02b81f0113
Security (fail-secure for production): - Refuse to start without PPM_PASSWORD/PPM_PASSWORD_HASH unless PPM_ALLOW_NO_AUTH=1 (local dev only) - Add login rate limiting (5 failures / 60s per client), enforced inside SessionManager.login so it cannot be bypassed at the endpoint layer - compose defaults PPM_COOKIE_SECURE=true for HTTPS behind reverse proxy - Add .dockerignore to keep runtime data/out of the image Features: - Task timeline gantt on home page (week/month zoom, horizontal scroll, infinite-arrow for open-ended dates, CSS Grid layout) - Duration metrics gain a second/minute/hour unit for input & display (canonical storage stays integer seconds) - Per-metric progress bars on home page (no more merged average) - Backfill historical records via date picker in the today-record card - Admin panel: stats overview, JSON import/restore, full task list mgmt Fixes: - Nullable task startDate; summarize handles missing start date - Task dialog cancel/close no longer submits the form - Import validates whole backup first, rejects path traversal, rebuilds archives, and replaces stale files Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
19 lines
249 B
Plaintext
19 lines
249 B
Plaintext
# 运行数据不入镜像（compose 用命名卷挂载到 /app/data）
|
||
data/*
|
||
!data/.gitkeep
|
||
|
||
# 开发与版本控制产物
|
||
.git
|
||
.gitignore
|
||
.env
|
||
__pycache__/
|
||
*.pyc
|
||
.pytest_cache/
|
||
.venv/
|
||
|
||
# 测试与文档
|
||
tests/
|
||
需求记录.md
|
||
README.md
|
||
start.bat
|