wanzi/ftb-project-management
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

merge: 集成V2.7 企业协作与管理治理

Browse Source 
# Conflicts:
#	apps/server/src/app.module.ts
#	apps/web/components/layout/Sidebar.tsx
#	apps/web/lib/permissions.ts
#	docs/architecture.md
#	docs/decisions.md
#	docs/roadmap.md
This commit is contained in:
。
2026-07-08 18:10:08 +08:00
parent 7677fd0d71 f69ec83193
commit d18bbfa14b
60 changed files with 3219 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
docs/architecture.md
View File

@@ -351,3 +351,22 @@ Current source-of-truth boundary:
- V2.2 read APIs and V2.3 relation sync remain compatibility infrastructure for fast reads, historical AppData imports, and rollback. They are no longer the main proof of data freshness for domains that now write relation tables directly.
- `packages/shared` status contracts have been aligned with the current workflow statuses before the V2.4 write switch.
- V2.5 boundary: audit/RBAC/consistency are active on domain writes. Xiaobao risk snapshots/insights and warning read-state AppData keys are read-only archives pending V2.6 relation writer/backgrounding and V2.7 per-user read-state API.
## V2.7 Enterprise Collaboration And Governance Layer (2026-07-08)
V2.7 adds enterprise collaboration capabilities on top of the relational source-of-truth direction. New collaboration data does not add AppData keys:
- `notifications`: per-recipient notification records with stable event types `assignment / mention / risk_alert / overdue_item`.
- `comments`: polymorphic comments for `dev_task / test_case / bug / requirement / version_plan`, with mention metadata and soft deletion.
- `project_members`: project-level Owner/Admin/Member/Viewer governance, now exposed through server-enforced APIs.
- `audit_logs`: append-only governance and collaboration audit events.
- `governance_dictionaries`: centralized requirement type/platform/source dictionaries; task categories continue to use `task_categories`.
V2.7 uses stable server adapters for collaboration and governance modules:
- `RbacService`: project role and global permission assertion adapter. Feature modules call this instead of hard-coding permission checks, while V2.5 `PermissionGuard` / `@ProtectedMutation()` continue to protect existing domain mutation controllers.
- `AuditService`: append-only collaboration/governance audit adapter. Feature modules call this instead of writing ad-hoc audit records; V2.5 `audit_events` remains the cross-domain mutation audit control plane.
When the later JWT/NextAuth server verification replaces the current header auth adapter, global permission sourcing should be swapped behind these auth/RBAC adapters; feature modules should keep depending on the adapter boundary.
Management overview reads only relation tables and summaries. It intentionally avoids AppData so it reflects the target backend boundary rather than the compatibility document store.