yun-zhi-ztl
04eb468a19
feat(skill): add lifecycle management UI
2026-03-15 17:02:03 +08:00
yun-zhi-ztl
cc8ce22c85
feat(report): add skill report backend workflow
2026-03-15 16:41:31 +08:00
yun-zhi-ztl
0bdca1ab81
feat(skill): add lifecycle management APIs
2026-03-15 16:30:10 +08:00
tww
f38fea85b5
cli
2026-03-15 16:02:54 +08:00
yun-zhi-ztl
2b6f4e335e
refactor(web): move portal APIs under api/web
2026-03-15 15:48:14 +08:00
yun-zhi-ztl
17dcb4807a
fix(review): allow super admins to review own skills
2026-03-15 15:39:37 +08:00
yun-zhi-ztl
a7d1ba1952
fix(download): fall back to safe same-origin skill downloads
2026-03-15 14:20:14 +08:00
yun-zhi-ztl
9f4ac978b9
feat(token): support copy hints and expiration updates
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
f3c3c2beeb
feat(token): support configurable expiration times
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
091a5fe190
fix(search): improve short skill query matching
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
835b0da397
fix(auth): reduce login timing side channels
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
1aefa365a7
fix(search): reduce noisy matches for short prefixes
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
cc11f2f023
fix(search): unify prefix vector search behavior
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
c9b49ad5b0
fix(auth): harden mock auth and rate limit auth flows
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
605634290a
fix(publish): allow long skill descriptions
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
6e3582b4bc
fix(admin): avoid runtime role helper dependency
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
984c25d104
fix(publish): reject oversized skill summaries
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
6a53a6f6c7
fix(admin): resolve user ids for role updates
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
149f811b43
fix(auth): localize password change feedback
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
1d983233de
fix(auth): default new users to USER role
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
bace5f0b1b
fix(my-skills): show pending skills after upload
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
bf62b340ab
fix: change api/v1/cli to api/v1
2026-03-14 20:35:50 +08:00
yun-zhi-ztl
9040b8ef3a
chore(api): add concise logs for failed core requests
2026-03-14 20:01:45 +08:00
yun-zhi-ztl
a1083412e1
fix(stars): keep favorites data in sync
2026-03-14 19:51:06 +08:00
yun-zhi-ztl
05c4842ac5
fix(auth): validate email format on register
2026-03-14 19:47:02 +08:00
yun-zhi-ztl
bf319332c5
feat(token): paginate token list
2026-03-14 19:44:11 +08:00
yun-zhi-ztl
fc9bdffc7d
fix(token): validate name length and uniqueness
2026-03-14 19:38:18 +08:00
yun-zhi-ztl
df850d1f63
fix(search): support short skill queries
2026-03-14 19:30:15 +08:00
yun-zhi-ztl
a5d6b6246b
fix(auth): localize login errors and align API error handling
2026-03-14 19:05:20 +08:00
yun-zhi-ztl
188f6108d1
feat(auth): improve extensible login method metadata
2026-03-14 18:52:35 +08:00
yun-zhi-ztl
142685610a
fix(test): update ReviewPermissionCheckerTest for stricter self-review policy
...
After merge, HEAD's ReviewPermissionChecker prohibits all self-review
(including SKILL_ADMIN/SUPER_ADMIN). Updated tests to reflect this
stricter security model from A2.
2026-03-14 17:52:56 +08:00
yun-zhi-ztl
a6cf862e8e
merge(main): sync latest origin/main into feature/project-review
...
Resolved 9 conflicts according to documented strategy:
- .gitignore: kept both entries (docs/review/ + CLAUDE.md)
- ClawHubCompatController.java: manual merge (use @AuthenticationPrincipal + platformRoles)
- ClawHubCompatControllerTest.java: kept ours (HEAD security tests)
- CliControllerTest.java: kept ours (HEAD platform roles tests)
- ReviewPermissionChecker.java: kept ours (stricter permission model)
- SkillPublishService.java: kept theirs (main SUPER_ADMIN bypass + events)
- SkillPublishServiceTest.java: kept theirs (main complete test suite)
- router.tsx: manual merge (HEAD's createLazyRouteComponent + main's privacy/terms)
- markdown-renderer.tsx: kept ours (HEAD frontmatter stripping + styles)
All A1-A9 security fixes preserved. No new logic introduced.
