docs: test reports + knowledge iteration design + PRDs

提交 OTP/RBAC/Tier0/Tier1/P0+P2 测试报告、方案A E2E 验证、知识库迭代设计(PRD/mermaid/html 原型)、项目状态看板更新; 根配置 docker-compose.yml/mkdocs.yml。
2026-07-09 11:50:19 +08:00
parent 584c975e7f
commit e4e2de47bb
21 changed files with 3311 additions and 214 deletions
@@ -1,89 +1,33 @@
 classDiagram
-    class Employee {
-        +str employee_id
-        +str corp_id
-        +str name
-        +str department
-        +str position
-        +str avatar
+    class MFAVerifyRequest {
+        +str otp_code
    }
-    class Agent {
+
+    class MFAVerifyResponse {
+        +bool verified
+        +int expires_in
+    }
+
+    class MFAVerifyBindResponse {
+        +bool verified
+        +int expires_in
+        +str token
        +str user_id
        +str name
        +str role
-        +str status
-        +str mfa_secret
-        +bool mfa_enabled
-        +datetime mfa_bound_at
-        +datetime mfa_last_verified_at
-        +str password_hash
-        +int current_load
-        +int max_load
    }
-    class OtpSecret {
-        <<值对象，内嵌于 Agent>>
+
+    class MFABindStartResponse {
        +str secret
+        +str otpauth_url
+        +str qr_code_base64
+    }
+
+    class MFAStatusResponse {
+        +bool bound
        +bool enabled
-        +datetime bound_at
        +datetime last_verified_at
    }
-    class Token {
-        <<Redis 存储>>
-        +str token
-        +str employee_id
-        +list roles
-        +str current_role
-        +str login_source
-        +int ttl_seconds
-    }
-    class MFAService {
-        <<static 封装 pyotp>>
-        +generate_secret() str
-        +build_provisioning_uri(secret, id) str
-        +render_qrcode_base64(uri) str
-        +verify_code(secret, code) bool
-        +mark_verified(redis, id, ttl)
-        +is_verified(redis, id) bool
-    }
-    class TokenService {
-        +create_token(employee_id, name, roles, ...) str
-        +get_user_info(token) dict
-        +refresh(token) bool
-        +switch_role(token, role) bool
-    }
-    class OtpRouter {
-        <<FastAPI 前缀 /api/auth>>
-        +GET otp-status
-        +POST otp-bind
-        +POST otp-verify
-        +POST otp-unbind
-        +POST otp-admin-reset/{id}
-        +GET otp-admin-users
-    }
-    class LoginRouter {
-        <<agents/login + auth_qrcode>>
-        +POST agents/login
-        +POST auth_qrcode/create
-        +GET auth_qrcode/poll/{ticket}
-        +POST auth_qrcode/scan
-        +POST auth_qrcode/confirm
-    }
-    class H5OAuthRouter {
-        <<h5 OAuth>>
-        +GET h5/oauth/authorize
-        +GET h5/oauth/sns-callback
-        +POST h5/oauth/callback
-    }
-    class AdminIPWhitelistMiddleware {
-        +is_production 门控
-        +ip_in_whitelist(ip) bool
-    }
-    Agent "1" *-- "1" OtpSecret : 内嵌 mfa_*
-    OtpRouter ..> MFAService : 复用
-    OtpRouter ..> Agent : 读写 mfa_*
-    OtpRouter ..> Token : 依赖 Bearer 鉴权
-    LoginRouter ..> TokenService : 签发 token
-    LoginRouter ..> MFAService : agents/login 内联校验
-    H5OAuthRouter ..> TokenService : 签发 employee token
-    TokenService ..> Token : 存 Redis(user/employee/agent)
-    AdminIPWhitelistMiddleware ..> LoginRouter : 守卫 /api/admin/*
+
+    MFAVerifyRequest --> MFAVerifyResponse : "mfa_enabled=True → 仅验证"
+    MFAVerifyRequest --> MFAVerifyBindResponse : "mfa_enabled=False → 绑定+签发token"