951 lines
48 KiB
Markdown
951 lines
48 KiB
Markdown
# Version History
|
||
|
||
## 1.8.9 (2026-04-18)
|
||
|
||
### chore(infra): Docker Compose security hardening — 27 findings (C1–S4) addressed
|
||
|
||
#### Summary
|
||
|
||
Full security audit and hardening of the production Docker Compose stacks on QNAP and ASUSTOR. 27 findings resolved across 4 phases (Critical / High / Medium / Low + Suggestions), 11 compose files modified, 12 new files created, **zero secrets remain committed**. See `specs/04-Infrastructure-OPS/04-00-docker-compose/SECURITY-MIGRATION-v1.8.6.md` for the complete runbook.
|
||
|
||
#### **Phase 1 — Critical (C1–C6) + H6**
|
||
|
||
- **C1**: Extracted all secrets from `.env.template` and inline `environment:` blocks → `env_file: .env` + `${VAR:?...}` substitution with `CHANGE_ME_*` placeholders
|
||
- **C2**: Split `JWT_SECRET` (backend-only) from `AUTH_SECRET` (Next.js NextAuth) — no more identical values
|
||
- **C3**: Redis enforced `--requirepass $REDIS_PASSWORD` on the server (not just client env)
|
||
- **C4**: Elasticsearch bound to internal `lcbp3` network only, removed LAN `ports:` exposure
|
||
- **C5**: MariaDB root and app user split; host loopback bind; `MARIADB_RANDOM_ROOT_PASSWORD` fallback documented
|
||
- **C6**: ClamAV service added upstream of backend file uploads (ADR-016)
|
||
- **H6**: Renamed deprecated `QNAP/service/docker-compse.yml` → `docker-compose.yml`
|
||
|
||
#### **Phase 2 — High (H1–H5, H7)**
|
||
|
||
- **H1**: Backend-only env verified (no `JWT_REFRESH_SECRET` leakage to frontend)
|
||
- **H2**: n8n + n8n-db secrets moved to `${N8N_DB_PASSWORD}` / `${N8N_ENCRYPTION_KEY}`
|
||
- **H3**: Removed `/var/run/docker.sock` mount on n8n; added `tecnativa/docker-socket-proxy` (read-only `CONTAINERS/IMAGES/INFO/VERSION` only); n8n uses `DOCKER_HOST=tcp://docker-socket-proxy:2375`
|
||
- **H4**: ASUSTOR cAdvisor port mapping corrected to `8088:8080`
|
||
- **H5**: QNAP exporters use `expose:` only (no host ports); resource limits + healthchecks applied
|
||
- **H7**: All `:latest` tags pinned to verified semver: `gitea:1.22.3-rootless`, `n8n:1.66.0`, `tika:2.9.2.1-full`, `postgres:16.4-alpine`, `mongo:7.0.14`, `rocket.chat:6.10.5`, `nginx-proxy-manager:2.11.3`, `registry-ui:2.5.7`, `act_runner:0.2.11`, `node-exporter:v1.8.2`, `cadvisor:v0.49.1`; app images templated `${BACKEND_IMAGE_TAG:-latest}` / `${FRONTEND_IMAGE_TAG:-latest}` for CI
|
||
|
||
#### **Phase 3 — Medium (M1–M9)**
|
||
|
||
- **M1**: Removed obsolete `version:` keys from remaining compose files
|
||
- **M2**: Healthchecks added to `mongodb` (authed mongosh ping), `rocketchat` (`/api/info`), `tika` (`/tika`), `landing`, `registry-ui`, `npm`, `gitea`, `docker-socket-proxy`
|
||
- **M3**: Resource `reservations` + `limits` filled in on all services
|
||
- **M4**: Backend / Frontend / ClamAV hardened — `security_opt: [no-new-privileges:true]`, `cap_drop: [ALL]`, `read_only: true` + `tmpfs`, non-root `user:` (`node` / `nextjs`)
|
||
- **M5**: Elasticsearch `ulimits.memlock: -1` verified (Phase 1)
|
||
- **M6**: Docker Registry enforces `REGISTRY_AUTH=htpasswd` with mounted `/auth/htpasswd`
|
||
- **M7**: phpMyAdmin host port `89:80` removed → `expose: 80` only (access via NPM)
|
||
- **M8**: MongoDB runs with `--auth --keyFile=/etc/mongo/keyfile`; `mongo-init-replica` creates root + limited `rocketchat` user; RocketChat uses authenticated `MONGO_URL` / `MONGO_OPLOG_URL`
|
||
- **M9**: `x-restart` / `x-logging` anchors applied uniformly
|
||
|
||
#### **Phase 4 — Low + Suggestions (L1–L5 + S1–S4)**
|
||
|
||
- **L1**: Removed `stdin_open: true` + `tty: true` from all production services
|
||
- **L2**: Filename strategy documented; existing `docker-compose-*.yml` names kept to not break ops scripts
|
||
- **L3**: Stale `v1_7_0` / `v1_8_0` version markers bumped to `v1.8.6` (stack-internal)
|
||
- **L4**: Trimmed ~50 lines of legacy ACL/ops comments from `npm` and `gitea` compose files
|
||
- **L5**: Documented promtail `user: '0:0'` requirement (reads `/var/lib/docker/containers` read-only)
|
||
- **S1**: Secret-manager roadmap added (Docker Swarm secrets → Infisical/Vault → SOPS)
|
||
- **S2**: Created `x-base.yml` with shared YAML anchors for Compose V2.20+ `include:`
|
||
- **S3**: Per-stack `.env.example` created for 9 stacks (app, service, mariadb, npm, n8n, gitea, rocketchat, ASUSTOR monitoring, ASUSTOR registry)
|
||
- **S4**: ClamAV scan service already delivered in C6 ✓
|
||
|
||
#### **New Documentation**
|
||
|
||
- `specs/04-Infrastructure-OPS/04-00-docker-compose/README.md` — stack overview + secret roadmap
|
||
- `specs/04-Infrastructure-OPS/04-00-docker-compose/SECURITY-MIGRATION-v1.8.6.md` — full migration runbook (Phase 1–4 verification checklists, MongoDB keyfile + Registry htpasswd ops steps, breaking-change notices)
|
||
- `specs/04-Infrastructure-OPS/04-00-docker-compose/x-base.yml` — shared anchors
|
||
|
||
#### **Ops Actions Required (Post-Merge)**
|
||
|
||
1. **Rotate** every secret that ever appeared in git history (JWT, DB, Redis, Grafana, n8n, Mongo, Registry)
|
||
2. Populate per-stack `.env` files on QNAP/ASUSTOR from the new `.env.example` + root `.env.template`
|
||
3. Generate MongoDB keyfile: `openssl rand -base64 756 > /share/np-dms/rocketchat/mongo-keyfile && chmod 400 && chown 999:999`
|
||
4. Generate Registry htpasswd: `docker run --rm --entrypoint htpasswd httpd:2 -Bbn $USER $PASS > /volume1/np-dms/registry/auth/htpasswd`
|
||
5. `ALTER USER 'n8n'@'%' IDENTIFIED BY '<new>';` in MariaDB before recreating n8n-db container
|
||
6. Update CI pipelines to pass `BACKEND_IMAGE_TAG=$GITHUB_SHA` / `FRONTEND_IMAGE_TAG=$GITHUB_SHA`
|
||
7. Verify backend/frontend work under `read_only: true` (tmpfs covers `/tmp`, `/app/.next/cache`)
|
||
|
||
#### **Breaking Changes**
|
||
|
||
- **MongoDB**: requires keyfile + data migration (`mongodump` → wipe → `mongorestore` with new auth) before restart
|
||
- **Frontend `read_only`**: Next.js image must not write outside `/tmp` or `/app/.next/cache`
|
||
- **Backend `user: node`**: image must have `node` user with write access to `/app/logs`
|
||
- **Registry auth**: existing CI runners need new credentials; pushes fail with 401 otherwise
|
||
- **phpMyAdmin**: direct-port `:89` users must switch to `https://pma.np-dms.work` via NPM
|
||
|
||
#### **Files Modified**
|
||
|
||
`QNAP/app/docker-compose-app.yml`, `QNAP/mariadb/docker-compose-lcbp3-db.yml`, `QNAP/service/docker-compose.yml`, `QNAP/npm/docker-compose.yml`, `QNAP/gitea/docker-compose.yml`, `QNAP/n8n/docker-compose.yml`, `QNAP/rocketchat/docker-compose.yml`, `QNAP/monitoring/docker-compose.yml`, `ASUSTOR/registry/docker-compose.yml`, `ASUSTOR/gitea-runner/docker-compose.yml`, `ASUSTOR/monitoring/docker-compose.yml`
|
||
|
||
#### **Root/Docs Updates**
|
||
|
||
- `README.md` — version badge 1.8.9, added "Infrastructure" row + Roadmap entry
|
||
- `CONTRIBUTING.md` — version history table + compose folder entry
|
||
- `specs/README.md` — version bump, added Infra Hardening to Critical Files table
|
||
- `specs/04-Infrastructure-OPS/README.md` — refreshed with hardened stack layout + new Guiding Principles (§5 Secret Hygiene, §6 Container Hardening)
|
||
|
||
## 1.8.8 (2026-04-14)
|
||
|
||
### feat(workflow): ADR-021 Integrated Workflow Context & Step-specific Attachments
|
||
|
||
#### Summary
|
||
|
||
Successfully implemented ADR-021 (Integrated Workflow Context & Step-specific Attachments) across the entire LCBP3-DMS system. This major enhancement provides unified workflow management with step-specific file attachments, comprehensive RBAC security, and integrated file preview functionality.