2026-03-14 17:50:38 +08:00
wowo
b96126a267
Merge pull request #20 from iflytek/bugfix/require-auth-for-download
...
fix: require authentication for downloads and fix download count increment
2026-03-14 17:22:38 +08:00
yun-zhi-ztl
3a5e03fd63
Merge pull request #5 from iflytek/feature/projcet-clawhub
...
feat: add ClawHub registry compatibility layer for public skill installation
2026-03-14 02:21:06 -07:00
wowo-zZ
871278d43a
fix(infra): add @Transactional to incrementDownloadCount
...
The @Modifying query requires a transaction context to execute.
Adding @Transactional at the repository method level ensures the
update query runs within a transaction, even when called from
async event listeners.
This fixes the issue where download counts were not being incremented
after skill downloads due to TransactionRequiredException.
2026-03-14 17:03:58 +08:00
wowo-zZ
56e7baed15
fix(auth): require authentication for skill downloads
...
- Remove download endpoints from permitAll list in SecurityConfig
- Add authentication checks to download tests
- Add login redirect for unauthenticated download attempts in frontend
This prevents unauthorized access to skill package downloads while
maintaining public access to skill metadata and file listings.
2026-03-14 16:54:10 +08:00
wowo-zZ
e97752735c
fix(auth): improve logout flow to always redirect to home
...
- Use window.location.href for full page refresh
- Move redirect to finally block to ensure it always executes
- Fix V7 migration to be a no-op since column is already jsonb
2026-03-14 15:40:53 +08:00
wowo
bd87e701cf
Merge pull request #14 from iflytek/feat/optimize-staging-build
...
feat: optimize development workflow with fast local dev and staging environments
2026-03-14 14:27:48 +08:00
wowo-zZ
5581bd6f06
feat(staging): optimize staging build with local Maven packaging
...
- Add server/Dockerfile.dev for fast local builds (JRE-only, ~70MB)
- Modify staging target to build JAR locally before Docker image
- Update .dockerignore to allow target/ directory for Dockerfile.dev
- Build time reduced from 17+ minutes to ~4 seconds
- Reuses local Maven cache (~/.m2/repository) instead of downloading in Docker
2026-03-14 14:21:06 +08:00
wowo-zZ
5254cd155e
update
2026-03-14 13:54:39 +08:00
wowo-zZ
797cfc5272
feat(dev): add Spring Boot DevTools for fast restart in local dev
2026-03-14 13:23:50 +08:00
wowo-zZ
d631b0e20a
fix(ops): resolve storage permission and audit log JSONB type issues
...
Fixes two critical issues when deploying with runtime.sh:
1. Storage Permission Error
- Problem: AccessDeniedException when publishing skills
- Root cause: /var/lib/skillhub/storage owned by root, but app runs as 'app' user
- Solution: Pre-create storage directory with correct permissions in Dockerfile
2. Audit Log JSONB Type Error
- Problem: PostgreSQL JSONB type mismatch when recording audit logs
- Root cause: Missing type mapping annotation in AuditLog entity
- Solution: Add @JdbcTypeCode(SqlTypes.JSON) annotation and V7 migration
Changes:
- server/Dockerfile: Add storage directory creation and permission setup
- server/skillhub-domain/.../AuditLog.java: Add @JdbcTypeCode annotation
- server/skillhub-app/.../V7__fix_audit_log_jsonb_type.sql: Migration for existing data
Impact:
- New deployments: Issues resolved automatically
- Existing deployments: Flyway auto-applies V7 migration on upgrade
2026-03-14 11:23:19 +08:00
vsxd
ac352314f7
Add extensible auth compatibility layer for private SSO
2026-03-13 18:00:22 +08:00
vsxd
9ae9b93ca7
Refine production compose runtime config
2026-03-13 17:00:47 +08:00
vsxd
14d86c290a
chore(release): v0.1.0-beta.7
2026-03-13 16:05:08 +08:00
yun-zhi-ztl
f96fa74413
feat(compat): add clawhub registry adapter
2026-03-13 16:04:33 +08:00
vsxd
3682a4646b
Auto-publish skills submitted by super admins
2026-03-13 15:36:56 +08:00
vsxd
d82665baba
feat(review): allow admins to review their own submissions
2026-03-13 14:23:20 +08:00
yun-zhi-ztl
cab3bc3f8c
Merge branch 'main' into feature/project-review
2026-03-13 13:21:51 +08:00
vsxd
763c908f74
Revert "fix(api): 统一所有分页接口为1-based page"
...
This reverts commit 3706e920df
2026-03-13 12:56:29 +08:00
