kra-oa/docs/audit/parity-ops-content.md

GVA Operations and Content API Parity Audit

Scope and method

• Reference: official GVA working tree C:\Users\Yvan\AppData\Local\Temp\gva-parity-02f3783, commit 02f37833255e0e339c3d69199cb5a468f17de9fc.
• Local target: this repository's Gin compatibility surface. The global private/public placement and the compatibility operation-record selection are established in internal/server/gin.go:33-48 and internal/server/middleware/audit.go:137-178.
• Checked for each endpoint: method/path, public vs private placement, operation-record placement, request binding/defaults, business side effects, and response/error envelope. Both applications use a 200 JSON response envelope for business failures (internal/server/httpx/response.go:28-36); this audit treats message-only wording differences as compatible unless the control flow or payload differs.
• Deliberately excluded: GVA auto-code, AI, skills, example, plugin-management and other modules that have not been migrated. This includes the GVA error-log action which delegates to AutoCodeService.LLMAuto; it is listed below only so the route inventory is complete, not as a required migration gap.

OK means no material mismatch was found in this read-only audit. EXCLUDED is a GVA route intentionally outside the migration scope. The route evidence in the tables is the local router shown first, then the GVA router.

Findings

Excluded - Error-solution endpoint is intentionally out of scope

GET /sysError/getSysErrorSolution?id=<id> is registered as a private, operation-recorded GVA route in server/router/system/sys_error.go:15-24, seeded in both its API and Casbin sources (server/source/system/api.go:221-225, server/source/system/casbin.go:294-298), and consumed by the GVA UI (web/src/api/system/sysError.js:120-126, web/src/view/systemTools/sysError/sysError.vue:290-293). It validates id, changes the error to 处理中, starts an asynchronous LLM solution task through AutoCodeService.LLMAuto, and returns 已提交至AI处理 (server/api/v1/system/sys_error.go:179-197; delegation and state transitions at server/service/system/sys_error.go:83-129).

The local error router exposes only delete/update/find/list/create (internal/server/router/audit.go:27-33) and neither internal/server/handler/audit.go nor internal/server/middleware/audit.go:167-171 defines the action/audit selection. The local client module likewise ends after getSysErrorList (web/src/api/system/sysError.js:82-96), while GVA exports the action at web/src/api/system/sysError.js:120-126. This is an expected absence under the user's explicit exclusion of AI/code-generation functionality. It does not count as a parity defect for the scoped migration; do not add its route, Casbin seed, client action, asynchronous state transition, or LLM integration unless that exclusion changes.

Cross-cutting audit behavior is aligned

The selected mutation set matches GVA's per-router OperationRecord() use: local operationRoutes includes the dictionary, parameter, config, token, export, version, error, login, data-access, timed-task, announcement and email mutations (internal/server/middleware/audit.go:161-171). Both implementations reuse the access-log capture, mask the same sensitive JSON fields, preserve the multipart/download truncation markers, and record request/trace/device metadata (internal/server/middleware/audit.go:27-103; GVA server/middleware/access_log.go:43-112, server/middleware/operation.go:20-102). No parity difference was found at this boundary; keep it as a regression-test seam rather than a finding.

Per-module endpoint review

Dictionary and dictionary detail

Route sets match GVA (internal/server/router/dictionary.go:9-29; GVA server/router/system/sys_dictionary.go:14-23, sys_dictionary_detail.go:14-24). Local handlers bind the same JSON/query shapes and return the same compatibility wrapper keys, including resysDictionary, reSysDictionaryDetail, list, and path (internal/server/handler/dictionary.go:20-266). The data layer keeps GVA's name OR type search, unpaged dictionary-list behavior, detail filters and sort,id ordering (internal/data/dictionary.go:218-282, 370-400); GVA equivalents are server/service/system/sys_dictionary.go:122-149 and sys_dictionary_detail.go:180-209.

Endpoint	Status	Binding / effect check
POST /sysDictionary/createSysDictionary	OK	JSON dictionary; uniqueness/create; detailed created response.
PUT /sysDictionary/updateSysDictionary	OK	JSON dictionary; update response.
DELETE /sysDictionary/deleteSysDictionary	OK	JSON dictionary ID; deletion side effects retained.
GET /sysDictionary/findSysDictionary	OK	Query dictionary; enabled lookup; {resysDictionary: ...}.
GET /sysDictionary/getSysDictionaryList	OK	name searches name/type; unpaged list.
GET /sysDictionary/getSysDictionaryListWithDetails	OK	name searches name/type; details preloaded and sorted.
GET /sysDictionary/exportSysDictionary	OK	Query ID required; export shape retained.
POST /sysDictionary/importSysDictionary	OK	JSON {json} import and failure propagation.
POST /sysDictionaryDetail/createSysDictionaryDetail	OK	JSON detail; hierarchy metadata calculated.
PUT /sysDictionaryDetail/updateSysDictionaryDetail	OK	JSON detail; hierarchy update/cycle validation retained.
DELETE /sysDictionaryDetail/deleteSysDictionaryDetail	OK	JSON detail ID; parent-with-children rejection retained.
GET /sysDictionaryDetail/findSysDictionaryDetail	OK	Query ID; {reSysDictionaryDetail: ...}.
GET /sysDictionaryDetail/getSysDictionaryDetailList	OK	Query page/filter fields label,value,status,sysDictionaryID,parentID,level; sort,id ordering.
GET /sysDictionaryDetail/getDictionaryTreeList	OK	Query sysDictionaryID required; root tree with children.
GET /sysDictionaryDetail/getDictionaryTreeListByType	OK	Query type required; type-resolved root tree.
GET /sysDictionaryDetail/getDictionaryDetailsByParent	OK	sysDictionaryID required, optional parentID/includeChildren.
GET /sysDictionaryDetail/getDictionaryPath	OK	Query id required; ancestor path.

System parameters

Route, binding and result shapes match (internal/server/router/parameter.go:9-19; GVA server/router/system/sys_params.go:15-23; local handler internal/server/handler/parameter.go:19-92; GVA API server/api/v1/system/sys_params.go:22-169). name, key, created-time window and page fields reach the local repo in the same way (internal/service/parameter.go:20-64, internal/data/parameter.go:63-90).

Endpoint	Status	Binding / effect check
POST /sysParams/createSysParams	OK	Required JSON name,key,value; create.
PUT /sysParams/updateSysParams	OK	Required JSON name,key,value; struct-update behavior retained.
DELETE /sysParams/deleteSysParams	OK	Query ID; delete one.
DELETE /sysParams/deleteSysParamsByIds	OK	Query IDs[]; batch delete.
GET /sysParams/findSysParams	OK	Query ID; one parameter.
GET /sysParams/getSysParam	OK	Query key; one parameter.
GET /sysParams/getSysParamsList	OK	Query page/name/key/created-time window; page result.

Security config, system config/info/reload, and initialization

The route split and mutation audit placement match GVA: local internal/server/router/system_config.go:9-21 and router/public.go:9-16; GVA server/router/system/sys_security_config.go:15-18, sys_system.go:15-20, sys_initdb.go:12-13. The system config read already returns the required {config: ...} payload because ConfigurationJSON() constructs that envelope (internal/data/config_management.go:30-117), matching GVA SysConfigResponse (server/model/system/response/sys_system.go:5-7). Local reload also reloads the task runtime (internal/biz/system_init.go:66-73), preserving GVA-visible reload behavior while avoiding a process restart.

Endpoint	Status	Binding / effect check
GET /securityConfig/getSecurityConfig	OK	Private read; security config response fields.
POST /securityConfig/setSecurityConfig	OK	Private JSON update; saved config returned.
POST /system/getSystemConfig	OK	Private read; {config: ...} wrapper and secret masking.
POST /system/setSystemConfig	OK	Private JSON config; persistent config update.
POST /system/reloadSystem	OK	Private mutation; reloads runtime/task config.
POST /system/getServerInfo	OK	Private server information under server.
POST /init/checkdb	OK	Public needInit response and compatible message.
POST /init/initdb	OK	Public only while uninitialized; validates DB input and seeds active Gin routes.

API token, export templates, and versions

Paths and methods match (internal/server/router/api_token.go:9-15, export.go:9-23, version.go:9-18; GVA sys_api_token.go:15-17, sys_export_template.go:18-33, sys_version.go:15-23). API-token revocation also blacklists the persisted JWT before disabling it (internal/data/api_token.go:123-129), matching GVA server/service/system/sys_api_token.go:93-106. Export token issuance/consumption and public downloads are present in the local handler (internal/server/handler/export.go:144-225), and version import/export preserves staged errors (internal/server/handler/version.go:85-151, internal/service/version.go:185-267).

Endpoint	Status	Binding / effect check
POST /sysApiToken/createApiToken	OK	JSON userId,authorityId,days,remark; authority check/JWT issuance.
POST /sysApiToken/getApiTokenList	OK	JSON page/user/status filters; newest-first page result.
POST /sysApiToken/deleteApiToken	OK	JSON ID; blacklist then mark disabled.
POST /sysExportTemplate/createSysExportTemplate	OK	JSON template; name required/create.
PUT /sysExportTemplate/updateSysExportTemplate	OK	JSON template; name required/update.
DELETE /sysExportTemplate/deleteSysExportTemplate	OK	JSON ID; empty-ID failure preserved.
DELETE /sysExportTemplate/deleteSysExportTemplateByIds	OK	JSON IDs; batch delete.
GET /sysExportTemplate/findSysExportTemplate	OK	Query ID; resysExportTemplate key.
GET /sysExportTemplate/getSysExportTemplateList	OK	Query filters/page; page result.
GET /sysExportTemplate/previewSQL	OK	templateID required plus encoded params; SQL preview.
GET /sysExportTemplate/exportExcel	OK	templateID plus params; one-time download-token URL.
GET /sysExportTemplate/exportTemplate	OK	Blank-template token URL.
POST /sysExportTemplate/importExcel	OK	Multipart file plus query templateID; import.
GET /sysExportTemplate/exportExcelByToken	OK	Public token consumption; XLSX download.
GET /sysExportTemplate/exportTemplateByToken	OK	Public blank-template token consumption; XLSX download.
DELETE /sysVersion/deleteSysVersion	OK	Query ID; delete.
DELETE /sysVersion/deleteSysVersionByIds	OK	Query IDs[]; batch delete.
GET /sysVersion/findSysVersion	OK	Query ID; version record.
GET /sysVersion/getSysVersionList	OK	Query page/name/code/date window; page result.
POST /sysVersion/exportVersion	OK	Required JSON version name/code and selected menu/API/dictionary data.
GET /sysVersion/downloadVersionJson	OK	Query ID; attachment JSON stream.
POST /sysVersion/importVersion	OK	JSON bundle; staged menu/API/dictionary import errors.

Operation/login/data-access/error/file logs

The non-AI endpoints and their public/private placement match local internal/server/router/audit.go:9-33 with GVA sys_operation_record.go:12-15, sys_login_log.go:16-21, sys_data_access_log.go:14-17, sys_error.go:16-26, and sys_log_viewer.go:10-12. Local log-viewer validation rejects malformed month/date/path before storage access (internal/server/handler/audit.go:199-271) and passes the expected errors. Error, operation and login handler bindings are in internal/server/handler/audit.go:67-343.

Endpoint	Status	Binding / effect check
GET /sysOperationRecord/getSysOperationRecordList	OK	Query page/path/method/status; newest-first page result.
GET /sysOperationRecord/findSysOperationRecord	OK	Query ID; reSysOperationRecord wrapper.
DELETE /sysOperationRecord/deleteSysOperationRecord	OK	JSON ID; delete one.
DELETE /sysOperationRecord/deleteSysOperationRecordByIds	OK	JSON IDs; batch delete.
GET /sysLoginLog/getLoginLogList	OK	Query page/username/status; newest-first page result.
GET /sysLoginLog/findLoginLog	OK	Query ID; login record.
DELETE /sysLoginLog/deleteLoginLog	OK	JSON ID; delete one.
DELETE /sysLoginLog/deleteLoginLogByIds	OK	JSON IDs; batch delete.
POST /dataAccessLog/getDataAccessLogList	OK	JSON page/eventType/targetTable; page result.
DELETE /dataAccessLog/deleteDataAccessLogByIds	OK	JSON IDs; batch delete.
GET /logViewer/dates	OK	Required query month; log-date listing.
GET /logViewer/files	OK	Required query date; file listing.
GET /logViewer/content	OK	Required date,path, optional cursor; safe content page.
POST /sysError/createSysError	OK	Public JSON error record creation.
DELETE /sysError/deleteSysError	OK	Query ID; delete one.
DELETE /sysError/deleteSysErrorByIds	OK	Query IDs[]; batch delete.
PUT /sysError/updateSysError	OK	JSON error record update.
GET /sysError/findSysError	OK	Query ID; error record.
GET /sysError/getSysErrorList	OK	Query page/form/info/date range; page result.
GET /sysError/getSysErrorSolution	EXCLUDED	GVA private async AI solution submit through AutoCodeService.LLMAuto; outside the requested migration scope.

Timed task and SSE

All nine routes match (internal/server/router/task.go:9-20; GVA server/router/system/sys_timed_task.go:15-26). Local mutation handlers bind the same task/ID payloads (internal/server/handler/task.go:24-120) and drive durable task changes plus scheduler schedule/remove actions (internal/biz/task.go:157-193). The local SSE handler has the GVA-required long-lived headers, initial comment, task alert event, heartbeat and deadline removal (internal/server/handler/task.go:122-161); GVA calls out the timeout exception at server/router/system/sys_timed_task.go:24-26.

Endpoint	Status	Binding / effect check
POST /timedTask/createTimedTask	OK	JSON task; validate, persist and schedule.
PUT /timedTask/updateTimedTask	OK	JSON task; validate, persist and reschedule.
DELETE /timedTask/deleteTimedTask	OK	JSON required ID; remove schedule then delete.
POST /timedTask/toggleTimedTask	OK	JSON ID/enabled; persist toggle then reschedule.
POST /timedTask/triggerTimedTask	OK	JSON ID; manual asynchronous trigger.
GET /timedTask/getTimedTaskList	OK	Query page/name/executorType/enabled; next-run metadata.
GET /timedTask/getTimedTaskLogList	OK	Query page/taskId/status; page result.
GET /timedTask/getRegisteredMethods	OK	Registered method catalog under methods.
GET /timedTask/alertStream	OK	Authenticated SSE timedTask:alert stream with heartbeat.

Media uploads, attachment categories, and chunked upload

Route sets match local internal/server/router/media.go:9-30 and GVA server/router/media/media_file_upload_and_download.go:12-19, media_attachment_category.go:12-14, media_upload.go:10-13. Local handler bindings follow the GVA APIs (internal/server/handler/media.go:19-244; GVA server/api/v1/media/media_file_upload_download.go:25-216, media_upload.go:26-116). The storage/repository paths retain extension validation, key reference counting on delete, partial batch-delete reporting, attachment-category tree behavior, ownership checks, chunk MD5/full-file MD5, atomic merge claim and cleanup (internal/biz/media.go:51-170, internal/biz/media_upload.go:36-184, internal/data/media.go:128-203).

Endpoint	Status	Binding / effect check
POST /fileUploadAndDownload/upload	OK	Multipart file, classId, query noSave; upload/create response file.
POST /fileUploadAndDownload/getFileList	OK	JSON page/keyword/classId/tag/user/time/order filters.
POST /fileUploadAndDownload/deleteFile	OK	JSON ID; storage delete only for final key reference.
POST /fileUploadAndDownload/deleteFiles	OK	JSON IDs; partial success reports failedIds.
GET /fileUploadAndDownload/findFile	OK	Query id; file response.
POST /fileUploadAndDownload/editFileName	OK	JSON ID/name; existence check then rename.
POST /fileUploadAndDownload/importURL	OK	JSON file array; batch insert.
POST /fileUploadAndDownload/listOssFiles	OK	JSON prefix/cursor/limit; list/nextCursor/hasMore.
GET /attachmentCategory/getCategoryList	OK	Category tree rooted at PID 0.
POST /attachmentCategory/addCategory	OK	JSON category; sibling uniqueness plus create/update.
POST /attachmentCategory/deleteCategory	OK	JSON ID required; reject non-leaf category.
POST /mediaUpload/init	OK	JSON init; max size, instant/resume probing.
POST /mediaUpload/chunk	OK	Multipart uploadId,chunkIndex,chunkHash,chunk; owner/status/MD5 checks.
POST /mediaUpload/complete	OK	JSON uploadId; atomic merge, full hash check, media registration.
DELETE /mediaUpload/:uploadId	OK	Path ID; owner-only session/chunk cleanup.

Announcement/info and email

Announcement route placement matches GVA: private mutations/reads and public datasource/public message (internal/server/router/announcement.go:9-24; GVA server/plugin/announcement/router/info.go:16-29). The local public response intentionally mirrors GVA's fixed compatibility message (internal/server/handler/announcement.go:97-99; GVA server/plugin/announcement/api/info.go:171-181). Announcement CRUD/time-range/data-source semantics are retained (internal/server/handler/announcement.go:23-95, internal/data/announcement.go:38-98; GVA server/plugin/announcement/service/info.go:15-76). Email paths, JSON binding and send/test behavior match (internal/server/router/email.go:9-13, internal/server/handler/email.go:15-34; GVA server/plugin/email/router/sys_email.go:16-17, api/sys_email.go:20-51).

Endpoint	Status	Binding / effect check
POST /info/createInfo	OK	Private JSON title/content/user/attachments; create.
DELETE /info/deleteInfo	OK	Private query ID; delete one.
DELETE /info/deleteInfoByIds	OK	Private query IDs[]; batch delete.
PUT /info/updateInfo	OK	Private JSON record; update.
GET /info/findInfo	OK	Private query ID; record response.
GET /info/getInfoList	OK	Private query page/created-time window; page result.
GET /info/getInfoDataSource	OK	Public userID label/value datasource.
GET /info/getInfoPublic	OK	Public fixed compatibility message, not a listing API.
POST /email/emailTest	OK	Private configured-recipient test mail.
POST /email/sendEmail	OK	Private JSON to,subject,body; sends mail.

Suggested regression tests

1. Add a route contract test that enumerates every in-scope table entry above under both no-prefix and a configured routerPrefix; omit the documented AI-excluded GET /sysError/getSysErrorSolution.
2. Add cross-implementation request fixtures for the high-risk shapes: dictionary-detail hierarchy, export token single use/type mismatch, API-token blacklist revoke, media partial delete/chunk ownership/hash, and timed-task SSE headers plus heartbeat/event format.
3. Snapshot the response envelope keys for special cases: resysDictionary, reSysDictionaryDetail, reSysOperationRecord, resysExportTemplate, system {config: ...}, and page {list,total,page,pageSize}.
4. Test audit persistence separately from API behavior: mutation-route selection, sensitive-field masking, multipart/download truncation, and the shared requestId/traceId/deviceId metadata.