|
||
|
||
#### **Backend Changes (T001-T041)**
|
||
|
||
- **Database Schema**: Added `workflow_history_id` to `attachments` table with foreign key constraint
|
||
- **WorkflowEngineService**:
|
||
- Extended `processTransition()` to handle `attachmentPublicIds` parameter
|
||
- Added `getHistoryWithAttachments()` with batch loading to prevent N+1 queries
|
||
- Implemented attachment linking within same transaction as workflow history
|
||
- **WorkflowEngineController**:
|
||
- Added `GET /instances/:id/history` endpoint with RBAC protection
|
||
- Enhanced `POST /instances/:id/transition` with idempotency key validation
|
||
- Added `Idempotency-Key` header validation for duplicate submission prevention
|
||
- **WorkflowTransitionGuard**: Implemented 4-Level RBAC Matrix:
|
||
- Level 1: Superadmin with `system.manage_all`
|
||
- Level 2: Org Admin with same organization
|
||
- Level 2.5: Contract membership validation (cross-contract prevention)
|
||
- Level 3: Assigned handler validation
|
||
- Level 4: Unauthorized user denial
|
||
- **File Storage**: Added `GET /files/preview/:publicId` endpoint for inline file viewing
|
||
- **Entity Relations**: Enhanced `Attachment` and `WorkflowHistory` with bidirectional relationships
|
||
|
||
#### **Frontend Changes (T012-T041)**
|
||
|
||
- **IntegratedBanner Component**:
|
||
- Displays document metadata, workflow status, and action buttons
|
||
- Integrates with `useWorkflowAction` hook for seamless workflow operations
|
||
- Supports priority badges and status indicators
|
||
- **WorkflowLifecycle Component**:
|
||
- Vertical timeline visualization of workflow history
|
||
- Drag-and-drop file upload zone for step-specific attachments
|
||
- Attachment chips with preview and unavailable file handling
|
||
- Real-time status updates with loading states
|
||
- **FilePreviewModal Component**:
|
||
- Inline PDF rendering via iframe
|
||
- Image preview with proper scaling
|
||
- JWT-authenticated file access via apiClient
|
||
- Download functionality and proper cleanup
|
||
- **WorkflowErrorBoundary**: Error boundary for workflow components
|
||
- **useWorkflowAction Hook**:
|
||
- UUIDv7 idempotency key generation
|
||
- TanStack Query cache invalidation on success
|
||
- Comprehensive error handling with user feedback
|
||
- **Type Definitions**: Extended interfaces for workflow integration
|
||
|
||
#### **Security & Compliance**
|
||
|
||
- **RBAC Implementation**: Full 4-Level RBAC Matrix compliance per ADR-016
|
||
- **UUID Strategy**: ADR-019 compliant UUIDv7 handling throughout
|
||
- **Input Validation**: Class-validator + Zod for all DTOs
|
||
- **Audit Logging**: Comprehensive audit trail for all workflow actions
|
||
- **File Security**: Two-phase upload with ClamAV scanning (where applicable)
|
||
|
||
#### **Testing (T030-T031)**
|
||
|
||
- **WorkflowTransitionGuard**: 15 test cases covering all RBAC levels and edge cases
|
||
- **WorkflowEngineService**: Extended tests for attachment linking and transaction handling
|
||
- **Frontend Components**: Comprehensive integration testing
|
||
- **E2E Coverage**: Full workflow scenarios with file attachments
|
||
|
||
#### **i18n Support (T036-T039)**
|
||
|
||
- Complete internationalization for all new UI components
|
||
- Thai and English locale support for workflow actions and messages
|
||
- No hardcoded strings in JSX/TSX components
|
||
|
||
#### **Performance Optimizations**
|
||
|
||
- **Batch Loading**: Prevented N+1 queries in history retrieval
|
||
- **Cache Strategy**: Redis-based caching for workflow history (TTL 3600s)
|
||
- **Lazy Loading**: Attachment relationships loaded on-demand
|
||
- **Memory Management**: Proper cleanup of Blob URLs and event listeners
|
||
|
||
#### **Documentation Updates**
|
||
|
||
- **Data Dictionary**: Updated with `workflow_history_id` field documentation
|
||
- **API Documentation**: Enhanced OpenAPI specs for new endpoints
|
||
- **Component Documentation**: Comprehensive JSDoc for all new components
|
||
|
||
## 1.8.7 (2026-04-14)
|
||
|
||
### feat(workflow): ADR-021 Integration Complete - Transmittals & Circulation
|
||
|
||
#### Summary
|
||
|
||
Successfully integrated ADR-021 (Integrated Workflow Context & Step-specific Attachments) into Transmittals and Circulation modules. All backend services, frontend pages, and tests are wired to the Unified Workflow Engine.
