important-new · important-new · Jun 14, 2026 · Jun 14, 2026
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
@@ -26,5 +26,5 @@ Closes #
 - [ ] For frontend changes, I built all three apps (Admin, Application, Landing) and the Playwright smoke tests pass.
 - [ ] I updated the docs (README.md / README.zh-CN.md and docs/) if behavior changed.
 - [ ] No secrets, credentials, or AWS account IDs are committed.
-- [ ] My changes follow the coding conventions in [CONTRIBUTING.md](../blob/main/CONTRIBUTING.md).
+- [ ] My changes follow the coding conventions in [CONTRIBUTING.md](CONTRIBUTING.md).
 - [ ] I confirm my contribution is licensed under the MIT-0 license.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -12,6 +12,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- Branch protection on `main`: direct pushes are blocked, a Pull Request is
+  required for all changes, and required status checks must pass before merge.
+
+### Changed
+- Both CI workflows (`backend-tests.yml`, `frontend-e2e.yml`) now run the full
+  pytest and Playwright suites on every pull request, gating merges into `main`.
+
 ## [2.0.0] - 2026-06-14
 
 Dependency & runtime modernization, a cross-platform test suite, and a security
@@ -21,7 +29,7 @@ major upgrades, hence the major version bump.
 ### Added
 - Cross-platform backend test suite using **pytest + moto** (in-memory DynamoDB,
   no Docker/AWS required): `requirements-test.txt`, `pytest.ini`, `server/conftest.py`,
-  and per-service `tests/test_*.py`.
+  and tests for the product and order services (`tests/test_*.py`).
 - Cross-platform frontend smoke tests using **Playwright** (`e2e/`).
 - **GitHub Actions CI**: `.github/workflows/backend-tests.yml` (pytest on
   ubuntu/windows/macOS) and `.github/workflows/frontend-e2e.yml`, both with
@@ -63,7 +71,7 @@ major upgrades, hence the major version bump.
 
 ## [1.0.1] - 2025-08-05
 
-Initial tagged baseline of the derivative: Lab6 reworked from a teaching-oriented
+Initial baseline of the derivative: Lab6 reworked from a teaching-oriented
 lab into a deployable, structurally simplified reference implementation. See
 [`docs/CHANGES_FROM_WORKSHOP.md`](docs/CHANGES_FROM_WORKSHOP.md) for the complete
 divergence record and the upstream→quickstart path mapping.
@@ -97,6 +105,5 @@ divergence record and the upstream→quickstart path mapping.
   `shared-template.yaml` / `tenant-template.yaml`, plus the `shardId`-based
   sharding strategy and its parallel-query logic.
 
-[Unreleased]: https://github.com/important-new/aws-serverless-saas-quickstart/compare/2.0.0...HEAD
-[2.0.0]: https://github.com/important-new/aws-serverless-saas-quickstart/compare/1.0.1...2.0.0
-[1.0.1]: https://github.com/important-new/aws-serverless-saas-quickstart/releases/tag/1.0.1
+<!-- This project does not publish git tags / GitHub releases; the version
+     sections above document changes by date. See git history for the commits. -->
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -49,18 +49,27 @@ npx playwright install chromium
 npx playwright test
 ```
 
-CI runs both on every push/PR — see [`.github/workflows/`](.github/workflows).
+CI runs both on every pull request — see [`.github/workflows/`](.github/workflows).
 
 ### Submitting changes
 
-1. Fork the repository and create a topic branch off `main`
-   (e.g. `fix/order-update-bug`, `feat/add-invoice-service`).
+`main` is a protected branch: **direct pushes are blocked and all changes must go
+through a Pull Request**. Required status checks must pass before a PR can be
+merged — the backend `pytest` suite on ubuntu/windows/macOS
+(`backend-tests.yml`) and the frontend Playwright suite (`frontend-e2e.yml`).
+These rules apply to everyone, maintainers included.
+
+1. Fork the repository (or, if you have write access, create a topic branch);
+   either way, branch off `main` (e.g. `fix/order-update-bug`,
+   `feat/add-invoice-service`). Never push directly to `main`.
 2. Make focused commits with clear messages. Keep unrelated changes in separate PRs.
 3. Ensure `pytest` passes and, for frontend changes, that all three apps build
    (`npx ng build --configuration production`) and Playwright smoke tests pass.
+   The same checks run in CI and must pass before merge.
 4. Update docs (`README.md` / `README.zh-CN.md` and anything under `docs/`) when
    behaviour or setup changes.
-5. Open a Pull Request using the template. Link any related issue.
+5. Open a Pull Request using the template. Link any related issue. A maintainer
+   merges it once the required checks are green.
 
 ### Coding conventions
 
@@ -118,15 +127,22 @@ npx playwright install chromium
 npx playwright test
 ```
 
