📋 PM Board
Epic EP-09 Kritik 09_auth erpbom-backend backend

09_auth — Authentication, Authorization va audit (poydevor)

Bajarildi
100% 47/47
Status:

Tavsif

Butun tizimning xavfsizlik poydevori: `users` / `user_sessions` / `auth_logs` / RBAC jadvallari (135 rule katalogi, huquq guruhlari, scope), org-node daraxti (`organizations` — barcha node-lokal jadvallarning FK nishoni), login oqimi (`audience` bilan rol tanlash, ikki o'lchovli brute-force qulfi), refresh rotation + o'g'irlangan token aniqlash, ruxsat hisoblash (§6.1 union) va in-process kesh, audit jurnali (partitsiyalangan, INSERT-ONLY), bootstrap seed va birinchi `owner`, fayl saqlash qatlami (MinIO proxy upload / presigned GET). Backend'da to'liq data-model + REST API + enforcement mexanizmi; web'da ichki foydalanuvchi uchun auth qobig'i va boshqaruv ekranlari; mobil ilovada auth qatlami (login `audience` bilan, refresh, logout / rol almashtirish) — mock kontraktga qarshi. 🔴 Bu epic tugagach har keyingi modul epicida endpoint himoyasi (`@RequirePermission`), `created_by_user_id` va `organization_id` **haqiqiy FK** bilan yoziladi — vaqtinchalik yechim qolmaydi.

Texnik ko'rsatma

Agent uchun

Majburiy o'qish: erp/docs/modules/09_auth.md (to'liq — 3863 qator; har task o'z `spec_ref` bo'limini chuqur o'qiydi), erp/docs/00_ARCHITECTURE.md (ADR-001 AR-1…AR-12), erp/docs/00_CROSS_CUTTING.md (F fon jarayonlari, G audit, H soft-delete, K nomlash, L rule konvensiyasi, N tenant setting, P infratuzilma, Q advisory lock), .claude/skills/coding/java-spring-coder/SKILL.md, .claude/skills/coding/postgresql/SKILL.md, .claude/skills/coding/vuejs-coder/SKILL.md, .claude/skills/coding/flutter-coder/SKILL.md, .claude/skills/coding/swagger/SKILL.md (T00 uchun). 🔴 Yuqoridagi 5 forward-reference qarori har task uchun majburiy — agent ularni qayta muhokama qilmaydi, faqat qo'llaydi. DB nomlash: snake_case, jadvallar ko'plikda (CROSS_CUTTING K). Jadval ro'yxati (12 ta, hammasi bitta `public` schema — AR-1): `permissions`, `currencies`, `organizations`, `organization_settings`, `users`, `user_sessions`, `auth_logs` (partitsiyalangan), `permission_groups`, `permission_group_items`, `user_permissions`, `user_permission_groups`, `ip_login_locks`. 🔴 `tenant_id` ustuni HECH BIR jadvalda yo'q (AR-1). Katalog kodlariga **haqiqiy FK** (AR-10): `permission_group_items.permission_code` va `user_permissions.permission_code` → `permissions.code` (`ON DELETE RESTRICT`). Xato kodi konvensiyasi (§2.4.2): API javob tanasidagi `code` — UPPER_SNAKE (`AUDIENCE_MISMATCH`, `INVALID_CREDENTIALS`, `LAST_OWNER_REQUIRED`…); `auth_logs.details.reason` — lower_snake (`audience_mismatch`, `web_channel_forbidden`); `auth_logs.error_code` — HTTP status satri (`401`/`403`/`423`). Yangi bog'liqliklar (pom.xml): `spring-boot-starter-security` (BCrypt + filter chain), JWT kutubxonasi (jjwt yoki nimbus), MinIO/S3 SDK. EP-01 skeletida ular hali yo'q — T03-S01 qo'shadi.