|
||
|
||
#### **Backend Changes (B1-B9)**
|
||
|
||
- **WorkflowEngineService**: Added `getInstanceByEntity(entityType, entityId)` for polymorphic workflow instance lookup
|
||
- **TransmittalService**:
|
||
- Expose `workflowInstanceId`, `workflowState`, `availableActions` in `findOneByUuid()`
|
||
- Added purpose filter to `findAll()`
|
||
- Added `submit()` with EC-RFA-004 validation (prevents submission if any item correspondence is DRAFT)
|
||
- Starts workflow instance `TRANSMITTAL_FLOW_V1` and updates CorrespondenceRevision status
|
||
- **TransmittalController**: Added `POST /:uuid/submit` endpoint with RBAC and Audit
|
||
- **TransmittalModule**: Imported `WorkflowEngineModule` and `CorrespondenceRevision`
|
||
- **CirculationService**:
|
||
- Expose workflow fields in `findOneByUuid()`
|
||
- Added `reassignRouting()` (EC-CIRC-001) for PENDING routing reassignment
|
||
- Added `forceClose()` (EC-CIRC-002) with transactional rollback and reason validation
|
||
- **CirculationController**: Added `PATCH /:uuid/routing/:routingId/reassign` and `POST /:uuid/force-close`
|
||
- **Circulation Entity**: Added `deadlineDate` column for EC-CIRC-003 Overdue badge
|
||
- **Schema Delta**: `05-add-circulation-deadline.sql` per ADR-009 (no migrations)
|
||
|
||
#### **Frontend Changes (F1-F7)**
|
||
|
||
- **Types**: Extended `Transmittal` and `Circulation` interfaces with workflow fields; added `deadlineDate` to Circulation
|
||
- **Hooks**: Created `useTransmittal()` and extended `useCirculation()` hooks with TanStack Query
|
||
- **Detail Pages**:
|
||
- Both wired with `IntegratedBanner` and `WorkflowLifecycle` using live workflow data
|
||
- Circulation page includes EC-CIRC-003 Overdue badge logic (`isOverdue()`)
|
||
- **List Page**: Added purpose filter dropdown to `transmittals/page.tsx`
|
||
|
||
#### **Tests (T1-T2): 19/19 Passing**
|
||
|
||
- **TransmittalService**: 7 tests covering EC-RFA-004 validation, workflow instance creation, and error cases
|
||
- **CirculationService**: 12 tests covering EC-CIRC-001 (reassign), EC-CIRC-002 (forceClose), EC-CIRC-003 (deadlineDate exposure)
|
||
|
||
#### **Key Technical Decisions**
|
||
|
||
- Followed ADR-019 UUID handling (no parseInt, use string UUIDs)
|
||
- Used ADR-009 direct schema edits (no TypeORM migrations)
|
||
- Enforced RBAC with CASL guards and Audit decorators
|
||
- Implemented transactional force-close with proper rollback
|
||
- Maintained existing patterns for error handling and service architecture
|
||
|
||
#### **Remaining Work**
|
||
|
||
- I1: i18n keys for new workflow actions (low priority)
|
||
|
||
#### **Files Modified**
|
||
|
||
Backend: 11 files (services, controllers, entities, modules, deltas)
|
||
Frontend: 7 files (types, hooks, pages, services)
|
||
Tests: 2 new spec files with full coverage
|
||
|
||
#### **Verification**
|
||
|
||
- Backend TS: No errors in modified files
|
||
- Frontend TS: No errors in modified files
|
||
- Jest: 19/19 tests passing
|
||
- All components follow existing patterns and ADRs
|
||
|
||
---
|
||
|
||
## 1.8.6 (2026-04-12)
|
||
|
||
### feat(workflow): ADR-021 Integrated Workflow Context & Step-specific Attachments
|
||
|
||
#### 🏗️ Backend (NestJS)
|
||
|
||
- **Added**: `workflow_history_id` column to `attachments` table (Delta SQL: `04-add-workflow-history-id-to-attachments.sql`)
|
||
- **Added**: `WorkflowTransitionWithAttachmentsGuard` — validates UUIDv7 `attachmentPublicIds` array on transition requests
|
||
- **Added**: `processTransition()` in `WorkflowEngineService` — links step-evidence attachments to `workflow_history` in the same transaction; commits temp→permanent atomically
|
||
- **Added**: `GET /workflow-engine/instances/:id/history` endpoint with attachment summaries per step (Redis cached, 5 min TTL)
|
||
- **Added**: `GET /files/preview/:publicId` endpoint with inline `Content-Disposition` for PDF/image rendering
|
||
- **Added**: `Idempotency-Key` header support on `POST /workflow-engine/instances/:id/transition` (Redis dedup, 24 h TTL)
|
||
|
||
#### 🖥️ Frontend (Next.js)
|
||
|
||
- **Added**: `IntegratedBanner` component — document header with status badge, priority badge, workflow state, and action buttons (Approve/Reject/Return/Acknowledge/Comment)
|
||
- **Added**: `WorkflowLifecycle` component — vertical timeline of workflow history with attachment chips, "current step" badge, and drag-and-drop upload zone
|
||
- **Added**: `FilePreviewModal` component — inline PDF/image preview via BlobURL with 404 "ไฟล์ไม่พร้อมใช้งาน" detection
|
||
- **Added**: `useWorkflowAction` hook — idempotent workflow transition with UUIDv4 Idempotency-Key, TanStack Query cache invalidation on success
|
||
- **Added**: `useWorkflowHistory` hook — fetches step history with attachments per instance
|
||
- **Added**: `WorkflowErrorBoundary` class component — catches unexpected failures without crashing the full detail page
|
||
- **Added**: i18n support for all new components (`public/locales/th|en/common.json`, `lib/i18n/`, `hooks/use-translations.ts`)
|
||
- **Modified**: RFA and Correspondence detail pages — integrated all ADR-021 components end-to-end
|
||
|
||
#### 📚 Specs & Documentation
|
||
|
||
- **Updated**: `specs/03-Data-and-Storage/03-01-data-dictionary.md` — `attachments.workflow_history_id` field with business rules (ADR-021)
|
||
- **Added**: `specs/08-Tasks/ADR-021-workflow-context/tasks.md` — complete task breakdown (47 tasks, Phases 1–8)
|
||
|
||
---
|
||
|
||
## 1.8.5 (2026-04-10)
|
||
|
||
### Specification & ADR Documentation
|
||
|
||
#### 📋 **ADR Registry Update** (2026-04-10)
|
||
|
||
- **Added**: ADR-003 (API Design Strategy) to `06-Decision-Records/README.md` — Hybrid REST + Action Strategy สำหรับ Resource และ Workflow Operations
|
||
- **Added**: ADR-004 (Database Schema Design Strategy) to `06-Decision-Records/README.md` — Selective Normalization + Standard Patterns (UUID, Soft Delete, Audit)
|
||
- **Added**: ADR-007 (Error Handling & Recovery Strategy) to `06-Decision-Records/README.md` — Layered Classification (Validation / Business / System) + Recovery Actions
|
||
- **Updated**: `06-Decision-Records/README.md` version 1.8.2 → 1.8.5
|
||
- **Total ADRs**: 21 (ADR-001 to ADR-020 + ADR-017B)
|
||
|
||
### Correspondence Module — Phase 7 Complete (2026-03-24)
|
||
|
||
#### 📧 **Email Notification Wiring** (Phase 7.1)
|
||
|
||
- **Changed**: Notification `type` on correspondence events: `'SYSTEM'` → `'EMAIL'` in 3 places
|
||
- `correspondence.service.ts` — cancel event
|
||
- `correspondence-workflow.service.ts` — submit event (recipient orgs)
|
||
- `due-date-reminder.service.ts` — due date cron
|
||
