Skip to content

release: promote validated develop baseline - #13

Open
cb8010d6 wants to merge 69 commits into
mainfrom
develop
Open

release: promote validated develop baseline#13
cb8010d6 wants to merge 69 commits into
mainfrom
develop

Conversation

@cb8010d6

@cb8010d6 cb8010d6 commented May 6, 2026

Copy link
Copy Markdown
Owner

Summary / 摘要

中文

  • 将当前已通过 CI 的 develop 集成分支发布到 main。
  • 包含 CI 基线修复、模块 runbooks、双语 review 规范、采购收货加固、库存拣货测试、财务断言增强和 web dashboard warning 清理。

English

  • Promote the current CI-green develop integration branch to main.
  • Includes CI baseline fixes, module runbooks, bilingual review rules, purchase receiving hardening, inventory picking tests, finance assertion improvements, and web dashboard warning cleanup.

Validation / 验证

中文

  • develop 上相关 PR 均已通过 CI。
  • 最新 develop push CI 已通过。

English

  • Related PRs on develop passed CI.
  • Latest develop push CI passed.

cb8010d6 added 26 commits May 5, 2026 14:55
- Empty DB migrate deploy: verify all 32 tables, TaxCode columns, tax snapshot fields, indexes, FKs
- Old schema upgrade: step-by-step pre-taxcode migrations, verify column additions
- TaxCode historical data strategy: zero-default for old rows, full snapshots for new rows, unique constraints, FK SET NULL behavior, idempotency
- docker-compose.prod.yml:
  - 修复 NEXT_PUBLIC_API_URL -> NEXT_PUBLIC_API_BASE_URL (与 api.ts 一致)
  - 修复 Redis 健康检查带密码: redis-cli -a  ping
  - 新增 CORS_ORIGINS 环境变量 (main.ts 读取)
  - 移除 IMAGE_OWNER 无效默认值 your-org, 强制要求配置
  - 镜像标签从硬编码 :latest 改为  支持回滚

- deploy.yml:
  - 从 placeholder 升级为完整 SSH 自动部署 (appleboy/ssh-action)
  - 新增 workflow_dispatch inputs: deploy_api, deploy_web, image_tag
  - 支持通过 image_tag 参数回滚到指定 commit SHA
  - 部署后自动健康检查 + 旧镜像清理

- .env.example:
  - 补充生产环境专用变量文档 (IMAGE_OWNER, IMAGE_TAG, CORS_ORIGINS)
  - 新增端口/URL 对应关系说明

- docs/deployment.md (新建):
  - 部署模式决策: CI/CD 全自动构建+推送+SSH部署
  - GHCR 权限配置指南 (推送/拉取/所需 Secrets)
  - 镜像 Tag 策略 (latest/SHA/branch)
  - 回滚策略 (GitHub Actions 手动触发 + 服务器紧急回滚)
  - 环境变量完整性检查 (必填/可选/最小模板)
  - 运维命令速查
…ng/Move models and enums

- Add PurchaseOrderStatus, GoodsReceiptStatus, PickingType, PickingStatus, MoveStatus enums
- Add PurchaseOrder, PurchaseOrderLine models (purchase management)
- Add GoodsReceipt, GoodsReceiptLine models (goods receipt)
- Add StockPicking, StockMove models (stock execution documents)
- Add reservedQuantity to StockQuant for stock reservation
- Add stockMoveId to InventoryTransaction for traceability chain
- Update Company, Partner, Material, StockLocation with new relations
- Register new models in COMPANY_SCOPED_MODELS for tenant isolation
- Add new models to export-prisma-ddl-context.ts
- README.md: mark TaxCode engine as completed in Roadmap, update AI section, add ARCHITECTURE.md link
- docs/architecture/ARCHITECTURE.md: create comprehensive architecture overview (new file)
- docs/analysis/MISSING_FEATURES_ANALYSIS.md: fix status table (TaxCode 5%->60%, AI 20%->65%), correct CI/CD status, update AI implementation details
- docs/plans/PROJECT_PLAN_AND_STATUS.md: update Phase 3 AI status to 'core logic landed', update date to 2026-05-05
- .github/copilot-instructions.md: add ARCHITECTURE.md to required reading list
…iew schemas

- Add purchaseOrder schema with form sections (basic info, amounts, notes), list view, and kanban (6 status columns)
- Add purchaseOrderLine schema with form, list views and reference fields to purchaseOrder and material
- Add sidebar nav entry for purchase orders (ClipboardList icon, /dashboard/dynamic/purchaseOrder)
…imeline

