chore: release v1.0.31

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
fix(client): 将 _buildLicenseBanner/_showLicenseExpiryDialog 移回 _AppShellState
2026-06-10 23:53:32 +08:00 · 2026-06-10 23:50:55 +08:00
4 changed files with 612 additions and 90 deletions
@@ -5,6 +5,11 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

+## [1.0.31] - 2026-06-10
+
+### 修复
+- 修复 Windows 客户端构建失败：授权到期横幅与弹窗方法位置错误导致编译报错
+
 ## [1.0.30] - 2026-06-10

 ### 新功能
@@ -476,6 +476,90 @@ class _AppShellState extends ConsumerState<AppShell> {
    ),
  );
  }
+
+  Widget _buildLicenseBanner(LicenseInfo lic) {
+    final Color bg;
+    final String msg;
+    switch (lic.phase) {
+      case 'locked':
+        bg = AppTheme.danger;
+        msg = '授权已锁定，所有写操作已停用 — 请立即续费或激活新授权码';
+      case 'readonly':
+        bg = const Color(0xFFB71C1C);
+        msg = '授权已过期，当前为只读模式（剩余宽限期 ${lic.daysRemaining ?? 0} 天后彻底锁定）';
+      default: // grace
+        bg = const Color(0xFFE65100);
+        msg = '授权将于 ${lic.daysRemaining ?? 0} 天后到期，请及时续费';
+    }
+    return Container(
+      width: double.infinity,
+      color: bg,
+      padding: const EdgeInsets.symmetric(horizontal: 16, vertical: 6),
+      child: Row(
+        children: [
+          const Icon(Icons.warning_amber_rounded,
+              size: 16, color: Colors.white),
+          const SizedBox(width: 8),
+          Expanded(
+            child: Text(msg,
+                style: const TextStyle(color: Colors.white, fontSize: 13),
+                overflow: TextOverflow.ellipsis),
+          ),
+          TextButton(
+            onPressed: () => context.go('/settings'),
+            style: TextButton.styleFrom(foregroundColor: Colors.white70),
+            child: const Text('去激活'),
+          ),
+        ],
+      ),
+    );
+  }
+
+  void _showLicenseExpiryDialog(BuildContext ctx, LicenseInfo lic) {
+    final String title;
+    final String body;
+    final Color titleColor;
+    switch (lic.phase) {
+      case 'locked':
+        title = '授权已锁定';
+        body = '您的授权已到期超过 15 天，所有写操作已停用。\n请前往「设置 → 授权」激活新的授权码，或联系客服续费。';
+        titleColor = AppTheme.danger;
+      case 'readonly':
+        title = '授权已过期 · 只读模式';
+        body = '您的授权已过期，系统进入只读模式，无法执行任何写操作。\n到期 15 天后将彻底锁定登录，请尽快续费。';
+        titleColor = AppTheme.danger;
+      default: // grace
+        title = '授权即将到期';
+        body = '您的授权将在 ${lic.daysRemaining ?? 0} 天后到期，到期后系统进入只读模式。\n请提前联系客服续费，避免影响正常使用。';
+        titleColor = Colors.orange[800]!;
+    }
+    showDialog(
+      context: ctx,
+      barrierDismissible: true,
+      builder: (_) => AlertDialog(
+        title: Row(children: [
+          Icon(Icons.warning_amber_rounded, color: titleColor, size: 20),
+          const SizedBox(width: 8),
+          Text(title, style: TextStyle(color: titleColor, fontSize: 16)),
+        ]),
+        content: Text(body, style: const TextStyle(fontSize: 14)),
+        actions: [
+          TextButton(
+            onPressed: () => Navigator.pop(_),
+            child: const Text('稍后处理'),
+          ),
+          ElevatedButton(
+            style: ElevatedButton.styleFrom(backgroundColor: titleColor),
+            onPressed: () {
+              Navigator.pop(_);
+              ctx.go('/settings');
