OoO 86f1fd5f50 fix(p33): admin observability auth hardening — Critic CRITICAL 修正 ...

Critic 1 CRITICAL 發現：6 個觀測端點零認證 + csrf_exempt
→ Flask 一旦對外可達，任何人可 POST 晉升 episode / 改月預算
→ X-Forwarded-User header client 偽造 = 偽造 admin 身份

修正：
1. 全 8 個 route handler 加 @login_required（session-based auth）
   - GET: ai_calls / promotion_review / quality_trend / host_health /
          budget / ppt_audit_history
   - POST: promotion_review/approve, .../reject, budget/update/<id>
2. promotion_review_approve approver_hash 改從 Flask session 取
   （get_current_user().username）— 不再信 X-Forwarded-User header
3. app.py 移除 csrf.exempt(admin_observability_bp)
4. 12 tests（10 原 + 2 新 auth gate）全 PASS：
   - test_anon_get_redirects_to_login: 6 GET 路由匿名 → 302
   - test_anon_post_blocked: 3 POST mutation 匿名 → 302

2026-05-04 14:19:54 +08:00

..

__init__.py

feat: EwoooC 初始化 — 完整專案推版至 Gitea

2026-04-19 01:21:13 +08:00

conftest.py

feat(p1+p3): logger 接 13 caller + Q&A/Nemotron/日報 feature flag 灰度

2026-05-03 23:05:38 +08:00

test_admin_observability_routes.py

fix(p33): admin observability auth hardening — Critic CRITICAL 修正

2026-05-04 14:19:54 +08:00

test_agent_actions.py

落地 L2 安全記憶動作

2026-04-29 23:29:45 +08:00

test_ai_automation_metrics.py

fix(metrics): 輸出 AI 自動化 baseline 指標

2026-04-30 10:32:43 +08:00

test_ai_automation_smoke_service.py

加入 AI Smoke 每日摘要推播

2026-04-29 23:57:36 +08:00

test_ai_call_logger.py

feat(observability): ai_call_logger + 23:55 Telegram token 日報

2026-05-03 23:04:58 +08:00

test_ai_history_service.py

feat: EwoooC 初始化 — 完整專案推版至 Gitea

2026-04-19 01:21:13 +08:00

test_ai_insight_embedding_bridge.py

加入告警去重與洞察向量回補

2026-04-29 23:10:27 +08:00

test_anthropic_service.py

feat(p7): Anthropic SDK + Claude Opus 4.7 接 Code Review (feature flag OFF)

2026-05-03 23:31:30 +08:00

test_app_startup_contracts.py

test(app): 鎖定啟動自檢與模板契約

2026-04-30 10:12:43 +08:00

test_auto_heal_safety.py

補齊自癒稽核與 OpenClaw 記憶閉環

2026-04-29 23:02:06 +08:00

test_cache_manager.py

fix(dashboard): prewarm cache and expose pick evidence

2026-05-01 16:34:13 +08:00

test_caller_registry.py

test(p19): 補 Phase 14/15/16/17 unit test — 27 tests 全綠

2026-05-04 10:27:35 +08:00

test_cd_health_check.py

fix(runtime): 強化健康檢查監控韌性

2026-05-01 14:46:49 +08:00

test_code_review_claude_routing.py

feat(p7): Anthropic SDK + Claude Opus 4.7 接 Code Review (feature flag OFF)

