v1.4.0

Security

• Resetting another user's password, or setting their sign-in mobile, now needs the right to grant every role that user holds, like assigning those roles; otherwise 403 B1001 with the message iam.takeover_exceeds_own (a user administrator could take over a better-privileged account). A tenant administrator is judged only on the permissions it holds and the platform-only ones, so permissions of disabled or out-of-package menus a role keeps do not block it. Helpdesk-style roles with only iam.user.reset-password can no longer reset users whose roles carry permissions or a data scope they lack.
• Moving a department is judged as a grant: the subtree must fit the caller's scope for every permission of the dept-subtree roles held above its new place (403 iam.grant_exceeds_own).
• Password and SMS sign-in refuse a foreign or null Origin (403 auth.origin_rejected), so another site can no longer plant its own session in the console (login CSRF). Requests without Origin (apps, scripts) and mobile sign-ins are unchanged. Upgrade note: behind a reverse proxy, Host and the scheme must reach the server as the browser sent them (or the console's origin be listed in CORS_ORIGIN), as the refresh already required; otherwise console sign-in answers 403 A1007.
• Sign-in usernames must use the stored syntax (letters, digits, _ . @ -; fullwidth forms are folded first); other spellings get 400 instead of revealing whether an account exists. Upgrade note: accounts whose stored username does not match that syntax (for example imported by SQL with Chinese names) must be renamed before upgrading, their sign-in answers 400. Parallel password guesses now reach the password check at most the lock threshold times.
• Excel imports are rebuilt from the file's central directory and every part's real size is counted before parsing, so a file lying about its sizes is refused (400 excel.invalid) instead of exhausting memory.
• Dictionary and parameter reads ignore codes outside the stored syntax (no cache entry per spelling); a user keeps at most 200 saved list settings (409 iam.pref_keys_limit); presigned download URLs are masked in request logs; audit.retention_days is root-only; disabled users get no WeChat reminders.
• The mobile H5 dev server serves only the app and shared sources, without CORS, and only to its own pages (docs/mobile.md).

Fixed

• DATE columns (e.g. a book's publication date) no longer come back a day early when the server process runs west of UTC.

v1.3.1

Added

• Breakpoint debugging of the server in development: QW_INSPECT=1 pnpm dev (PowerShell: $env:QW_INSPECT=1; pnpm.cmd dev) opens the Node inspector on 127.0.0.1:9229 for the server app process only, with source maps; a port number instead of 1 picks another port. .vscode/launch.json adds a server attach configuration that reattaches after every restart, and Edge / Chrome launch configurations for the Vite dev server. See docs/getting-started.md.

v1.3.0

Added

• Job queues on the existing Redis (BullMQ, no separate message broker): modules declare a queue with registerQueue and a processor extending TenantJobProcessor, and add jobs with QueueService.add, which records the caller's tenant; each job runs in that tenant, and a job without one fails at once without retries. Defaults: 3 attempts with exponential backoff, the last 1000 completed and 5000 failed jobs kept. Every instance runs the workers, which finish their running jobs on shutdown; start-up warns when Redis maxmemory-policy is not noeviction. See docs/queue.md.
• Queue monitor page (System monitor → Queue monitor, platform only, root only with multi-tenancy on): job counts and paused state per queue, jobs by state with masked data, retrying failed jobs and removing jobs (permissions monitor.queue.browse / retry / remove, action-logged).

v1.2.1

Fixed

• The last sign-in time shown after signing in (GET /api/auth/me lastSignInAt) no longer depends on the application and database clocks agreeing: sign-in log rows are timestamped by the application. Sessions started before the upgrade show the corrected time after their next sign-in.
• Three server tests no longer fail on Windows or on hosts whose clock is off the database's.

v1.2.0

Added

• Data scope for hand-written SQL: dataScopeSql(alias, columns) / dataScopeSqlFor(entity, alias) return the same department/owner condition as the ORM path, as a parameterized { sql, params } for raw queries. A new pnpm verify check reports raw SQL (and QueryBuilder table-name joins) on a data-scoped table that neither uses it nor states qw:no-data-scope <reason>. See docs/data-scope.md.

v1.1.0

Multi-tenancy: one deployment serves several companies from one MySQL database (a shared schema with a tenant_id column). It is off by default; with the switch off the system behaves as 1.0.x and all data belongs to the built-in default tenant. See docs/multi-tenancy.md.