+            },
+            child: const Text('立即前往', style: TextStyle(color: Colors.white)),
+          ),
+        ],
+      ),
+    );
+  }
 }

 class _NavItem {
@@ -579,91 +663,6 @@ class _StatusItem extends StatelessWidget {
      ],
    );
  }
-
-  Widget _buildLicenseBanner(LicenseInfo lic) {
-    final Color bg;
-    final String msg;
-    switch (lic.phase) {
-      case 'locked':
-        bg = AppTheme.danger;
-        msg = '授权已锁定，所有写操作已停用 — 请立即续费或激活新授权码';
-      case 'readonly':
-        bg = const Color(0xFFB71C1C);
-        msg = '授权已过期，当前为只读模式（剩余宽限期 ${lic.daysRemaining ?? 0} 天后彻底锁定）';
-      default: // grace
-        bg = const Color(0xFFE65100);
-        msg = '授权将于 ${lic.daysRemaining ?? 0} 天后到期，请及时续费';
-    }
-    return Container(
-      width: double.infinity,
-      color: bg,
-      padding: const EdgeInsets.symmetric(horizontal: 16, vertical: 6),
-      child: Row(
-        children: [
-          const Icon(Icons.warning_amber_rounded,
-              size: 16, color: Colors.white),
-          const SizedBox(width: 8),
-          Expanded(
-            child: Text(msg,
-                style: const TextStyle(color: Colors.white, fontSize: 13),
-                overflow: TextOverflow.ellipsis),
-          ),
-          TextButton(
-            onPressed: () => context.go('/settings'),
-            style:
-                TextButton.styleFrom(foregroundColor: Colors.white70),
-            child: const Text('去激活'),
-          ),
-        ],
-      ),
-    );
-  }
-
-  void _showLicenseExpiryDialog(BuildContext ctx, LicenseInfo lic) {
-    final String title;
-    final String body;
-    final Color titleColor;
-    switch (lic.phase) {
-      case 'locked':
-        title = '授权已锁定';
-        body = '您的授权已到期超过 15 天，所有写操作已停用。\n请前往「设置 → 授权」激活新的授权码，或联系客服续费。';
-        titleColor = AppTheme.danger;
-      case 'readonly':
-        title = '授权已过期 · 只读模式';
-        body = '您的授权已过期，系统进入只读模式，无法执行任何写操作。\n到期 15 天后将彻底锁定登录，请尽快续费。';
-        titleColor = AppTheme.danger;
-      default: // grace
-        title = '授权即将到期';
-        body = '您的授权将在 ${lic.daysRemaining ?? 0} 天后到期，到期后系统进入只读模式。\n请提前联系客服续费，避免影响正常使用。';
-        titleColor = Colors.orange[800]!;
-    }
-    showDialog(
-      context: ctx,
-      barrierDismissible: true,
-      builder: (_) => AlertDialog(
-        title: Row(children: [
-          Icon(Icons.warning_amber_rounded, color: titleColor, size: 20),
-          const SizedBox(width: 8),
-          Text(title, style: TextStyle(color: titleColor, fontSize: 16)),
-        ]),
-        content: Text(body, style: const TextStyle(fontSize: 14)),
-        actions: [
-          TextButton(
-            onPressed: () => Navigator.pop(_),
-            child: const Text('稍后处理'),
-          ),
-          ElevatedButton(
-            style: ElevatedButton.styleFrom(backgroundColor: titleColor),
-            onPressed: () {
-              Navigator.pop(_);
-              ctx.go('/settings');
-            },
-            child: const Text('立即前往', style: TextStyle(color: Colors.white)),
-          ),
-        ],
-      ),
-    );
-  }
 }

 class _StatusDivider extends StatelessWidget {
@@ -223,8 +223,8 @@ ul.todo-list { list-style: none; margin: 0; padding: 0; }
