[site-finder] EPIC 18: Безопасность: роль «аналитик», ACL инсайдов/сделок, аудит-лог #962

New issue

Closed

opened 2026-06-02 16:32:56 +00:00 by Light1YT · 1 comment

Light1YT commented 2026-06-02 16:32:56 +00:00

Owner

Copy link

Часть #944 (Site Finder v2 / ТЗ ГенГеныч).

Статус: EXTEND · Приоритет: P1 · ТЗ §19

Scope

Расширить RBAC (core/auth.py, roles.yaml) ролью analyst; ACL инсайдов/сделок (§7.13, §19); аудит запросов+отчётов + gate чувствительного экспорта. Caddy/secrets → devops.

Зависимости: EPIC4
Уже есть (EXTEND): core/auth.py, auth/roles.yaml, Caddyfile

**Часть #944 (Site Finder v2 / ТЗ ГенГеныч).** Статус: **EXTEND** · Приоритет: **P1** · ТЗ §19 ## Scope Расширить RBAC (core/auth.py, roles.yaml) ролью analyst; ACL инсайдов/сделок (§7.13, §19); аудит запросов+отчётов + gate чувствительного экспорта. Caddy/secrets → devops. **Зависимости:** EPIC4 **Уже есть (EXTEND):** core/auth.py, auth/roles.yaml, Caddyfile

Light1YT added the

GG-форсайт

site-finder

labels 2026-06-02 16:32:56 +00:00

Light1YT referenced this issue 2026-06-02 16:34:02 +00:00

🔮 [EPIC][site-finder] Site Finder v2 — ИИ-прогноз продуктовой стратегии (ТЗ ГенГеныч) #944

lekss361 added this to the Site Finder v2 — Foresight (GG-форсайт) milestone 2026-06-02 19:02:40 +00:00

bot-backend referenced this issue from a commit 2026-06-08 07:16:23 +00:00

feat(rbac): add analyst role + §19 audit-log middleware (#962)

bot-backend referenced this issue 2026-06-08 07:16:50 +00:00

feat(rbac): analyst role + §19 audit-log middleware (#962) #1163

bot-backend referenced this issue 2026-06-08 07:42:14 +00:00

feat(insights): manual-entry Insight entity CRUD + §19 audit (#948 part A) #1164

bot-backend referenced this issue 2026-06-08 10:22:46 +00:00

[site-finder] EPIC 4: Сущность «Инсайт» (ручная, ACL) + «Локация» как первый класс #948

bot-backend commented 2026-06-08 10:28:33 +00:00

Collaborator

Copy link

Закрыто после мега-детального defensive-correctness аудита (deep-code-reviewer; первый прогон триггернул cyber-safeguard на offensive-формулировке → переспавнен с оборонной) — verdict CLEAN.

DoD §19 (backend-скоуп) покрыт:

• роль analyst в core/auth.py + roles.yaml (+ tradein mirror), deny-overrides-allow.
• ACL: backend hard-gate /api/v1/admin/*; pilot/analyst non-admin скоупинг — frontend RouteGuard (документированный split). created_by инсайта неспуфится (server-side из X-Authenticated-User).
• §19 audit-log: middleware INNER к rbac_guard (аудитятся только авторизованные), best-effort (сбой не ломает запрос), параметризованный SQL, CHECK-словарь = classify_path. Миграция 145 — load-bearing фикс CHECK для insight_write.

70 тестов passed, findings только minor/informational. Trust-boundary: бэк полагается на Caddy overwrite X-Authenticated-User — корректно при текущем compose (бэк недостижим мимо Caddy).

Follow-up (devops, вне backend-скоупа #962 — DoD item 4): добавить analysttest / реальные analyst-логины в caddy/users.caddy.snippet (bcrypt) + E2E-смоук analyst. До этого analyst-путь только unit-tested. Нужны креды.

Закрыто после мега-детального defensive-correctness аудита (deep-code-reviewer; первый прогон триггернул cyber-safeguard на offensive-формулировке → переспавнен с оборонной) — verdict **CLEAN**. **DoD §19 (backend-скоуп) покрыт:** - роль `analyst` в `core/auth.py` + `roles.yaml` (+ tradein mirror), deny-overrides-allow. - ACL: backend hard-gate `/api/v1/admin/*`; pilot/analyst non-admin скоупинг — frontend `RouteGuard` (документированный split). `created_by` инсайта неспуфится (server-side из `X-Authenticated-User`). - §19 audit-log: middleware **INNER** к rbac_guard (аудитятся только авторизованные), best-effort (сбой не ломает запрос), параметризованный SQL, CHECK-словарь = `classify_path`. Миграция **145** — load-bearing фикс CHECK для `insight_write`. **70 тестов passed**, findings только minor/informational. Trust-boundary: бэк полагается на Caddy overwrite `X-Authenticated-User` — корректно при текущем compose (бэк недостижим мимо Caddy). **Follow-up (devops, вне backend-скоупа #962 — DoD item 4):** добавить `analysttest` / реальные analyst-логины в `caddy/users.caddy.snippet` (bcrypt) + E2E-смоук analyst. До этого analyst-путь только unit-tested. Нужны креды.

