後台唯讀展示帳號（viewer 角色） - #51
Merged
Merged
Conversation
- admins.role enum（operator 預設/viewer）；BaseController 統一 攔截 viewer 的所有非 GET 請求（整體策略，未來新增寫入端點 自動涵蓋），sessions 豁免使其可登入登出 - viewer 介面顯示「展示模式（唯讀）」banner，寫入表單改靜態 說明；operator 完全不受影響（迴歸測試鎖住） - seeds 新增公開展示帳號 demo-admin@venture-ferris.example （密碼刻意公開於 README，寫入攔截在伺服器端非前端隱藏） - 測試 221 integration（+12：五頁瀏覽、四寫入端點零變化、 登出、operator 迴歸）
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
需求說明
讓作品集訪客能實際瀏覽後台（而非只看截圖），同時把「權限分級＋伺服器端強制唯讀」作為可展示的設計決策。
變更內容
admins.roleenum（operator預設／viewer）Admin::BaseController統一攔截 viewer 的所有非 GET/HEAD 請求——採整體策略而非逐 action 列舉，未來新增的寫入端點自動被涵蓋；sessions 豁免（viewer 可登入登出）demo-admin@venture-ferris.example／walkthrough2026（刻意公開，README 說明攔截在 controller 層非前端隱藏）測試確認
bin/rails test：221 runs, 0 failures（+12）；test:system：13 runs, 0 failures