scriptoriumadmin/skillhub
1
0
Fork 0
mirror of https://github.com/iflytek/skillhub.git synced 2026-10-14 04:08:16 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(auth): declare staged avatar uploads session-only

Browse source 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
This commit is contained in:
XiaoSeS 2026-10-13 11:47:11 +08:00
parent 1a7ffbe6e2
commit 14cc3f11eb
2 changed files with 14 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/policy/RouteSecurityPolicyRegistry.java
View file

@ -301,6 +301,8 @@ public class RouteSecurityPolicyRegistry {
"ANY /api/v1/auth/direct/login",
"ANY /api/v1/auth/local/**",
"ANY /api/v1/admin/**",
"POST /api/v1/skills/avatar-uploads",
"POST /api/web/skills/avatar-uploads",
"POST /api/v1/suites/reviews/*/approve",
"POST /api/v1/suites/reviews/*/reject",
"POST /api/web/suites/reviews/*/approve",

12
server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/policy/RouteSecurityPolicyRegistryTest.java
View file

@ -48,6 +48,18 @@ class RouteSecurityPolicyRegistryTest {
registry.accessLevel("GET", "/api/web/skills/avatar-review/queue"));
}
@Test
void stagedAvatarUploadRequiresSessionWhilePreviewRequiresAnAuthenticatedUploader() {
for (String prefix : List.of("/api/v1", "/api/web")) {
String upload = prefix + "/skills/avatar-uploads";
assertEquals(RouteSecurityPolicyRegistry.AccessLevel.AUTHENTICATED, registry.accessLevel("POST", upload));
assertTrue(registry.sessionOnlyRoutes().contains("POST " + upload));
assertFalse(registry.authorizeApiToken("POST", upload, ALL_SCOPES).allowed());
assertEquals(RouteSecurityPolicyRegistry.AccessLevel.AUTHENTICATED,
registry.accessLevel("GET", upload + "/upload-id/image"));
}
}
@Test
void reviewRoutesExposePublicListingButProtectCurrentUserMutations() {
assertEquals(RouteSecurityPolicyRegistry.AccessLevel.PERMIT_ALL,