node_modules (14 MB, 240 files) accounted for 91.6% of tracked file
size. Dependencies are reproducible via `cd deploy/tools && npm ci`
using the committed package.json and package-lock.json.
Co-Authored-By: Claude <noreply@anthropic.com>
- Clear default passwords in all service configs and local dev YAMLs
- Add entrypoint.sh with envsubst to resolve ${ENV} vars in go-zero YAML
- Update Dockerfiles to install gettext and use entrypoint
- Update docker-compose to pass secrets via environment and require via ${VAR:?...}
- Add .gitignore rules for .env files, add .env.example template
Co-Authored-By: Claude <noreply@anthropic.com>
Align origin/main with upstream/main (GitHub). The two branches
diverged due to pre-rebase vs post-rebase merge commits for the
k8s-amd64-dockerfiles feature.
Includes: multi-stage Go compilation Dockerfiles, pan-bolt
inventory features, CRM relations, Excel import tooling,
proto/gRPC updates, migration scripts, and tools/ directory.
Excludes deploy/bin/ pre-compiled binaries (arm64, not needed
for amd64 K3s cluster; builds use multi-stage Dockerfiles now).
- JWT claims extended with tenantId; login enforces strict tenant verification
- AuthorityMiddleware: tenant scope check + Casbin path permission + anti-spoofing
- CRM relation API (upstream/downstream one-hop, create/update/history, full graph)
- CrmRepo backed by PostgreSQL with $N placeholders
- gRPC tenant propagation via UnaryClientInterceptor (x-tenant-id metadata)
- All legacy tables (12) gain tenant_id column with indexes
- All model queries inject WHERE tenant_id filter
- Casbin gorm-adapter downgraded to v3.28.0 for v2 compatibility
- GraphSyncWorker (Kafka -> Neo4j) with idempotent MERGE
- Full graph API restricted to admin role only
- Database migrations for MySQL (CRM tables + tenant columns) and PostgreSQL (CRM init)
- Docker Compose: added postgres service to main stack, graph stack with Kafka/Debezium/Neo4j
Made-with: Cursor