Qabul mezonlari (DoD)

0 / 6 bajarildi

  • docs/modules/09_auth.md §12 dagi barcha AKTIV (⛔ tombstone bo'lmagan) AC mos avtomatik test bilan qoplangan: AC4, AC10, AC11, AC13, AC14, AC16–AC23, AC26–AC29, AC32–AC37, AC40–AC47, AC49–AC52

  • Migratsiyalarda hech bir jadvalda `tenant_id` ustuni yo'q (grep 0) — AC52

  • `permissions` seed'i §7.2 jadvalidan aynan 135 kod yozadi; `owner` guruhi 135 ta, `viewer` = `*.view` minus 10 istisno — AC23/AC27/AC28

  • openapi drift toza (T00 muzlatgan `openapi/v1/auth.yaml` bilan)

  • erpbom-web: bootstrap owner bilan login → parol almashtirish → foydalanuvchi/huquq/sessiya/audit ekranlari jonli backend'ga qarshi ishlaydi

  • erpbom-mobile: auth qatlami Prism mock (:4010) ga qarshi ishlaydi — login (`audience`), refresh rotation, AUDIENCE_MISMATCH → rol ekrani, logout/rol almashtirish

Ichki ishlar

11 ta

EP-09-T00 OpenAPI kontrakt — 09_auth (muzlatish) contract-ep-09
Bajarildi EP-09-T01 Migratsiya — 09_auth data model (Flyway, 12 jadval)
Bajarildi EP-09-T02 Bootstrap seed (R__) va birinchi owner (R54)
Bajarildi EP-09-T03 Backend — JWT, login oqimi, sessiya va rotation
Bajarildi EP-09-T04 Backend — ruxsat hisoblash, in-process kesh va audit jurnali
Bajarildi EP-09-T05 Backend — foydalanuvchi, huquq va org-node boshqaruvi REST API
Bajarildi EP-09-T06 Backend — fayl saqlash qatlami (MinIO proxy upload / presigned GET)
Bajarildi EP-09-T07 Web — auth qobig'i (login, refresh interceptor, ruxsat store)
Bajarildi EP-09-T08 Web — foydalanuvchi, huquq, sessiya, audit va filial ekranlari
Bajarildi EP-09-T09 Mobil — auth qatlami (login audience bilan, refresh, rol almashtirish)
Bajarildi EP-09-T10 Test — katalog, sxema va xavfsizlik kafolatlari (§12 kesishuvchi AC)
Bajarildi

Izoh qoldirish

Tarix

13 yozuv

  • 💬

    team-lead-ep-09 izoh qoldirdi

    ASBOB TOPILMASI #4 (erpbom-backend, finalize 2-urinish): oasdiff/openapi_contract_bundle.py qo-lda yozilgan kontraktdagi nomlangan enum $ref (mas. Audience, UserStatus, ScopeType) bilan springdoc generatsiya qilgan spec-ni solishtirganda, @Pattern-validated String maydonlarini (Java enum emas -- bu repo-dagi ongli, hujjatlangan konvensiya) har doim enumDeleted=true deb belgilaydi, garchi qiymat to-plami AYNAN mos bo-lsa ham. Bu haqiqiy drift EMAS. EP-09-da 5 barg shu sabab bilan noto-g-ri bloklandi, qiymatlarni qo-lda solishtirib (regex vs enum ro-yxati) tasdiqlab qayta done qilindi. Tavsiya: scripts/openapi-diff.sh yoki bundler-ga @Pattern String maydonlarni named enum bilan bir xil deb hisoblaydigan (yoki hech bo-lmasa enumDeleted-ni faqat qiymat to-plami HAM farq qilsa xato deb hisoblaydigan) mantiq qo-shilsin -- aks holda har keyingi modul finalize-ida xuddi shu qo-lda-tekshiruv kerak bo-ladi (asbob topilma #1-3 bilan bir qatorda).

