Commit graph

418 commits

Author SHA1 Message Date
XiaoSeS
ccc3a6e758 fix(publish): constrain rejected version replacement
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
2026-07-28 13:45:02 +08:00
FenjuFu
466d50280e test(publish): drop the spring-test dependency from the new test
skillhub-domain has no spring-test on its test classpath, so
ReflectionTestUtils does not resolve there. Use plain JDK reflection for
setting the generated id and invoking the private method.

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
2026-07-23 17:13:40 +08:00
FenjuFu
8677244685 fix(publish): delete review tasks of any status when replacing a version
Re-uploading a rejected version under the same version number returned
HTTP 500. deleteReplaceableVersionArtifacts only removed a PENDING review
task, but a rejected version owns a REJECTED one; that row kept a foreign
key on the skill_version, so the subsequent delete hit a constraint
violation that surfaced as a 500.

Delete every review task attached to the version instead.

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
2026-07-23 17:01:11 +08:00
dongmucat
3a254d7524 fix(auth): guard SUPER_ADMIN role mutations
Signed-off-by: dongmucat <1127093059@qq.com>
2026-07-01 16:23:45 +08:00
dongmucat
8413ee3950
Merge pull request #554 from iflytek/fix/auth-password-settings
Some checks failed
Security / Dependency Review (push) Has been cancelled
Security / CodeQL (java-kotlin) (push) Has been cancelled
Security / CodeQL (javascript-typescript) (push) Has been cancelled
fix(auth): restore password settings access
2026-06-24 10:50:26 +08:00
dongmucat
e501be9cf8 feat(promotion): improve promotion review dashboard
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-24 09:28:43 +08:00
dongmucat
665ee0499a feat(auth): add ISSUE-60 password capability field
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-22 12:40:01 +08:00
dongmucat
f8ea4e67e4
feat(cli): support anonymous public search and install
feat(cli): support anonymous public search and install
2026-06-18 14:29:45 +08:00
dongmucat
48a1de9640 fix(notification): preserve SSE headers for notification stream
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-17 15:19:07 +08:00
dongmucat
cf22f568f7 test(cli): align auth tests with bearer hardening
Refs: 25f57a32-5f1d-4d56-b6b7-9b6b7b868799
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-17 11:35:17 +08:00
dongmucat
cb4bf94711 fix(cli): filter installable search before pagination
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-17 11:35:16 +08:00
dongmucat
5a708a5bd6 fix(domain): reject anonymous restricted resolves cleanly
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-17 11:35:16 +08:00
dongmucat
f5259daa94 fix(cli): require installable latest in search
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-17 11:35:16 +08:00
dongmucat
32cc316b30 fix(cli): align anonymous installability rules
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-17 11:35:16 +08:00
dongmucat
b56973fb80 fix(auth): fail closed invalid cli bearer tokens
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-17 11:35:16 +08:00
dongmucat
e4e1639833
Merge pull request #536 from iflytek/fix/review-super-admin-self-promotion
fix(review): allow super admin self promotion review
2026-06-17 11:25:09 +08:00
dongmucat
a85298f7ae
Merge pull request #508 from iflytek/fix/security-review-hardening
fix(security): harden review findings
2026-06-17 11:08:38 +08:00
dongmucat
a23cbd84eb
Merge pull request #530 from iflytek/fix/issue-51-profile-review-notifications
fix: admin notifications for profile review requests
2026-06-17 11:08:10 +08:00
dongmucat
e50140272b fix(security): close review hardening gaps
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-16 17:48:15 +08:00
dongmucat
a73dba5f80
Merge pull request #533 from iflytek/fix/publish-notification-owner
fix(notification): avoid publish notice for promotion reviewers
2026-06-16 15:16:08 +08:00
dongmucat
73767a9022 fix(notification): avoid publish notice for promotion reviewers
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-16 12:19:27 +08:00
dongmucat
8527409742 fix(notification): keep SSE live push streams open (#524)
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-16 11:57:49 +08:00
dongmucat
256344cbde fix(review): allow super admin self promotion review
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-16 11:29:39 +08:00
dongmucat
a865960cf3 fix(notification): ISSUE-51 add profile review notifications
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-16 10:33:02 +08:00
dongmucat
6d6577faa2 fix(bootstrap): confirm builtin publish warnings
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-16 10:23:02 +08:00
dongmucat
abdad25df3 feat(bootstrap): add agentguard builtin skill
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-15 15:32:35 +08:00
dongmucat
40d7de8462 fix(security): harden review findings
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-12 14:40:30 +08:00
dongmucat
4776550391
Merge pull request #498 from iflytek/feature/cloud-url-builtin-skills
feat(bootstrap): sync built-in skills from cloud manifest
2026-06-11 17:27:26 +08:00
XiaoSeS
a88b09e51b fix(publish): accept case-insensitive SKILL.md uploads 2026-06-11 16:34:13 +08:00
dongmucat
8045e52f5e feat(bootstrap): add skillhub hello builtin skill
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-11 11:20:27 +08:00
dongmucat
0298823d06 fix(skill): remove namespace bundle backend residues
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-10 19:48:27 +08:00
dongmucat
f93ab170e5 Merge remote-tracking branch 'origin/main' into feature/cloud-url-builtin-skills
Signed-off-by: dongmucat <1127093059@qq.com>

