jackyu66gitandCursor
879bf70cb7
新增独立鉴权的 /api/v1/admin 与 Vue 控制台；会员授予与审计同事务，并补集成/单测。 Co-authored-by: Cursor <cursoragent@cursor.com>
31 lines
958 B
Markdown
31 lines
958 B
Markdown
# CODE_REVIEW — ECR-006
|
||
|
||
**Verdict:** Approve（Feature Complete · Ops-A）
|
||
|
||
Date: 2026-08-06 · Re-review after P1/P2 fixes
|
||
|
||
## Checklist
|
||
|
||
- [x] Handler → Service → Repository；admin 路由未挂 DeviceAuth
|
||
- [x] Feature Spec Active + BACKEND_DESIGN BD-2026-006
|
||
- [x] OpenAPI 增补 `/admin/*`
|
||
- [x] 文件 ≤400；integration 绿
|
||
- [x] Grant + Audit **同事务**（`GrantMembershipWithAudit`）
|
||
- [x] Logout 复用 `middleware.BearerToken`（大小写无关）
|
||
- [x] Bootstrap 失败打 `log.Printf`
|
||
|
||
## Prior findings — resolved
|
||
|
||
| Was | Fix |
|
||
|-----|-----|
|
||
| P1 grant/audit 非原子 | `AdminRepo.GrantMembershipWithAudit` 单事务 |
|
||
| P2 logout Bearer 大小写 | 共享 `BearerToken` |
|
||
| P2 bootstrap 静默失败 | router 记录 `admin bootstrap failed` |
|
||
|
||
## Residual（不阻断）
|
||
|
||
- session token 明文落库（后置 hash）
|
||
- bootstrap 多实例 TOCTOU
|
||
- admin 未进 `@yuxingu/sdk`
|
||
- RBAC / CMS → Phase B+
|