solution-erp

vietreport-admin/solution-erp

Fork 0

Commit Graph

Author	SHA1	Message	Date
pqhuy1987	c808b9ad81	[CLAUDE] Auth: gate ReportsController tai-chinh HD behind Reports.Read policy (reviewer S118) All checks were successful Deploy SOLUTION_ERP / build-deploy (push) Successful in 5m34s Details Lo hong (reviewer S118 phat hien khi phan quyen PRO tra.bui): ReportsController chi co [Authorize] tran (khong policy) -> MOI user dang nhap goi duoc GET /reports/dashboard (tong gia tri HD dang chay, top NCC/du an theo gia tri, xu huong 12 thang) + GET /reports/contracts/export (xuat toan bo HD ra Excel). Nguoc quyet dinh S92 "HD chi Admin thay" (menu an nhung API van mo, go URL/API truc tiep lay duoc). Fix (owner chot: chi Admin qua Reports.Read policy -- linh hoat mo role khac qua ma tran sau): - Dashboard() + ExportContracts() -> them [Authorize(Policy = "Reports.Read")] per-method. Hien chi Admin co Reports.Read -> non-admin 403. Admin bypass moi policy nhu cu. - MyDashboard() GIU MO (chi [Authorize] class-level) -- scope theo currentUser, moi user chi thay so cua CHINH MINH (draft/pending/SLA/gia tri draft cua minh), khong lo toan cong ty. Test: +4 reflection authz regression (AuthorizePolicyRegressionTests, mirror gotcha #44 S45): dashboard/export co Reports.Read; my-dashboard KHONG co action-policy (guard chong ai khoa nham dashboard ca nhan). 505 -> 509. Gotcha #82 (menu-flag grant != quyen API that). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 15:55:18 +07:00
pqhuy1987	051b62bc2f	[CLAUDE] Tests: close 3 HRM coverage gaps (S45) Gap1 (CRITICAL) Holiday composite UNIQUE (Year,Date): Create/Update guard, self-update no false-positive, soft-delete exclusion. Gap2 EmployeeSatellite: 5x FK-invariant parent guard + soft-delete + cascade semantics + EF model cascade config. Gap3 gotcha #44 authz regression: HrmConfigsController (bare [Authorize] + writes Roles=Admin) + EmployeesController (class Policy Hrm_HoSo.Read + per-action). 154 -> 181 PASS (+27, Infra 96->123). Surfaced drift (test-locked current behavior, fix pending): Holiday DB UNIQUE (Year,Date) NOT filtered by IsDeleted -> recreating on soft-deleted slot throws DbUpdateException(500) vs app-level !IsDeleted intent. Inconsistent with PE/Contract LevelOpinions filtered-unique pattern. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-01 13:38:05 +07:00
pqhuy1987	dbda37eb30	[CLAUDE] Tests: Plan C task 4 — regression test #44 silent 403 (Authorize policy ApprovalWorkflowsV2) 5 reflection-based tests verify ApprovalWorkflowsV2Controller Authorize policy split (gotcha #44 fix `f77ea38` S18): - class-level [Authorize] (any authenticated), NO Policy - GET Overview inherits class-level (no action policy) - POST Create + DELETE + PATCH user-selectable require Policy="Workflows.Create" Pattern reusable: catch future regression nếu ai add Policy lên class-level hoặc GET action → test fail ngay, không cần UAT reproduce silent 403. Add ProjectReference Api → Infrastructure.Tests cho reflection access. Verify: - dotnet test SolutionErp.slnx — 89/89 PASS (58 Domain + 31 Infra = 26+5 #44) Δ: 84 → 89 (+5) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-13 21:05:25 +07:00

Author

SHA1

Message

Date

pqhuy1987

c808b9ad81

[CLAUDE] Auth: gate ReportsController tai-chinh HD behind Reports.Read policy (reviewer S118)

Deploy SOLUTION_ERP / build-deploy (push) Successful in 5m34s

Details

Lo hong (reviewer S118 phat hien khi phan quyen PRO tra.bui): ReportsController chi co
[Authorize] tran (khong policy) -> MOI user dang nhap goi duoc GET /reports/dashboard (tong gia
tri HD dang chay, top NCC/du an theo gia tri, xu huong 12 thang) + GET /reports/contracts/export
(xuat toan bo HD ra Excel). Nguoc quyet dinh S92 "HD chi Admin thay" (menu an nhung API van mo,
go URL/API truc tiep lay duoc).

Fix (owner chot: chi Admin qua Reports.Read policy -- linh hoat mo role khac qua ma tran sau):
- Dashboard() + ExportContracts() -> them [Authorize(Policy = "Reports.Read")] per-method. Hien
  chi Admin co Reports.Read -> non-admin 403. Admin bypass moi policy nhu cu.
- MyDashboard() GIU MO (chi [Authorize] class-level) -- scope theo currentUser, moi user chi thay
  so cua CHINH MINH (draft/pending/SLA/gia tri draft cua minh), khong lo toan cong ty.

Test: +4 reflection authz regression (AuthorizePolicyRegressionTests, mirror gotcha #44 S45):
dashboard/export co Reports.Read; my-dashboard KHONG co action-policy (guard chong ai khoa nham
dashboard ca nhan). 505 -> 509. Gotcha #82 (menu-flag grant != quyen API that).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-14 15:55:18 +07:00

pqhuy1987

051b62bc2f

[CLAUDE] Tests: close 3 HRM coverage gaps (S45)

Gap1 (CRITICAL) Holiday composite UNIQUE (Year,Date): Create/Update guard, self-update no false-positive, soft-delete exclusion. Gap2 EmployeeSatellite: 5x FK-invariant parent guard + soft-delete + cascade semantics + EF model cascade config. Gap3 gotcha #44 authz regression: HrmConfigsController (bare [Authorize] + writes Roles=Admin) + EmployeesController (class Policy Hrm_HoSo.Read + per-action). 154 -> 181 PASS (+27, Infra 96->123).

Surfaced drift (test-locked current behavior, fix pending): Holiday DB UNIQUE (Year,Date) NOT filtered by IsDeleted -> recreating on soft-deleted slot throws DbUpdateException(500) vs app-level !IsDeleted intent. Inconsistent with PE/Contract LevelOpinions filtered-unique pattern.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-01 13:38:05 +07:00

pqhuy1987

dbda37eb30

[CLAUDE] Tests: Plan C task 4 — regression test #44 silent 403 (Authorize policy ApprovalWorkflowsV2)

5 reflection-based tests verify ApprovalWorkflowsV2Controller Authorize policy
split (gotcha #44 fix `f77ea38` S18):
- class-level [Authorize] (any authenticated), NO Policy
- GET Overview inherits class-level (no action policy)
- POST Create + DELETE + PATCH user-selectable require Policy="Workflows.Create"

Pattern reusable: catch future regression nếu ai add Policy lên class-level
hoặc GET action → test fail ngay, không cần UAT reproduce silent 403.

Add ProjectReference Api → Infrastructure.Tests cho reflection access.

Verify:
- dotnet test SolutionErp.slnx — 89/89 PASS (58 Domain + 31 Infra = 26+5 #44)
  Δ: 84 → 89 (+5)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-13 21:05:25 +07:00

3 Commits