-CI 在每次 push / PR 时运行二者，见 [`.github/workflows/`](.github/workflows)。
+CI 在每次 Pull Request 时运行二者，见 [`.github/workflows/`](.github/workflows)。
 
 ### 提交变更
 
-1. Fork 仓库，从 `main` 切出主题分支（如 `fix/order-update-bug`）。
+`main` 是受保护分支：**禁止直接推送，所有改动都必须通过 Pull Request 合入**。合并前
+必须通过所需的状态检查 —— 后端在 ubuntu/windows/macOS 上的 `pytest` 套件
+（`backend-tests.yml`）以及前端的 Playwright 套件（`frontend-e2e.yml`）。该规则对所有
+人生效，包括维护者。
+
+1. Fork 仓库（若你拥有写权限，也可直接创建主题分支），无论哪种方式都从 `main` 切出主题
+   分支（如 `fix/order-update-bug`）。切勿直接推送到 `main`。
 2. 提交粒度清晰、信息明确；无关改动请拆分到不同 PR。
-3. 确保 `pytest` 通过；前端改动需保证三个 app 均能构建并通过 Playwright 冒烟。
+3. 确保 `pytest` 通过；前端改动需保证三个 app 均能构建并通过 Playwright 冒烟。相同的检查
+   会在 CI 中运行，且必须在合并前通过。
 4. 行为或配置变化时，同步更新文档（`README.md` / `README.zh-CN.md` 及 `docs/`）。
-5. 使用模板提交 Pull Request，并关联相关 issue。
+5. 使用模板提交 Pull Request，并关联相关 issue。所需检查全部通过后，由维护者完成合并。
 
 ### 编码约定
 

diff --git a/README.zh-CN.md b/README.zh-CN.md
@@ -161,10 +161,10 @@ aws-serverless-saas-quickstart/
 
 本 README 为高层入口,深入的架构剖析位于 [`docs/`](docs/) 目录下:
 
-- [`docs/ARCHITECTURE.md`](docs/zh-CN/ARCHITECTURE.md) —— 架构索引(技术栈、数据库设计、结构)
-- [`docs/TENANT_MANAGEMENT.md`](docs/zh-CN/TENANT_MANAGEMENT.md) —— 平台租户管理实现(生命周期、用户/租户关联、权限控制、分级)
-- [`docs/API_CONFIGURATION.md`](docs/zh-CN/API_CONFIGURATION.md) —— 管理端与租户端接口配置关系剖析
-- [`docs/THROTTLING_AND_MONITORING.md`](docs/zh-CN/THROTTLING_AND_MONITORING.md) —— 监控运维、使用计划限流,以及 CloudWatch 限流指标机制
+- [`docs/zh-CN/ARCHITECTURE.md`](docs/zh-CN/ARCHITECTURE.md) —— 架构索引(技术栈、数据库设计、结构)
+- [`docs/zh-CN/TENANT_MANAGEMENT.md`](docs/zh-CN/TENANT_MANAGEMENT.md) —— 平台租户管理实现(生命周期、用户/租户关联、权限控制、分级)
+- [`docs/zh-CN/API_CONFIGURATION.md`](docs/zh-CN/API_CONFIGURATION.md) —— 管理端与租户端接口配置关系剖析
+- [`docs/zh-CN/THROTTLING_AND_MONITORING.md`](docs/zh-CN/THROTTLING_AND_MONITORING.md) —— 监控运维、使用计划限流,以及 CloudWatch 限流指标机制
 - [`docs/CONFIGURATION.md`](docs/CONFIGURATION.md) ｜ [`docs/LOCAL_TESTING.md`](docs/LOCAL_TESTING.md) ｜ [`docs/CHANGES_FROM_WORKSHOP.md`](docs/CHANGES_FROM_WORKSHOP.md) ｜ [`docs/DEPENDENCY_AUDIT.md`](docs/DEPENDENCY_AUDIT.md)
 
