|
|
@@ -0,0 +1,64 @@
|
|
|
+# Enterprise Identity Navigation Move Design
|
|
|
+
|
|
|
+## Status
|
|
|
+
|
|
|
+Approved design option: minimal compatible migration.
|
|
|
+
|
|
|
+## Problem
|
|
|
+
|
|
|
+The `企业身份` entry is currently a child of `数据研发`, although its page, route, permissions, APIs, and operational responsibility belong to system identity administration. This makes the feature appear to be a data-development tool and separates it from user, audit, and governance administration.
|
|
|
+
|
|
|
+## Decision
|
|
|
+
|
|
|
+Move the existing navigation record from `数据研发` to `系统管理` and rename its displayed title to `企业身份与 SSO`.
|
|
|
+
|
|
|
+The migration preserves:
|
|
|
+
|
|
|
+- route path `/systemManage/enterprise-identity`;
|
|
|
+- route name `systemEnterpriseIdentity`;
|
|
|
+- component `systemManage/enterpriseIdentity`;
|
|
|
+- permission requirement `identity:manage`;
|
|
|
+- frontend page and backend API behavior;
|
|
|
+- existing bookmarks and direct links.
|
|
|
+
|
|
|
+## Navigation Order
|
|
|
+
|
|
|
+`系统管理` children will be displayed in this order:
|
|
|
+
|
|
|
+1. `用户管理`
|
|
|
+2. `企业身份与 SSO`
|
|
|
+3. `设备责任矩阵`
|
|
|
+4. `审计与运行证据`
|
|
|
+5. `Agent 治理`
|
|
|
+
|
|
|
+The existing system-management entries after the insertion will have their sort values shifted to preserve an unambiguous order.
|
|
|
+
|
|
|
+## Alternatives Rejected
|
|
|
+
|
|
|
+### Duplicate entry in both modules
|
|
|
+
|
|
|
+Rejected because two menu entries would imply two ownership boundaries and make future permission and documentation changes ambiguous.
|
|
|
+
|
|
|
+### New URL with an old-path redirect
|
|
|
+
|
|
|
+Rejected because the existing URL already uses the `systemManage` namespace. Changing it would add migration and redirect complexity without improving the architecture.
|
|
|
+
|
|
|
+## Security and Behaviour
|
|
|
+
|
|
|
+- Users without `identity:manage` will not gain menu visibility or page access.
|
|
|
+- No IdP configuration, identity session, audit, or emergency-access behavior changes.
|
|
|
+- No API, database migration, OpenAPI, or Docker configuration change is required.
|
|
|
+- The current `待企业 IdP UAT` status remains unchanged.
|
|
|
+
|
|
|
+## Test Plan
|
|
|
+
|
|
|
+1. Add a failing navigation contract proving the entry is absent from `数据研发`.
|
|
|
+2. Prove the entry is present exactly once under `系统管理` with the preserved path, name, component, icon, and permission.
|
|
|
+3. Prove the visible label is `企业身份与 SSO` and the system menu order is stable.
|
|
|
+4. Run existing enterprise-identity, router, RBAC, and architecture contracts.
|
|
|
+5. Build the frontend production bundle.
|
|
|
+6. Rebuild only the local UAT frontend and verify the preserved deep link returns successfully.
|
|
|
+
|
|
|
+## Rollback
|
|
|
+
|
|
|
+Rollback is a single router-data change: move the same record back under `数据研发` and restore its old title. No persisted data or identity configuration is affected.
|
马小龙