2026-05-03 23:31:30 +08:00

test_code_review_pipeline_security.py

feat(code-review): ADR-020 全自動修復政策 — 拆掉 CRITICAL/HIGH HITL 閘門

2026-05-02 23:44:01 +08:00

test_competitor_match_attempts_persistence.py

feat(competitor): persist match attempts

2026-05-01 20:56:17 +08:00

test_database_manager_cache.py

fix(db): 補齊 action_plans schema drift

2026-04-30 14:45:40 +08:00

test_deepseek_service.py

test(p19): 補 Phase 14/15/16/17 unit test — 27 tests 全綠

2026-05-04 10:27:35 +08:00

test_docker_compose_runtime_mounts.py

fix(frontend): 掛載 Flask web static assets

2026-04-30 23:53:23 +08:00

test_edm_dashboard_template.py

fix(edm): 修正活動看板排序 endpoint

2026-04-30 14:29:40 +08:00

test_elephant_alpha_engine.py

fix(ai): 價格調整轉人工覆核

2026-05-01 14:09:54 +08:00

test_elephant_service.py

fix(ai): 擴大 ElephantAlpha 暫時性 fallback

2026-04-30 13:59:12 +08:00

test_email_content.py

feat: EwoooC 初始化 — 完整專案推版至 Gitea

2026-04-19 01:21:13 +08:00

test_email_send.py

feat: EwoooC 初始化 — 完整專案推版至 Gitea

2026-04-19 01:21:13 +08:00

test_event_router.py

補齊 EventRouter 失敗通知回放

2026-04-29 23:26:02 +08:00

test_excel_columns.py

feat: EwoooC 初始化 — 完整專案推版至 Gitea

2026-04-19 01:21:13 +08:00

test_feedback_quality_tracker.py

feat(p25): 反饋環深化 — caller-level quality 趨勢追蹤 + ROI 月報整合

2026-05-04 11:12:52 +08:00

test_file_upload.py

style(ppt): align PPT palette perfectly with MOMO Pro v2 design tokens (Beige, Warm Ink, Caramel Orange) as per frontend upgrade roadmap

2026-05-02 15:01:55 +08:00

test_frontend_v2_assets.py

feat(reports): move monthly analysis to v2 shell

2026-05-01 21:13:18 +08:00

test_full_import.py

修復 P0 告警自癒鏈與測試收集

2026-04-29 22:37:20 +08:00

test_google_drive_auth.py

chore(cleanup): 移除 legacy 5888 測試入口

2026-04-30 14:12:21 +08:00

test_google_drive.py

chore(cleanup): 移除 legacy 5888 測試入口

2026-04-30 14:12:21 +08:00

test_grafana_ai_automation_dashboard.py

新增 AI 自動化 Grafana 儀表板

2026-04-30 00:06:24 +08:00

test_gunicorn_config.py

fix(dashboard): prewarm cache and expose pick evidence

2026-05-01 16:34:13 +08:00

test_image_fetch.py

feat: EwoooC 初始化 — 完整專案推版至 Gitea

2026-04-19 01:21:13 +08:00

test_imap_to_smtp.py

style(ppt): align PPT palette perfectly with MOMO Pro v2 design tokens (Beige, Warm Ink, Caramel Orange) as per frontend upgrade roadmap

