MMD f7b1f7f751 feat(security): JWT required on every API route, gated dev fallback, role checks ...

- main.py: global get_current_user dependency on all routers except
  /auth/login and /health; prod fail-fast startup guard rejects wildcard
  CORS, default credentials, DEV_LOGIN_ENABLED
- inventory/pm: X-User-Role header identity fallback now only active when
  PROCUREMENT_DEV_LOGIN_ENABLED=true (was unconditional in production)
- item_decisions writes + attachment deletes: require_role(
  procurement_manager, admin) — require_role was defined but never used
- config.py: ENVIRONMENT flag, comma-separated CORS_ORIGINS, no default
  Casdoor client secret/admin password, DEV_LOGIN_ENABLED=false
- frontend: authenticated file downloads (Bearer + blob) — <a href> links
  cannot send the token; FileList/QuoteDetail/AcceptModal/EditModal/
  PurchaseHistory converted; DEV_LOGIN_ENABLED build arg defaults false
- smoke tests authenticate via POST /auth/login (SMOKE_USER/SMOKE_PASSWORD)
- traefik: security headers, API rate limit, 12MB body cap (prod overlay)
- nginx client_max_body_size aligned to 12MB

2026-09-18 22:02:09 +03:30

..

seed_casdoor.py

chore(security): remove committed secrets/dumps, .env-based config, hardened deploy webhook

2026-09-18 21:55:24 +03:30

seed.py

fix(seed): enforce only the 8 canonical topic categories

2026-09-02 18:28:54 +03:30

smoke_test_misc.py

feat(security): JWT required on every API route, gated dev fallback, role checks

2026-09-18 22:02:09 +03:30

smoke_test_write.py

feat(security): JWT required on every API route, gated dev fallback, role checks

2026-09-18 22:02:09 +03:30

smoke_test.py

feat(security): JWT required on every API route, gated dev fallback, role checks

2026-09-18 22:02:09 +03:30