22 lines
1.3 KiB
Markdown
22 lines
1.3 KiB
Markdown
## 1. OpenSpec And Contracts
|
|
|
|
- [x] 1.1 Add auth/session requirements covering login, registration, logout, current-user, profile/theme updates, user update, and local fallback limits.
|
|
|
|
## 2. Platform Implementation
|
|
|
|
- [x] 2.1 Extend user domain, DTO, model, validation, and service contracts for password hashes, profile, theme, and controlled user updates.
|
|
- [x] 2.2 Implement in-memory platform auth sessions and route handlers for `/api/v1/auth/*` and `/api/v1/users/current*`.
|
|
- [x] 2.3 Implement `PUT /api/v1/users/{id}` for the 用户管理 page.
|
|
|
|
## 3. Frontend Implementation
|
|
|
|
- [x] 3.1 Send bearer session tokens on API calls and persist only the API session token, not a privileged local user.
|
|
- [x] 3.2 Gate local fallback behind an explicit dev/demo env flag and ensure fallback never grants platform administrator privileges.
|
|
- [x] 3.3 Keep metrics/config/AI suggestion gaps in graceful page-local fallback behavior.
|
|
|
|
## 4. Verification
|
|
|
|
- [x] 4.1 Add backend API/service tests for login/register/current-user/logout/pending/disabled/user-update behavior.
|
|
- [x] 4.2 Add frontend session tests for API login, failed auth, refresh session restoration, and fallback gating.
|
|
- [x] 4.3 Run platform tests, platform_web tests/typecheck/build, `scripts/check-structure.sh`, and `openspec validate fix-platform-auth-session-api --strict`.
|