scriptoriumadmin/skillhub
1
0
Fork 0
mirror of https://github.com/iflytek/skillhub.git synced 2026-09-05 08:05:56 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7
958 commits 212 branches 25 tags 42 MiB
Commit graph

100 commits

Author SHA1 Message Date
yun-zhi-ztl
1d983233de fix(auth): default new users to USER role 2026-03-15 14:20:07 +08:00
yun-zhi-ztl
bf62b340ab fix: change api/v1/cli to api/v1 2026-03-14 20:35:50 +08:00
yun-zhi-ztl
05c4842ac5 fix(auth): validate email format on register 2026-03-14 19:47:02 +08:00
yun-zhi-ztl
bf319332c5 feat(token): paginate token list 2026-03-14 19:44:11 +08:00
yun-zhi-ztl
fc9bdffc7d fix(token): validate name length and uniqueness 2026-03-14 19:38:18 +08:00
yun-zhi-ztl
188f6108d1 feat(auth): improve extensible login method metadata 2026-03-14 18:52:35 +08:00
yun-zhi-ztl
a6cf862e8e merge(main): sync latest origin/main into feature/project-review 
Resolved 9 conflicts according to documented strategy:
- .gitignore: kept both entries (docs/review/ + CLAUDE.md)
- ClawHubCompatController.java: manual merge (use @AuthenticationPrincipal + platformRoles)
- ClawHubCompatControllerTest.java: kept ours (HEAD security tests)
- CliControllerTest.java: kept ours (HEAD platform roles tests)
- ReviewPermissionChecker.java: kept ours (stricter permission model)
- SkillPublishService.java: kept theirs (main SUPER_ADMIN bypass + events)
- SkillPublishServiceTest.java: kept theirs (main complete test suite)
- router.tsx: manual merge (HEAD's createLazyRouteComponent + main's privacy/terms)
- markdown-renderer.tsx: kept ours (HEAD frontmatter stripping + styles)

All A1-A9 security fixes preserved. No new logic introduced.
 2026-03-14 17:50:38 +08:00
wowo-zZ
56e7baed15 fix(auth): require authentication for skill downloads 
- Remove download endpoints from permitAll list in SecurityConfig
- Add authentication checks to download tests
- Add login redirect for unauthenticated download attempts in frontend

This prevents unauthorized access to skill package downloads while
maintaining public access to skill metadata and file listings.
 2026-03-14 16:54:10 +08:00
vsxd
ac352314f7 Add extensible auth compatibility layer for private SSO 2026-03-13 18:00:22 +08:00
vsxd
14d86c290a chore(release): v0.1.0-beta.7 2026-03-13 16:05:08 +08:00
yun-zhi-ztl
cab3bc3f8c Merge branch 'main' into feature/project-review 2026-03-13 13:21:51 +08:00
yun-zhi-ztl
447a34a1d1 merge(main): sync latest origin/main into feature/project-review 2026-03-13 12:49:12 +08:00
vsxd
ac32fce08f fix(auth): preserve return target across oauth login 2026-03-13 11:59:17 +08:00
yun-zhi-ztl
383bc1edae fix(admin): replace compat and admin placeholders with real queries 
Implement compat search through SkillSearchAppService instead of returning an empty placeholder list, and map search results back to canonical slugs for the compatibility API.

Replace hard-coded admin user and audit-log payloads with repository-backed application services. User management now supports paged search and status filters, validates managed statuses and role codes, prevents USER_ADMIN from assigning SUPER_ADMIN, and persists role/status changes against the real repositories. Audit logs now read from the audit_log table through a dedicated query repository/service with filterable pagination.

Align admin response DTOs with the frontend contract, add domain not-found handling for localized 404 responses, and cover the new behavior with controller and service regression tests. Verified with targeted skillhub-app tests plus full server mvn test.
 2026-03-13 11:46:21 +08:00
vsxd
84dd08503d merge: bring feature/project-init into main for beta3 
# Conflicts:
#	scripts/smoke-test.sh
 2026-03-13 11:45:56 +08:00
vsxd
6a9e0845d4 Complete phase 3 and 4 backend workflows 2026-03-13 11:36:34 +08:00
vsxd
76808ca794 test(auth): align auth module tests with current flows 2026-03-13 11:32:50 +08:00
vsxd
5bb2eb0d98 fix(auth): grant global membership to new users 2026-03-13 11:29:01 +08:00
yun-zhi-ztl
ad8bb9c6fd fix(security): whitelist only public skill GET routes 
- require authentication for skill star and rating GET endpoints before the public skill-read rules

