Blockers:
- Harden XML parsing against XXE (disallow DOCTYPE, external entities/DTDs,
enable FEATURE_SECURE_PROCESSING) and switch to UTF-8 byte decoding.
- Generalize AccessPolicy.evaluate from OAuthClaims to IdentityClaims; extract
IdentityAuthenticator so OAuth and CAS share allow/deny/pending evaluation.
CAS callback now goes through the policy instead of bypassing it with a
direct bindOrCreate call.
- Configure JDK HttpClient with connect/read timeouts (5s/10s) and disable
HTTP redirects to prevent ticket exfiltration via a malicious CAS server.
Major:
- Require HTTPS for skillhub.auth.cas.service-url in addition to server-url.
- Stop logging raw service tickets; log claims.subject() instead.
- Remove the dead authCasEnabled web flag — the backend AuthMethodCatalog is
the single source of truth for CAS visibility, matching how OAuth works.
- Wire SKILLHUB_AUTH_CAS_* env vars into compose.release.yml and add a fully
documented section in .env.release.example.
Minor:
- CasProtocolVersion enum replaces string comparisons in the validator.
- JSON multi-value array attributes are preserved as List<String> instead of
silently dropping all but the first element.
- AuthMethod.methodType union adds 'CAS_REDIRECT'.
- application.yml notes that service-url must equal
${SKILLHUB_PUBLIC_BASE_URL}/api/v1/auth/cas/callback.
Tests:
- CasTicketValidatorTest tightens URL matching to assert ticket/service/format
parameters and adds XXE + billion-laughs regression cases.
- IdentityAuthenticatorTest covers ALLOW / PENDING / DENY paths.
- AuthMethodCatalogTest exercises both cas.enabled=true and =false.
- isExternalRedirectMethod predicate extracted and unit-tested.
Implement native CAS protocol ticket validation for enterprise SSO
integration, supporting both CAS 2.0 (XML) and CAS 3.0 (JSON) modes.
Backend:
- Introduce IdentityClaims interface to abstract identity providers;
OAuthClaims now implements it, enabling CAS reuse of IdentityBindingService
- CasProperties with @PostConstruct HTTPS validation and feature flag
- CasTicketValidator: validates tickets via /serviceValidate (2.0) or
/p3/serviceValidate (3.0), parses XML/JSON responses
- CasLoginController: /api/v1/auth/cas/login (redirect) and /callback
(ticket validation + session establishment)
- RouteSecurityPolicyRegistry: permit /api/v1/auth/cas/**
- AuthMethodCatalog: expose CAS as CAS_REDIRECT method type
Frontend:
- LoginButton renders CAS_REDIRECT methods alongside OAuth providers
- Runtime config adds authCasEnabled flag
- CAS logo SVG added
Closes#456
* fix(runtime): pass auth environment variables to containers
The web container's envsubst in 30-runtime-config.sh only substituted
SKILLHUB_WEB_API_BASE_URL and SKILLHUB_PUBLIC_BASE_URL, leaving auth-related
variables (authDirectEnabled, authSessionBootstrapEnabled, etc.) as literal
${...} strings in runtime-config.js. Additionally, compose.release.yml did not
pass SKILLHUB_WEB_AUTH_DIRECT_ENABLED or SKILLHUB_WEB_AUTH_DIRECT_PROVIDER to
the web container, nor SKILLHUB_AUTH_DIRECT_ENABLED to the server container.
This made it impossible to enable direct (username/password) authentication
for intranet deployments without OAuth2, even though the frontend template and
backend already supported it.
Changes:
- compose.release.yml: add SKILLHUB_AUTH_DIRECT_ENABLED to server env
- compose.release.yml: add auth direct and session bootstrap vars to web env
- 30-runtime-config.sh: expand envsubst to cover all runtime-config.js template variables
- .env.release.example: document the new auth configuration variables
All new variables default to false/empty, preserving existing GitHub OAuth behavior.
* fix: remove session bootstrap frontend config from compose
Per reviewer feedback: exposing SKILLHUB_WEB_AUTH_SESSION_BOOTSTRAP_* in the
compose without matching SKILLHUB_AUTH_SESSION_BOOTSTRAP_ENABLED on the server
would cause 403 errors when frontend attempts bootstrap.
Keep this PR focused on direct auth only. Bootstrap variables are still handled
in 30-runtime-config.sh with false defaults, so runtime-config.js will have
authSessionBootstrapEnabled: "false" and frontend will not trigger bootstrap.
---------
Co-authored-by: wowo <zhenggui5228@126.com>
Co-authored-by: PR Review Helper <review-helper@local>
* docs: add VitePress bilingual documentation site
- Add VitePress-based documentation with Chinese (root) and English (/en/) locales
- Include 6 feature guides: skill-publish, skill-discovery, namespace, review, scanner, social
- Add quickstart, introduction, and FAQ pages
- Include AI-generated diagrams and screenshots
- Add GitHub Pages deployment workflow
- Add Makefile targets: docs-dev, docs-build, docs-preview
* docs: rename docs/claude to docs/skillhub
- Rename documentation directory from docs/claude to docs/skillhub
- Update Makefile paths for docs-dev, docs-build, docs-preview
- Update GitHub workflow paths for deploy-docs.yml
* fix: add enablement parameter to auto-enable GitHub Pages
* Revert "fix: add enablement parameter to auto-enable GitHub Pages"
This reverts commit 11096b1a9b.
* docs: add documentation link to README
Add link to GitHub Pages documentation (https://iflytek.github.io/skillhub/)
under Quick Start section in both English and Chinese README files.
* fix: add --public-url parameter for docker deployment
- Add --public-url parameter to runtime.sh for configuring public access URL
- Create skill.md.template for dynamic URL substitution at container startup
- Update getBaseUrl() to fallback to window.location.host when appBaseUrl is localhost
- Update landing-quick-start.tsx to dynamically generate agent command URL
- Add commandTemplate to i18n files for URL placeholder support
- Update README.md and README_zh.md with deployment parameter documentation
Fixes: Docker deployment shows localhost in install commands and skill.md
