Implement compat search through SkillSearchAppService instead of returning an empty placeholder list, and map search results back to canonical slugs for the compatibility API.
Replace hard-coded admin user and audit-log payloads with repository-backed application services. User management now supports paged search and status filters, validates managed statuses and role codes, prevents USER_ADMIN from assigning SUPER_ADMIN, and persists role/status changes against the real repositories. Audit logs now read from the audit_log table through a dedicated query repository/service with filterable pagination.
Align admin response DTOs with the frontend contract, add domain not-found handling for localized 404 responses, and cover the new behavior with controller and service regression tests. Verified with targeted skillhub-app tests plus full server mvn test.
- require authentication for skill star and rating GET endpoints before the public skill-read rules
- keep documented public skill detail, version, download, resolve, and tag listing endpoints readable anonymously
- add regression coverage for anonymous star and rating access denial plus public tag listing
- parse stored api token scopes and attach SCOPE authorities during authentication
- reject disabled users from establishing api token sessions and stop touching last-used for inactive accounts
- add an api-token-only scope filter that limits tokens to documented publish and token-management endpoints
- Add TestRedisConfig with mock RedisTemplate bean
- Restore DeviceAuthService as normal @Service (no conditional)
- Restore controllers as normal @RestController (no conditional)
- Remove DeviceAuthConfig and DeviceAuthWebConfig (not needed)
- All 179 tests pass
Task 14: Spring Security config
- SecurityConfig with OAuth2 login, CSRF Cookie-to-Header, CLI API exempt
- ApiTokenAuthenticationFilter before UsernamePasswordAuthenticationFilter
- Spring Session Redis + OAuth2 client config in application.yml
Task 15: MockAuthFilter
- @Profile("local") filter reads X-Mock-User-Id header
- Creates PlatformPrincipal and sets SecurityContext for local dev
Task 16: AuthController + TokenController
- GET /api/v1/auth/me: current user info from session
- GET /api/v1/auth/providers: available OAuth providers
- POST/GET/DELETE /api/v1/tokens: create, list, revoke API tokens
Task 17: Enhanced GlobalExceptionHandler
- ErrorResponse with requestId and timestamp
- 400 for IllegalArgumentException, 500 catch-all with MDC requestId
