2 Commits

Author	SHA1	Message	Date
hiderfong	8b2bc84399	feat: implement full RBAC role-based access control ... Backend: - deps.py: add require_admin, require_manager, require_labeler, require_guest_or_above - user.py: all write endpoints require admin - datasource.py: write/sync endpoints require admin - metadata.py: sync endpoint requires admin - classification.py: category/rule write requires admin; results query requires guest+ with data isolation - project.py: GET requires manager with created_by filtering; DELETE checks ownership - task.py: my-tasks requires labeler with assignee_id filtering; create-task requires manager - dashboard.py: requires guest_or_above - report.py: requires guest_or_above - project_service: list_projects adds created_by filter; list_results adds project_ids filter Frontend: - stores/user.ts: add hasRole, hasAnyRole, isAdmin, isManager, isLabeler, isSuperadmin - router/index.ts: add roles to route meta; beforeEach checks role permissions - Layout.vue: filter menu routes by user roles - System.vue: hide add/edit/delete buttons for non-admins - DataSource.vue: hide add/edit/delete/sync buttons for non-admins - Project.vue: hide add/delete buttons for non-admins	2026-04-23 12:09:32 +08:00
hiderfong	3b50ccc7e1	feat: dashboard & report APIs with real DB stats ... Backend: - Add /dashboard/stats API (data_sources, tables, columns, labeled, sensitive, projects) - Add /dashboard/distribution API (level/cat/source distribution, project progress, heatmap) - Add /reports/stats API (total/auto/manual/reviewed counts + level distribution) - Fix report download: add template relationship to ClassificationProject - All stats computed from real DB queries Frontend: - Dashboard.vue: replace all hardcoded data with API-driven computed charts - Report.vue: replace all hardcoded data with API-driven charts - Add dashboard.ts and report.ts API clients	2026-04-23 11:10:16 +08:00