XiaoSeS
86b4d0508b
fix(skill): defer version storage deletion until commit ( #162 )
...
* fix(skill): resolve duplicate result error when deleting skill with shared namespace+slug
V13 migration changed the unique constraint from (namespace_id, slug) to
(namespace_id, slug, owner_id), allowing multiple skills with the same
namespace+slug but different owners. The findByNamespaceSlugAndSlug query
returned Optional<Skill> which threw IncorrectResultSizeDataAccessException
when 2 rows matched.
Changed the query to return List<Skill> and added ownerId query param to
DELETE endpoints so the frontend can specify exactly which skill to delete.
* fix(review): keep failed scans reviewable and expose feedback
* fix(skill-delete): delete skills by id
* fix(skill): defer version storage deletion until commit
2026-03-26 13:54:30 +08:00
yun-zhi-ztl
6e8b257abb
feat(notification): add in-app notifications and harden delivery
2026-03-23 12:31:28 +08:00
Xudong Sun
21ba6ee938
fea: implement skill label system end to end ( #140 )
...
* docs(label): add skill label system design spec
Covers data model, permission model, search integration,
API design, and frontend design for the label system.
* docs(label): address spec review findings
- Add CHECK constraint on label_definition.type, deny-by-default in app layer
- Use TIMESTAMPTZ consistently for all new tables
- Add (label_id) index on skill_label for filter performance
- Add label count limits (10 per skill, 100 definitions)
- Detail async rebuild strategy (Spring @Async, batch 50, error isolation)
- Clarify search_vector is GENERATED STORED column, auto-maintained
- Expand SearchQuery with labelSlugs field, detail SQL changes
- Define all API response JSON structures
- Clarify PUT update: no slug in body, full-replace translations
- Clarify hard delete with audit_log
- Add cross-namespace permission boundary (promotion scenario)
- Pre-reserve multi-label API param for future
- Clarify ClawHub compat layer: no label support in phase 1
* docs(label): address second-round spec review findings
- Fix chapter numbering (duplicate "6." → "6." + "7.")
- Move labelSlugs to end of SearchQuery record to reduce breaking change
- Add TIMESTAMPTZ convention note for new tables
- Clarify async rebuild transaction boundary (per-skill independent tx)
- Move rebuildByLabelId to app layer to preserve module boundaries
- Clarify multi-label filter uses OR semantics with AND extension path
* docs(label): fix section numbering in frontend design chapter
* Implement skill label system end to end
* Unify label app services and DTOs
* Add admin label management page
* Add label admin backend tests
* Fix merge fallout in generated schema
2026-03-20 15:26:41 +08:00
vsxd
a17deb9b7f
test(app): cover missing query context paths
2026-03-20 11:33:32 +08:00
vsxd
ef7332d520
refactor(app): clarify query boundaries and workflow owners
2026-03-20 11:33:32 +08:00
yun-zhi-ztl
94ecc4d0b2
feat: add super-admin hard delete skill api ( #131 )
...
* feat: add super-admin hard delete skill api
* fix: address hard delete review feedback
* fix: add missing unarchive skill locale
* docs: add skill detail hard delete design
* feat: add owner hard delete flow for skill details
2026-03-20 11:02:02 +08:00
vsxd
2868c10467
refactor(app): slim portal controllers and sync backend findings
2026-03-20 10:09:03 +08:00
vsxd
9bad6a38e2
chore(release): v0.1.0
2026-03-19 20:25:18 +08:00
vsxd
25de227f1b
refactor: consolidate backend workflow and security policies
2026-03-19 15:20:08 +08:00
vsxd
8ef53d0fdd
docs: enrich backend code documentation
2026-03-19 13:37:21 +08:00
vsxd
0814b8939c
refactor: unify backend time handling in utc
2026-03-18 17:16:55 +08:00
vsxd
72054dee0f
Allow anonymous downloads for global public skills
2026-03-17 20:25:26 +08:00
vsxd
e52853c49c
test: cover role and user status permission edges
2026-03-17 14:27:25 +08:00
vsxd
033ac54c76
chore: unify build and test entrypoints
2026-03-17 14:09:22 +08:00
vsxd
66cbdd7b57
fix: official site urls removed
2026-03-16 21:25:55 +08:00
tww
3ab76b201a
cli login fix
2026-03-16 17:33:12 +08:00
tww
bd83f91648
cli fix
2026-03-15 20:34:36 +08:00
yun-zhi-ztl
155a59790a
feat(skill): allow withdrawing pending submissions ( #40 )
2026-03-15 04:26:52 -07:00
yun-zhi-ztl
f544d9419d
Merge remote-tracking branch 'origin/main' into feature/project-local
...