2026-05-02 15:01:55 +08:00

test_import_logic.py

修復 P0 告警自癒鏈與測試收集

2026-04-29 22:37:20 +08:00

test_learning_pipeline.py

feat(p11.5): learning_episodes embedding 寫入 — 解鎖 Stage 3 dedup

2026-05-04 09:16:39 +08:00

test_llm_model_router.py

feat(p21): Caller × Context 動態 Model Router + ADR-034

2026-05-04 10:54:12 +08:00

test_low_quality_response_v2.py

test(p19): 補 Phase 14/15/16/17 unit test — 27 tests 全綠

2026-05-04 10:27:35 +08:00

test_mcp_router.py

feat(p10.5): MCP Router 統一介面 + mcp_collector 接 omnisearch L0

2026-05-04 09:34:21 +08:00

test_modularization_governance.py

docs(modularization): 建立模組化治理守門

2026-04-30 14:07:10 +08:00

test_momo_url_utils.py

fix(momo): block EC404 auto-open with end-to-end URL guard

2026-05-02 12:00:34 +08:00

test_ms1_pchome.py

feat: EwoooC 初始化 — 完整專案推版至 Gitea

2026-04-19 01:21:13 +08:00

test_nemotron_fallback.py

補強 AI 自動化閉環與安全降級

2026-04-29 22:56:00 +08:00

test_nemotron_qwen3_compat.py

feat(p1+p3): logger 接 13 caller + Q&A/Nemotron/日報 feature flag 灰度

2026-05-03 23:05:38 +08:00

test_notification_samples.py

feat: EwoooC 初始化 — 完整專案推版至 Gitea

2026-04-19 01:21:13 +08:00

test_ollama_embedding.py

fix(ai): 遷移 Ollama embedding 至 api embed

2026-04-30 10:24:15 +08:00

test_ollama_resolve.py

fix(adr-027): Phase 2 — ADR-027 4 破洞修補 + 移除寫死 111

2026-05-03 23:05:11 +08:00

test_ollama_retry_chain.py

feat(p13): OllamaResponse token 補欄 + COST_TABLE 補新模型 + retry 鏈 unit test

2026-05-04 10:07:33 +08:00

test_openclaw_bot_menu_keyboards.py

fix(telegram): dedupe webhook+polling updates via shared DB guard

2026-05-02 12:01:04 +08:00

test_openclaw_bot_routes_webhook.py

test(openclaw): assert /menu returns full main menu keyboard

2026-05-02 16:13:43 +08:00

test_openclaw_bot_telegram_api.py

fix(telegram): dedupe webhook+polling updates via shared DB guard

2026-05-02 12:01:04 +08:00

test_openclaw_daily_template.py

test(p3): 配合 OPENCLAW_DAILY_HERMES_TEMPLATE 預設翻 ON 更新 assertion

2026-05-03 23:30:47 +08:00

test_openclaw_qa_golden_set.py

feat(p1+p3): logger 接 13 caller + Q&A/Nemotron/日報 feature flag 灰度

2026-05-03 23:05:38 +08:00

test_openclaw_qa_routing.py

feat(p1+p3): logger 接 13 caller + Q&A/Nemotron/日報 feature flag 灰度

2026-05-03 23:05:38 +08:00

test_path_traversal.py

style(ppt): align PPT palette perfectly with MOMO Pro v2 design tokens (Beige, Warm Ink, Caramel Orange) as per frontend upgrade roadmap

2026-05-02 15:01:55 +08:00

test_pchome_smtp.py

style(ppt): align PPT palette perfectly with MOMO Pro v2 design tokens (Beige, Warm Ink, Caramel Orange) as per frontend upgrade roadmap

2026-05-02 15:01:55 +08:00

test_pg_sync.py

修復 P0 告警自癒鏈與測試收集

2026-04-29 22:37:20 +08:00

test_phase3f_cleanup_contracts.py

fix(runtime): 強化健康檢查監控韌性

2026-05-01 14:46:49 +08:00

test_ppt_vision_audit.py

test(p26): 修 libreoffice not installed test patch path

2026-05-04 11:16:30 +08:00

test_ppt_vision_service.py

test(p19): 補 Phase 14/15/16/17 unit test — 27 tests 全綠

2026-05-04 10:27:35 +08:00

test_prometheus_ai_automation_scrape.py

fix(runtime): 強化健康檢查監控韌性

2026-05-01 14:46:49 +08:00

test_promo_persistence_contract.py

fix(campaign): persist full crawl snapshots

2026-05-01 20:48:28 +08:00

test_promotion_gate.py

feat(p11): RAG 自主學習 + Promotion Gate 4 階段護欄（feature flag OFF）

2026-05-03 23:56:12 +08:00

test_rag_service.py

feat(p11): RAG 自主學習 + Promotion Gate 4 階段護欄（feature flag OFF）

2026-05-03 23:56:12 +08:00

test_real_excel.py

feat: EwoooC 初始化 — 完整專案推版至 Gitea

2026-04-19 01:21:13 +08:00

test_roi_report_service.py

feat(p24): ROI 月報生成器 — 每月 1 日 09:00 推 Telegram

2026-05-04 11:04:14 +08:00

test_sql_security.py

style(ppt): align PPT palette perfectly with MOMO Pro v2 design tokens (Beige, Warm Ink, Caramel Orange) as per frontend upgrade roadmap

2026-05-02 15:01:55 +08:00

test_telegram_update_guard.py

fix(telegram): dedupe webhook+polling updates via shared DB guard

2026-05-02 12:01:04 +08:00

test_token_report_service.py

feat(observability): ai_call_logger + 23:55 Telegram token 日報

2026-05-03 23:04:58 +08:00

test_trend_telegram_bot_service.py

Fix OpenClaw callback command path from NL dispatch regression

2026-05-02 15:59:54 +08:00

test_vendor_email.py

feat: EwoooC 初始化 — 完整專案推版至 Gitea

2026-04-19 01:21:13 +08:00