1408d4eb03
All checks were successful
Deploy SOLUTION_ERP / build-deploy (push) Successful in 5m24s
- RevokeTemporarilyHiddenModulesAsync mở rộng predicate: +Contracts/Ct_* +Master/Suppliers/Projects/Departments/Catalog* (cộng dồn S58 Hrm*/Off*/Personal). - Tắt 2 re-grant public cũ: SeedAllRolesHrmProfileReadPermissions (S65) + SeedAllRolesOfficeModulePermissions (S69). Revoke là bước permission CUỐI trong SeedAdminPermissionsAsync (ungated) → durable, re-ẩn mỗi restart prod (gotcha #75). - Thu hẹp InReviewScope → chỉ Pe_* (Duyệt NCC giữ nguyên cho user thường; master-data GET = any-auth nên form PE vẫn chọn được Dự án/NCC/Hạng mục dù menu ẩn). - 2 method grant giữ private static (reversibility) → 2 seed test cũ vẫn invoke cô-lập, pass. - +AdminOnlyModulesRevokeTests (3 test-before-merge, security): non-Admin revoked 4 cờ / Admin untouched / PE preserved. Test 431→434 PASS (45 Domain + 389 Infra). - Reviewer PASS (5 attack vector: seed-order/under-revoke/over-revoke/test-genuine/prod-impact). FYI: role CatalogManager (0 user hiện tại) cũng bị thu Danh mục — intended-by-spec. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>