* fix(api): correct inverted enable_flag comment and document time unit
- tenant.proto enable_flag comment said "1 enabled, 0 disabled" but the
actual EnableFlagEnum is ENABLE=0, DISABLE=1 — callers reading the
comment would invert the flag. Correct it.
- base.proto create_time/operate_time are epoch milliseconds
(LocalDateTimeUtil/Instant.toEpochMilli); document the unit so callers
don't guess seconds vs millis.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(api): carry timestamp in point-value history; explicit bool presence
#5 Point-value history: the whole chain (proto -> gRPC server ->
PointValueService -> repository -> facades -> controller -> agentic tool)
returned List<String> and dropped create_time even though the DB row
already carried it. Switch to PointValueBO / FacadePointValueBO end to
end so callers receive each value with its timestamp.
#6 Field presence: GrpcR.ok and McpIntrospectDTO.active are now optional
bool, so "unset" is distinguishable from false on the wire.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(auth): unify JWT signing key, drop salt/password from token contract
The JWT signing key was per-principal — securityKey + ":" + salt, where
salt was the credential salt also carried through the gateway and the
token RPC. That makes the JWT key weak and widens salt exposure to every
gateway hop. Sign with the single configured securityKey (HS256) instead
and remove salt from the JWT path entirely:
- KeyUtil.generateToken/parserToken drop the salt parameter; the HMAC
key is now just securityKey (must be >= 32 bytes for HS256).
- TokenService.generateToken/checkValid drop the salt parameter.
- token.proto GrpcLoginQuery drops salt and password — CheckValid only
ever needed tenant, name and token.
- gateway FilterService, TokenGrpcFacade, TokenController adapted; the
request header no longer feeds salt into validation.
The login-handshake salt (POST /token/salt, used to salt the password
client-side before verifyPassword) is unchanged — only the JWT signing
salt is removed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* refactor(api): type MCP authorize decision as proto enum
The authorize-tool-call decision was a free-form string, so callers
could only compare it against literals with no compile-time check.
Introduce GrpcMcpDecision (MCP_DECISION_UNSPECIFIED / AUTHORIZED /
CONFIRM_REQUIRED / REJECTED) and type GrpcMcpToolAuthorizeDTO.decision
with it. Enum names match the existing auth-side literals, so the
mapping is a direct valueOf / name().
- McpRuntimeServer builds the enum via toGrpcDecision (unknown -> UNSPECIFIED).
- McpRuntimeGrpcFacade maps enum -> BO string via name().
- gateway unchanged: it receives the BO (string decision) through the facade.
The other string MCP fields (risk_level, status, grant_type,
principal_type) stay strings for now — their value sets are wider and
partly lowercase (OAuth grant_type), so they are a follow-up.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(facade): align TokenLocalFacade with 3-arg checkValid (CI compile fix)
TokenLocalFacade (local impl) was missed when TokenFacade.checkValid
dropped salt; CI compiles facade-local-auth independently and caught
it. Align it + its test.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
DOMPurify does not strip <script>/on* handlers under happy-dom (the
default vitest environment), so the "strips <script> tags" assertion
has been failing on main since the sanitizer switched to DOMPurify.
Production is unaffected — real browsers sanitize correctly. Pin this
single test file to jsdom via a per-file environment annotation and add
jsdom as a devDependency; all other tests stay on happy-dom.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
RenderedAssistantMessage rendered model output via v-html after a
hand-rolled regex sanitizer that CodeQL flagged 5 ways: bad-tag-filter,
incomplete-multi-character-sanitization (on* attributes, javascript:),
incomplete-url-scheme-check (data:/vbscript:). Replace with DOMPurify,
which covers all these plus mutation XSS. Fixes CodeQL #2146-2150.
Batch-upgrade dc3-web dependencies (element-plus, pinia, vue-router,
@types/node, typescript-eslint, vite, vitest, and related dev tooling),
covering Dependabot PRs #125/#128/#129 that could not auto-rebase because
Dependabot cannot parse the pnpm v9 lockfile.
Keep typescript on ~6: vue-tsc 3.3.7 and its volar toolchain do not yet
support TypeScript 7 (vue-tsc crashes resolving the removed ./lib/tsc
export), which would break the type-check quality gate.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Drop prettier, eslint-config-prettier, eslint-plugin-prettier and related
configs. Code formatting is now controlled solely by the IDE (IDEA) via
.editorconfig, eliminating the two-formatter conflict.
- EventAttributeExt/CommandAttributeExt: change @Schema example from
Chinese placeholder to 'Enter text'
- dc3-web/package.json: change description to English
Merge the standalone iot-dc3-web repository into iot-dc3 as dc3-web/,
creating a single monorepo with unified versioning, CI/CD, and release
process.
- subtree-add iot-dc3-web under dc3-web/ with full commit history
- relocate nginx configs and SSL certs to dc3/dependencies/
- merge CI workflows (ci-backend.yml, ci-web.yml, docker-ci-web.yml)
- merge Issue/PR templates and dependabot config
- host frontend docs under docs/zh/frontend/
- share .husky/ hooks via root-level package.json (pnpm)
- unify versioning: single dc3/bin/tag.sh (vYYYY.M.P) for the whole repo
- update Dockerfile, docker-compose.yml, Makefile for new paths
- remove redundant directories from dc3-web/ (.claude, .github, dc3, docs, bin)
Co-Authored-By: Claude <noreply@anthropic.com>
