c808b9ad81
All checks were successful
Deploy SOLUTION_ERP / build-deploy (push) Successful in 5m34s
Lo hong (reviewer S118 phat hien khi phan quyen PRO tra.bui): ReportsController chi co [Authorize] tran (khong policy) -> MOI user dang nhap goi duoc GET /reports/dashboard (tong gia tri HD dang chay, top NCC/du an theo gia tri, xu huong 12 thang) + GET /reports/contracts/export (xuat toan bo HD ra Excel). Nguoc quyet dinh S92 "HD chi Admin thay" (menu an nhung API van mo, go URL/API truc tiep lay duoc). Fix (owner chot: chi Admin qua Reports.Read policy -- linh hoat mo role khac qua ma tran sau): - Dashboard() + ExportContracts() -> them [Authorize(Policy = "Reports.Read")] per-method. Hien chi Admin co Reports.Read -> non-admin 403. Admin bypass moi policy nhu cu. - MyDashboard() GIU MO (chi [Authorize] class-level) -- scope theo currentUser, moi user chi thay so cua CHINH MINH (draft/pending/SLA/gia tri draft cua minh), khong lo toan cong ty. Test: +4 reflection authz regression (AuthorizePolicyRegressionTests, mirror gotcha #44 S45): dashboard/export co Reports.Read; my-dashboard KHONG co action-policy (guard chong ai khoa nham dashboard ca nhan). 505 -> 509. Gotcha #82 (menu-flag grant != quyen API that). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>