After merge, HEAD's ReviewPermissionChecker prohibits all self-review
(including SKILL_ADMIN/SUPER_ADMIN). Updated tests to reflect this
stricter security model from A2.
The @Modifying query requires a transaction context to execute.
Adding @Transactional at the repository method level ensures the
update query runs within a transaction, even when called from
async event listeners.
This fixes the issue where download counts were not being incremented
after skill downloads due to TransactionRequiredException.
- Remove download endpoints from permitAll list in SecurityConfig
- Add authentication checks to download tests
- Add login redirect for unauthenticated download attempts in frontend
This prevents unauthorized access to skill package downloads while
maintaining public access to skill metadata and file listings.
- Use window.location.href for full page refresh
- Move redirect to finally block to ensure it always executes
- Fix V7 migration to be a no-op since column is already jsonb
- Add server/Dockerfile.dev for fast local builds (JRE-only, ~70MB)
- Modify staging target to build JAR locally before Docker image
- Update .dockerignore to allow target/ directory for Dockerfile.dev
- Build time reduced from 17+ minutes to ~4 seconds
- Reuses local Maven cache (~/.m2/repository) instead of downloading in Docker
Change DELETE /api/v1/tokens/{id} to return HTTP 204 No Content so the backend matches the existing OpenAPI contract and the frontend delete flow no longer rejects successful revocations.
Add a controller regression test that verifies the endpoint returns 204 with an empty body and still delegates the revoke call to ApiTokenService. Verified with the targeted TokenControllerTest plus full server mvn test.
Implement compat search through SkillSearchAppService instead of returning an empty placeholder list, and map search results back to canonical slugs for the compatibility API.
Replace hard-coded admin user and audit-log payloads with repository-backed application services. User management now supports paged search and status filters, validates managed statuses and role codes, prevents USER_ADMIN from assigning SUPER_ADMIN, and persists role/status changes against the real repositories. Audit logs now read from the audit_log table through a dedicated query repository/service with filterable pagination.
Align admin response DTOs with the frontend contract, add domain not-found handling for localized 404 responses, and cover the new behavior with controller and service regression tests. Verified with targeted skillhub-app tests plus full server mvn test.
- require authentication for skill star and rating GET endpoints before the public skill-read rules
- keep documented public skill detail, version, download, resolve, and tag listing endpoints readable anonymously
- add regression coverage for anonymous star and rating access denial plus public tag listing
