From 4a54087070d7e26da3766e295e59d57a8fe8a651 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=B5=85=E5=BF=B5?= Date: Fri, 18 Sep 2026 20:14:53 +0800 Subject: [PATCH] =?UTF-8?q?docs:=20T6=E6=96=87=E4=BB=B6=E6=B8=85=E5=8D=95?= =?UTF-8?q?=E8=A1=A5server=E6=97=B6=E9=97=B4=E7=BA=BF=E6=96=87=E4=BB=B6?= =?UTF-8?q?=EF=BC=88=E5=AE=A1=E6=9F=A5advisory=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Code --- docs/superpowers/plans/2026-09-18-collection-phase-b.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/superpowers/plans/2026-09-18-collection-phase-b.md b/docs/superpowers/plans/2026-09-18-collection-phase-b.md index 9a2fd8d..46fc630 100644 --- a/docs/superpowers/plans/2026-09-18-collection-phase-b.md +++ b/docs/superpowers/plans/2026-09-18-collection-phase-b.md @@ -271,9 +271,11 @@ function matchProduct(path: string): string | null { ### Task 6: Admin（时间线新事件 + 漏斗卡） **Files:** +- Modify: `server/tracker/api/visitors.py`（Step 0 时间线安全字段白名单） +- Modify: `server/tracker/tests/test_visitors.py`（Step 0 测试） - Modify: `admin/src/views/tracker/visitor/components/EventTimeline.vue`（EVENT_META 扩展） - Modify: `admin/src/views/tracker/dashboard/index.vue`（漏斗卡） -- Modify: `admin/src/api/`（漏斗 API 函数，沿 dashboard 既有 API 模块） +- Modify: `admin/src/api/tracker/dashboard.ts`（漏斗 API 函数）+ `admin/src/api/tracker/visitors.ts`（TimelineEvent 接口） - Test: Playwright 视觉验证（T6 内含） - [ ] **Step 0: server 时间线 payload 白名单扩展**（前置——timeline API 现只出 time/event_name/path/title/active_ms，不透出 properties，业务属性到不了前端）：`server/tracker/api/visitors.py` 的 `_merge_page_stay`（约 178-202 行）事件序列化处，按事件名增加安全字段映射：contact_click→channel；form_start→form_id；form_submit→form_id+submission_id 前 8 位；form_error→error_code+field_count；form_submit_result→result_code；product_view→product_id+inferred（全部非 PII，OT10 白名单内字段）。test_visitors.py 加断言（新事件行带安全字段、无其他 properties 泄漏）；admin `TimelineEvent` 接口（api/tracker/visitors.ts:119-127）同步字段。**先 server 测试红绿再动 admin**，随本任务 commit。