# Conflicts:
#	server/skillhub-domain/src/main/java/com/iflytek/skillhub/domain/skill/service/SkillPublishService.java
2026-06-10 16:53:48 +08:00
dongmucat
f35f91616a fix(publish): preserve latest version reference cleanup order
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-10 16:51:35 +08:00
dongmucat
1b09ab88a2 fix(bootstrap): enforce strict builtin skill skips
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-10 14:19:41 +08:00
dongmucat
dd3e511a91 fix(bootstrap): support skill directory archives
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-10 10:31:40 +08:00
dongmucat
43d66a59e1 Merge remote-tracking branch 'origin/main' into HEAD
Signed-off-by: dongmucat <1127093059@qq.com>

# Conflicts:
#	server/skillhub-domain/src/test/java/com/iflytek/skillhub/domain/skill/service/SkillDownloadServiceTest.java
2026-06-09 14:29:03 +08:00
dongmucat
ed13a41ed8 fix(skill): align anonymous download helper with main
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-09 14:25:17 +08:00
dongmucat
973c37613e fix(bootstrap): harden builtin skill sync
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-09 14:19:25 +08:00
dongmucat
973c336c82 fix(auth): protect builtin system account boundaries
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-08 18:01:20 +08:00
Xudong Sun
7e23508a32
chore(logging): include idempotency cleanup threshold 2026-06-08 17:31:07 +08:00
dongmucat
5cc934a294 fix(bootstrap): harden builtin skill startup sync
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-08 15:20:10 +08:00
dongmucat
4c4a888b01 fix(bootstrap): harden built-in skill startup sync
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-08 14:01:19 +08:00
dongmucat
6e094f4199 fix(skill): cap namespace bundle downloads
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-08 10:46:30 +08:00
XiaoSeS
531d59caf2
feat(my-skills): add keyword search, namespace filter and clickable pagination (#493)
* feat(my-skills): add keyword search, namespace filter and clickable pagination

Add comprehensive filtering and search capabilities to the My Skills page:

- Keyword search: search by skill name, slug, or description
- Namespace filter: filter skills by namespace
- Clickable pagination: page number buttons with smart ellipsis
- State preservation: sync search state to URL, restore when returning from detail page
- Debounced search: 300ms debounce to avoid excessive queries
- Fix: hide stale rejected preview badge when newer version is published

Backend changes:
- MySkillAppService: add keyword and namespace filtering logic
- SkillLifecycleProjectionService: only show preview versions newer than published
- MeController: add keyword and namespace query parameters
- 6 new test cases covering search and filter scenarios

Frontend changes:
- my-skills.tsx: search input, namespace dropdown, URL state sync
- pagination.tsx: clickable page numbers with ellipsis
- use-user-queries.ts: prevent flicker on query transitions
- skill-detail.tsx: remove invalid rejected badge display
- router.tsx: URL parameter validation
- i18n: add search-related translation keys

Synced from SAAS commits:
- 939fa749 (feat: search and filters)
- dc14df6c (fix: search flicker)
- 0168ea81 (fix: rejected badge)
- c9eefa93 (fix: stale preview)

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(tests): address test failures in PR #493

Backend test fixes:
- Remove unnecessary Mockito stubbing for filtered-out skills
- Add missing findBySkillIdAndStatus stub for published version lookup
- Update MeController test mocks to match new method signature (keyword, namespace params)

Frontend fixes:
- Fix TypeScript error: useMyNamespaces returns ManagedNamespace[] not PagedResponse
- Add type annotation for namespace map callback parameter

E2E test fix:
- Update URL regex to allow query parameters (returnTo from search page)

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(tests): resolve test failures in PR #493

Backend:
- Remove unnecessary mock stubbings for skillId 2 and 3 in MySkillAppServiceTest.listMySkills_combinesKeywordNamespaceAndStatusFilters
- The test filters results to only return skill with id=1, so mocks for id 2 and 3 were never called, causing UnnecessaryStubbingException

Frontend:
- Add missing mocks for useLocation, useSearch, useMyNamespaces, and useDebounce in my-skills.test.ts
- MySkillsPage component uses these hooks but the test setup didn't provide mocks, causing 'No QueryClient set' and 'No export' errors

All 4 frontend tests now pass locally.

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

---------

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
2026-06-05 17:24:51 +08:00
dongmucat
9bb6b31db7 feat(bootstrap): sync built-in skills from cloud manifest
Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-05 16:27:02 +08:00
XiaoSeS
31b25fb6c5
fix(domain): clear skill.latest_version_id before deleting skill_version (#495)
The PG FK constraint fk_skill_latest_version blocks deleting a
SkillVersion whenever Skill.latest_version_id still references it.
Two services had the wrong order:

- SkillPublishService.deleteReplaceableVersionArtifacts: triggered
  when re-uploading the same version (UPLOADED -> overwritten).
  Reproduced by AstronClaw client retrying personal-skills upload.