- **Effect**: `NotificationProcessor` now also dispatches Nodemailer email (immediate or digest per user preference) alongside in-app + WebSocket push
|
||
|
||
#### 🧪 **Unit Tests** (Phase 7.2)
|
||
|
||
- **Backend** (`due-date-reminder.service.spec.ts` — 8 tests):
|
||
- No revisions → no notifications
|
||
- Skip: no correspondence, CANCELLED, CLBOWN, no doc-control user found
|
||
- Happy path: correct `userId`, `type: 'EMAIL'`, `link`, `entityId`
|
||
- Error isolation: one failed revision doesn't stop others
|
||
- `daysLeft` message format validation
|
||
- **Frontend** (`hooks/__tests__/use-circulation.test.ts` — 5 tests):
|
||
- Cache key generation for `circulationKeys.byCorrespondence()`
|
||
- Successful fetch, disabled when UUID empty, error handling, query key assertion
|
||
|
||
#### 📦 **Bulk Operations** (Phase 7.3)
|
||
|
||
- **Backend**: `BulkCancelDto` (`uuids[]` + `reason`) → `POST /correspondences/bulk-cancel` (returns `{ succeeded[], failed[] }`)
|
||
- **Backend**: `GET /correspondences/export-csv` — streams UTF-8 BOM CSV with all filtered correspondence data
|
||
- **Frontend**: **Export CSV** button in `/correspondences` filter bar — respects active search/status/revision filters, triggers browser download
|
||
|
||
### Correspondence Module — Phase 6 Complete (2026-03-24)
|
||
|
||
#### 🔖 **Tag Manager** (Phase 5 → 6 bridge)
|
||
|
||
- **New Entity**: `CorrespondenceTag` (`correspondence_tags` junction table) — composite PK, eager-loads `Tag`
|
||
- **Backend**: `getTags()`, `addTag()`, `removeTag()` in `CorrespondenceService`; `GET/POST/DELETE /:uuid/tags` endpoints
|
||
- **Frontend**: `correspondenceService.getTags/addTag/removeTag` → `useCorrespondenceTags`, `useAddTag`, `useRemoveTag` hooks → `TagManager` component in detail sidebar
|
||
|
||
#### 🔍 **Search Enhancement** (Phase 6.1)
|
||
|
||
- **Backend**: Added `status` filter to `SearchQueryDto` and `SearchService.search()` ES query
|
||
- **Frontend**: `SearchFilters` now controlled (accepts `filters` prop), proper status codes (`SUBOWN`, `CLBOWN`, `CCBOWN`), active filter badge count
|
||
- **Frontend**: Added pagination (Prev/Next) to `/search` page with `PAGE_SIZE = 20`
|
||
- **Frontend**: Improved result cards — type-colored icons, color-coded status badges, doc number prominence, correct drawing links
|
||
|
||
#### 🔄 **Circulation Status Card** (Phase 6.2)
|
||
|
||
- **Backend**: Added `correspondenceUuid` filter to `SearchCirculationDto`; `findAll` now joins correspondence + routings when filtering by UUID
|
||
- **Frontend**: `circulationService.getByCorrespondenceUuid()` → `useCirculationsByCorrespondence` hook → `CirculationStatusCard` component showing per-circulation status + routing assignees in correspondence detail sidebar
|
||
|
||
#### 📜 **Revision History UI** (Phase 6.3)
|
||
|
||
- **Frontend**: `RevisionHistory` component — vertical timeline showing all revisions sorted desc, active revision marker, color-coded status, date + remarks; rendered from existing `data.revisions` (no new endpoint needed)
|
||
|
||
#### ⏰ **Due Date Reminder Cron** (Phase 6.4)
|
||
|
||
- **Backend**: Registered `ScheduleModule.forRoot()` in `AppModule`
|
||
- **Backend**: `DueDateReminderService` — `@Cron(EVERY_DAY_AT_8AM)` queries revisions where `dueDate` between now and +3 days, skips CANCELLED/CLBOWN, sends in-app notification via `NotificationService` with link to correspondence
|
||
|
||
### CI/CD & Deployment Simplification (2026-03-24)
|
||
|
||
#### 🚀 **deploy.sh v2.0 — Rewrote deployment script**
|
||
|
||
- **Changed**: Replaced 9-step blue-green deployment with 3-step direct deploy
|
||
- **Step 1**: Build Docker images (backend + frontend) from source
|
||
- **Step 2**: `docker compose -f [compose_file] up -d --force-recreate`
|
||
- **Step 3**: Health check on `backend` container
|
||
- **Removed**: Blue/green directory switching, NGINX switching, `current` file tracking
|
||
- **Reason**: QNAP setup uses a single stack — simultaneous blue/green was not viable with shared container names
|
||
|
||
#### ⚙️ **ci-deploy.yml — CI pipeline improvements**
|
||
|
||
- **Added**: `pnpm/action-setup@v4` + `cache: 'pnpm'` for faster installs
|
||
- **Fixed**: `--watchAll=false` removed from backend test command (not a valid Jest flag)
|
||
- **Fixed**: `mkdir -p /share/np-dms/app/logs` before deploy to prevent `tee` error
|
||
- **Simplified**: Removed `tee` + `PIPESTATUS` — `set -e` handles errors
|
||
|
||
### Document Numbering System Fixes (2026-03-21)
|
||
|
||
#### 🔢 **Template Management Hardening**
|
||
|
||
- **Issue**: Save/Edit functionality failing due to missing fields and data complexity.
|
||
- **Fix (Backend)**: Added `disciplineId` and `isActive` to `DocumentNumberFormat` entity.
|
||
- **Fix (Backend)**: Implemented automated "Upsert" logic in `DocumentNumberingService` to handle business keys (Project + Type + Discipline).
|
||
- **Fix (Frontend)**: Refactored `numberingApi.saveTemplate` to sanitize DTOs and avoid sending nested relation objects.
|
||
- **Feature**: Added **Discipline** selection to the Template Editor UI for granular numbering rules.
|
||
- **Result**: Administrators can now successfully create, update, and manage numbering templates globally or per discipline.
|
||
|
||
### Build & Deployment Fixes (2026-03-20)
|
||
|
||
#### 🔧 **Backend Dependency Resolution**
|
||
|
||
- **Issue**: `ms` package not found during build
|
||
- **Fix**: Added `"ms": "^2.1.3"` to dependencies and `"@types/ms": "^2.1.0"` to devDependencies
|
||
- **Issue**: `CACHE_MANAGER` not available in UserModule and AuthModule
|
||
- **Fix**: Added global `CacheModule.register({ isGlobal: true, ttl: 300 })` to AppModule
|
||
- **Issue**: `UuidResolverService` not available despite `@Global()` decorator
|
||
- **Fix**: Added `CommonModule` import to AppModule to initialize global services
|
||
- **Result**: Backend starts successfully with all dependencies resolved
|
||
|
||
#### 🐳 **Docker Build Fixes**
|
||
|
||
- **Issue**: Next.js standalone build failed with pnpm symlink structure
|
||
- **Error**: `ENOENT: no such file or directory` creating standalone node_modules
|
||
- **Fix**: Temporarily disabled `output: "standalone"` in next.config.mjs
|
||
- **Fix**: Updated Dockerfile to copy full app and node_modules instead of standalone output
|
||
- **Result**: Frontend builds successfully in Docker (slightly larger image)
|
||
|
||
#### 📦 **Cache Architecture Update**
|
||
|
||
- **Before**: Local CacheModule imports in UserModule and AuthModule
|
||
- **After**: Global CacheModule in AppModule (TTL 5 minutes, in-memory)
|
||
