diff --git a/coverage/ontology-coverage-audit.md b/coverage/ontology-coverage-audit.md index 1c9ef58..70f3381 100644 --- a/coverage/ontology-coverage-audit.md +++ b/coverage/ontology-coverage-audit.md @@ -19,13 +19,13 @@ | 类型 | 数量 | |------|------| | Entity | 29 | -| Action | 77 | +| Action | 75 | | Event | 33 | | Rule | 49 | | Relation | 102 | -| **合计** | **290** | +| **合计** | **288** | -证据强度：`anchored` 249（85.9%）/ `documented` 28 / `gap` 11 / `implemented` 2。 +证据强度：`anchored` 249（86.5%）/ `documented` 28 / `gap` 9 / `implemented` 2。 > anchored 占比相对 Batch 2 下降，是因为主动录入了 P1/P2 `gap` 占位与客户端埋点 `documented` 条目；端点漂移仍为 0。 @@ -36,14 +36,14 @@ python3 docs/graph/validate_ontology.py docs python3 docs/graph/audit_drift.py ``` -当前结果：校验通过；HTTP 端点 70/70、JPA Entity 16/16 对齐；非 JPA 领域实体 13 个；代码与本体均无单边漂移。 +当前结果：校验通过；HTTP 端点 68/68、JPA Entity 16/16 对齐；非 JPA 领域实体 13 个；代码与本体均无单边漂移。 ## 元数据卫生 | 项 | 状态 | |----|------| | Action / Relation `domain` | ✅ 已回填（0 缺失） | -| gap 入口 `deprecated` | ✅ `register_store`、`wechat_authorize`、`wechat_callback` | +| gap 入口 `deprecated` | ✅ `register_store`；未实现的网页 OAuth demo 已删除，不再作为入口建模 | | 寄语事件独立化 | ✅ `event:testimonial_saved`（不再误挂 `report_submitted`） | | `video_*` emittedBy | ✅ 挂到 `action:track_video_play` / `track_video_save` | @@ -144,4 +144,4 @@ python3 docs/graph/audit_drift.py **页面清单 PRD（已写）**：`docs/门店管理后台-PhaseA-页面清单PRD.md`（A0–A7 全页字段/筛选/API/验收）。 -当前 validate 规模以脚本输出为准（290 条目）。 +当前 validate 规模以脚本输出为准（288 条目）。 diff --git a/graph/ontology.jsonl b/graph/ontology.jsonl index 96f2e76..3190a1c 100644 --- a/graph/ontology.jsonl +++ b/graph/ontology.jsonl @@ -172,8 +172,6 @@ {"id":"action:register_store","type":"Action","name":"registerStore","nameZh":"店铺注册（旧入口停用）","inputs":["entity:store"],"outputs":[],"entrypoints":["POST /api/store/register","StoreController#register"],"appliesRules":[],"code":"backend/src/main/java/com/petstore/controller/StoreController.java#register","evidence":"anchored","domain":"store","status":"deprecated","deprecated":true,"doc":"固定返回 LEGACY_STORE_REGISTRATION_DISABLED"} {"id":"action:delete_appointment","type":"Action","name":"deleteAppointment","nameZh":"删除预约","inputs":["id"],"outputs":[],"entrypoints":["DELETE /api/appointment/delete","AppointmentController#delete"],"appliesRules":["rule:BR-APPT-002"],"code":"backend/src/main/java/com/petstore/controller/AppointmentController.java#delete","evidence":"anchored","domain":"appointment"} {"id":"action:list_reports","type":"Action","name":"listReports","nameZh":"报告列表","inputs":["page","pageSize"],"outputs":["entity:report"],"entrypoints":["GET /api/report/list","ReportController#list"],"appliesRules":["rule:BR-RPT-005"],"code":"backend/src/main/java/com/petstore/controller/ReportController.java#list","evidence":"anchored","domain":"report"} -{"id":"action:wechat_authorize","type":"Action","name":"wechatAuthorize","nameZh":"获取微信授权跳转URL","inputs":[],"outputs":[],"entrypoints":["GET /api/wechat/authorize","WechatController#getAuthorizeUrl"],"appliesRules":[],"code":"backend/src/main/java/com/petstore/controller/WechatController.java#getAuthorizeUrl","evidence":"gap","domain":"auth","status":"deprecated","deprecated":true,"doc":"deprecated：勿作为新集成入口"} -{"id":"action:wechat_callback","type":"Action","name":"wechatCallback","nameZh":"微信授权回调","inputs":["code","state"],"outputs":[],"entrypoints":["GET /api/wechat/callback","WechatController#callback"],"appliesRules":[],"code":"backend/src/main/java/com/petstore/controller/WechatController.java#callback","evidence":"gap","domain":"auth","status":"deprecated","deprecated":true,"doc":"deprecated：勿作为新集成入口"} {"id":"rel:report_has_testimonial","type":"Relation","subject":"entity:report","predicate":"HAS","object":"entity:report_testimonial","cardinality":"1—1","evidence":"anchored","doc":"ReportTestimonial.report_id（唯一约束）","domain":"report"} {"id":"rel:testimonial_belongs_to_store","type":"Relation","subject":"entity:report_testimonial","predicate":"BELONGS_TO","object":"entity:store","cardinality":"N—1","evidence":"anchored","doc":"ReportTestimonial.store_id","domain":"report"} {"id":"rel:service_interval_belongs_to_store","type":"Relation","subject":"entity:service_interval","predicate":"BELONGS_TO","object":"entity:store","cardinality":"N—1","evidence":"anchored","doc":"ServiceInterval.store_id（NULL=系统默认）","domain":"service_type"} diff --git a/ontology/actions.md b/ontology/actions.md index ac6a5c4..23e0c89 100644 --- a/ontology/actions.md +++ b/ontology/actions.md @@ -555,26 +555,6 @@ legacy 永久邀请码查询入口已停用，固定返回 `410 / LEGACY_INVITE_ - **代码**：`backend/src/main/java/com/petstore/controller/ReportController.java#list` - **证据**：`anchored` -## 微信 OAuth（TODO demo，deprecated） - -### action:wechat_authorize - -获取微信授权跳转 URL：公开接口（TODO demo，真实微信登录走 `action:wx_phone_login`）。**deprecated**。 - -- **入口**：`GET /api/wechat/authorize` → `WechatController#getAuthorizeUrl`（公开） -- **状态**：`deprecated` -- **代码**：`backend/src/main/java/com/petstore/controller/WechatController.java#getAuthorizeUrl` -- **证据**：`gap`（TODO demo，未真实实现） - -### action:wechat_callback - -微信授权回调：公开接口（TODO demo，返回 `demo_openid_` + code，未真实换取 access_token）。**deprecated**。 - -- **入口**：`GET /api/wechat/callback` → `WechatController#callback`（公开） -- **状态**：`deprecated` -- **代码**：`backend/src/main/java/com/petstore/controller/WechatController.java#callback` -- **证据**：`gap`（TODO demo，未真实实现；真实微信登录走 `action:wx_phone_login`） - ## 客户端埋点 / 会话生命周期 ### action:track_video_play diff --git a/架构决策-下线未实现微信网页OAuth-2026-08-02.md b/架构决策-下线未实现微信网页OAuth-2026-08-02.md new file mode 100644 index 0000000..6517cfa --- /dev/null +++ b/架构决策-下线未实现微信网页OAuth-2026-08-02.md @@ -0,0 +1,25 @@ +# 架构决策：下线未实现的微信网页 OAuth + +> 日期：2026-08-02 +> 决策：删除 `GET /api/wechat/authorize`、`GET /api/wechat/callback` 与 `WECHAT_REDIRECT_URI` +> 保留：微信小程序手机号核验登录 `/api/user/wx-phone-login` + +## 背景 + +旧代码保留了一组公开网页 OAuth demo：授权地址使用 `qrconnect`，回调没有向微信换取身份，而是把请求中的 `code` 拼成 `demo_openid_` 后返回“微信授权成功”。它不签发 Petstore session，但会对外表达不存在的身份核验结果，也让生产发布多维护一个实际不使用的 `WECHAT_REDIRECT_URI`。 + +当前试点只有小程序登录：客户端通过 `getPhoneNumber` 与 `wx.login` 获取一次性 code，后端 `WechatMiniProgramService` 分别向微信换取已核验手机号和 openid/unionid，再由 `/api/user/wx-phone-login` 建立真实账号与 session。Admin、H5 和小程序源码均未调用旧网页 OAuth 端点。 + +## 决策 + +1. 删除 `WechatController` 与只服务于它的 `WechatConfig`；旧路径不再公开放行，也不提供伪成功兼容响应。 +2. 生产配置和 release preflight 不再要求 `WECHAT_REDIRECT_URI`；`WECHAT_APPID`、`WECHAT_APPSECRET` 继续作为小程序服务必填项。 +3. 从机器本体和动作文档删除两个 deprecated/gap 入口，使本体只描述实际存在的 HTTP 契约。 +4. 不在本阶段补做 PC 扫码登录、公众号网页授权或第二套账号绑定模型；未来若有真实场景，必须以独立 PRD、威胁模型和新 API 契约重新设计。 + +## 兼容与发布影响 + +- 数据库无迁移，现有 session、用户、预约、报告和小程序登录不受影响。 +- 若外部仍请求旧路径，将不再得到 demo 成功响应；这属于预期的 fail-closed 行为。 +- 生产环境文件应删除废弃变量，避免运维人员误以为仍需配置网页回调。 +- 三角色验收继续只验证微信小程序手机号核验、员工邀请手机号一致性和旧注册入口 410，不验证网页 OAuth。