Added

• Tenancy switch APP_MULTI_TENANT (server environment, read at start-up, default false); there is no runtime toggle, and a change is complete only after every instance has restarted.
• Data isolation: every tenant-owned row carries tenant_id; the ORM adds the tenant condition to reads and writes, raw SQL states its own, and static plus test-time checks reject raw SQL on tenant tables without it.
• Tenant management (a platform page): create a tenant in one step (root department, built-in tenant_admin role, workflow templates and an owner account with a one-time initial password), expiry date, user quota, several host names, brand name and logo, enable/disable and initial-password reset. Disabling or expiring a tenant ends its sessions at once; its data stays.
• Tenant packages: the menus a tenant may use, enforced on the server (permissions = role grants ∩ package). Routes of a feature group outside the package answer 404, and GET /api/auth/me lists the available features.
• Sign-in by bound host name or tenant code on web, H5, App and mini program; unknown, disabled and existing codes get identical responses. Lockout, SMS codes, password resets, OAuth consent and WeChat bindings are per tenant.
• Platform staff with iam.tenant.enter can enter a tenant for support with a required reason: a permanent banner, a two-hour limit, stale tabs reloaded through the X-Tenant-Expect header, and audit records for entering, leaving and every request made inside.
• Platform pages (menus, dictionaries, parameters, storage, templates, code generation, jobs, monitoring and more) belong to the default tenant; with the switch on, API trace, API fault and cache pages are limited to the platform root. Operation and sign-in logs show the actor's tenant.
• Code generator: tenant columns, @TenantColumn() and cross-tenant 404 cases in the generated end-to-end tests. docs/multi-tenancy.md explains how to write tenant-aware project code.
• Demo data: sample tenants with their own packages and brands, created only when both APP_DEMO_MODE and APP_MULTI_TENANT are on.

Changed

• New tables are tenant tables by default. A platform table is registered in PLATFORM_TABLES, a globally unique key in GLOBAL_UNIQUE (apps/server/src/core/db/tenant-tables.ts).

Upgrade notes

• This release's migrations only add columns and indexes and stay compatible with the previous code: upgrading with the switch off needs no downtime and can be rolled back.
• New installs may start with the switch on. An existing database is switched on in two deployments: first upgrade to 1.1.0 with the switch off and confirm it is healthy; then turn the switch on and deploy again. db:migrate then removes the default of the tenant columns (or run tenancy-harden); the server refuses to start with the switch on before that. Review the default tenant's roles that hold platform menus first. See docs/deploy.md.
• A database that has run with the switch on cannot go back to any version before 1.1.0, including patch versions released from the 1.0 line.
• Tenants are never deleted, only disabled or expired. Before switching off, disable every tenant that should stop serving; tenant-disable handles ones missed while the switch is off.
• Known limits: a WeChat account binds to an account in one tenant only; on the main host name, one browser signs in to one tenant at a time; host-name changes take up to 60 seconds; package changes reload every session's permissions once.

v1.0.3

1.0.1 and 1.0.2 were tagged but never released. The first CI run of 1.0.1 failed on a fresh checkout: the shared package was not built before verify. The run of 1.0.2 failed on Linux in a deploy-lock test that held the lock in the wrong process. This release contains their changes and the fixes.

Added

• GitHub Actions for the public repository: pushes and pull requests to main run the full local gate (pnpm ci:local with MySQL 8.4 and Redis 8 service containers, web and mobile Playwright). A vX.Y.Z tag does not run the gate again: it requires a successful CI run of the same commit on main, publishes a GitHub Release from this changelog and, after approval in the demo environment, deploys the demo site over SSH.
• Server deploy kit (scripts/deploy/): one directory per release behind an atomic current link, shared env files, PM2 cluster reloads with health checks and automatic code rollback, a root-owned kit, and a deploy key that can only run the deploy command (kept in a root-owned keys file, outside the app user's home). See docs/deploy.md.

Fixed

• pnpm ci:local builds the shared package before verify, so the full gate also passes on a fresh checkout (it relied on an earlier build); the mobile removal drill in docs/mobile.md gained the same step.
• Mobile: wot-ui component texts such as placeholders follow English in the dev server and from the first render after a restart.
• Mobile workbench: long English subtitles wrap beside the header illustration instead of running under it.

栖梧 Qiwu v1.0.0

栖梧 Qiwu 的第一个公开版本：基于 NestJS 12 + Vue 3.5 + Element Plus + MySQL + Redis 的 MIT 开源管理后台模板，附带可选的 uni-app 员工移动端。

• 在线演示：https://demo.qiwuadmin.com （账号 admin / 密码 admin@123，演示模式下只能浏览）
• 文档：https://qiwuadmin.com
• 快速开始：docs/getting-started.md

主要功能

• 用户、角色、菜单、部门、岗位，五种数据权限，在线会话与强制下线
• 中英文界面，亮色 / 暗色主题，多种导航布局
• 字典、参数、公告、登录与操作日志、HTTP 访问记录、系统监控、定时任务
• 本地 / S3 兼容存储，Excel 导入导出，站内信、邮件、短信
• 代码生成：单表、树表、主子表，一键生成前后端代码与测试
• 审批流：树形与 BPMN 两种设计器，表单设计，加签、转办、退回、超时处理
• OAuth2（授权码 + PKCE）与单点登录
• 多实例部署：实时推送与限流通过 Redis 共享
• uni-app 员工移动端：微信小程序、Android、iOS

环境要求

Node ≥ 22.22.1、pnpm 11、MySQL ≥ 8.4、Redis ≥ 7；支持 macOS、Linux，以及原生 Windows 11（PowerShell 5.1）

完整更新内容见 CHANGELOG.md。

---

The first public release of Qiwu, an MIT admin template built on NestJS 12, Vue 3.5, Element Plus, MySQL and Redis, with an optional uni-app mobile client. Live demo: https://demo.qiwuadmin.com (admin / admin@123, read-only demo mode). Docs: https://qiwuadmin.com. See CHANGELOG.md for the full list.