7 commits

Author	SHA1	Message	Date
bot-backend	a9dfe44f5c	fix(tradein/auth): always-available logout button on NoAccessScreen ... Locked/no-access users (403/denied path/expired session/trial ended) were trapped: NoAccessScreen had no logout control, and «Выйти» lived only inside UserMenu, which does not render on the no-access screen. They could not switch accounts without clearing browser basic-auth manually. - Extract logout() into shared `lib/logout.ts` (single source of truth). - UserMenu now imports it instead of a local copy (behaviour unchanged). - NoAccessScreen renders an always-available «Выйти» accent button for every variant. Mirrored across both frontends (tradein-mvp/frontend + main frontend) to keep the MIRROR invariant in sync.	2026-06-27 15:16:42 +03:00
Light1YT	249182b678	fix(week-review): дожим ревью — #1569, #1590, #1642 + feat #801 MSW-preview ... Финиш-волна по cross-file/partial остаткам аудита + a11y-харнесс. Полностью (4): #1569 alembic регистрирует все ORM-модели (+убран фантомный Parcel) · #1590 «Индекс дефицита» больше не лжёт на fallback-горизонте (report_pdf+report_md) · #1642 thumbs mtime-freshness (нет устаревшей миниатюры) · #801 /__preview/estimate mock-render для axe/lighthouse (env-gated bypass). Частично (остаток cross-file/домен, открыты): #1593 #1635 #1640. needs-leha (открыт): #1650 (нужна новая миграция вьюхи supply-слоёв). Verify: tsc --noEmit 0; py_compile OK. Closes #1569 Closes #1590 Closes #1642 Closes #801	2026-06-17 11:24:34 +05:00
Light1YT	86e9ea2937	fix(week-review): автофиксы код-ревью — 169 issue (label «week ревью 1») ... Многоагентный аудит + имплементация: один воркер на файл, точечные правки. Верификация: py_compile (47/47 .py) + tsc --noEmit (0 ошибок). Unit-тесты не прогонялись (окружение не поднято: rollup native dep / нет pytest-venv). Полностью исправлено (169): #1336, #1337, #1339, #1340, #1341, #1342, #1343, #1345, #1346, #1348, #1349, #1350, #1351, #1354, #1356, #1358, #1359, #1360, #1362, #1364, #1365, #1366, #1367, #1368, #1369, #1370, #1371, #1372, #1373, #1374, #1375, #1376, #1377, #1378, #1379, #1380, #1381, #1382, #1384, #1385, #1386, #1387, #1388, #1389, #1390, #1391, #1392, #1394, #1395, #1396, #1397, #1399, #1400, #1401, #1402, #1403, #1404, #1408, #1409, #1410, #1411, #1412, #1413, #1414, #1415, #1416, #1417, #1418, #1420, #1423, #1425, #1426, #1427, #1428, #1429, #1430, #1431, #1432, #1433, #1434, #1435, #1437, #1438, #1439, #1440, #1441, #1442, #1443, #1444, #1445, #1446, #1447, #1448, #1449, #1450, #1451, #1452, #1453, #1454, #1455, #1456, #1457, #1458, #1459, #1460, #1461, #1462, #1463, #1464, #1465, #1466, #1467, #1468, #1469, #1471, #1472, #1473, #1474, #1476, #1478, #1479, #1481, #1482, #1483, #1484, #1485, #1487, #1488, #1489, #1490, #1491, #1492, #1493, #1494, #1495, #1496, #1497, #1499, #1500, #1501, #1502, #1504, #1505, #1506, #1507, #1510, #1514, #1515, #1516, #1517, #1518, #1519, #1521, #1522, #1523, #1524, #1525, #1526, #1527, #1528, #1529, #1531, #1532, #1533, #1534, #1535, #1536, #1537, #1538 Частично (9, in-file часть, остаток cross-file): #1361, #1419, #1422, #1424, #1470, #1475, #1477, #1480, #1498 Требуют cross-file (3, не тронуты): #1338, #1363, #1421 Пропущено (1): #1539 Не входило в партию: 22 needs-Leha issue (нужны решения владельца). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-15 20:21:11 +05:00
Light1YT	d8a2ad7854	fix(auth): отобразить роль analyst в UserMenu, расширить Role union в useMe (#1237)	2026-06-13 15:03:15 +05:00
bot-frontend	654ce7b6c8	fix(frontend): pilot-only юзер → auto-redirect на /trade-in/ вместо «Доступа нет» ... RouteGuard: при denied path главного фронта (корень / и пр.) если у роли единственная рабочая зона — trade-in (isPathAllowed(/trade-in/)=true) → window.location.replace('/trade-in/') вместо дед-энда NoAccessScreen. Guard от петли: не редиректить если путь уже под /trade-in. admin/multi-scope с разрешённым / не затронуты. Вариант 2 из issue (без Caddy/backend). Refs #799	2026-05-30 21:18:19 +03:00
Light1YT	56a7a36c9a	feat(auth): UserMenu — личный кабинет top-right (PR D) (#590)	2026-05-26 10:48:57 +00:00
Light1YT	7a2b055b35	feat(rbac): frontend route-guard + nav filter (#586) ... PR B (frontend) to backend RBAC #585. RouteGuard wraps app, NoAccessScreen on 403 from /me, TopNav filtered by role.	2026-05-26 06:51:45 +00:00