103 lines
3.1 KiB
YAML
103 lines
3.1 KiB
YAML
version: 1
|
||
id: nfr
|
||
title: Non-Functional Requirements
|
||
sources:
|
||
project_md:
|
||
path: openspec/project.md
|
||
lines: "67-70"
|
||
middleware:
|
||
- api/middlewares/index.ts
|
||
database:
|
||
- api/database/index.ts
|
||
|
||
security:
|
||
password_handling:
|
||
status: not_compliant
|
||
current_state:
|
||
storage: "明文存储在 users.password（SQLite）"
|
||
transmission: "前后端请求体中直接传输 password 字段"
|
||
evidence:
|
||
- api/models/user.ts:18
|
||
- api/controllers/userController.ts:81
|
||
- openspec/project.md:69
|
||
required_state:
|
||
storage: "使用强哈希算法存储（例如 bcrypt/scrypt/argon2），不存明文"
|
||
transmission: "避免回传密码；日志与导出不得包含敏感字段"
|
||
constraints:
|
||
- "当前实现未满足 required_state，属于待整改项"
|
||
|
||
admin_authentication:
|
||
status: not_compliant
|
||
current_state:
|
||
admin_login_token: "固定值 admin-token"
|
||
route_guard: "adminAuth 中间件放行"
|
||
evidence:
|
||
- api/controllers/adminController.ts:1
|
||
- api/middlewares/index.ts:57
|
||
- openspec/project.md:68
|
||
required_state:
|
||
token_validation: "生产环境需实现真实鉴权（例如 JWT 校验）并在前后端一致落地"
|
||
constraints:
|
||
- "当前管理接口在后端层面不具备访问控制"
|
||
|
||
logging_sensitivity:
|
||
status: partial
|
||
current_state:
|
||
request_logging: "记录 method/path/statusCode/duration"
|
||
evidence:
|
||
- api/middlewares/index.ts:65
|
||
constraints:
|
||
- "应避免在日志中输出密码、token、导出数据等敏感信息（当前需持续自查）"
|
||
|
||
reliability:
|
||
database_initialization:
|
||
status: implemented
|
||
behavior: "仅当 users 表不存在时执行 init.sql"
|
||
evidence:
|
||
- api/database/index.ts:109
|
||
constraints:
|
||
- "若数据库存在但缺少部分表/列（例如用户组、selection_config），当前不会自动迁移"
|
||
|
||
performance:
|
||
limits:
|
||
request_body_max_bytes:
|
||
status: implemented
|
||
value: 10485760
|
||
evidence:
|
||
- api/server.ts:30
|
||
upload_max_bytes:
|
||
status: implemented
|
||
value: 10485760
|
||
evidence:
|
||
- api/middlewares/index.ts:7
|
||
database_characteristics:
|
||
status: implemented
|
||
notes: "SQLite 适合单机/轻量；并发与事务能力有限。"
|
||
evidence:
|
||
- openspec/project.md:70
|
||
|
||
compliance:
|
||
data_minimization:
|
||
status: partial
|
||
stored_personal_data:
|
||
- field: users.name
|
||
- field: users.phone
|
||
constraints:
|
||
- "当前未见用户数据保留期限/删除流程的实现"
|
||
gdpr_like_rights:
|
||
status: not_implemented
|
||
requirements:
|
||
- "数据导出：提供用户个人数据导出能力（当前仅管理员数据导出，且范围为业务数据）"
|
||
- "数据删除：支持按合规要求删除用户数据并处理关联记录"
|
||
constraints:
|
||
- "以上为合规目标要求；当前代码中未实现对应流程"
|
||
|
||
operability:
|
||
configuration:
|
||
status: implemented
|
||
mechanism: "dotenv + system_configs 表"
|
||
evidence:
|
||
- openspec/project.md:25
|
||
- api/models/systemConfig.ts:1
|
||
|