- Fixed double @ in namespace display (@@global -> @global)
- Added download button functionality to download skill package
- Download button is disabled when no version is available
- Cleaned namespace parameter before constructing download URL
- Added platformRoles to User interface in UserMenu
- Implemented role checks for menu items:
- Reviews: SKILL_ADMIN, NAMESPACE_ADMIN, SUPER_ADMIN
- Promotions: SKILL_ADMIN, SUPER_ADMIN
- User Management: USER_ADMIN, SUPER_ADMIN
- Audit Log: AUDITOR, SUPER_ADMIN
- Added translations for new menu items
- Menu items now only show for users with appropriate permissions
- Changed route paths from @$namespace to /$namespace to match TanStack Router syntax
- Added @ prefix stripping in API calls to match backend expectations
- Fixed useParams from parameter to match new route paths
- URL format remains /@namespace/slug but route captures @namespace as parameter
- Added i18next for internationalization support
- Created language switcher component with zh/en support
- Refactored user navigation into dropdown menu
- Moved Dashboard, Security, and Account settings into user menu
- Added translation files for Chinese and English
- Updated layout to use i18n for all text content
Remove the markdown renderer ts-ignore workaround by applying prose styling at the container level, which clears the remaining lint failure without changing rendered behavior.
Convert top-level pages to route-level lazy imports with a shared suspense fallback so the main bundle is no longer forced to include every page upfront. Verified with pnpm run lint, pnpm run typecheck, and pnpm run build; the entry chunk dropped from roughly 770 kB to 338.77 kB after the split.
Change DELETE /api/v1/tokens/{id} to return HTTP 204 No Content so the backend matches the existing OpenAPI contract and the frontend delete flow no longer rejects successful revocations.
Add a controller regression test that verifies the endpoint returns 204 with an empty body and still delegates the revoke call to ApiTokenService. Verified with the targeted TokenControllerTest plus full server mvn test.
Implement compat search through SkillSearchAppService instead of returning an empty placeholder list, and map search results back to canonical slugs for the compatibility API.
Replace hard-coded admin user and audit-log payloads with repository-backed application services. User management now supports paged search and status filters, validates managed statuses and role codes, prevents USER_ADMIN from assigning SUPER_ADMIN, and persists role/status changes against the real repositories. Audit logs now read from the audit_log table through a dedicated query repository/service with filterable pagination.
Align admin response DTOs with the frontend contract, add domain not-found handling for localized 404 responses, and cover the new behavior with controller and service regression tests. Verified with targeted skillhub-app tests plus full server mvn test.
- require authentication for skill star and rating GET endpoints before the public skill-read rules
- keep documented public skill detail, version, download, resolve, and tag listing endpoints readable anonymously
- add regression coverage for anonymous star and rating access denial plus public tag listing
When pathname is '/', Layout now renders only the Outlet without its
own header/footer chrome, so the landing page's self-contained layout
displays correctly.
- parse stored api token scopes and attach SCOPE authorities during authentication
- reject disabled users from establishing api token sessions and stop touching last-used for inactive accounts
- add an api-token-only scope filter that limits tokens to documented publish and token-management endpoints
- add shared package safety policy for path normalization and size limits
- stream zip extraction for cli check and publish flows to reject traversal and oversized entries
- confine local storage keys to the configured base path and add regression coverage