- LoginPage: render, default credentials, submit, error states, loading
- DynamicView: list/create/edit/reference field include generation
- OrderDetailPage: order info, timeline events, status transitions, empty states
- Unified web-smoke.test.tsx aggregating all core frontend paths
- Add TaxNature enum (OUTPUT/INPUT) for sales vs purchase tax distinction
- Create TaxService (core/tax) as single source of truth for tax resolution & calculation
- Split TaxCode into outputAccountId / inputAccountId for configurable tax accounts
- Add taxRate/taxNature snapshot fields to Invoice; create PurchaseInvoice model
- Remove external taxCodeId/taxRate params from postInvoice to freeze historical amounts
- Only recalculate for legacy records where subTotal=0 && taxAmount=0
- Add explicit AuditLog fallback warning when no default tax code configured
- Add TaxCode CRUD controller (POST/GET/PUT /finance/tax-codes)
- Register TaxModule as @global so any module can inject TaxService
- Update metadata schema for taxNature/outputAccountId/inputAccountId + PurchaseInvoice
- All 114 tests passing, TypeScript zero errors
- Add GET /orders/:id/stock-transactions API endpoint
- Add getStockTransactions service method querying InventoryTransaction by referenceNo pattern (SALE-SHIP-{orderNo}, REVERSE-SHIP-{orderNo})
- Add '物流发货' tab in SaleOrderDrawer showing StockPickings list and stock posting timeline
- Create ShipmentsTable component: type badges, material, qty, batch, source/dest locations, referenceNo
- Create ShipmentTimeline component: chronological posting flow with emoji type indicators
- ARCHITECTURE_BASELINE.md: module boundaries, events, data flow
- DOMAIN_FLOW.md: purchase, inventory, sales, finance flow diagrams
- MIGRATION_POLICY.md: migration rules, backfill strategy
- QUALITY_GATES.md: local & CI unified commands
- BACKLOG.md: P0/P1/P2 backlog
Root causes fixed: 1) package-lock.json not synced 2) Jest config typo setupFilesAfterSetup->setupFilesAfterEnv 3) Missing jsdom peer dep 4) Wrong require() paths in tests 5) jsdom window redefine errors 6) isJwtTokenLikelyValid exp==0 bug 7) .dockerignore missing tsx test patterns. All 123 tests passing (API:96 Web:27)
…hains

- auth.spec.ts: register/login/select-company (6 tests)
- master-data.spec.ts: create partner/material/product (7 tests)
- purchase-flow.spec.ts: purchase inbound + reversal (4 tests)
- sales-flow.spec.ts: sales outbound + reversal (6 tests)
- finance.spec.ts: invoice posting & debit/credit balance (7 tests)
- tenant-isolation.spec.ts: cross-tenant access denied (7 tests)
- helpers.ts: shared API client, auth, CRUD, and business operation utilities
- playwright.config.ts: serial execution, baseURL=http://localhost:8000/api
- package.json: added test:e2e scripts and @playwright/test dependency
- .gitignore: added playwright artifacts
…t confirmation

- Add createSaleOrderPicking: creates DRAFT picking + moves from order items
- Add confirmStockPicking: executes stock deduction with 3-layer idempotency guard
  - Picking-level: DONE status skips entire picking
  - Move-level: DONE status skips individual move lines
  - CANCELLED status rejects confirmation
- Add getPickings/getPickingById query endpoints
- Refactor postSaleOrderShipment as convenience wrapper (picking + confirm)
- Add GET /pickings, POST /pickings/sale-order/:id, POST /pickings/:id/confirm
- Add CreatePickingDto, ConfirmPickingDto
- Add 7 new test cases for picking idempotency (11 total, all passing)
- TypeScript compilation passes with zero errors
- Enhance PurchaseInvoice model: add receiptId, notes, DRAFT status, PurchaseInvoiceLine, VendorBillPayment
- Add GoodsReceipt <-> PurchaseInvoice reverse relation
- Create VendorBillService: CRUD + confirm + payment + posting + auto-draft from receipt
- Create VendorBillController: REST API at /finance/vendor-bills
- Add postVendorBillPostedEntry to AccountingService (PUR journal: DR inventory + input tax, CR AP)
- Add finance.vendor_bill.posted event handler in FinanceBridgeListener
- Add DTOs with class-validator / swagger decorators
- Register in FinanceModule
- Fix pre-existing schema conflict markers and missing reverse relations

BREAKING: Prisma migration required for new models (PurchaseInvoiceLine, VendorBillPayment)
- Add accountId to PurchaseInvoiceLine for expense/inventory account selection
- Refactor postVendorBillPostedEntry to support mixed inventory + expense debit lines
- Add buildPurchaseDebitLines helper for per-line account grouping
- Update VendorBillService to pass accountId through to line creation
- Add Prisma migration for PurchaseInvoiceLine.accountId
- Add comprehensive unit tests for AccountingService (19 tests)

Voucher posting logic:
- Sales: Debit AR, Credit Revenue + Output Tax (unchanged)
- Purchase: Debit Inventory/Expense + Input Tax, Credit AP (enhanced)
- Stock Depletion: Debit COGS, Credit Inventory (unchanged)
- Balance validation: totalDebit === totalCredit enforced
Copilot AI review requested due to automatic review settings May 6, 2026 08:29