 深度剖析的英文版位于 [`docs/`](docs/) 根目录。

diff --git a/SECURITY.md b/SECURITY.md
@@ -10,8 +10,8 @@ This project is a reference architecture and quick-start derived from the AWS
 Serverless SaaS Workshop. It is community-maintained and licensed under MIT-0.
 
 Only the latest `main` branch is supported. There are no tagged releases and no
-backported security patches for older commits. Fixes land on `main`; if you are
-running an older checkout, please update to the latest `main`.
+backported security patches for older commits; security fixes land on `main`.
+If you are running an older checkout, please update to the latest `main`.
 
 | Version | Supported |
 | --- | --- |
@@ -83,9 +83,9 @@ This project is distributed under the terms in [LICENSE](LICENSE).
 本项目是基于 AWS Serverless SaaS Workshop 衍生的参考架构与快速入门模板，由社区维护，
 采用 MIT-0 许可证。
 
-仅支持最新的 `main` 分支。本项目没有发布带标签的版本，也不会为较旧的提交提供安全补丁的
-回溯（backport）。所有修复都会合入 `main`；如果你正在使用较旧的检出版本，请更新到最新的
-`main`。
+仅支持最新的 `main` 分支。本项目没有打标签的发布版本，也不会为较旧的提交提供回溯
+（backport）安全补丁；安全修复都会合入 `main`。如果你正在使用较旧的检出版本，请更新到
+最新的 `main`。
 
 | 版本 | 是否受支持 |
 | --- | --- |

diff --git a/client/Admin/README.md b/client/Admin/README.md
@@ -1,11 +1,11 @@
 ## 项目概览
 
-Admin 是一个使用 Angular 14 构建的管理端前端应用，集成 AWS Amplify（Cognito User Pool）完成用户认证，通过全局 HTTP 拦截器为 API 请求自动附加 ID Token 进行后端鉴权。路由采用懒加载模块，顶层使用 `AmplifyAuthenticator` 门户在 UI 层完成“登录后可见”的访问控制。
+Admin 是一个使用 Angular 20 构建的管理端前端应用，集成 AWS Amplify（Cognito User Pool）完成用户认证，通过全局 HTTP 拦截器为 API 请求自动附加 ID Token 进行后端鉴权。路由采用懒加载模块，顶层使用 `AmplifyAuthenticator` 门户在 UI 层完成“登录后可见”的访问控制。
 
