3 Commits

Include renames

Author	SHA1	Message	Date
MMD	e1495afee9	fix(auth): auth deps use their own DB session; smoke suites made dataset-independent ... RUNTIME BUG (caught by live smoke tests): the global auth dependency queried the request-scoped session, auto-beginning its transaction — any endpoint opening 'async with db.begin()' afterwards crashed with 'transaction already begun' (POST /materials 500). get_current_user / get_actor now resolve in a short-lived session (expire_on_commit=False keeps the context usable detached); inventory/pm scopes keep passing the request session explicitly. Smoke suites rewritten against CURRENT contracts: - assertions are behavior-based (shapes, envelopes, filters), no magic seed counts; dynamic lookups instead of hard-coded names/ids - rerun-tolerant: tolerate 409-on-create by reusing prior artifacts - aligned with current rules: revert blocked after inventory receipts (v2.6), attachments allowed in every status, termsheets optional at quote level - SMOKE_USER/SMOKE_PASSWORD env for login (default tester/123456) Verified on a fresh volume: migration + audit_log bootstrap, Casdoor seed (bcrypt), demo data, and 29+76+61 smoke checks all green.	2026-09-19 00:49:15 +03:30
MMD	f7b1f7f751	feat(security): JWT required on every API route, gated dev fallback, role checks ... - main.py: global get_current_user dependency on all routers except /auth/login and /health; prod fail-fast startup guard rejects wildcard CORS, default credentials, DEV_LOGIN_ENABLED - inventory/pm: X-User-Role header identity fallback now only active when PROCUREMENT_DEV_LOGIN_ENABLED=true (was unconditional in production) - item_decisions writes + attachment deletes: require_role( procurement_manager, admin) — require_role was defined but never used - config.py: ENVIRONMENT flag, comma-separated CORS_ORIGINS, no default Casdoor client secret/admin password, DEV_LOGIN_ENABLED=false - frontend: authenticated file downloads (Bearer + blob) — <a href> links cannot send the token; FileList/QuoteDetail/AcceptModal/EditModal/ PurchaseHistory converted; DEV_LOGIN_ENABLED build arg defaults false - smoke tests authenticate via POST /auth/login (SMOKE_USER/SMOKE_PASSWORD) - traefik: security headers, API rate limit, 12MB body cap (prod overlay) - nginx client_max_body_size aligned to 12MB	2026-09-18 22:02:09 +03:30
ali_mohaghegh	170aed66ea	feat(backend): add FastAPI backend — procurement, inventory domain, Casdoor auth, PM arrival endpoints	2026-08-25 19:08:14 +03:30