    <h1>酒库管理系统 — 项目 TODO</h1>
    <div class="header-meta">生成于 2026-06-10 · 真相源 todo/todo.json</div>
    <div class="stats">
-      <div class="stat-pill"><strong>24</strong>全部</div>
-      <div class="stat-pill"><strong>2</strong>待开始</div>
+      <div class="stat-pill"><strong>36</strong>全部</div>
+      <div class="stat-pill"><strong>14</strong>待开始</div>
      <div class="stat-pill"><strong>0</strong>开发中</div>
      <div class="stat-pill"><strong>8</strong>待验收</div>
      <div class="stat-pill"><strong>14</strong>已验收</div>
@@ -269,7 +269,7 @@ ul.todo-list { list-style: none; margin: 0; padding: 0; }
  
  <div class="section-block" id="section-open">
    <div class="section-title st-open" data-toggle="open">
-      📋 待开始 <span class="s-count">2</span>
+      📋 待开始 <span class="s-count">14</span>
      <span class="s-arrow">▴ 收起</span>
    </div>
    <div class="section-list-wrap " id="list-wrap-open">
@@ -303,6 +303,258 @@ ul.todo-list { list-style: none; margin: 0; padding: 0; }
      </div>
    </li>

+    <li class="todo-card s-open"
+        data-id="29"
+        data-level="high"
+        data-status="open"
+        data-tier="2"
+        data-tags="后端">
+      <div class="card-header">
+        <span class="item-title">修复库存扣减 TOCTOU 竞态：SUM 预检纳入事务且在 FOR UPDATE 加锁后执行</span>
+        <div class="card-badges">
+          <span class="tag status-badge s-open">待开始</span>
+          <span class="tag t-block">高优 · 紧急</span>
+          <span class="tag tier-2">二级</span>
+          
+          
+        </div>
+      </div>
+      
+      <div class="item-desc">stock.go ApproveStockOut 中库存总量 SUM 在 FOR UPDATE 加锁前执行，存在 check-then-act 窗口，高并发下可超扣。需将预检 SUM 也放入事务并在加锁后执行</div>
+      
+      <div class="card-footer">
+        <div class="tag-row"><span class="tag t-tag" data-tag="后端">后端</span></div>
+        <div class="item-meta">
+      <span class="meta-date">🕐 2026-06-10</span>
+      
+    </div>
+      </div>
+    </li>
+
+    <li class="todo-card s-open"
+        data-id="30"
+        data-level="high"
+        data-status="open"
+        data-tier="2"
+        data-tags="后端">
+      <div class="card-header">
+        <span class="item-title">统一 handler Update 改用白名单字段更新，防止 GORM Save() 跨租户覆盖</span>
+        <div class="card-badges">
+          <span class="tag status-badge s-open">待开始</span>
+          <span class="tag t-block">高优 · 紧急</span>
+          <span class="tag tier-2">二级</span>
+          
+          
+        </div>
+      </div>
+      
+      <div class="item-desc">partner.go/product_attr.go/warehouse.go 等多处用 db.Save(&amp;object) 更新全字段，若中间件被绕过会造成 shop_id 被覆盖。改为 db.Model(&amp;x).Where(&quot;id=? AND shop_id=?&quot;).Updates(fields) 白名单模式</div>
+      
+      <div class="card-footer">
+        <div class="tag-row"><span class="tag t-tag" data-tag="后端">后端</span></div>
+        <div class="item-meta">
+      <span class="meta-date">🕐 2026-06-10</span>
+      
+    </div>
+      </div>
+    </li>
+
+    <li class="todo-card s-open"
+        data-id="31"
+        data-level="high"
+        data-status="open"
+        data-tier="2"
+        data-tags="后端">
+      <div class="card-header">
+        <span class="item-title">添加库存与财务流水定期对账检查，防止事务中断导致不平账</span>
+        <div class="card-badges">
+          <span class="tag status-badge s-open">待开始</span>
+          <span class="tag t-block">高优 · 紧急</span>
+          <span class="tag tier-2">二级</span>
+          
+          
+        </div>
+      </div>
+      
+      <div class="item-desc">出库审批若 DB 断连，Rollback 后库存正确但财务记录可能未落地。需添加对账脚本：SUM(InventoryLog.quantity by direction) == SUM(Inventories.quantity)，及告警机制</div>
+      
+      <div class="card-footer">
+        <div class="tag-row"><span class="tag t-tag" data-tag="后端">后端</span></div>
+        <div class="item-meta">
+      <span class="meta-date">🕐 2026-06-10</span>
+      
+    </div>
+      </div>
+    </li>
+
+    <li class="todo-card s-open"
+        data-id="32"
+        data-level="mid"
+        data-status="open"
+        data-tier="2"
+        data-tags="后端,数据库">
+      <div class="card-header">
+        <span class="item-title">迁移 License 激活逻辑到 license_devices 表，废弃 licenses.device_id 字段</span>
+        <div class="card-badges">
+          <span class="tag status-badge s-open">待开始</span>
+          <span class="tag t-high">重要</span>
+          <span class="tag tier-2">二级</span>
+          
+          
+        </div>
+      </div>
+      
+      <div class="item-desc">licenses.device_id 已标记 deprecated 但激活/解绑逻辑仍在使用它，license_devices 表未被完整采用。需将 Activate/Deactivate 逻辑迁移至 license_devices，并写数据迁移脚本</div>
+      
+      <div class="card-footer">
+        <div class="tag-row"><span class="tag t-tag" data-tag="后端">后端</span> <span class="tag t-tag" data-tag="数据库">数据库</span></div>
+        <div class="item-meta">
+      <span class="meta-date">🕐 2026-06-10</span>
+      
+    </div>
+      </div>
+    </li>
+
+    <li class="todo-card s-open"
+        data-id="33"
+        data-level="mid"
+        data-status="open"
+        data-tier="2"
+        data-tags="后端">
+      <div class="card-header">
+        <span class="item-title">将 checkInventory 业务逻辑从 StockOutHandler 移到 Service 层</span>
+        <div class="card-badges">
+          <span class="tag status-badge s-open">待开始</span>
+          <span class="tag t-high">重要</span>
+          <span class="tag tier-2">二级</span>
+          
+          
+        </div>
+      </div>
+      
+      <div class="item-desc">checkInventory 实现在 handler/stock_out.go 中而非 service 层，导致单元测试困难、逻辑无法复用。应移至 StockService 或 InventoryService</div>
+      
+      <div class="card-footer">
+        <div class="tag-row"><span class="tag t-tag" data-tag="后端">后端</span></div>
+        <div class="item-meta">
+      <span class="meta-date">🕐 2026-06-10</span>
+      
+    </div>
+      </div>
+    </li>
+
+    <li class="todo-card s-open"
+        data-id="34"
+        data-level="mid"
+        data-status="open"
+        data-tier="2"
+        data-tags="后端">
+      <div class="card-header">
+        <span class="item-title">统一后端 API 错误响应格式为 {code, message}，创建 util/response.go</span>
+        <div class="card-badges">
+          <span class="tag status-badge s-open">待开始</span>
+          <span class="tag t-high">重要</span>
+          <span class="tag tier-2">二级</span>
+          
+          
+        </div>
+      </div>
+      
+      <div class="item-desc">各 handler 返回格式不一致：有的 {error: err.Error()}，有的 {error: 硬编码字符串}，有的直接 struct。前端解析困难。需定义 ErrorResponse struct 和 RespondError/RespondSuccess 辅助函数统一调用</div>
+      
+      <div class="card-footer">
+        <div class="tag-row"><span class="tag t-tag" data-tag="后端">后端</span></div>
+        <div class="item-meta">
+      <span class="meta-date">🕐 2026-06-10</span>
+      
+    </div>
+      </div>
+    </li>
+
+    <li class="todo-card s-open"
+        data-id="35"
+        data-level="mid"
+        data-status="open"
+        data-tier="3"
+        data-tags="后端">
+      <div class="card-header">
+        <span class="item-title">生产环境 CORS 强制校验：非 debug 模式禁止 Origin=*</span>
+        <div class="card-badges">
+          <span class="tag status-badge s-open">待开始</span>
+          <span class="tag t-high">重要</span>
+          <span class="tag tier-3">三级</span>
+          
+          
+        </div>
+      </div>
+      
+      <div class="item-desc">config.go 默认 CORSOrigin=&quot;*&quot;，注释提示生产需改但无代码强制。应在 main.go 中添加：server.mode!=debug 且 CORSOrigin==&quot;*&quot; 时 log.Fatal 拒绝启动</div>
+      
+      <div class="card-footer">
+        <div class="tag-row"><span class="tag t-tag" data-tag="后端">后端</span></div>
+        <div class="item-meta">
+      <span class="meta-date">🕐 2026-06-10</span>
+      
+    </div>
+      </div>
+    </li>
+
+    <li class="todo-card s-open"
+        data-id="36"
+        data-level="mid"
+        data-status="open"
+        data-tier="3"
+        data-tags="后端">
+      <div class="card-header">
+        <span class="item-title">License 私钥未配置时改为 Fatal 而非静默跳过</span>
+        <div class="card-badges">
+          <span class="tag status-badge s-open">待开始</span>
+          <span class="tag t-high">重要</span>
+          <span class="tag tier-3">三级</span>
+          
+          
+        </div>
+      </div>
+      
+      <div class="item-desc">license.go 中私钥未配置只打 log 并跳过，导致授权功能失效但程序正常运行。应改为 log.Fatal，确保运维人员知晓配置缺失</div>
+      
+      <div class="card-footer">
+        <div class="tag-row"><span class="tag t-tag" data-tag="后端">后端</span></div>
+        <div class="item-meta">
+      <span class="meta-date">🕐 2026-06-10</span>
+      
+    </div>
+      </div>
+    </li>
+
+    <li class="todo-card s-open"
+        data-id="37"
+        data-level="mid"
+        data-status="open"
+        data-tier="3"
+        data-tags="后端">
+      <div class="card-header">
+        <span class="item-title">统一各 handler 的 pageSize 上限校验，创建 util.ValidatePageSize()</span>
+        <div class="card-badges">
+          <span class="tag status-badge s-open">待开始</span>
+          <span class="tag t-high">重要</span>
+          <span class="tag tier-3">三级</span>
+          
+          
+        </div>
+      </div>
+      
+      <div class="item-desc">inventory.go 限制 pageSize 最大 500，其他 handler 无此限制，前端可传 pageSize=10000 打满 DB。创建 util.ValidatePageSize(n) 统一处理</div>
+      
+      <div class="card-footer">
+        <div class="tag-row"><span class="tag t-tag" data-tag="后端">后端</span></div>
+        <div class="item-meta">
+      <span class="meta-date">🕐 2026-06-10</span>
+      
+    </div>
+      </div>
+    </li>
+
    <li class="todo-card s-open"
        data-id="23"
        data-level="low"
@@ -327,6 +579,90 @@ ul.todo-list { list-style: none; margin: 0; padding: 0; }
        <div class="item-meta">
      <span class="meta-date">🕐 2026-06-08</span>
      
+    </div>
+      </div>
+    </li>
+
+    <li class="todo-card s-open"
+        data-id="38"
+        data-level="low"
+        data-status="open"
+        data-tier="3"
+        data-tags="后端">
+      <div class="card-header">
+        <span class="item-title">将拼音回填从启动逻辑改为一次性迁移脚本</span>
+        <div class="card-badges">
+          <span class="tag status-badge s-open">待开始</span>
+          <span class="tag t-low">一般 / 优化</span>
+          <span class="tag tier-3">三级</span>
+          
+          
+        </div>
+      </div>
+      
+      <div class="item-desc">main.go 每次启动执行 backfillPinyin 全表扫描，数据量大后拖慢启动。改为 go run ./cmd/migrate-pinyin 一次性迁移，后续新数据靠写入时自动生成</div>
+      
+      <div class="card-footer">
+        <div class="tag-row"><span class="tag t-tag" data-tag="后端">后端</span></div>
+        <div class="item-meta">
+      <span class="meta-date">🕐 2026-06-10</span>
+      
+    </div>
+      </div>
+    </li>
+
+    <li class="todo-card s-open"
+        data-id="39"
+        data-level="low"
+        data-status="open"
+        data-tier="3"
+        data-tags="后端">
+      <div class="card-header">
+        <span class="item-title">DB 连接池参数（MaxIdleConns/MaxOpenConns）改为可配置项</span>
+        <div class="card-badges">
+          <span class="tag status-badge s-open">待开始</span>
+          <span class="tag t-low">一般 / 优化</span>
+          <span class="tag tier-3">三级</span>
+          
+          
+        </div>
+      </div>
+      
+      <div class="item-desc">main.go 中硬编码 MaxIdleConns=10, MaxOpenConns=100，无法运维调优。改为读取 config（viper），并在文档中说明推荐值</div>
+      
+      <div class="card-footer">
+        <div class="tag-row"><span class="tag t-tag" data-tag="后端">后端</span></div>
+        <div class="item-meta">
+      <span class="meta-date">🕐 2026-06-10</span>
+      
+    </div>
+      </div>
+    </li>
+
+    <li class="todo-card s-open"
+        data-id="40"
+        data-level="low"
+        data-status="open"
+        data-tier="2"
+        data-tags="后端,数据库">
+      <div class="card-header">
+        <span class="item-title">明确 Inventories 反范式字段语义：是当前值还是入库快照</span>
+        <div class="card-badges">
+          <span class="tag status-badge s-open">待开始</span>
+          <span class="tag t-low">一般 / 优化</span>
+          <span class="tag tier-2">二级</span>
+          
+          
+        </div>
+      </div>
+      
+      <div class="item-desc">inventories 表存了 product_name/warehouse_name/supplier_name 等，既可能是冗余（与 products JOIN 重复），也可能是历史快照（入库时锁定）。需明确语义并在 model 注释中说明；若是快照，应只在写入时固定，不随主表变化</div>
+      
+      <div class="card-footer">
+        <div class="tag-row"><span class="tag t-tag" data-tag="后端">后端</span> <span class="tag t-tag" data-tag="数据库">数据库</span></div>
+        <div class="item-meta">
+      <span class="meta-date">🕐 2026-06-10</span>
+      
    </div>
      </div>
    </li>
@@ -1,9 +1,9 @@
 {
  "meta": {
    "title": "酒库管理系统 — 项目 TODO",
-    "updated_at": "2026-06-10T14:56:28.055Z"
+    "updated_at": "2026-06-10T15:32:03.641Z"
  },
-  "seq": 28,
+  "seq": 40,
  "items": [
    {
      "id": 1,
@@ -467,6 +467,188 @@
      "done": false,
      "completed_at": null,
      "version": null
+    },
+    {
+      "id": 29,
+      "title": "修复库存扣减 TOCTOU 竞态：SUM 预检纳入事务且在 FOR UPDATE 加锁后执行",
+      "desc": "stock.go ApproveStockOut 中库存总量 SUM 在 FOR UPDATE 加锁前执行，存在 check-then-act 窗口，高并发下可超扣。需将预检 SUM 也放入事务并在加锁后执行",
+      "level": "high",
+      "tier": 2,
+      "tags": [
+        "后端"
+      ],
+      "status": "open",
+      "created_at": "2026-06-10T15:31:13.249Z",
+      "done": false,
+      "completed_at": null,
+      "version": null
+    },
+    {
+      "id": 30,
+      "title": "统一 handler Update 改用白名单字段更新，防止 GORM Save() 跨租户覆盖",
+      "desc": "partner.go/product_attr.go/warehouse.go 等多处用 db.Save(&object) 更新全字段，若中间件被绕过会造成 shop_id 被覆盖。改为 db.Model(&x).Where(\"id=? AND shop_id=?\").Updates(fields) 白名单模式",
+      "level": "high",
+      "tier": 2,
+      "tags": [
+        "后端"
+      ],
+      "status": "open",
+      "created_at": "2026-06-10T15:31:15.102Z",
+      "done": false,
+      "completed_at": null,
+      "version": null
+    },
+    {
+      "id": 31,
+      "title": "添加库存与财务流水定期对账检查，防止事务中断导致不平账",
+      "desc": "出库审批若 DB 断连，Rollback 后库存正确但财务记录可能未落地。需添加对账脚本：SUM(InventoryLog.quantity by direction) == SUM(Inventories.quantity)，及告警机制",
+      "level": "high",
+      "tier": 2,
+      "tags": [
+        "后端"
+      ],
+      "status": "open",
+      "created_at": "2026-06-10T15:31:16.854Z",
+      "done": false,
+      "completed_at": null,
+      "version": null
+    },
+    {
+      "id": 32,
+      "title": "迁移 License 激活逻辑到 license_devices 表，废弃 licenses.device_id 字段",
+      "desc": "licenses.device_id 已标记 deprecated 但激活/解绑逻辑仍在使用它，license_devices 表未被完整采用。需将 Activate/Deactivate 逻辑迁移至 license_devices，并写数据迁移脚本",
+      "level": "mid",
+      "tier": 2,
+      "tags": [
+        "后端",
+        "数据库"
+      ],
+      "status": "open",
+      "created_at": "2026-06-10T15:31:25.715Z",
+      "done": false,
+      "completed_at": null,
+      "version": null
+    },
+    {
+      "id": 33,
+      "title": "将 checkInventory 业务逻辑从 StockOutHandler 移到 Service 层",
+      "desc": "checkInventory 实现在 handler/stock_out.go 中而非 service 层，导致单元测试困难、逻辑无法复用。应移至 StockService 或 InventoryService",
+      "level": "mid",
+      "tier": 2,
+      "tags": [
+        "后端"
+      ],
+      "status": "open",
+      "created_at": "2026-06-10T15:31:28.106Z",
+      "done": false,
+      "completed_at": null,
+      "version": null
+    },
+    {
+      "id": 34,
+      "title": "统一后端 API 错误响应格式为 {code, message}，创建 util/response.go",
+      "desc": "各 handler 返回格式不一致：有的 {error: err.Error()}，有的 {error: 硬编码字符串}，有的直接 struct。前端解析困难。需定义 ErrorResponse struct 和 RespondError/RespondSuccess 辅助函数统一调用",
+      "level": "mid",
+      "tier": 2,
+      "tags": [
+        "后端"
+      ],
+      "status": "open",
+      "created_at": "2026-06-10T15:31:33.596Z",
+      "done": false,
+      "completed_at": null,
+      "version": null
+    },
+    {
+      "id": 35,
+      "title": "生产环境 CORS 强制校验：非 debug 模式禁止 Origin=*",
+      "desc": "config.go 默认 CORSOrigin=\"*\"，注释提示生产需改但无代码强制。应在 main.go 中添加：server.mode!=debug 且 CORSOrigin==\"*\" 时 log.Fatal 拒绝启动",
+      "level": "mid",