- keep documented public skill detail, version, download, resolve, and tag listing endpoints readable anonymously

- add regression coverage for anonymous star and rating access denial plus public tag listing
 2026-03-13 11:12:18 +08:00
yun-zhi-ztl
ec8f7ec838 fix(auth): enforce api token scopes and active-user checks 
- parse stored api token scopes and attach SCOPE authorities during authentication

- reject disabled users from establishing api token sessions and stop touching last-used for inactive accounts

- add an api-token-only scope filter that limits tokens to documented publish and token-management endpoints
 2026-03-13 11:04:52 +08:00
vsxd
3cee8fbb5a fix(phase4): harden smoke checks and metrics access 2026-03-13 10:56:28 +08:00
vsxd
0ca38e73ba merge: bring phase4 worktree implementation into feature/project-init 
# Conflicts:
#	server/skillhub-app/src/main/java/com/iflytek/skillhub/controller/cli/CliPublishController.java
#	server/skillhub-app/src/main/java/com/iflytek/skillhub/controller/portal/SkillPublishController.java
#	server/skillhub-storage/src/main/java/com/iflytek/skillhub/storage/LocalFileStorageService.java
#	web/src/app/router.tsx
 2026-03-13 10:35:42 +08:00
vsxd
b982011614 fix(ops): align smoke test with csrf and metrics access 2026-03-13 10:23:46 +08:00
vsxd
07ea0fa822 merge: bring phase4 worktree implementation into main 
# Conflicts:
#	server/skillhub-app/src/main/java/com/iflytek/skillhub/controller/cli/CliPublishController.java
#	server/skillhub-app/src/main/java/com/iflytek/skillhub/controller/portal/SkillPublishController.java
#	server/skillhub-storage/src/main/java/com/iflytek/skillhub/storage/LocalFileStorageService.java
#	web/src/app/router.tsx
 2026-03-13 10:20:19 +08:00
vsxd
33c44fb9cc feat(phase4): complete auth, governance, observability, and ops polish 2026-03-13 10:17:48 +08:00
vsxd
62d9d88546 chore(release): cut v0.1.0-beta.2 2026-03-13 10:13:50 +08:00
vsxd
d4deb2fb74 fix: address review-reported auth and publish issues 2026-03-13 10:06:25 +08:00
vsxd
f7798dddc5 Revert "merge: bring review fixes into feature/project-init" 
This reverts commit 92f63f8b89, reversing
changes made to 78e16f0fe7.
 2026-03-13 10:06:14 +08:00
vsxd
5bb887b292 fix: address review-reported auth and publish issues 2026-03-12 22:29:51 +08:00
vsxd
8c5b4d176a feat(auth): add local username-password login 2026-03-12 21:59:28 +08:00
tlzhu3
444a52f802 fix(auth): complete device flow token exchange 2026-03-12 21:42:15 +08:00
vsxd
3c9b95fd98 refactor(auth): remove local auth flow 2026-03-12 21:36:49 +08:00
vsxd
e63531ca3d feat(dev): stabilize local env and phase3 flows 2026-03-12 21:33:25 +08:00
vsxd
05ec9bfbc2 feat(auth): add local username-password login 2026-03-12 21:27:01 +08:00
vsxd
50adf3545d refactor(auth): improve DeviceAuthService error handling and tests 
Strengthen device auth flow with better error messages and
additional test coverage.
 2026-03-12 20:11:40 +08:00
vsxd
cab627be02 feat(infra): add i18n messages, Redis config, and slug normalization migration 
- Add rating/admin i18n message keys (en + zh)
- Improve IdempotencyInterceptor error handling
- Add RedisTemplateConfig for consistent serialization
- Add V4 migration to normalize skill slugs
- Fix RequestIdFilterTest
 2026-03-12 20:11:24 +08:00
vsxd
efd43ef3cd feat(compat): add ClawHub compatibility layer 2026-03-12 19:20:02 +08:00
vsxd
fae775eb97 fix(test): provide mock RedisTemplate for test context 
- Add TestRedisConfig with mock RedisTemplate bean
- Restore DeviceAuthService as normal @Service (no conditional)
- Restore controllers as normal @RestController (no conditional)
- Remove DeviceAuthConfig and DeviceAuthWebConfig (not needed)
- All 179 tests pass
 2026-03-12 19:08:25 +08:00
vsxd
5cc595b0ff feat(cli): add skill package check endpoint 2026-03-12 18:26:50 +08:00
vsxd
f47377cff1 feat(cli): add Device Auth controllers 2026-03-12 18:19:03 +08:00
vsxd
9a4d64b11b feat(cli): implement DeviceAuthService with Redis storage 2026-03-12 18:13:46 +08:00
vsxd
37fd831ce7 feat(cli): add Device Flow data models 2026-03-12 18:11:13 +08:00
vsxd
d44f9415fe feat(auth): update security config, auth entities, and token services 2026-03-12 17:47:08 +08:00
vsxd
0b1607630f fix(phase1): close auth and frontend acceptance gaps 2026-03-12 00:37:51 +08:00
vsxd
404692d671 Fix phase1 auth flow gaps 2026-03-12 00:26:33 +08:00
vsxd
6380677fcf feat(auth): complete Chunk 2 - security config, controllers, mock auth 
Task 14: Spring Security config
- SecurityConfig with OAuth2 login, CSRF Cookie-to-Header, CLI API exempt
- ApiTokenAuthenticationFilter before UsernamePasswordAuthenticationFilter
- Spring Session Redis + OAuth2 client config in application.yml

