From a6aa073627095d22701d279c32052b002e275bea Mon Sep 17 00:00:00 2001
From: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
Date: Tue, 8 Sep 2026 12:25:29 +0800
Subject: [PATCH] fix(validation): preserve wrapper expression boundaries

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
---
 .../validation/BasicPrePublishValidator.java  | 29 +++++++++++++------
 .../BasicPrePublishValidatorTest.java         |  4 ++-
 2 files changed, 23 insertions(+), 10 deletions(-)

diff --git a/server/skillhub-domain/src/main/java/com/iflytek/skillhub/domain/skill/validation/BasicPrePublishValidator.java b/server/skillhub-domain/src/main/java/com/iflytek/skillhub/domain/skill/validation/BasicPrePublishValidator.java
index c65e8908..ff27ff4c 100644
--- a/server/skillhub-domain/src/main/java/com/iflytek/skillhub/domain/skill/validation/BasicPrePublishValidator.java
+++ b/server/skillhub-domain/src/main/java/com/iflytek/skillhub/domain/skill/validation/BasicPrePublishValidator.java
@@ -131,10 +131,10 @@ public class BasicPrePublishValidator implements PrePublishValidator {
             return new GenericValueScan(null, line.length());
         }
 
-        int quotedStart = findQuotedLiteralStart(line, start);
-        char first = line.charAt(quotedStart);
+        QuotedLiteralStart quotedStart = findQuotedLiteralStart(line, start);
+        char first = line.charAt(quotedStart.index());
         if (first == '\'' || first == '"') {
-            return scanQuotedLiteral(line, quotedStart, first);
+            return scanQuotedLiteral(line, quotedStart.index(), first, quotedStart.wrapperDepth());
         }
 
         int end = start;
@@ -149,20 +149,23 @@ public class BasicPrePublishValidator implements PrePublishValidator {
         return new GenericValueScan(literal, end);
     }
 
-    private int findQuotedLiteralStart(String line, int start) {
+    private QuotedLiteralStart findQuotedLiteralStart(String line, int start) {
         int index = start;
+        int wrapperDepth = 0;
         while (index < line.length() && line.charAt(index) == '(') {
+            wrapperDepth++;
             index++;
             while (index < line.length() && Character.isWhitespace(line.charAt(index))) {
                 index++;
             }
         }
         return index < line.length() && (line.charAt(index) == '\'' || line.charAt(index) == '"')
-                ? index
-                : start;
+                ? new QuotedLiteralStart(index, wrapperDepth)
+                : new QuotedLiteralStart(start, 0);
     }
 
-    private GenericValueScan scanQuotedLiteral(String line, int start, char quote) {
+    private GenericValueScan scanQuotedLiteral(
+            String line, int start, char quote, int wrapperDepth) {
         boolean escaped = false;
         for (int i = start + 1; i < line.length(); i++) {
             char current = line.charAt(i);
@@ -176,7 +179,7 @@ public class BasicPrePublishValidator implements PrePublishValidator {
             }
             if (current == quote) {
                 String value = line.substring(start + 1, i);
-                String literal = hasLiteralTerminator(line, i + 1)
+                String literal = hasLiteralTerminator(line, i + 1, wrapperDepth)
                         && value.length() >= MIN_GENERIC_SECRET_LENGTH
                         ? value
                         : null;
@@ -186,8 +189,14 @@ public class BasicPrePublishValidator implements PrePublishValidator {
         return new GenericValueScan(null, line.length());
     }
 
-    private boolean hasLiteralTerminator(String line, int startIndex) {
+    private boolean hasLiteralTerminator(String line, int startIndex, int wrapperDepth) {
         int index = skipWhitespace(line, startIndex);
+        for (int i = 0; i < wrapperDepth; i++) {
+            if (index == line.length() || line.charAt(index) != ')') {
+                return false;
+            }
+            index = skipWhitespace(line, index + 1);
+        }
         if (isLiteralTerminatorAt(line, index)) {
             return true;
         }
@@ -238,5 +247,7 @@ public class BasicPrePublishValidator implements PrePublishValidator {
 
     private record GenericValueScan(String literal, int nextSearchIndex) {}
 
+    private record QuotedLiteralStart(int index, int wrapperDepth) {}
+
     private record SecretRule(Pattern pattern, int valueGroup, String label) {}
 }
diff --git a/server/skillhub-domain/src/test/java/com/iflytek/skillhub/domain/skill/validation/BasicPrePublishValidatorTest.java b/server/skillhub-domain/src/test/java/com/iflytek/skillhub/domain/skill/validation/BasicPrePublishValidatorTest.java
index 1e19c4c5..fbad8464 100644
--- a/server/skillhub-domain/src/test/java/com/iflytek/skillhub/domain/skill/validation/BasicPrePublishValidatorTest.java
+++ b/server/skillhub-domain/src/test/java/com/iflytek/skillhub/domain/skill/validation/BasicPrePublishValidatorTest.java
@@ -114,8 +114,10 @@ class BasicPrePublishValidatorTest {
                 access_token = token_v2
                 access_token = configuredToken123
                 refresh_token = foo123bar456
+                token = ("static-prefix-") + configuredToken
+                access_token = ("static_prefix_") + configured_token
                 """.getBytes(StandardCharsets.UTF_8),
-                371,
+                476,
                 "text/x-python"
         );