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

cb8010d6 added 30 commits May 7, 2026 11:24
- Add retry button on error with model name context
- Replace text loading with animated spinner
- Show more detailed error information for debugging
- Environment setup (Docker, Prisma, API/Web)
- Login verification steps
- Business flow test checklist (sales, purchase, inventory, finance, production, settings)
- AI command and Chat2SQL test cases
- Automation test commands
- Common troubleshooting guide
- Add RefreshToken Prisma model with userId, expiresAt, revoked fields
- Shorten access token to 15 minutes
- Add 30-day refresh token with secure random generation
- Implement token rotation (old refresh token revoked on use)
- Detect refresh token reuse and revoke all tokens for security
- Add POST /auth/refresh and POST /auth/logout endpoints
- Order/OrderItem: totalAmount, subTotal, taxTotal, unitPrice, totalPrice, taxAmount
- Invoice/Payment: amount, subTotal, taxAmount, taxRate
- PurchaseOrder/PurchaseOrderLine: totalAmount, subTotal, taxTotal, unitPrice, taxAmount
- PurchaseInvoice/PurchaseInvoiceLine: amount, subTotal, taxAmount, taxRate, unitPrice, lineTotal
- VendorBillPayment: amount
- JournalEntryLine: debit, credit
- Add Number() conversions in 5 service files for Decimal compatibility
- Fix unused eslint-disable directive in FormEngine
- Suppress intentional exhaustive-deps in SaleOrderDrawer
- Remove unused axios variable in api.test.ts
- Current state analysis (multi-lockfile, --prefix pattern)
- Migration plan with risk assessment
- Recommended migration window and steps
- Update AuthResult type with refreshToken and accessTokenExpiresIn
- Add tests for refresh endpoint, token rotation, and reuse detection
- Fix duplicate email expected status from 401 to 409
- Replace old inventory-only test with full purchase order lifecycle
- Test PO creation with line items
- Test list and detail queries
- Test generic CRUD access for purchaseOrder model
- Test submit (DRAFT→SUBMITTED) and confirm (SUBMITTED→APPROVED) transitions
- Set turbopack.root to project root in next.config.ts
- Next.js will no longer warn about multiple lockfiles
- apps/api/tsconfig.json: add ignoreDeprecations: 5.0 for baseUrl deprecation
- e2e/tsconfig.json: add ignoreDeprecations: 5.0 for moduleResolution=node10 deprecation
…y fixes

- fix(deps): upgrade @nestjs/core and path-to-regexp (CVE fixes)
- fix(prisma): TaxCode.rate Float to Decimal(6,4) for financial precision
- feat(prisma): add REVERSED to EntryPostingStatus, reversedEntryId to JournalEntry
- feat(finance): add reverseJournalEntry with idempotency and audit trail
- feat(finance): add getTrialBalance aggregation by account/period
- feat(finance): add getJournalEntries with pagination and status filter
- feat(purchase): add cancel action for purchase orders
- fix(e2e): playwright use default Edge browser instead of Chromium
- test: update finance.controller.spec.ts for new AccountingService dependency
…subprojects

- api: fix handlebars, lodash, picomatch, brace-expansion CVEs (0 remaining)
- web: fix axios, brace-expansion, picomatch CVEs (2 remaining in next.js core, requires major version change)
- feat(core): add RequirePermissions decorator to define endpoint permissions
- feat(core): add PermissionsGuard to validate userRole.permissions against requirements
- feat(core): implement ADMIN role auto-grant capability
- refactor(finance): secure sensitive endpoints with finance:write, finance:reverse, finance:admin
- refactor(purchase): secure sensitive endpoints with purchase:write, purchase:approve, purchase:cancel
- test(core): add comprehensive unit tests for PermissionsGuard behavior
- Added `SubTableEngine` to edit arrays of objects inline within forms
- Updated `FormEngine` to support the new `subtable` field type
- Added support for Custom Action Buttons in `DynamicView` via schema definitions
- Integrated backend `purchaseOrder` and `journalEntry` metadata with UI actions
- Fixed TypeScript errors and verified `npm run build` succeeds
- Added `PermissionsContext` and `usePermissions` hook
- Updated `AuthStore` to store user role permissions correctly
- Integrated `hasAnyPermission` check with `DynamicView` action buttons
- Only users with appropriate permissions (e.g., `purchase:cancel`) will see action buttons
- Added Goods Receipt (`goodsReceipt`) to metadata engine for dynamic UI rendering with confirm/reverse actions.
- Added Three-way Match (`match`) and `post` actions to Vendor Bill (`purchaseInvoice`) metadata.
- Created custom Trial Balance page (`/dashboard/finance/trial-balance`) with data fetching from API.
- Added navigation links for Goods Receipt, Vendor Bills, and Trial Balance to Dashboard Layout.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants