20260727173703

code/fms/CODEBUDDY.md

@@ -87,8 +87,8 @@ Vue 3 `<script setup>` SFCs, Pinia for state, **antdv-next** components (auto-im
 Feature code should call these, or wrap them in a dedicated service like `src/services/moduleManagement.js` (e.g. `loadModuleConfiguration`, `nextIds`, `saveChanges`). Do not introduce new backend URLs from the frontend — reuse the generic endpoints.
 
 ### Routing & permissions
-- `src/router/index.js` registers view components via **static explicit `import()`**, not a dynamic whitelist. Each route carries `meta.moduleCode` (e.g. `m_module`), plus `menuKey`, `title`, `requiresAuth`.
-- A `beforeEach` guard checks auth, then `permissionStore.canModule(to.meta.moduleCode)`. `src/stores/permissions.js` loads `b_user_module` / `b_user_power` / `s_module_power` and gates page entry and button enable/disable. Currently permission enforcement is **frontend-only**; backend interception is not yet implemented.
+- `src/router/index.js` registers view components via **static explicit `import()`**, not a dynamic whitelist. Data-backed routes carry `meta.dataCode` (e.g. `d_login_log`), plus `menuKey`, `title`, `requiresAuth`; legacy system pages without data nodes may temporarily use `meta.moduleCode`.
+- A `beforeEach` guard checks auth, then resolves `meta.dataCode` to its parent page and checks that page's `b_user_module` grant. `src/stores/permissions.js` loads `s_module` / `b_user_module` / `b_user_power` / `s_module_power` and gates page entry and button enable/disable. Currently permission enforcement is **frontend-only**; backend interception is not yet implemented.
 - `src/layouts/components/AppSidebar.vue` still uses a hardcoded `fallbackMenuItems` array. It should fall back to this static menu when the generic-interface module load fails.
 
 ### State & i18n