- **Benefit**: All services (UserService, AuthService, JwtStrategy, IdempotencyInterceptor, MaintenanceModeGuard) can inject CACHE_MANAGER
|
||
- **Note**: Temporary solution until Redis store TypeScript issues are resolved
|
||
|
||
### Frontend Quality Refactor Pass (2026-03-20)
|
||
|
||
#### 🔧 **ESLint Hardening**
|
||
|
||
- Added `@typescript-eslint/no-explicit-any` as warning for TypeScript files
|
||
- Added `no-console` as warning for TypeScript files
|
||
- Added `eslint-plugin-react-hooks` rules (rules-of-hooks: error, exhaustive-deps: warn)
|
||
|
||
#### 🧹 **Eliminate `any` Types (69 → 4)**
|
||
|
||
- **admin pages**: Replaced `(projects as any[])` with typed `{ id?; uuid?; projectCode; projectName }` casts (6 pages)
|
||
- **drawings/upload-form.tsx**: Fixed discriminated union form errors with `Record<string, FieldError | undefined>`
|
||
- **generic-crud-table.tsx**: Added `ApiError` interface, replaced `any` with `Record<string, unknown>` generics
|
||
- **numbering components**: Updated `projectId` prop types to `number | string`, coerced with `Number()`
|
||
- **numbering/page.tsx**: Defined `ProjectItem` interface, typed find/filter operations
|
||
- **admin/user-dialog.tsx**: Typed roles, organizations, and mutation payloads with `CreateUserDto`
|
||
- **admin/security/rbac-matrix.tsx**: Typed API responses with explicit `Role[]` / `Permission[]` return types
|
||
- **numbering/template-tester.tsx**: Typed template project access, fixed `error: any` → `error: unknown`
|
||
- **numbering/template-editor.tsx**: Typed correspondence type lookup
|
||
- **rfas/detail.tsx**: Created `RFADetailData` / `RFADetailItem` interfaces
|
||
- **rfas/form.tsx**: Added `items` to `CreateRfaDto`, aligned DTO imports
|
||
- **correspondences/form.tsx**: Fixed `defaultValues as any` → `as FormData`
|
||
- **correspondences-content.tsx**: Removed `as any` on `useCorrespondences` params
|
||
- **drawings/list.tsx**: Replaced `as any` with `as DrawingSearchParams`
|
||
- **auth/auth-sync.tsx**: Typed NextAuth session user with explicit interface
|
||
- **migration/review/[id]/page.tsx**: Fixed `error: any` → `error: unknown` with typed response cast
|
||
- **reference pages** (disciplines, rfa-types, tags): Typed `fetchFn` mapping and `createFn` casts
|
||
- **Remaining 4**: All `zodResolver(formSchema) as any` — known zod 4 + @hookform/resolvers compat (marked with `eslint-disable`)
|
||
|
||
#### 🔇 **Remove Production Console Logs (53 → 4)**
|
||
|
||
- Removed all `console.log`, `console.warn`, `console.error` from production code
|
||
- **Kept**: 4 Next.js error boundary files (`error.tsx`, `global-error.tsx`) — required by framework
|
||
- **Replaced**: Redundant catch-block logging where `toast` already provides user feedback
|
||
- **Files cleaned**: `lib/auth.ts`, `lib/api/client.ts`, `lib/api/numbering.ts`, `lib/services/dashboard.service.ts`, all numbering components, admin pages, migration pages, workflow components, login page
|
||
|
||
#### 🔑 **Fix Index-as-Key Anti-pattern**
|
||
|
||
- **layout/sidebar.tsx**: Replaced `key={index}` with `key={item.href}` (desktop + mobile nav)
|
||
- **admin/page.tsx**: Replaced `key={index}` with `key={stat.title}` and `key={link.href}`
|
||
|
||
#### 📦 **Component Consolidation**
|
||
|
||
- **correspondences/form.tsx**: Replaced duplicate `FileUpload` import with canonical `FileUploadZone`
|
||
- **custom/file-upload-zone.tsx**: Removed unnecessary `as any` cast in File constructor
|
||
|
||
#### 📊 **Type System Improvements**
|
||
|
||
- **types/rfa.ts**: Added `items?: RFAItem[]` to `CreateRFADto`
|
||
- **types/dto/rfa/rfa.dto.ts**: Added `items?: RFAItem[]` to `CreateRfaDto` (DTO version)
|
||
- **Build**: ✅ `pnpm run build` passes with zero errors
|
||
|
||
### Build Fixes & Dependency Updates (2026-03-19)
|
||
|
||
#### 🔧 **Build Issues Fixed**
|
||
|
||
**Frontend Build**:
|
||
|
||
- **Fixed Tailwind CSS v4.2.2 PostCSS compatibility** → Downgraded to v3.4.3
|
||
- **Fixed Zod + React Hook Form compatibility** → @hookform/resolvers@3.9.0
|
||
- **Fixed ambiguous routes** → Removed conflicting `[id]` routes
|
||
- **Fixed TypeScript errors** → Added proper type casting in template-editor.tsx
|
||
- **Result**: ✅ Zero warnings, 57 routes generated
|
||
|
||
**Backend Build**:
|
||
|
||
- **Migrated cache-manager-redis-yet → cache-manager-redis-store@3.0.1**
|
||
- **Removed deprecated @types packages** → @types/cache-manager, @types/ioredis, @types/uuid
|
||
- **Updated import statements** → Redis store import path changed
|
||
- **Result**: ✅ Zero warnings, all dependencies compatible
|
||
|
||
#### 📦 **Package Updates**
|
||
|
||
```bash
|
||
# Frontend
|
||
tailwindcss: 4.2.2 → 3.4.3
|
||
@hookform/resolvers: 5.2.2 → 3.9.0
|
||
|
||
# Backend
|
||
cache-manager-redis-yet: 5.1.5 → cache-manager-redis-store: 3.0.1
|
||
Removed: @types/cache-manager@5.0.0, @types/ioredis@5.0.0, @types/uuid@11.0.0
|
||
```
|
||
|
||
#### 📊 **Build Performance**
|
||
|
||
- **Frontend**: 19.4s (57 routes, zero warnings)
|
||
- **Backend**: ~30s (18 modules, zero warnings)
|
||
- **Status**: ✅ Production Ready
|
||
|
||
#### 📝 **Documentation Updated**
|
||
|
||
- Updated AGENTS.md, .windsurfrules, CLAUDE.md, GEMINI.md
|
||
- Created build-status-2026-03-19.md
|
||
- Updated tech stack specifications
|
||
|
||
### Backend Security & Dependency Updates (2026-03-19)
|
||
|
||
#### 🛡️ Security Vulnerabilities Fixed
|
||
|
||
- **All 52 vulnerabilities resolved** (27 high + 20 moderate + 5 low severity)
|
||
- **Security overrides applied**: 30 package overrides via `pnpm audit --fix`
|
||
- **Current status**: "No known vulnerabilities found"
|
||
- **Critical patches applied**:
|
||
- Webpack SSRF bypass (via @nestjs/cli)
|
||
- qs DoS vulnerability (via @compodoc/compodoc)
|
||
- Multiple package security updates (axios, ajv, multer, etc.)
|
||
|
||
#### 📦 Backend Dependency Updates
|
||
|
||
**Major Version Upgrades**:
|
||
|
||
- `@elastic/elasticsearch`: 8.19.1 → 9.3.4 (Major version jump)
|
||
- `nodemailer`: 7.0.11 → 8.0.3 (Major version jump)
|
||
- `uuid`: 11.1.0 → 13.0.0 (Major version jump)
|
||
- `@types/node`: 22.19.1 → 25.5.0 (Major version jump)
|
||
|
||
**Security & Compatibility Updates**:
|
||
|
||
- `eslint`: 9.39.1 → 9.39.1 (kept 9.x for typescript-eslint compatibility)
|
||
- `typescript-eslint`: 8.48.0 → 8.57.1 (Latest compatible version)
|
||
- `@types/uuid`: 10.0.0 → 11.0.0 (Deprecated package updated)
|
||
- `ajv`: 8.17.1 → 8.18.0
|
||
- `axios`: 1.13.2 → 1.13.6
|
||
- `multer`: 2.0.2 → 2.1.1
|
||
|
||
#### 🔧 Build & Test Configuration
|
||
|
||
- **Jest Configuration**: Added `transformIgnorePatterns` for UUID v13 ES modules compatibility
