niuniu/gaokao-volunteer-system
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
240 Commits 3 Branches 1 Tag
ef7ecb794a4525b9b59f820ec0040a218bb41008
Commit Graph

8 Commits

Author SHA1 Message Date
Hermes Agent
adacb1224c feat(legal): 个人主体正式落盘 + consent_version 切到 v2026.06.25
Some checks failed
CI / pytest (Python 3.10) (push) Has been cancelled
Details
CI / pytest (Python 3.11) (push) Has been cancelled
Details
CI / pytest (Python 3.12) (push) Has been cancelled
Details 
按确认方案落地:
- 运营主体: 龙某某（个人开发者）
- 联系邮箱: lon22@qq.com
- 隐私政策版本: privacy-policy-v2026.06.25
- 服务条款版本: service-terms-v2026.06.25
- 生效日期: 2026-06-25

文档更新:
- PRIVACY_POLICY_DRAFT.md: 新增个人信息处理者信息, 联系邮箱, 版本号, 生效日期
- SERVICE_TERMS.md: 新增运营主体信息, 联系邮箱, 版本号, 生效日期
- LEGAL_PRIVACY_BASELINE.md: 同步法务基线状态, 收窄待补项到前台挂载/第三方实名披露
- 清理文档中残留的“待补运营主体/邮箱/版本号”占位文案

运行时更新:
- Settings 默认 GAOKAO_CONSENT_VERSION 改为 privacy-policy-v2026.06.25
- /privacy 和 /service-terms 页面头部渲染主体/邮箱/版本/生效日期
- admin create_order / portal intake 默认 consent_version 与文档版本对齐

测试:
- 38 个针对性测试全过
- 页面真实渲染包含 lon22@qq.com 与正式版本号
- dev-verify all checks passed
 2026-06-25 15:04:29 +08:00
Hermes Agent
ed68e298eb feat(compliance): consent_version 改为从 Settings 读取（支持环境变量覆盖）
Some checks failed
CI / pytest (Python 3.10) (push) Has been cancelled
Details
CI / pytest (Python 3.11) (push) Has been cancelled
Details
CI / pytest (Python 3.12) (push) Has been cancelled
Details 
改造前: consent_version 硬编码 't12-web-mvp-v1' / consent_scope 硬编码
改造后: 从 Settings 读取，可通过环境变量覆盖
- GAOKAO_CONSENT_VERSION (默认 privacy-policy-v2026.06-draft)
- GAOKAO_CONSENT_SCOPE_PORTAL (默认 web-self-service-order-intake)
- GAOKAO_CONSENT_SCOPE_CHANNEL_PREFIX (默认 channel-intake)

实现:
- Settings 新增 consent_version / consent_scope_portal / consent_scope_channel_prefix
- web_public._render_info_page 改为从 settings 取默认值
- orders.create_order 改为从 settings 取默认值

升级隐私政策时:
- 更新 docs/PRIVACY_POLICY_DRAFT.md 版本号
- 设置环境变量 GAOKAO_CONSENT_VERSION=new-version
- 无需改代码，老订单保留历史版本

测试:
- test_create_order_uses_settings_consent_version 锁定新行为
- dev-verify: 1292 passed / coverage / ruff / mypy 全绿
 2026-06-25 13:55:08 +08:00
Hermes Agent
65422b53b2 feat(admin): 后台 routes + tests 多项增量改进 
- routes: cases/orders/stats/ui/web_public 同步字段扩展
- stats.py: 统计聚合逻辑增强
- 14 个测试文件同步更新断言

dev-verify 1279 passed / ruff / mypy 全绿
 2026-06-25 09:27:06 +08:00
hermes
187b2ae634 fix(compliance): A-2 admin/外部渠道补录同意审计统一化 
LEGAL_PRIVACY_BASELINE §4/§6 要求任何订单创建路径必须记录同意审计字段。
portal 路径已落 consent_channel=portal / consent_operator=guardian (见
web_public.py + intake_store.save), admin 路径 6/20 之前完全不入任何 consent
字段 (admin/routes/orders.py grep 'consent' 0 命中), 形成合规盲区。

落地:
- CreateOrderRequest 新增必填 consent: ConsentInfo
  - consent_method Literal: verbal_chat / phone_recording / screenshot /
    written_form / self_declared
  - consent_note Optional[str]
  - 缺失或非法 → HTTP 422
- Order 模型 + DAO _WRITABLE_COLUMNS 加 consent_method / consent_given_at
  (冗余落库避免每次列表 join order_intakes)
- schema 增量: ALTER TABLE orders ADD COLUMN consent_method / consent_given_at
  (幂等)
- create_order 同步写 order_intakes (独立 IntakeStore.for_db, 不复用 OrdersDAO
  conn — T12-D conn ownership 修复保驾)
  - consent_channel = payload.source (xianyu/wechat/school/web)
  - consent_operator 严格按基线白名单 self/guardian/admin_import:
    - web 渠道: 'guardian' (与 intake_store.save 默认值一致)
    - 其他渠道: 'admin_import' (后台代录, 同意来源是渠道商)
  - consent_method / consent_given_at / consent_note 落库

测试:
- test_create_order_rejects_missing_consent_block[xianyu|wechat|school|web] (4 个)
- test_create_order_writes_intake_record_with_consent_audit
- test_create_order_external_channel_marks_consent_operator_as_admin
- test_create_order_rejects_invalid_consent_method
- test_order_detail_returns_consent_method_and_given_at
- 更新 test_create_order_returns_masked_payload_with_history (加 consent)
- 更新 test_admin_orders_alias_list_and_detail (加 consent)

验证:
- 25/25 admin/tests/{test_routes_orders,test_admin_alias_routes} 通过
- ruff + mypy 通过
- 端到端 smoke: 4 笔订单 (2 terminal + 1 pending + 1 paid-in-window) 实测
  包含 consent 字段全部通过
- dev-verify: 1186 passed / 2 failed (失败的 2 个均为 worktree 环境限制:
  test_backup_restore_service_level 的 subprocess 路径假设 + 6/19 已知问题,
  与本改动无关; main 上单跑同样测试通过)
 2026-06-20 15:29:06 +08:00
Hermes Agent
c07c998204 fix: enforce admin role on backend order and audit routes 2026-06-18 14:36:38 +08:00
Hermes Agent
444fc8a530 fix: restrict portal report paths to trusted directories 2026-06-18 14:28:04 +08:00
Hermes Agent
d0ff5b5fe7 feat: gate serving on submitted intake 2026-06-14 10:38:04 +08:00
Hermes Agent
3f46811e49 release: cut v2.1
Some checks failed
CI / pytest (Python 3.10) (push) Has been cancelled
Details
CI / pytest (Python 3.11) (push) Has been cancelled
Details
CI / pytest (Python 3.12) (push) Has been cancelled
Details
2026-06-13 14:49:58 +08:00