  • ⇄

    system statusni o'zgartirdi Ishlanyapti → Bajarildi

    Bolalardan avtomatik hisoblandi

  • ⇄

    system statusni o'zgartirdi Bajarildi → Ishlanyapti

    Bolalardan avtomatik hisoblandi

  • ⇄

    system statusni o'zgartirdi Ishlanyapti → Bajarildi

    Bolalardan avtomatik hisoblandi

  • 🔗

    team-lead-ep-09 bog'liqlik qo'shdi

    → EP-01

  • ✎

    team-lead-ep-09 yangiladi

    Yangilandi: estimate_hours, meta

  • 💬

    finalize-ep-09 izoh qoldirdi

    ASBOB TOPILMASI (erpbom-backend, finalize): scripts/openapi-diff.sh / scripts/lib/openapi_contract_bundle.py --module bilan HALI HECH QACHON haqiqiy modul kontraktiga qarshi ishlatilmagan edi (faqat common.yaml, AC107) — EP-09 birinchi haqiqiy sinov bo'ldi va uchta bog'liq bug topildi: (1) rewrite_external_refs faqat #/components/schemas/* ni qayta yozadi, parameters/responses/headers ni EMAS -> PageParam/ValidationError kabi ../common.yaml havolalari kontraktda dangling qoladi; (2) modulning O'Z components.responses/examples (mas. auth.yaml InvalidCredentials) bundle qilinmaydi (faqat schemas+paths olinadi); (3) generated-subset qurishda faqat KONTRAKT tarafidan chaqirilgan sxemalar transitive yig'iladi — springdoc paths ichidan (mas. PageQuery @ModelAttribute) chaqirilgan sxemalar tashlab ketiladi -> oasdiff revision spec'ni yuklay olmaydi ("map key ... not found", chiqish kodi 6, asbob xatosi sifatida to'g'ri ushlanadi, lekin natija umuman olinmaydi). Bu safar drift qo'lda (scratch'da) to'liq deref qilib tekshirildi — natija pastda T05-S04/T06-S02/T06-S03 blocked qaydlarida. Tavsiya: skript bug'lari (1)-(3) tuzatilsin — aks holda KEYINGI HAR BIR modul finalize'ida xuddi shu qo'lda-workaround kerak bo'ladi.

  • 💬

    finalize-ep-09 izoh qoldirdi

    DRIFT (finalize, oasdiff, erpbom-backend): kontrakt (openapi/v1/auth.yaml) GET /api/v1/permissions (ruxsat katalogi ro'yxati, PermissionPage/PermissionResponse) e'lon qiladi, lekin BUTUN EPIC bo'ylab bironta task/subtask bu endpoint'ni implement qilishga TOPSHIRILMAGAN — controller mavjud emas. erpbom-web (T08-S02, permission-catalog.store.ts) bu endpoint'ni ALLAQACHON chaqiradi — huquq guruhlari ekrani bu qatalogsiz runtime'da ishlamaydi. Bu individual barg xatosi emas, BACKLOG BO'SHLIG'I: T00 kontrakt bosqichida deklaratsiya qilingan, lekin backlog maydalashda (T01-T06) hech qaysi taskka yozilmagan. Tavsiya: PM/team-lead yangi subtask ochsin (t.b. T05 ostida — foydalanuvchi/huquq REST API bilan bir repo/modul), spec_ref erp/docs/modules/09_auth.md dagi tegishli band bilan.

  • ⇄

    system statusni o'zgartirdi Bajarildi → Ishlanyapti

    Bolalardan avtomatik hisoblandi

  • ⇄

    system statusni o'zgartirdi Ishlanyapti → Bajarildi

    Bolalardan avtomatik hisoblandi

  • ⇄

    system statusni o'zgartirdi Backlog → Ishlanyapti

    Bolalardan avtomatik hisoblandi

  • 🔗

    pm-agent bog'liqlik qo'shdi

    → EP-01

  • ✦

    pm-agent yaratdi

    09_auth — Authentication, Authorization va audit (poydevor)

Ma'lumot

Agent
—
Olingan
—
Boshlandi
17.08.2026 19:27
Tugadi
18.08.2026 12:57
Baho
222 soat
Spec
erp/docs/modules/09_auth.md
Branch
—
Commit
—

Bog'liqliklar

Agent uchun

Bu ishni AI agent quyidagicha oladi:

curl -s -X POST https://pmboard.ferp.uz/api/items/EP-09/claim \
  -H "X-Agent: backend-dev-1"

Tugatgach:

curl -s -X POST https://pmboard.ferp.uz/api/items/EP-09/status \
  -H "X-Agent: backend-dev-1" \
  -H "Content-Type: application/json" \
  -d '{"status":"review","note":"..."}'