|
||
- **Build Verification**: Backend builds successfully after updates
|
||
- **Test Compatibility**: Sample tests pass (app.controller.spec.ts)
|
||
- **ESLint Compatibility**: Maintained 9.x for ecosystem compatibility
|
||
|
||
#### 📋 Package Management
|
||
|
||
- **pnpm audit**: Clean slate - 0 vulnerabilities
|
||
- **Dependency Resolution**: All peer dependency conflicts resolved
|
||
- **Deprecated Packages**: All stub type warnings acknowledged and documented
|
||
|
||
### Dependency Updates (2026-03-19)
|
||
|
||
#### Frontend Dependencies 📦
|
||
|
||
- **Security Updates**:
|
||
- Next.js: 16.0.7 → 16.2.0 (fixes security vulnerability)
|
||
- React: 19.0.0 → 19.2.4
|
||
- React DOM: 19.0.0 → 19.2.4
|
||
|
||
- **ESLint Migration**:
|
||
- ESLint: 8.57.1 → 9.39.1 (resolves deprecated warning)
|
||
- eslint-config-next: 14.2.33 → 16.2.0
|
||
- Created new `eslint.config.mjs` for ESLint 9 compatibility
|
||
- Updated lint script to use ESLint directly
|
||
|
||
- **Package Cleanup**:
|
||
- Removed deprecated `@types/uuid@11.0.0` (using built-in types from uuid@13.0.0)
|
||
- Fixed TypeScript ESLint disable comments in template files
|
||
|
||
- **Other Updates** (25+ packages):
|
||
- axios: 1.13.2 → 1.13.6
|
||
- lucide-react: 0.555.0 → 0.577.0
|
||
- react-day-picker: 9.12.0 → 9.14.0
|
||
- react-hook-form: 7.66.1 → 7.71.2
|
||
- react-dropzone: 14.3.8 → 15.0.0
|
||
- zustand: 5.0.8 → 5.0.12
|
||
- tailwind-merge: 3.4.0 → 3.5.0
|
||
- zod: 4.1.13 → 4.3.6
|
||
- vitest: 4.0.15 → 4.1.0
|
||
- @types/node: 20.19.25 → 25.5.0
|
||
- tailwindcss: 3.4.18 → 4.2.2
|
||
- jsdom: 27.3.0 → 29.0.0
|
||
|
||
#### Documentation Updates 📚
|
||
|
||
- **CHANGELOG.md**: Added comprehensive dependency update section
|
||
- **README.md**: Updated tech stack versions
|
||
- **AGENTS.md**: Updated frontend stack versions
|
||
- **CONTRIBUTING.md**: No changes required (already up-to-date)
|
||
|
||
#### Quality Improvements ✅
|
||
|
||
- All deprecated package warnings resolved
|
||
- ESLint 9 configuration working correctly
|
||
- No peer dependency conflicts
|
||
- All tests passing (vitest configuration stable)
|
||
|
||
### In Progress
|
||
|
||
- UAT (User Acceptance Testing) — ตาม `01-05-acceptance-criteria.md`
|
||
- KPI Baseline Collection (As-Is Metrics ก่อน Go-Live)
|
||
- Legacy Data Migration — Tier 1 (2,000 docs Critical)
|
||
- Final Security Audit — ตาม `04-06-security-operations.md`
|
||
- Go-Live: Blue-Green Deploy บน QNAP Container Station
|
||
|
||
### NestJS 11 + Next.js 16 Migration (2026-03-16)
|
||
|
||
#### Backend 🔧
|
||
|
||
- **NestJS 11 Upgrade**: `@nestjs/*` v11, Express v5, removed `@nestjs/mapped-types`
|
||
- **RequestWithUser Interface**: Shared typed interface replacing `req: any` across 6 controllers (`auth`, `session`, `file-storage`, `workflow-engine`, `correspondence`, `jwt-refresh`)
|
||
- **MasterModule DI Fix**: Imported `UserModule` so `RbacGuard` can resolve `UserService`
|
||
- **TypeORM Fix**: Explicit typing for `DocumentNumberFormat` save/create overload resolution
|
||
- **Swagger**: Updated API version to 1.8.1
|
||
|
||
### Frontend 🎨
|
||
|
||
- **Next.js 16 Upgrade**: Next.js 16.0.7 → 16.2.0, React 19 → 19.2.4 (Security Fix)
|
||
- **ESLint 9 Migration**: ESLint 8.57.1 → 9.39.1, removed deprecated warnings
|
||
- **Dependency Updates**: Updated 25+ packages to latest stable versions
|
||
- **Deprecated Package Cleanup**: Removed `@types/uuid@11.0.0` (using built-in types)
|
||
- **proxy.ts Rename**: `middleware.ts` → `proxy.ts` (Next.js 16 deprecated `middleware` convention)
|
||
- **ADR-019 UUID Fixes — Drawing Admin Pages (5 pages)**:
|
||
- `contract/volumes`, `contract/categories`, `contract/sub-categories`
|
||
- `shop/main-categories`, `shop/sub-categories`
|
||
- Changed `useState<number>` → `useState<string>`, removed `parseInt(uuid)`
|
||
- **ADR-019 UUID Fixes — Contract Page**:
|
||
- Fixed edit form showing "New Contract" (`contract.uuid` → `contract.id` after `@Expose`)
|
||
- Fixed blank Project dropdown (was using contract's UUID instead of project's UUID)
|
||
- Fixed delete passing `undefined` uuid
|
||
- Updated `Contract` interface to match serialized API response
|
||
- **ADR-019 UUID Fixes — Disciplines & RFA Types**:
|
||
- `useContracts(projectId=1)` → optional param, fetches all contracts when unspecified
|
||
- `useDisciplines(contractId?: number)` → `number | string`
|
||
- **ADR-019 UUID Fixes — Tags Page**:
|
||
- Fixed Radix Select crash on empty `value=""` → `"__none__"` sentinel
|
||
- Fixed Project Scope dropdown showing UUIDs (snake_case → camelCase field names)
|
||
- **DTO Updates**: `CreateContractDto`, `SearchContractDto`, `CreateShopMainCategoryDto`, etc. — `projectId: number` → `number | string`
|
||
- **Service Updates**: `drawing-master-data.service.ts`, `master-data.service.ts` — accept `string | number` for project/contract IDs
|
||
|
||
#### Documentation 📚
|
||
|
||
- **ADR-005**: Updated Backend Stack table (NestJS 11, Express v5)
|
||
- **Engineering Guidelines** (`05-01`): Added NestJS 11 specific patterns section
|
||
- **README.md**: Tech stack versions, status date, ADR-019 in roadmap
|
||
- **AGENTS.md**: Tech stack versions updated
|
||
|
||
---
|
||
|
||
## 1.8.1 Patch (2026-03-11)
|
||
|
||
### Summary
|
||
|
||
**Product Owner Documentation Complete** — ปิด 10/10 Documentation Gaps สำหรับ UAT Readiness
|
||
ระบบมีเอกสารครบถ้วนสำหรับ Stakeholder Sign-off และ Go-Live Process
|
||
|
||
### Documentation 📚 — 10/10 Gaps Closed
|
||
|
||
#### Gap 1: Product Vision Statement ✅ `specs/00-Overview/00-03-product-vision.md`
|
||
|
||
- Elevator Pitch, Problem Statement, Geoffrey Moore Vision Format
|
||
- Strategic Pillars: Speed / Security / Visibility
|
||
- Phase Roadmap (Now → 24 เดือน), Guardrails, Success Metrics
|
||
|
||
#### Gap 2: User Stories ✅ `specs/01-Requirements/01-04-user-stories.md`
|
||
|
||
- 27 User Stories ครอบคลุม 8 Epics
|
||
- MoSCoW Prioritization per Story
|
||
- Acceptance Criteria + Definition of Done
|
||
|
||
#### Gap 3: Acceptance Criteria (UAT) ✅ `specs/01-Requirements/01-05-acceptance-criteria.md`
|
||
|
||
- 35 Acceptance Criteria (All Modules)
|
||
- UAT Plan: 4 Phases, Sign-off Process
|
||
- Go-Live Criteria Matrix
|
||
|
||
#### Gap 4: UI/UX Wireframes ✅ `specs/01-Requirements/01-07-ui-wireframes.md`
|
||
|
||
- Screen Inventory: 26 Screens พร้อม Role + Priority
|
||
- Navigation Map / Site Map ครบทุก Route
|
||
- ASCII Wireframes: Login, Dashboard, Correspondence, RFA, Circulation, Admin
|
||
- Design System Tokens + Interaction Patterns
|
||
|
||
#### Gap 5: Stakeholder Sign-off & Risk ✅ `specs/00-Overview/00-04-stakeholder-signoff-and-risk.md`
|