 ## 技术栈
 
-- **框架**: Angular 14, RxJS 7
-- **UI**: Angular Material, Angular CDK, Flex Layout, Bootstrap
+- **框架**: Angular 20, RxJS 7
+- **UI**: Angular Material, Angular CDK, Bootstrap
 - **认证**: AWS Amplify UI + Cognito User Pool (`@aws-amplify/ui-angular`, `aws-amplify`)
 - **网络**: Angular `HttpClient` + 自定义 `HttpInterceptor`
 - **部署**: S3/CloudFront（脚本使用 AWS CLI 从 CloudFormation 读取输出并同步静态资源）
@@ -24,14 +24,14 @@ Admin 是一个使用 Angular 14 构建的管理端前端应用，集成 AWS Amp
   </amplify-authenticator>`
   ```
 
-- **会话与登出**: 使用 `Auth.currentSession()` 获取当前会话；`Auth.signOut({ global: true })` 退出登录（见 `views/auth/AuthComponent`）。
+- **会话与登出**: 使用 `fetchAuthSession()` 获取当前会话；`signOut({ global: true })` 退出登录（均来自 `aws-amplify/auth`，见 `views/auth/AuthComponent`）。
 - **后端鉴权（令牌附加）**: 自定义拦截器 `AuthInterceptor`（在 `app/interceptors` 提供）对除包含 `tenant/init` 的请求外的所有 HTTP 请求读取当前会话 ID Token，并在请求头加入 `Authorization: Bearer <JWT>`：
 
   ```ts
   // src/app/interceptors/auth.interceptor.ts（节选）
-  return from(Auth.currentSession()).pipe(
-    filter((sesh) => !!sesh),
-    map((sesh) => sesh.getIdToken().getJwtToken()),
+  return from(fetchAuthSession()).pipe(
+    filter((sesh) => !!sesh?.tokens?.idToken),
+    map((sesh) => sesh?.tokens?.idToken?.toString() ?? ''),
     switchMap((tok) => next.handle(req.clone({
       headers: req.headers.set('Authorization', 'Bearer ' + tok),
     })))
@@ -104,7 +104,7 @@ Admin 是一个使用 Angular 14 构建的管理端前端应用，集成 AWS Amp
 
 ## 权限与路由控制的扩展建议
 
-- 如需前端基于角色的控制，可新增守卫（如 `CanActivate`）读取 `Auth.currentSession()` 的 ID Token Claim（例如 Cognito 组或自定义 Claim），结合路由 `data` 元信息决定放行与否。
+- 如需前端基于角色的控制，可新增守卫（如 `CanActivate`）读取 `fetchAuthSession()` 的 ID Token Claim（例如 Cognito 组或自定义 Claim），结合路由 `data` 元信息决定放行与否。
 - 导航菜单可基于角色/Claim 进行动态过滤。
 - 如需白名单更多无需鉴权的接口，可在 `AuthInterceptor` 中扩展排除逻辑。
 

diff --git a/client/Admin/docs/modules.md b/client/Admin/docs/modules.md
@@ -1,10 +1,10 @@
 # Admin 模块功能说明
 
 ## 项目概述
-Admin 是一个基于 Angular 14 和 AWS Amplify 构建的管理端前端应用，提供完整的租户和用户管理功能。
+Admin 是一个基于 Angular 20 和 AWS Amplify 构建的管理端前端应用，提供完整的租户和用户管理功能。
 
 ## 技术架构
-- **前端框架**: Angular 14 + RxJS 7
+- **前端框架**: Angular 20 + RxJS 7
 - **UI 组件**: Angular Material + Angular CDK
 - **认证系统**: AWS Amplify + Cognito User Pool
 - **状态管理**: RxJS + Angular 服务
@@ -29,9 +29,6 @@ Admin 是一个基于 Angular 14 和 AWS Amplify 构建的管理端前端应用
 - **路由配置**: `/dashboard`
 - **懒加载**: 是
 
-### 页面截图
-![Dashboard](./screenshots/dashboard.png)
-
 ---
 
 ## Tenants 模块
@@ -47,13 +44,10 @@ Admin 是一个基于 Angular 14 和 AWS Amplify 构建的管理端前端应用
 
 ### 技术实现
 - **模块路径**: `views/tenants`
-- **主要组件**: TenantsComponent
+- **主要组件**: ListComponent / CreateComponent
 - **路由配置**: `/tenants`
 - **懒加载**: 是
 