bot-backend closed this issue 2026-06-08 10:28:34 +00:00

bot-backend referenced this issue 2026-06-13 04:49:48 +00:00

[Fable 5][P3] UserMenu: роль analyst (есть в backend с #962) отображается бейджем «Пилот» #1237

bot-backend referenced this issue 2026-06-13 11:34:43 +00:00

🔮 [EPIC][site-finder] Site Finder v2 — ИИ-прогноз продуктовой стратегии (ТЗ ГенГеныч) #944

bot-backend referenced this issue 2026-06-13 12:31:21 +00:00

🔮 [EPIC][site-finder] Site Finder v2 — ИИ-прогноз продуктовой стратегии (ТЗ ГенГеныч) #944

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

fix/2013-avito-cohort-null

fix/rbac-test-user2-expired

fix/expire-brusnika-trial-access

feat/tradein-domclick-house-sku-schema

chore/design-sync-tradein

fix/tradein-deploy-scraper-paths-filter

fix/tradein-no-numberless-house-insert

fix/tradein-dedup-fias-pass-no-geoguard

feat/tradein-fias-estimate-frontend

fix/tradein-dedup-by-fias

feat/tradein-fias-tier-matching

fix/tradein-v2-uiux-p1

fix/objective-lots-dedup-1964

fix/audit-followups-1953

feat/concept-house-picker-1965-stage3b

feat/concept-house-catalog-1965-stage3a

feat/concept-live-massing-1965-stage2b

feat/concept-recompute-1965-stage2a

feat/concept-section-1965-stage1

fix/best-layouts-per-object-snapshot-1956

fix/deficit-segmentation-1959

feat/tradein-hedonic-ground-floor

fix/report-map-points-1961

fix/report-microcopy-1963

fix/report-nspd-zoning-1962

fix/report-frontend-display-1953

perf/tradein-estimate-audit

perf/best-layouts-objects-first

fix/171-migration-path

perf/171-objective-crm-report-month-idx

fix/1926-app-log-stdout

fix/estimator-tiebreaker-nanalogs

fix/1917-fetch-json-network-retry

fix/1926-scrape-runs-total-seen

fix/1781-house-fk-source-identity

feat/39-osrm-per-category

feat/1746-utility-infra-map

fix/test-849-savepoint-count

fix/parking-economics-by-class

fix/zouit-engineering-area-gate

fix/zoning-resolution-decouple

feat/dcf-velocity-schedule

feat/zone-regulation-backfill

chore/mock-financial-estimate

fix/finmodel-split-disclosure-threshold

feat/finmodel-financing

feat/finmodel-sitefinder-bridge

feat/finmodel-dcf

feat/finmodel-price-calibration

feat/finmodel-cost-cascade

audit/1871-p2-estimator-dedup-split

audit/1871-p2-avito-coord

audit/1871-p3-uiux

audit/1871-p2-invest-moi

audit/1871-p2-velocity-market

audit/1871-p1-3-isreal-stubs

audit/1871-p1-2-ghost-anchor-guard

audit/1871-p1-scenarios-collapse

revert/site-finder-v2

fix/v2-remove-resource-legend

fix/v2-map-legend-position

feat/site-finder-v2-map-light-polish

rollback/site-finder-home-light

feat/site-finder-v2-cockpit

rollback/sf-old-analysis-design

feat/ptica-tabs-6-6-reports-params

fix/ptica-vri-row

feat/ptica-map-glyphs-sitefinder-dark

fix/ptica-3d-preview-product-verdict

fix/ptica-button-fontsize

fix/ptica-parity-data-mapping

chore/ptica-iso-preview-spin

fix/ptica-inter-map-product

fix/ptica-visual-parity

fix/ptica-left-rail

feat/ptica-cockpit-complete-bottom

feat/ptica-default-and-rich-map

feat/ptica-real-ksit-frontend

feat/tradein-ekb-geoportal-buildings

fix/sf-feedback-batch

feat/avito-newbuilding-sweep

feat/browser-concurrent-pool

fix/backfill-kadastr-column

fix/avito-proactive-ip-rotate

feat/activate-domclick-sweep

feat/avito-newbuilding-capture

fix/house-id-fk-realtime-link

fix/migration-162-table-if-exists

feat/riasurt-sverdl-layers-108

fix/sber-dataset-paths-902

fix/conflict-resolution-freshness-1539

feat/objective-lots-history-writer-307-obj6

feat/velocity-mv-61

fix/objective-mapping-is-reviewed-gate-307-obj2

fix/cian-detail-rich-fields

fix/avito-novostroyki-segment

feat/yandex-novostroyki-newflat

fix/ci-dedup-runner-storm-1709

fix/emiss-pk-granularity-1687

feat/listings-segment-param-1188

fix/inn-regex-word-boundary-1682

fix/excel-deficit-horizon-1590

fix/admin-scrape-validation

fix/admin-leads-interval-cast-1694

fix/dkp-corridor-doc-p10p90-1695

fix/weather-wind-d-allnone