||
|
||
- Sign-off Process 4-Step + Digital Sign Matrix
|
||
- Risk Register: 15 Risks (Impact × Probability Matrix)
|
||
- Change Control Policy + Emergency Change Process
|
||
|
||
#### Gap 6: KPI Baseline Data ✅ `specs/00-Overview/00-05-kpi-baseline.md`
|
||
|
||
- 14 KPIs พร้อม Baseline Collection Form
|
||
- SQL Measurement Queries + Grafana Dashboard Specs
|
||
- User Satisfaction Survey Template
|
||
|
||
#### Gap 7: Migration Business Scope ✅ `specs/03-Data-and-Storage/03-06-migration-business-scope.md`
|
||
|
||
- Data Scope: IN/OUT SCOPE (ปี 2564 → Go-Live)
|
||
- Migration Tiers: Tier 1 (2K Critical) / Tier 2 (10K) / Tier 3 (8K Archive)
|
||
- Excel Metadata Mapping (11 Columns → Field ใหม่)
|
||
- Organization Code Lookup Table
|
||
- Timeline: T-6 สัปดาห์ → Go-Live → T+30
|
||
- Go/No-Go Gates 3 ด่าน
|
||
- Data Security: AI Isolation (ADR-018) + Token 7 วัน + IP Whitelist
|
||
|
||
#### Gap 8: Release Management Policy ✅ `specs/04-Infrastructure-OPS/04-08-release-management-policy.md`
|
||
|
||
- SemVer Strategy + Git Flow (main/release/develop/hotfix)
|
||
- 5 Release Gates: Code Complete → QA → Staging → Approval → Production
|
||
- Quality Thresholds: TS 0 errors, ≥80% Test Coverage, 0 Critical Vuln
|
||
- Hotfix Process: P0 < 4h / P1 < 24h + Decision Tree
|
||
- Rollback Policy: SLA < 30 วิ (Blue-Green) + Auto-trigger Rules
|
||
- CI/CD Pipeline: 5 Stages (Quality → Security → Build → Integration → Release)
|
||
- Release Checklist + Security Pre-release Requirements
|
||
|
||
#### Gap 9: Training Plan ✅ `specs/00-Overview/00-06-training-plan.md`
|
||
|
||
- Curriculum แบ่งตาม Role (4 Roles)
|
||
- 4-Phase Training Timeline
|
||
- Hands-on Lab + Assessment Criteria
|
||
|
||
#### Gap 10: Edge Cases & Business Rules ✅ `specs/01-Requirements/01-06-edge-cases-and-rules.md`
|
||
|
||
- 37 Edge Cases ครอบคลุมทุก Module
|
||
- Business Logic Guards + Error Handling Matrix
|
||
|
||
### Architecture Decision Records 🏛️
|
||
|
||
- **ADR-018** (Patch 1.8.1): AI Boundary — Ollama Isolation Policy
|
||
- Ollama ไม่มี Direct DB/Storage Access
|
||
- AI Output ต้องผ่าน Backend Validation ก่อน Write
|
||
- Migration Bot Token: IP Whitelist + 7-day Expiry
|
||
|
||
### READMEs Updated 📄
|
||
|
||
- `README.md`: Status badge v1.8.1, UAT Ready, 10/10 Gaps table, fixed schema commands, updated Roadmap
|
||
- `CONTRIBUTING.md`: Spec tree updated (new files), schema filenames corrected, category table updated
|
||
- `specs/00-Overview/README.md`: Quick Links table เพิ่ม Gap 4/7/8 links
|
||
- `specs/01-Requirements/README.md`: Gap documents registered
|
||
- `specs/03-Data-and-Storage/README.md`: Migration Scope registered
|
||
- `specs/04-Infrastructure-OPS/README.md`: Release Policy registered
|
||
|
||
## 1.8.0 (2026-02-24)
|
||
|
||
### Summary
|
||
|
||
**Documentation Realignment & Type Safety** - Comprehensive overhaul of the specifications structure and frontend codebase to enforce strict typing and consistency.
|
||
|
||
### Codebase Changes 💻
|
||
|
||
- **Frontend Type Safety**: Removed all `any` types from Frontend DTOs and Hooks. Implemented explicit types (`AuditLog[]`, `Record<string, unknown>`) avoiding implicit fallbacks.
|
||
- **Frontend Refactoring**: Refactored data fetching and mutations utilizing `TanStack Query` hooks aligned with real API endpoints.
|
||
- **Admin Pages Fixes**: Addressed crashes on Reference Data/Categories pages by introducing robust error handling and proper generic typing on DataTables.
|
||
|
||
### Documentation 📚
|
||
|
||
- **Specification Restructuring**: Restructured the entire `specs/` directory into 7 canonical layers (`00-Overview`, `01-Requirements`, `02-Architecture`, `03-Data-and-Storage`, `04-Infrastructure-OPS`, `05-Engineering-Guidelines`, `06-Decision-Records`).
|
||
- **Guidelines Synchronization**: Updated Engineering Guidelines (`05-1` to `05-4`) to reflect the latest state management (Zustand, React Hook Form) and testing strategies.
|
||
- **ADR Alignment**: Audited Architecture Decision Records (ADR 1 to 16) against actual implementation (e.g., LocalStorage JWT vs HTTP-Only cookies, bcrypt salt rounds).
|
||
- **Root Docs Update**: Fully updated `README.md` and `CONTRIBUTING.md` to reflect the current v1.8.0 folder structure and rules.
|
||
- **Cleanups**: Consolidated standalone infrastructure specs (formerly `08-infrastructure`) into `04-Infrastructure-OPS` and cleaned up legacy scripts and blank diagrams from the repository root.
|
||
|
||
## 1.7.0 (2025-12-18)
|
||
|
||
### Summary
|
||
|
||
**Schema Stabilization & Document Numbering Overhaul** - Significant schema updates to support advanced document numbering (reservations, varying reset scopes) and a unified workflow engine.
|
||
|
||
### Database Schema Changes 💾
|
||
|
||
#### Document Numbering System (V2) 🔢
|
||
|
||
- **`document_number_counters`**:
|
||
- **Breaking Change**: Primary Key changed to 8-column Composite Key (`project_id`, `originator_id`, `recipient_id`, `type_id`, `sub_type_id`, `rfa_type_id`, `discipline_id`, `reset_scope`).
|
||
- **New Feature**: Added `reset_scope` column to support flexible resetting (YEAR, MONTH, PROJECT, NONE).
|
||
- **New Feature**: Added `version` column for Optimistic Locking.
|
||
- **`document_number_reservations`** (NEW):
|
||
- Implemented Two-Phase Commit pattern (Reserve -> Confirm) for document numbers.
|
||
- Prevents race conditions and gaps in numbering.
|
||
- **`document_number_errors`** (NEW):
|
||
- Helper table for tracking numbering failures and deadlocks.
|
||
- **`document_number_audit`**:
|
||
- Enhanced with reservation tokens and performance metrics.
|
||
|
||
#### Unified Workflow Engine 🔄
|
||
|
||
- **`workflow_definitions`**:
|
||
- Updated structure to support compiled DSL and versioning.
|
||
- Added `dsl` (JSON) and `compiled` (JSON) columns.
|
||
- **`workflow_instances`**:
|
||
- Changed ID to UUID.
|
||
- Added `entity_type` and `entity_id` for polymorphic polymorphism.
|
||
- **`workflow_histories`**:
|
||
- Updated to link with UUID instances.
|
||
|
||
#### System & Audit 🛡️
|
||
|
||
- **`audit_logs`**:
|
||
- Updated schema for better partitioning support (`created_at` in PK).
|
||
- Standardized JSON details column.
|
||
- **`notifications`**:
|
||
- Updated schema to support polymorphic entity linking.
|
||
|
||
#### Master Data
|
||
|
||
- **`disciplines`**:
|
||
- Added relation to `correspondences` and `rfas`.
|
||
|
||
### Documentation 📚
|
||
|
||
- **Data Dictionary**: Updated to v1.7.0 with full index summaries and business rules.
|
||
- **Schema**: Released `lcbp3-v1.7.0-schema.sql` and `lcbp3-v1.7.0-seed.sql`.