Task 15: MockAuthFilter
- @Profile("local") filter reads X-Mock-User-Id header
- Creates PlatformPrincipal and sets SecurityContext for local dev

Task 16: AuthController + TokenController
- GET /api/v1/auth/me: current user info from session
- GET /api/v1/auth/providers: available OAuth providers
- POST/GET/DELETE /api/v1/tokens: create, list, revoke API tokens

Task 17: Enhanced GlobalExceptionHandler
- ErrorResponse with requestId and timestamp
- 400 for IllegalArgumentException, 500 catch-all with MDC requestId
 2026-03-11 23:55:15 +08:00
vsxd
5c4be0a26f feat(auth): add OAuth2 login, access policy, API token, and RBAC 
Task 10b: OAuth Claims + Access Policy
- OAuthClaims record, OAuthClaimsExtractor SPI, GitHubClaimsExtractor
- AccessPolicy SPI with Open/EmailDomain/ProviderAllowlist/SubjectWhitelist
- AccessPolicyFactory with config-driven strategy selection
- 8 unit tests for access policies

Task 11: Identity binding + OAuth2 user service
- PlatformPrincipal session-serializable record
- IdentityBindingService: bind-or-create on OAuth login
- CustomOAuth2UserService: policy evaluation + identity binding
- OAuth2LoginSuccessHandler: store principal in session

Task 12: API Token + RBAC
- ApiTokenService: SHA-256 hashed token create/validate/revoke
- ApiTokenAuthenticationFilter: Bearer token authentication
- RbacService: role/permission queries with SUPER_ADMIN bypass
 2026-03-11 23:48:16 +08:00
vsxd
2991eb11e0 feat(domain/infra/auth): add domain entities, JPA repos, and auth entities 
Task 8: Domain layer
- UserAccount entity with UserStatus lifecycle
- Namespace, NamespaceMember entities with NamespaceRole
- Repository interfaces for domain aggregates

Task 9: Infra layer
- UserAccountJpaRepository, NamespaceJpaRepository, NamespaceMemberJpaRepository
- Spring Data JPA implementations

Task 10: Auth entities and repositories
- IdentityBinding, ApiToken, Role, Permission, RolePermission, UserRoleBinding
- JPA repositories for all auth entities
- UserRoleBinding with eager-loaded Role for RBAC queries
 2026-03-11 23:42:53 +08:00
vsxd
edfff6abc7 feat: complete Chunk 1 - backend skeleton and infrastructure 
- Migrate all Maven groupId and Java packages to com.iflytek.skillhub
- Add Docker Compose with PostgreSQL 16, Redis 7, MinIO
- Add Flyway V1 migration with Phase 1 core schema (user, auth, RBAC, namespace, audit)
- Add RequestIdFilter with MDC tracing and X-Request-Id header
- Add GlobalExceptionHandler and ErrorResponse DTO
- Add HealthController (/api/v1/health) and OpenAPI config
- Add basic SecurityConfig permitting public endpoints
- Add H2 test profile for CI-friendly testing without external services
- Add top-level Makefile for dev workflow orchestration
- All 3 tests passing
 2026-03-11 23:35:47 +08:00
vsxd
27b7a4dad1 feat: project ini and docs updates 2026-03-11 22:47:05 +08:00