401 自动续期逻辑不变","首次登录无法进入业务页直到改密；AUTH_002 提示清晰且不暴露敏感；typecheck/build/e2e 通过","cd client && npm run typecheck && npm run build && npm run test:e2e",manual,TODO,TODO,TODO,"client/src/pages/LoginPage.tsx | client/src/pages/ChangePasswordPage.tsx | client/src/router/* | client/src/api/auth.ts | client/src/api/errorMessages.ts","[""F36"",""F35""]","data-testid: change-password-old/new/submit；确保退出登录后守卫生效"
|
F38,首次登录改密与锁定提示（前端）,"适配 mustChangePassword 流程：新增改密页面/强制守卫；对 AUTH_002 锁定提示与倒计时文案；保持现有刷新/401 自动续期逻辑不变","首次登录无法进入业务页直到改密；AUTH_002 提示清晰且不暴露敏感；typecheck/build/e2e 通过","cd client && npm run typecheck && npm run build && npm run test:e2e",manual,DONE,DONE,DONE,"client/src/pages/LoginPage.tsx | client/src/pages/ChangePasswordPage.tsx | client/src/router/* | client/src/api/auth.ts | client/src/api/errorMessages.ts","[""F36"",""F35""]","data-testid: change-password-old/new/submit；确保退出登录后守卫生效"
|
||||||
F39,弱密码库拦截（Top 10k）,"落实规格书：新增弱密码库拦截（Top 10k）并纳入 validatePassword；优先复用成熟库或公开词表；可配置开关","弱密码被拒绝并返回 VALID_001.details.password；正常密码不受影响；不显著增加接口延迟","manual: 用弱密码与强密码分别走创建用户/重置密码/改密流程验证",manual,DONE,DONE,DONE,"server/src/utils/passwordPolicy.js | server/package.json | server/README.md","[""F36""]","选型：[email protected]；替代：owasp-password-strength-test；回滚：WEAK_PASSWORD_CHECK_ENABLED=false 或移除依赖回退 passwordPolicy"
|
F39,弱密码库拦截（Top 10k）,"落实规格书：新增弱密码库拦截（Top 10k）并纳入 validatePassword；优先复用成熟库或公开词表；可配置开关","弱密码被拒绝并返回 VALID_001.details.password；正常密码不受影响；不显著增加接口延迟","manual: 用弱密码与强密码分别走创建用户/重置密码/改密流程验证",manual,DONE,DONE,DONE,"server/src/utils/passwordPolicy.js | server/package.json | server/README.md","[""F36""]","选型：[email protected]；替代：owasp-password-strength-test；回滚：WEAK_PASSWORD_CHECK_ENABLED=false 或移除依赖回退 passwordPolicy"
|
||||||
F40,组织/配置回归脚本（org+settings）,"新增 server/scripts/regression-org-settings.sh：覆盖费用类型/部门/员工别名/配置只读/委派别名等关键权限与返回结构，并可选挂入 regression-all.sh","脚本可重复执行且全绿；覆盖关键正负例；失败输出可定位","cd server && ./scripts/regression-org-settings.sh",manual,DONE,DONE,DONE,"server/scripts/regression-org-settings.sh | server/scripts/regression-all.sh | server/README.md","[""F3"",""F29"",""F31""]","将上述 manual 验收逐步收敛为可回归门禁"
|
F40,组织/配置回归脚本（org+settings）,"新增 server/scripts/regression-org-settings.sh：覆盖费用类型/部门/员工别名/配置只读/委派别名等关键权限与返回结构，并可选挂入 regression-all.sh","脚本可重复执行且全绿；覆盖关键正负例；失败输出可定位","cd server && ./scripts/regression-org-settings.sh",manual,DONE,DONE,DONE,"server/scripts/regression-org-settings.sh | server/scripts/regression-all.sh | server/README.md","[""F3"",""F29"",""F31""]","将上述 manual 验收逐步收敛为可回归门禁"
|
||||||
F41,认证安全回归脚本（auth security）,"新增 server/scripts/regression-auth-security.sh：覆盖首次登录改密 must_change_password 流程、登录失败锁定 AUTH_002 及弱密码拦截等核心负例","脚本可重复执行且全绿；可通过环境变量缩短锁定窗口以加速回归；失败输出可定位","cd server && ./scripts/regression-auth-security.sh",manual,DONE,DONE,DONE,"server/scripts/regression-auth-security.sh | server/scripts/regression-all.sh | server/README.md","[""F37"",""F39""]","建议脚本支持用 env 覆盖锁定窗口与阈值以加速测试"
|
F41,认证安全回归脚本（auth security）,"新增 server/scripts/regression-auth-security.sh：覆盖首次登录改密 must_change_password 流程、登录失败锁定 AUTH_002 及弱密码拦截等核心负例","脚本可重复执行且全绿；可通过环境变量缩短锁定窗口以加速回归；失败输出可定位","cd server && ./scripts/regression-auth-security.sh",manual,DONE,DONE,DONE,"server/scripts/regression-auth-security.sh | server/scripts/regression-all.sh | server/README.md","[""F37"",""F39""]","建议脚本支持用 env 覆盖锁定窗口与阈值以加速测试"
|
||||||
|
|||||||
|
在新工单中引用
屏蔽一个用户