From b9820116147f70241e06f545a3d66a74fa0d11ef Mon Sep 17 00:00:00 2001
From: vsxd <sun.xd@hotmail.com>
Date: Fri, 13 Mar 2026 10:23:46 +0800
Subject: [PATCH] fix(ops): align smoke test with csrf and metrics access

---
 scripts/smoke-test.sh                                | 12 ++++++++++++
 .../iflytek/skillhub/auth/config/SecurityConfig.java |  1 +
 2 files changed, 13 insertions(+)

diff --git a/scripts/smoke-test.sh b/scripts/smoke-test.sh
index 62a357ab..4a80e0f4 100755
--- a/scripts/smoke-test.sh
+++ b/scripts/smoke-test.sh
@@ -4,6 +4,13 @@ set -euo pipefail
 BASE_URL="${1:-http://localhost:8080}"
 PASS=0
 FAIL=0
+COOKIE_JAR="$(mktemp)"
+
+cleanup() {
+  rm -f "$COOKIE_JAR"
+}
+
+trap cleanup EXIT
 
 check() {
   local desc="$1"
@@ -29,8 +36,13 @@ check "Prometheus metrics" "$BASE_URL/actuator/prometheus" "200"
 check "Namespaces API" "$BASE_URL/api/v1/namespaces" "200"
 check "Auth required" "$BASE_URL/api/v1/auth/me" "401"
 
+curl -s -c "$COOKIE_JAR" "$BASE_URL/api/v1/auth/me" >/dev/null
+CSRF_TOKEN="$(awk '$6 == "XSRF-TOKEN" { print $7 }' "$COOKIE_JAR" | tail -n 1)"
+
 REGISTER_STATUS="$(curl -s -o /dev/null -w "%{http_code}" \
   -X POST "$BASE_URL/api/v1/auth/local/register" \
+  -b "$COOKIE_JAR" \
+  -H "X-XSRF-TOKEN: $CSRF_TOKEN" \
   -H "Content-Type: application/json" \
   -d '{"username":"smoketest","password":"Smoke@2026","email":"smoketest@example.com"}')"
 if [[ "$REGISTER_STATUS" == "200" || "$REGISTER_STATUS" == "409" ]]; then
diff --git a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/config/SecurityConfig.java b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/config/SecurityConfig.java
index a2501712..01fa1032 100644
--- a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/config/SecurityConfig.java
+++ b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/config/SecurityConfig.java
@@ -73,6 +73,7 @@ public class SecurityConfig {
                     "/api/v1/cli/auth/device/**",
                     "/api/v1/cli/check",
                     "/actuator/health",
+                    "/actuator/prometheus",
                     "/v3/api-docs/**",
                     "/swagger-ui/**",
                     "/.well-known/**",