- derive review namespace from skill ownership instead of trusting request input\n- require namespace membership for review submission and owner or namespace admin rights for promotion submission\n- forbid unauthorized pending-list and detail reads in review and promotion portal endpoints\n- add domain and controller regression tests for submit and read permission boundaries
- IdempotencyInterceptor: restructure Redis check to avoid swallowing
exceptions inside try-catch, use ApiResponse envelope for 409 response
- IdempotencyInterceptorTest: register JavaTimeModule for Instant
serialization, align mocks with actual implementation
- SkillRatingServiceTest: update expected exception type to match
DomainBadRequestException used in entity and service
- Add IdempotencyRecord entity with status tracking (PROCESSING/COMPLETED/FAILED)
- Implement IdempotencyInterceptor for request deduplication via X-Request-Id header
- Add scheduled cleanup tasks for expired and stale idempotency records
- Create admin API endpoints for user management (list/update role/update status)
- Create admin API endpoints for audit log viewing with filtering
- Add comprehensive unit tests for all components
- Configure test Redis mocks to support idempotency layer
- Add TestRedisConfig with mock RedisTemplate bean
- Restore DeviceAuthService as normal @Service (no conditional)
- Restore controllers as normal @RestController (no conditional)
- Remove DeviceAuthConfig and DeviceAuthWebConfig (not needed)
- All 179 tests pass
- Server Dockerfile: add Maven dependency caching layer for faster rebuilds
- Add .dockerignore for server and web to reduce build context
- Add docker profile to application.yml for container env var mapping
- Makefile: add help, logs, db-reset targets with ## annotations
Task 14: Spring Security config
- SecurityConfig with OAuth2 login, CSRF Cookie-to-Header, CLI API exempt
- ApiTokenAuthenticationFilter before UsernamePasswordAuthenticationFilter
- Spring Session Redis + OAuth2 client config in application.yml
Task 15: MockAuthFilter
- @Profile("local") filter reads X-Mock-User-Id header
- Creates PlatformPrincipal and sets SecurityContext for local dev
Task 16: AuthController + TokenController
- GET /api/v1/auth/me: current user info from session
- GET /api/v1/auth/providers: available OAuth providers
- POST/GET/DELETE /api/v1/tokens: create, list, revoke API tokens
Task 17: Enhanced GlobalExceptionHandler
- ErrorResponse with requestId and timestamp
- 400 for IllegalArgumentException, 500 catch-all with MDC requestId
- Create SkillhubApplication main class
- Add application.yml with JPA, Flyway, graceful shutdown config
- Add application-local.yml for local development profile
- Add database and Redis dependencies to skillhub-app POM