|
||
|
||
## 1.6.0 (2025-12-13)
|
||
|
||
### Summary
|
||
|
||
**Schema Refactoring Release** - Major restructuring of correspondence and RFA tables for improved data consistency.
|
||
|
||
### Database Schema Changes 💾
|
||
|
||
#### Breaking Changes ⚠️
|
||
|
||
- **`correspondence_recipients`**: FK changed from `correspondence_revisions(correspondence_id)` → `correspondences(id)`
|
||
- **`rfa_items`**: Column renamed `rfarev_correspondence_id` → `rfa_revision_id`
|
||
|
||
#### Schema Refactoring
|
||
|
||
- **`correspondences`**: Reordered columns, `discipline_id` now inline (no ALTER TABLE)
|
||
- **`correspondence_revisions`**:
|
||
- Renamed: `title` → `subject`
|
||
- Added: `body TEXT`, `remarks TEXT`, `schema_version INT`
|
||
- Added Virtual Columns: `v_ref_project_id`, `v_doc_subtype`
|
||
- **`rfas`**:
|
||
- Changed to Shared PK pattern (no AUTO_INCREMENT)
|
||
- PK now FK to `correspondences(id)`
|
||
- **`rfa_revisions`**:
|
||
- Removed: `correspondence_id` (uses rfas.id instead)
|
||
- Renamed: `title` → `subject`
|
||
- Added: `body TEXT`, `remarks TEXT`, `due_date DATETIME`, `schema_version INT`
|
||
- Added Virtual Column: `v_ref_drawing_count`
|
||
|
||
### Documentation 📚
|
||
|
||
- Updated Data Dictionary to v1.6.0
|
||
- Updated schema SQL files (`lcbp3-v1.6.0-schema.sql`, seed files)
|
||
|
||
## 1.5.1 (2025-12-10)
|
||
|
||
### Summary
|
||
|
||
**Major Milestone: System Feature Complete (~95%)** - Ready for UAT and production deployment.
|
||
|
||
All core modules implemented and operational. Backend and frontend fully integrated with comprehensive admin tools.
|
||
|
||
### Backend Completed ✅
|
||
|
||
#### Core Infrastructure
|
||
|
||
- ✅ All 18 core modules implemented and tested
|
||
- ✅ JWT Authentication with Refresh Token mechanism
|
||
- ✅ RBAC 4-Level (Global, Organization, Project, Contract) using CASL
|
||
- ✅ Document Numbering with Redis Redlock + Optimistic Locking
|
||
- ✅ Workflow Engine (DSL-based Hybrid Engine with legacy support)
|
||
- ✅ Two-Phase File Storage with ClamAV Virus Scanning
|
||
- ✅ Global Audit Logging with Interceptor
|
||
- ✅ Health Monitoring & Metrics endpoints
|
||
|
||
#### Business Modules
|
||
|
||
- ✅ **Correspondence Module** - Master-Revision pattern, Workflow integration, References
|
||
- ✅ **RFA Module** - Full CRUD, Item management, Revision handling, Approval workflow
|
||
- ✅ **Drawing Module** - Separated into Shop Drawing & Contract Drawing
|
||
- ✅ **Transmittal Module** - Document transmittal tracking
|
||
- ✅ **Circulation Module** - Circulation sheet management
|
||
- ✅ **Elasticsearch Integration** - Direct indexing, Full-text search (95% complete)
|
||
|
||
#### Supporting Services
|
||
|
||
- ✅ **Notification System** - Email and LINE notification integration
|
||
- ✅ **Master Data Management** - Consolidated service for Organizations, Projects, Disciplines, Types
|
||
- ✅ **User Management** - CRUD, Assignments, Preferences, Soft Delete
|
||
- ✅ **Dashboard Service** - Statistics and reporting APIs
|
||
- ✅ **JSON Schema Validation** - Dynamic schema validation for documents
|
||
|
||
### Frontend Completed ✅
|
||
|
||
#### Application Structure
|
||
|
||
- ✅ All 15 frontend tasks (FE-001 to FE-015) completed
|
||
- ✅ Next.js 14 App Router with TypeScript
|
||
- ✅ Complete UI implementation (17 component groups, 22 Shadcn/UI components)
|
||
- ✅ TanStack Query for server state management
|
||
- ✅ Zustand for client state management
|
||
- ✅ React Hook Form + Zod for form validation
|
||
- ✅ Responsive layout (Desktop & Mobile)
|
||
|
||
#### End-User Modules
|
||
|
||
- ✅ **Authentication UI** - Login, Token Management, Session Sync
|
||
- ✅ **RBAC UI** - `<Can />` component for permission-based rendering
|
||
- ✅ **Correspondence UI** - List, Create, Detail views with file uploads
|
||
- ✅ **RFA UI** - List, Create, Item management
|
||
- ✅ **Drawing UI** - Contract & Shop drawing lists, Upload forms
|
||
- ✅ **Search UI** - Global search bar, Advanced filtering with Elasticsearch
|
||
- ✅ **Dashboard** - Real-time KPI cards, Activity feed, Pending tasks
|
||
- ✅ **Circulation UI** - Circulation sheet management with DataTable
|
||
- ✅ **Transmittal UI** - Transmittal tracking and management
|
||
|
||
#### Admin Panel (10 Routes)
|
||
|
||
- ✅ **Workflow Configuration** - DSL Editor, Visual Builder, Workflow Definition management
|
||
- ✅ **Document Numbering Config** - Template Editor, Token Tester, Sequence Viewer
|
||
- ✅ **User Management** - CRUD, Role assignments, Preferences
|
||
- ✅ **Organization Management** - Organization CRUD and hierarchy
|
||
- ✅ **Project Management** - Project and contract administration
|
||
- ✅ **Reference Data Management** - CRUD for Disciplines, Types, Categories (6 modules)
|
||
- ✅ **Security Administration** - RBAC Matrix, Roles, Active Sessions (2 modules)
|
||
- ✅ **Audit Logs** - Comprehensive audit log viewer
|
||
- ✅ **System Logs** - System log monitoring
|
||
- ✅ **Settings** - System configuration
|
||
|
||
### Database 💾
|
||
|
||
- ✅ Schema v1.5.1 with standardized audit columns (`created_at`, `updated_at`, `deleted_at`)
|
||
- ✅ Complete seed data for all master tables
|
||
- ✅ Migration scripts and patches (`patch-audit-columns.sql`)
|
||
- ✅ Data Dictionary v1.5.1 documentation
|
||
|
||
### Documentation 📚
|
||
|
||
- ✅ Complete specs/ reorganization to v1.5.1
|
||
- ✅ 21 requirements documents in `specs/01-requirements/`
|
||
- ✅ 17 ADRs (Architecture Decision Records) in `specs/05-decisions/`
|
||
- ✅ Implementation guides for Backend & Frontend
|
||
- ✅ Operations guides for critical features (Document Numbering)
|
||
- ✅ Comprehensive progress reports updated
|
||
- ✅ Task archiving to `specs/09-history/` (27 completed tasks)
|
||
|
||
### Bug Fixes 🐛
|
||
|
||
- 🐛 Fixed role selection bug in User Edit form (2025-12-09)
|
||
- 🐛 Fixed workflow permissions - 403 error on workflow action endpoints
|
||
- 🐛 Fixed TypeORM relation errors in RFA and Drawing services
|
||
- 🐛 Fixed token refresh infinite loop in authentication
|
||
- 🐛 Fixed database schema alignment issues (audit columns)
|
||
- 🐛 Fixed "drawings.map is not a function" by handling paginated responses
|
||
- 🐛 Fixed invalid refresh token error loop
|
||
|
||
### Changed 📝
|
||
|
||
- 📝 Updated progress reports to reflect ~95% backend, 100% frontend completion
|
||
- 📝 Aligned all TypeORM entities with schema v1.5.1
|
||
- 📝 Enhanced data dictionary with business rules
|
||
- 📝 Archived 27 completed task files to `specs/09-history/`
|
||
|
||
## 1.5.0 (2025-11-30)
|
||
|
||
### Summary
|
||
|
||
Initial spec-kit structure establishment and documentation organization.
|
||
|
||
### Changed
|
||
|
||
- Changed the version to 1.5.0
|
||
- Modified to Spec-kit
|