-### 页面截图
-![Tenants](./screenshots/tenants.png)
-
 ---
 
 ## Users 模块
@@ -69,13 +63,10 @@ Admin 是一个基于 Angular 14 和 AWS Amplify 构建的管理端前端应用
 
 ### 技术实现
 - **模块路径**: `views/users`
-- **主要组件**: UsersComponent
+- **主要组件**: ListComponent / CreateComponent
 - **路由配置**: `/users`
 - **懒加载**: 是
 
-### 页面截图
-![Users](./screenshots/users.png)
-
 ## 部署信息
 
 ### 构建命令

diff --git a/client/Application/README.md b/client/Application/README.md
@@ -1,6 +1,6 @@
 # Application
 
-This project was generated with [Angular CLI](https://github.com/angular/angular-cli) version 14.0.5.
+This project was generated with [Angular CLI](https://github.com/angular/angular-cli) version 20.x.
 
 ## Development server
 
@@ -20,7 +20,13 @@ Run `ng test` to execute the unit tests via [Karma](https://karma-runner.github.
 
 ## Running end-to-end tests
 
-Run `ng e2e` to execute the end-to-end tests via a platform of your choice. To use this command, you need to first add a package that implements end-to-end testing capabilities.
+The canonical e2e suite is [Playwright](https://playwright.dev) at the repo root `e2e/` directory. Run it with:
+
+```bash
+cd e2e && npx playwright test
+```
+
+Legacy Cypress specs still exist under `cypress/` (see `cypress/README.md`), but Playwright is the canonical path.
 
 ## Further help
 

diff --git a/client/Application/cypress/README.md b/client/Application/cypress/README.md
@@ -1,8 +1,16 @@
-# Application End-to-End Testing
+# Application End-to-End Testing (Legacy Cypress)
 
-## Instructions
+> **Note:** The canonical e2e suite is now [Playwright](https://playwright.dev) at the repo root `e2e/` directory. Run it with:
+>
+> ```bash
+> cd e2e && npx playwright test
+> ```
+>
+> The Cypress specs in this folder are legacy/optional and kept for reference only.
 
-To run End-to-End (e2e) tests against the Sample Application, take the following steps:
+## Instructions (legacy Cypress)
+
+To run the legacy Cypress e2e tests against the Sample Application, take the following steps:
 
 1. Make a copy of the example env file (`cypress.env.json.example`):
 
@@ -22,7 +30,7 @@ cp cypress.env.json.example cypress.env.json
 
 - `email`: The email address to use for testing. (This should be a valid email address.)
 
-3. Navigate to the root of the Application project (`aws-saas-factory-ref-solution-serverless-saas/clients/Application/`) and run the following:
+3. Navigate to the root of the Application project (`aws-serverless-saas-quickstart/client/Application/`) and run the following:
 
 ```bash
 npx cypress run

diff --git a/client/Landing/README.md b/client/Landing/README.md
@@ -1,6 +1,6 @@
 # Landing
 
-This project was generated with [Angular CLI](https://github.com/angular/angular-cli) version 14.0.5.
+This project was generated with [Angular CLI](https://github.com/angular/angular-cli) version 20.x.
 
 ## Development server
 
@@ -20,7 +20,11 @@ Run `ng test` to execute the unit tests via [Karma](https://karma-runner.github.
 
 ## Running end-to-end tests
 
-Run `ng e2e` to execute the end-to-end tests via a platform of your choice. To use this command, you need to first add a package that implements end-to-end testing capabilities.
+The canonical e2e suite is [Playwright](https://playwright.dev) at the repo root `e2e/` directory. Run it with:
+
+```bash
+cd e2e && npx playwright test
+```
 
 ## Further help
 

diff --git a/client/Landing/src/app/views/register/register.component.html b/client/Landing/src/app/views/register/register.component.html
@@ -1,4 +1,4 @@
-<div fxLayout="column" class="tenant-form">
+<div class="tenant-form">
   <form [formGroup]="tenantForm" class="wide-form">
     <mat-card class="card">
       <mat-card-title>Provision a new Tenant</mat-card-title>