From cebad0bbd7f298764d8ec518161d4cc40a501b6f Mon Sep 17 00:00:00 2001 From: dongmucat <1127093059@qq.com> Date: Mon, 11 May 2026 13:56:08 +0800 Subject: [PATCH] refactor(security): use explicit SCANNING check in processScanResult Gemini review feedback: the previous != PUBLISHED condition was too broad and could inadvertently overwrite terminal states like REJECTED or YANKED. Now explicitly check == SCANNING before transitioning status. --- .../skillhub/domain/security/SecurityScanService.java | 5 ++--- .../skillhub/domain/security/SecurityScanServiceTest.java | 1 + 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/server/skillhub-domain/src/main/java/com/iflytek/skillhub/domain/security/SecurityScanService.java b/server/skillhub-domain/src/main/java/com/iflytek/skillhub/domain/security/SecurityScanService.java index 6439ef8e..7a901f73 100644 --- a/server/skillhub-domain/src/main/java/com/iflytek/skillhub/domain/security/SecurityScanService.java +++ b/server/skillhub-domain/src/main/java/com/iflytek/skillhub/domain/security/SecurityScanService.java @@ -109,9 +109,8 @@ public class SecurityScanService { audit.setScannedAt(Instant.now(Clock.systemUTC())); auditRepository.save(audit); - // Only transition status if the version is not already published (auto-publish flow) - if (version.getStatus() != SkillVersionStatus.PUBLISHED) { - // Set status based on requestedVisibility + // Only transition from SCANNING — leave PUBLISHED/REJECTED/YANKED untouched + if (version.getStatus() == SkillVersionStatus.SCANNING) { if (version.getRequestedVisibility() == SkillVisibility.PRIVATE) { version.setStatus(SkillVersionStatus.UPLOADED); } else { diff --git a/server/skillhub-domain/src/test/java/com/iflytek/skillhub/domain/security/SecurityScanServiceTest.java b/server/skillhub-domain/src/test/java/com/iflytek/skillhub/domain/security/SecurityScanServiceTest.java index 84cc6122..0d71b596 100644 --- a/server/skillhub-domain/src/test/java/com/iflytek/skillhub/domain/security/SecurityScanServiceTest.java +++ b/server/skillhub-domain/src/test/java/com/iflytek/skillhub/domain/security/SecurityScanServiceTest.java @@ -172,6 +172,7 @@ class SecurityScanServiceTest { void processScanResult_updatesAuditAndMovesVersionToPendingReview() { SecurityAudit audit = new SecurityAudit(42L, ScannerType.SKILL_SCANNER); SkillVersion version = new SkillVersion(8L, "1.0.0", "publisher-1"); + version.setStatus(SkillVersionStatus.SCANNING); given(auditRepository.findLatestActiveByVersionIdAndScannerType(42L, ScannerType.SKILL_SCANNER)) .willReturn(Optional.of(audit));