+      "tier": 3,
+      "tags": [
+        "后端"
+      ],
+      "status": "open",
+      "created_at": "2026-06-10T15:31:44.159Z",
+      "done": false,
+      "completed_at": null,
+      "version": null
+    },
+    {
+      "id": 36,
+      "title": "License 私钥未配置时改为 Fatal 而非静默跳过",
+      "desc": "license.go 中私钥未配置只打 log 并跳过，导致授权功能失效但程序正常运行。应改为 log.Fatal，确保运维人员知晓配置缺失",
+      "level": "mid",
+      "tier": 3,
+      "tags": [
+        "后端"
+      ],
+      "status": "open",
+      "created_at": "2026-06-10T15:31:46.792Z",
+      "done": false,
+      "completed_at": null,
+      "version": null
+    },
+    {
+      "id": 37,
+      "title": "统一各 handler 的 pageSize 上限校验，创建 util.ValidatePageSize()",
+      "desc": "inventory.go 限制 pageSize 最大 500，其他 handler 无此限制，前端可传 pageSize=10000 打满 DB。创建 util.ValidatePageSize(n) 统一处理",
+      "level": "mid",
+      "tier": 3,
+      "tags": [
+        "后端"
+      ],
+      "status": "open",
+      "created_at": "2026-06-10T15:31:49.032Z",
+      "done": false,
+      "completed_at": null,
+      "version": null
+    },
+    {
+      "id": 38,
+      "title": "将拼音回填从启动逻辑改为一次性迁移脚本",
+      "desc": "main.go 每次启动执行 backfillPinyin 全表扫描，数据量大后拖慢启动。改为 go run ./cmd/migrate-pinyin 一次性迁移，后续新数据靠写入时自动生成",
+      "level": "low",
+      "tier": 3,
+      "tags": [
+        "后端"
+      ],
+      "status": "open",
+      "created_at": "2026-06-10T15:31:57.979Z",
+      "done": false,
+      "completed_at": null,
+      "version": null
+    },
+    {
+      "id": 39,
+      "title": "DB 连接池参数（MaxIdleConns/MaxOpenConns）改为可配置项",
+      "desc": "main.go 中硬编码 MaxIdleConns=10, MaxOpenConns=100，无法运维调优。改为读取 config（viper），并在文档中说明推荐值",
+      "level": "low",
+      "tier": 3,
+      "tags": [
+        "后端"
+      ],
+      "status": "open",
+      "created_at": "2026-06-10T15:32:00.233Z",
+      "done": false,
+      "completed_at": null,
+      "version": null
+    },
+    {
+      "id": 40,
+      "title": "明确 Inventories 反范式字段语义：是当前值还是入库快照",
+      "desc": "inventories 表存了 product_name/warehouse_name/supplier_name 等，既可能是冗余（与 products JOIN 重复），也可能是历史快照（入库时锁定）。需明确语义并在 model 注释中说明；若是快照，应只在写入时固定，不随主表变化",
+      "level": "low",
+      "tier": 2,
+      "tags": [
+        "后端",
+        "数据库"
+      ],
+      "status": "open",
+      "created_at": "2026-06-10T15:32:03.641Z",
+      "done": false,
+      "completed_at": null,
+      "version": null
    }
  ]
 }
Author	SHA1	Message	Date
wangjia	666bf56933	chore: release v1.0.31 Deploy / build-linux-web (push) Successful in 51s Details Deploy / build-macos (push) Successful in 1m25s Details Deploy / build-android (push) Failing after 4m56s Details Deploy / build-windows (push) Failing after 9m7s Details Deploy / build-ios (push) Has been skipped Details Deploy / release-deploy (push) Has been skipped Details Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-10 23:53:32 +08:00
wangjia	1a0a7bd5ef	fix(client): 将 _buildLicenseBanner/_showLicenseExpiryDialog 移回 _AppShellState 两个方法误放入 _StatusItem 类，导致 Windows CI 编译报错： - _buildLicenseBanner/showLicenseExpiryDialog 对 _AppShellState 未定义 - _StatusItem 内 context.go() 调用找不到 context getter Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-10 23:50:55 +08:00