test/residential-zone-rawprops-1681

fix/domrf-badge-regex-narrow-1686

feat/yandex-camoufox-transport

fix/score-sat-factor-1509

fix/base-pace-room-bucket-1593

fix/gate-verdict-no-blocker-1617

fix/confidence-deal-count-window-1637

fix/match-economics-1511-1512

fix/listings-partial-indexes-1398

fix/smart-suggestions-threshold-1503

fix/dkp-corridor-percentile-1520

fix/enrich-economics-window-1513

fix/leads-stats-window-1383

fix/poi-score-scale-1486

fix/geo-weight-floor-1633

fix/inn-regex-context-1640

fix/domrf-status-classify-1609

fix/emiss-period-dedup-1606

fix/cian-paginate-tail-1393

fix/normalize-zero-fill-guard-1638

fix/supply-view-devgroup-key-1650

fix/residential-zone-detect-1353

fix/score-label-threshold-1357

fix/trend-ratio-vprior-zero-1508

fix/district-median-dedup-1352

fix/supply-layers-overlap-1355

fix/pdf-expires-at-1530

fix/quartirography-area-bucket-1406

fix/cad-zones-multipolygon-1344

fix/sold-pct-market-verdict-1407

fix/week-review-finish

fix/week-review-backend-v2

feat/plan-vectorization-spike-299

fix/1668-analyze-confidence

fix/1667-metro-block

fix/1666-layout-velocity-beat

chore/remove-n1-scraper

fix/cian-kitchen-area

feat/yandex-detail-backfill

feat/avito-detail-backfill

fix/best-layouts-bucket-normalization

fix/gknspecial-incremental-commit-per-prefix

fix/okn-objects-full-registry-load

fix/parcel-ird-overlap-except-expand

fix/report-assembler-confounded-keys

fix/job-settings-json-persist-v2

fix/nspd-geo-soft-time-limit-passthrough

fix/nspd-soft-time-limit-v2

fix/pilot-request-modal-validation

fix/recommend-mix-saturation-latest-snapshot

fix/scrape-cadastre-fail-counter-v2

fix/izyatie-ocr-cad-normalize

fix/job-settings-panel-json-state-persist

fix/noise-loader-savepoint-per-row

fix/objective-sync-config-bare-except

fix/parcel-snapshot-mdash-double-escape

fix/poi-loader-leap-year-date-replace

fix/scrape-cadastre-permanent-fail-counter

fix/usermenu-analyst-role-label

feat/location-948b-r

feat/location-entity-948b

feat/insight-entity-948a

feat/analyst-role-audit-962

feat/cbr-inflation-macro-946

feat/cian-zhk-resolve-972

perf/forecast-parallel-horizons-1129

feat/newbuilding-enrich-backfill-972

feat/emiss-macro-indicators-946

feat/rosstat-emiss-macro-946

ci/frontend-vitest-job

chore/frontend-vitest-wkt-tests

feat/forecast-meta-footer

feat/forecast-future-supply-competitors

feat/forecast-docx-pptx-buttons

feat/forecast-scoring-panel

feat/forecast-product-tz-block

feat/market-map-layers-999

feat/forecast-chart-section6

feat/forecast-export-pptx-959

feat/forecast-export-docx-959

feat/forecast-export-ui-959

feat/forecast-export-telegram-959

feat/forecast-export-md-959

feat/analyze-response-contract-961

feat/competitor-velocity-spatial-fallback-968

fix/frontend-healthcheck-hostname

feat/analyze-market-coords-999

fix/site-finder-entry-crash-1001

feat/horizon-selector-996

feat/forecast-section-998

feat/forecast-endpoint-horizon-enqueue

feat/forecast-celery-task-persist

feat/forecast-orchestrator-service

feat/demand-supply-months-of-inventory

feat/wire-district-resolver

feat/district-vocab-reconciliation

fix/affordability-market-spread

fix/backtest-sig-gate

feat/wire-978-almon-rate-regime

feat/backtest-oos-almon-seasonal

ci/forgejo-pytest-gate

fix/tradein-praktika-logo-form-scroll

feat/yandex-exhaustive-price-room

feat/794-sber-time-adjust

chore/bot-harness-tuning

docs/agent-usage-throttle-qa-terminal

fix/avito-sweep-single-run-guard

chore/analyst-inbound-queue-tradein-db

feat/801-preview-full-wt

chore/bot-safety-followups

feat/tradein-avito-imv-fix

feat/tradein-repair-coef-calibration

feat/tradein-avito-houses-fix

feat/tradein-address-precision

feat/tradein-backfill-prioritize-listings

feat/tradein-geocode-deals-nominatim

feat/tradein-geocode-deals-from-houses

feat/tradein-same-building-match

feat/claude-envvars-and-stale-cron

No results found.

