shiyuyun/ARR-2.0-0918
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add public h5 dashboard and publish traceability

Browse Source
This commit is contained in:
Wyndham ARR committed 2026-08-03 13:04:41 +08:00
1 parent 7e7470821b
commit 2107f00e32
29 files changed
+1047 -71
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.project-docs/40-domain/business-rules.md
+4 -1
View File
@@ -2,7 +2,10 @@
## Durable Rules
- Human access to desktop/H5 pages, detailed health, business APIs, uploads, traces and downloads requires an authenticated ARR Web session. Only login assets, `POST /api/login` and no-detail `/healthz` readiness are anonymous.
- Human access to the desktop Finance workspace, detailed health, generic business APIs, uploads, traces and downloads
requires an authenticated ARR Web session. The H5 mobile dashboard is an intentional anonymous read-only exception:
only its page/assets, `/api/public/h5/months`, `/api/public/h5/analytics` and no-detail `/healthz` are public; the H5
projection contains aggregate channel/room metrics and omits source hashes and operational metadata.
- The single-operator login identity is injected as `ARR_WEB_USERNAME` / `ARR_WEB_PASSWORD`; real credentials are never stored in source or returned/logged. Missing credentials fail Web startup closed.
- Login failures use a generic message and bounded attempt blocking. Logout revokes the server-side session; authenticated mutations continue to require CSRF.
- The user uploads XML; the user does not submit a report year, report month, cutoff date, or separate monthly-generation request in the primary workflow.