zhanghongyu_0626
4b8e11c9bd
- Added `ThresholdRepository` for managing customer loss threshold configurations and notifications. - Introduced `threshold_service` to handle loss threshold alerts based on customer portfolio performance. - Enhanced `customer_prompts` to include new intent for querying product net values. - Updated `customer_service` to integrate new threshold alert functionality into existing workflows. - Implemented `sanitize_postprocess` for improved compliance handling in customer interactions. - Enhanced course documentation to reflect updates in advisor training modules and interactive elements. This update significantly improves the customer experience by providing proactive loss threshold notifications and enhancing the overall service framework.
78 lines
4.8 KiB
HTML
78 lines
4.8 KiB
HTML
<section class="module" id="module-3">
|
||
<div class="module-inner">
|
||
<p class="eyebrow animate-in">模块 3 · 进门钥匙</p>
|
||
<h1 class="module-title animate-in">JWT 与 X-Agent-Type：<br>两套门禁别混</h1>
|
||
<p class="module-lead animate-in">
|
||
<span class="term" data-definition="JWT 像一张带防伪的工牌：服务器验签后知道你是谁（客户还是员工）、有什么角色。">JWT</span>
|
||
证明「你是谁」；<span class="term" data-definition="HTTP 请求头里的一行额外信息，告诉后端这次请求走哪条 Agent 业务线。">X-Agent-Type</span>
|
||
证明「你正在敲哪扇窗」。本项目里<strong>有两套验法</strong>，混用会 401。
|
||
</p>
|
||
|
||
<div class="screen animate-in">
|
||
<h2>两条通道（背下来能少踩一半坑）</h2>
|
||
<table style="width:100%; border-collapse:collapse; margin: 1.5rem 0; font-size: 0.95rem;">
|
||
<thead><tr><th>场景</th><th>鉴权函数</th><th>X-Agent-Type</th></tr></thead>
|
||
<tbody>
|
||
<tr><td>对话 / 风控 REST</td><td><code>get_auth_context</code></td><td><strong>必须</strong>（customer/advisor/risk/analyst）</td></tr>
|
||
<tr><td>平台只读 / 问数</td><td><code>get_platform_auth_context</code></td><td><strong>不要</strong></td></tr>
|
||
<tr><td>模拟交易</td><td><code>get_auth_context</code></td><td>要；且角色需 risk_demo 或客户本人</td></tr>
|
||
</tbody>
|
||
</table>
|
||
<div class="callout callout-warning">
|
||
<strong>真实 bug 已修：</strong> 风控台账 <code>risk.ts</code> 曾缺 <code>X-Agent-Type: risk</code>，JWT 正确也会 401。指挥 AI 接新 REST 时记得对照这条表。
|
||
</div>
|
||
</div>
|
||
|
||
<div class="screen animate-in">
|
||
<div class="translation-block">
|
||
<div class="translation-code">
|
||
<span class="translation-label">CODE · 模块鉴权工厂（deps.py）模块鉴权工厂</span>
|
||
<pre><code><span class="code-line">agent_type = request.headers.get(<span class="code-string">"X-Agent-Type"</span>)</span>
|
||
<span class="code-line"><span class="code-keyword">if not</span> agent_type:</span>
|
||
<span class="code-line"> raise ApiError(<span class="code-number">401</span>, <span class="code-string">"AUTH_401_MISSING_AGENT_TYPE"</span>)</span>
|
||
<span class="code-line">assert_agent_access(auth, agent_type, ...)</span></code></pre>
|
||
</div>
|
||
<div class="translation-english">
|
||
<span class="translation-label">白话</span>
|
||
<div class="translation-lines">
|
||
<p class="tl">读请求头：你声明自己是 customer 还是 risk？</p>
|
||
<p class="tl">没声明 → 直接 401，连业务代码都进不去。</p>
|
||
<p class="tl">再查矩阵：STAFF-30001 能不能走 risk 线？客户 token 能不能走 advisor 线？</p>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="screen animate-in">
|
||
<h2>Demo 账号（本地登录页一键用）</h2>
|
||
<div class="badge-list">
|
||
<div class="badge-item"><span class="badge-code">CUST-9527</span><span class="badge-desc">客户</span></div>
|
||
<div class="badge-item"><span class="badge-code">STAFF-10086</span><span class="badge-desc">理财师</span></div>
|
||
<div class="badge-item"><span class="badge-code">STAFF-20001</span><span class="badge-desc">分析员</span></div>
|
||
<div class="badge-item"><span class="badge-code">STAFF-30001</span><span class="badge-desc">风控 + risk_demo</span></div>
|
||
</div>
|
||
<p>改 宿主 JWT 签发/验签（<code>jwt_service.py</code>）宿主 JWT 签发/验签 里角色后，<strong>必须重新登录</strong> 才会拿到新 JWT。</p>
|
||
|
||
<div class="quiz-container" id="quiz-module3">
|
||
<div class="quiz-question-block"
|
||
data-correct="option-a"
|
||
data-explanation-right="GET /api/customers/... 走 platform 鉴权，前端 apiFetch 只带 Bearer。"
|
||
data-explanation-wrong="平台读 API 故意不要 X-Agent-Type，和 chat 线不同。">
|
||
<h3 class="quiz-question">客户「我的持仓」页调 /api/customers/.../holdings，要带 X-Agent-Type 吗？</h3>
|
||
<div class="quiz-options">
|
||
<button class="quiz-option" data-value="option-a" onclick="selectOption(this)">
|
||
<div class="quiz-option-radio"></div><span>不要</span>
|
||
</button>
|
||
<button class="quiz-option" data-value="option-b" onclick="selectOption(this)">
|
||
<div class="quiz-option-radio"></div><span>要，填 customer</span>
|
||
</button>
|
||
</div>
|
||
<div class="quiz-feedback"></div>
|
||
</div>
|
||
<button class="quiz-check-btn" onclick="checkQuiz('quiz-module3')">检查答案</button>
|
||
<button class="quiz-reset-btn" onclick="resetQuiz('quiz-module3')">重做</button>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</section>
|