Labels

Clear labels   

admin

Admin UI / internal tools / pipeline tracker

  

analytics

Аналитика данных / matching

  

auth

Authentication / authorization / multi-tenancy

  

automation

Автоматизация / cron / scheduler

  

bug

Something isn't working

  

business

Коммерческая воронка / пилоты / pipeline / реестр ПО

  

chore

Operational housekeeping

  

ci

Forgejo Actions / build pipeline

  

compliance

152-ФЗ / реестр ПО / legal / TOS

  

data

Data sources, parsers, ETL

  

data-moat

Уникальные данные — sales tracker, CRM aggregation

  

docs

README / runbooks / onboarding

  

duplicate

This issue or pull request already exists

  

dx

Developer experience / build speed

  

enhancement

New feature or request

  

Fable 5 ревью

Находки полного мульти-агентного ревью (Claude Fable 5, 2026-06-09)

  

feedback/max

Feedback from Max (Senior partner)

  

generative

Generative Design — concept generation engine

  

GG-форсайт

Новое ТЗ от Ген Геныча (июнь 2026): Site Finder v2 — ИИ-прогноз продуктовой стратегии девелопера. Актуальный приоритет.

  

needs-discussion

Pending team sync / decision

  

needs-human

Human review/decision required

  

observability

Monitoring / metrics / logs / Sentry / Uptime

  

pause-bots

Kill-switch — all autonomous bots pause

  

performance

Latency / throughput / DB query tuning

  

priority/p0

Critical / production-blocker

  

priority/p1

High priority

  

priority/p2

Normal priority

  

priority/p3

Низкий приоритет (follow-up, tech-debt)

  

scope/backend

Backend Python — FastAPI, Celery, scrapers

  

scope/db

DB migrations, indexes, SQL

  

scope/devops

docker-compose, Caddy, workflows

  

scope/frontend

Frontend — Next.js, React, TypeScript

  

scope/qa

Tests, smoke, Playwright

  

scrapers

Скрапперы (Avito/Cian/Yandex/Rosreestr)

  

security

Security audit / secrets / vulnerabilities

  

site-finder

Site Finder scoring quality & data layer

  

stage/1

Stage 1: Generative MVP (нед 2-7)

  

stage/2

Stage 2: Site Finder MVP (нед 8-12)

  

status/blocked

Blocked — needs human intervention

  

status/done

Closed, completed

  

status/needs-analysis

Raw/fuzzy task filed by human — auto-analyst подхватывает: code-archeology + декомпозиция в actionable scope/* + status/ready (или split на под-issues)

  

status/needs-fix

Reviewer/QA вернул worker на доработку — worker сам чинит свой PR (fixup), НЕ требует human (в отличие от status/blocked)

  

status/qa

PR merged, awaiting smoke test

  

status/ready

Ready for pickup by worker bot

  

status/review

PR open, awaiting code review

  

status/wip

Work in progress (worker claimed)

  

tech-debt

Технический долг

  

tradein

Trade-In MVP проект

  

ux

User experience / responsive / conversion

  

week ревью 1

Week review 1 — находки multi-agent аудита проекта (2026-06-14)

  

wontfix

This will not be worked on

  

вторичка

Trade-In Estimator — проект оценки вторичного жилья

  

ИРД

Исходно-разрешительная документация — слой ограничений участка для analyze-таблицы

No labels

admin

analytics

auth

automation

bug

business

chore

ci

compliance

data

data-moat

docs

duplicate

dx

enhancement

Fable 5 ревью

feedback/max

generative

GG-форсайт

needs-discussion

needs-human

observability

pause-bots

performance

priority/p0

priority/p1

priority/p2

priority/p3

scope/backend

scope/db

scope/devops

scope/frontend

scope/qa

scrapers

security

site-finder

stage/1

stage/2

status/blocked

status/done

status/needs-analysis

status/needs-fix

status/qa

status/ready

status/review

status/wip

tech-debt

tradein

ux

week ревью 1

wontfix

вторичка

ИРД

Milestone

Clear milestone

No items

No milestone

Site Finder v2 — Foresight (GG-форсайт)

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: lekss361/gendesign#962

No description provided.