- SkillGovernanceService.deleteVersion: triggered when admin deletes
  a draft version that happens to be skill.latest_version_id.

Fix: clear skill.latest_version_id and flush BEFORE deleting the
SkillVersion row, so PG sees no live reference at delete time.

Synced from SAAS commit 4626f0c117d9c0544c4dc1115c3aac7468f0d277
2026-06-05 16:21:33 +08:00
XiaoSeS
2bb7dedaf4
feat(cli,domain): support non-global namespace skill download (#497)
* feat(cli,domain): support non-global namespace skill download

Parse namespace from skill name using -- separator (e.g.,
astroclaw--api-gateway) so users don't need --namespace flag.
Allow anonymous download for any PUBLIC skill regardless of namespace.

CLI changes:
- Add cli/src/shared/skill-name-parser.ts utility
- Update install and remove commands to parse skill name argument
- 10 unit tests covering edge cases

Domain changes:
- SkillDownloadService.isAnonymousDownloadAllowed: drop namespace
  type check, only require PUBLIC visibility
- Update test to expect success for team-namespace public skill

Synced from SAAS commit 26c67e31b1221249cf9b73321d1b726d8ba6e6df

* fix(cli): use bun:test instead of vitest in skill-name-parser test
2026-06-05 16:20:34 +08:00
dongmucat
04caf21e76
fix(audit): resolve 8-hour timezone offset in audit log timestamps (#472)
## Problem
Audit log timestamps displayed 8 hours later than actual time when JVM
default timezone != UTC. Root cause: `audit_log.created_at` was
`TIMESTAMP without time zone`, and `rs.getTimestamp()` interprets bare
values using JVM timezone.

## Solution
### Backend
- **V42 migration**: Upgrade `audit_log.created_at` from `TIMESTAMP` to
  `TIMESTAMPTZ`, anchor historical data as UTC via `USING created_at AT
  TIME ZONE 'UTC'` (same pattern as V18/V19/V23/V25/V36)
- **Read path**: `AdminAuditLogAppService.readInstant()` uses
  `rs.getObject(col, OffsetDateTime.class).toInstant()`, result
  independent of JVM timezone
- **Write path (filter params)**: `startTime`/`endTime` binding changed
  from `Timestamp.from()` to `OffsetDateTime.ofInstant(instant,
  ZoneOffset.UTC)` via `toUtcOffsetDateTime()` helper, symmetric with
  read path

### Migration Safety
- `SET LOCAL lock_timeout = '30s'` (transaction-scoped, won't leak to pool)
- `DO $$ ... IF data_type = 'timestamp without time zone' THEN ... ELSE
  ... END $$` idempotent guard with dual-branch `RAISE NOTICE`
- Safe retry: re-running won't double-apply `AT TIME ZONE 'UTC'`

### Test Coverage (10 tests, 477 total suite)
- `rowMapper_readsCreatedAtAsInstant` — UTC offset regression
- `rowMapper_normalisesNonUtcOffsetToInstant` — Non-UTC offset (+08:00)
- `rowMapper_returnsNullTimestampWhenColumnIsNull` — Null path
- `rowMapper_isIndependentOfJvmDefaultTimezone` — JVM TZ=Asia/Shanghai
  drift prevention with `verify(rs, never()).getTimestamp()`
- `@ParameterizedTest buildWhereClause_bindsTimeRangeAsOffsetDateTime` —
  3 cases (both/startOnly/endOnly) for filter param binding
- `@BeforeEach setUp()` — Mock isolation to prevent cross-test stub
  accumulation

## Quality Gates
- [x] `make test-backend-app` passes (477 tests, 0 failures)
- [x] No Controller changes, `make generate-api` not needed
- [x] No frontend changes, typecheck/lint/e2e not needed

## Deployment
V42 must run before new code (guaranteed by Spring Boot startup sequence
→ Flyway executes before app accepts traffic). Rolling deployment:
- New pod + migrated column: correct
- Old pod + migrated column: old code reads TIMESTAMPTZ correctly (pgjdbc
  returns absolute instant)

## Related Docs
- `docs/15-backend-time-governance-plan.md` §3.1: V42 progress registered
- `docs/16-backend-time-inventory.md` §3.1: V42 listed
- Same migration pattern: V18/V19/V23/V25/V36
2026-06-05 15:28:12 +08:00
dongmucat
1ec93db0d6
Revert "feat(bootstrap): initialize built-in skills (#481)" (#487)
This reverts commit 90fc97e740.
2026-06-05 11:25:02 +08:00
dongmucat
90fc97e740
feat(bootstrap): initialize built-in skills (#481)
* feat(bootstrap): initialize built-in skills

Signed-off-by: dongmucat <1127093059@qq.com>

* docs(builtin-skills): remove implementation plan

Signed-off-by: dongmucat <1127093059@qq.com>

---------

Signed-off-by: dongmucat <1127093059@qq.com>
2026-06-05 10:27:37 +08:00