fix/status-review-sync-20260409 #1
Reference in New Issue
Block a user
Delete Branch "fix/status-review-sync-20260409"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
- TestTraceID_GeneratesAndAttachesTraceID - TestTraceID_ExtractsExistingTraceID - TestErrorHandler_HandlesErrors - TestRecover_HandlesPanic Fix test to use errors.New instead of gin.Error{Err: nil}- List/Get/Update/Delete users: standardize to {code, message, data} format - UpdateUserStatus: standardize to {code, message} format - handleError: standardize to {code, message} format (was {error: ...}) - All inline bad request errors now use {code: 400, message: ...} consistently- Mark P1 Service 层 DIP 违规 as ✅ 已修复 - Update honest assessment section to reflect current status - Note remaining P2 issue: Handler response format unification- captcha_handler.go: Fix GenerateCaptcha/VerifyCaptcha to use {code, message, data} - password_reset_handler.go: Fix all error responses to use {code, message} - settings_handler.go: Add missing "code" and "message" fields - sms_handler.go: Fix error responses to use {code, message} - sso_handler.go: Fix all error responses to use {code, message, data} - stats_handler.go: Add missing "message" field in success responses - theme_handler.go: Fix error responses to use {code, message} - totp_handler.go: Fix all responses to use {code, message, data} Standardize all JSON responses to {code: 0, message: "success", data: ...} for success and {code: XXX, message: "..."} for errors.- log_handler.go: Fix GetMyLoginLogs/GetMyOperationLogs/GetLoginLogs/GetOperationLogs to use {code, message, data} - permission_handler.go: Fix all error responses to use {code, message} - webhook_handler.go: Add missing "message" field in success responses, wrap data in data object with list/total/page/page_size - webhook_handler_test.go: Update test to match new response format Standardize all JSON responses to {code: 0, message: "success", data: ...} for success and {code: XXX, message: "..."} for errors.- custom_field_handler.go: Fix all error responses to use {code, message} - role_handler.go: Fix all error responses to use {code, message} Standardize all JSON responses to {code: 0, message: "success", data: ...} for success and {code: XXX, message: "..."} for errors.Standardize all JSON responses to {code: 0, message: "success", data: ...} for success and {code: XXX, message: "..."} for errors.Standardize all JSON responses to {code: 0, message: "success", data: ...} for success and {code: XXX, message: "..."} for errors.- Set function: use GORM clause.OnConflict for cross-database upsert - BatchSet function: replace NOW() with datetime('now') - Add tests for Set and BatchSet (both now 100%/85.7% covered)- Add RequiresTOTP, TempToken, UserID fields to LoginResponse - Add isTOTPRequiredForLogin() to check if TOTP is needed after password - Add VerifyTOTPAfterPasswordLogin() for completing login with TOTP - Login() now checks if TOTP is required after password verification When user has TOTP enabled and device is not trusted: - Login returns {requires_totp: true, user_id: <id>} instead of token - Frontend should prompt for TOTP code - Frontend calls VerifyTOTPAfterPasswordLogin to complete login Note: Frontend changes are required to handle the new login flow. The TempToken field is reserved for future use.Backend changes: - Add VerifyTOTPAfterPasswordLogin handler in auth_handler.go - Add route /auth/login/totp-verify in router.go Frontend changes: - Update TokenBundle type to include requires_totp and user_id fields - Add TOTPVerifyRequest type for TOTP verification - Add verifyTOTPAfterPasswordLogin() API function New login flow when user has TOTP enabled: 1. loginByPassword returns {requires_totp: true, user_id: <id>} 2. Frontend prompts user for TOTP code 3. Frontend calls verifyTOTPAfterPasswordLogin({user_id, code}) 4. If TOTP valid, full TokenBundle with tokens is returnedP1-02: OAuth ExchangeCode and GetUserInfo now accept context parameter to properly propagate request context to HTTP calls P1-16: AuthProvider isAuthenticated now uses single source of truth (effectiveUser !== null) instead of double-checking both React state and module-level function