# Conflicts:
# server/skillhub-app/src/test/java/com/iflytek/skillhub/compat/ClawHubRegistryControllerTest.java
# server/skillhub-domain/src/main/java/com/iflytek/skillhub/domain/skill/service/SkillQueryService.java
2026-03-15 17:57:58 +08:00
yun-zhi-ztl
39b0f3c852
fix(security): add baseline content security policy
2026-03-15 17:40:20 +08:00
yun-zhi-ztl
458fc6b300
fix(security): enforce admin roles and expand audit log filters
2026-03-15 17:38:51 +08:00
yun-zhi-ztl
d6fac50309
fix(security): harden auth boundaries and metrics access
2026-03-15 17:29:51 +08:00
tww
f38fea85b5
cli
2026-03-15 16:02:54 +08:00
yun-zhi-ztl
2b6f4e335e
refactor(web): move portal APIs under api/web
2026-03-15 15:48:14 +08:00
yun-zhi-ztl
9f4ac978b9
feat(token): support copy hints and expiration updates
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
f3c3c2beeb
feat(token): support configurable expiration times
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
835b0da397
fix(auth): reduce login timing side channels
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
c9b49ad5b0
fix(auth): harden mock auth and rate limit auth flows
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
1d983233de
fix(auth): default new users to USER role
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
bf62b340ab
fix: change api/v1/cli to api/v1
2026-03-14 20:35:50 +08:00
yun-zhi-ztl
05c4842ac5
fix(auth): validate email format on register
2026-03-14 19:47:02 +08:00
yun-zhi-ztl
bf319332c5
feat(token): paginate token list
2026-03-14 19:44:11 +08:00
yun-zhi-ztl
fc9bdffc7d
fix(token): validate name length and uniqueness
2026-03-14 19:38:18 +08:00
yun-zhi-ztl
188f6108d1
feat(auth): improve extensible login method metadata
2026-03-14 18:52:35 +08:00
yun-zhi-ztl
a6cf862e8e
merge(main): sync latest origin/main into feature/project-review
...
Resolved 9 conflicts according to documented strategy:
- .gitignore: kept both entries (docs/review/ + CLAUDE.md)
- ClawHubCompatController.java: manual merge (use @AuthenticationPrincipal + platformRoles)
- ClawHubCompatControllerTest.java: kept ours (HEAD security tests)
- CliControllerTest.java: kept ours (HEAD platform roles tests)
- ReviewPermissionChecker.java: kept ours (stricter permission model)
- SkillPublishService.java: kept theirs (main SUPER_ADMIN bypass + events)
- SkillPublishServiceTest.java: kept theirs (main complete test suite)
- router.tsx: manual merge (HEAD's createLazyRouteComponent + main's privacy/terms)
- markdown-renderer.tsx: kept ours (HEAD frontmatter stripping + styles)
All A1-A9 security fixes preserved. No new logic introduced.
2026-03-14 17:50:38 +08:00
wowo-zZ
56e7baed15
fix(auth): require authentication for skill downloads
...
- Remove download endpoints from permitAll list in SecurityConfig
- Add authentication checks to download tests
- Add login redirect for unauthenticated download attempts in frontend
This prevents unauthorized access to skill package downloads while
maintaining public access to skill metadata and file listings.
2026-03-14 16:54:10 +08:00
vsxd
ac352314f7
Add extensible auth compatibility layer for private SSO
2026-03-13 18:00:22 +08:00
vsxd
14d86c290a
chore(release): v0.1.0-beta.7
2026-03-13 16:05:08 +08:00
yun-zhi-ztl
cab3bc3f8c
Merge branch 'main' into feature/project-review
2026-03-13 13:21:51 +08:00
yun-zhi-ztl
447a34a1d1
merge(main): sync latest origin/main into feature/project-review
2026-03-13 12:49:12 +08:00
vsxd
ac32fce08f
fix(auth): preserve return target across oauth login
2026-03-13 11:59:17 +08:00
yun-zhi-ztl
383bc1edae
fix(admin): replace compat and admin placeholders with real queries
...
Implement compat search through SkillSearchAppService instead of returning an empty placeholder list, and map search results back to canonical slugs for the compatibility API.
Replace hard-coded admin user and audit-log payloads with repository-backed application services. User management now supports paged search and status filters, validates managed statuses and role codes, prevents USER_ADMIN from assigning SUPER_ADMIN, and persists role/status changes against the real repositories. Audit logs now read from the audit_log table through a dedicated query repository/service with filterable pagination.
Align admin response DTOs with the frontend contract, add domain not-found handling for localized 404 responses, and cover the new behavior with controller and service regression tests. Verified with targeted skillhub-app tests plus full server mvn test.
2026-03-13 11:46:21 +08:00
vsxd
84dd08503d
merge: bring feature/project-init into main for beta3
...
# Conflicts:
# scripts/smoke-test.sh
2026-03-13 11:45:56 +08:00
vsxd
6a9e0845d4
Complete phase 3 and 4 backend workflows
2026-03-13 11:36:34 +08:00
vsxd
76808ca794
test(auth): align auth module tests with current flows
2026-03-13 11:32:50 +08:00
vsxd
5bb2eb0d98
fix(auth): grant global membership to new users
2026-03-13 11:29:01 +08:00
yun-zhi-ztl
ad8bb9c6fd
fix(security): whitelist only public skill GET routes
...
- require authentication for skill star and rating GET endpoints before the public skill-read rules
- keep documented public skill detail, version, download, resolve, and tag listing endpoints readable anonymously
- add regression coverage for anonymous star and rating access denial plus public tag listing
2026-03-13 11:12:18 +08:00
yun-zhi-ztl
ec8f7ec838
fix(auth): enforce api token scopes and active-user checks
...
- parse stored api token scopes and attach SCOPE authorities during authentication
- reject disabled users from establishing api token sessions and stop touching last-used for inactive accounts
- add an api-token-only scope filter that limits tokens to documented publish and token-management endpoints
2026-03-13 11:04:52 +08:00
vsxd
3cee8fbb5a
fix(phase4): harden smoke checks and metrics access
2026-03-13 10:56:28 +08:00
vsxd
0ca38e73ba
merge: bring phase4 worktree implementation into feature/project-init
...
# Conflicts:
# server/skillhub-app/src/main/java/com/iflytek/skillhub/controller/cli/CliPublishController.java
# server/skillhub-app/src/main/java/com/iflytek/skillhub/controller/portal/SkillPublishController.java
# server/skillhub-storage/src/main/java/com/iflytek/skillhub/storage/LocalFileStorageService.java
# web/src/app/router.tsx
2026-03-13 10:35:42 +08:00
