tww
bd83f91648
cli fix
2026-03-15 20:34:36 +08:00
yun-zhi-ztl
28393669e0
feat(skill): allow owner preview of pending submissions
2026-03-15 19:59:19 +08:00
yun-zhi-ztl
4ad97aa55a
feat(skill): add version management APIs
2026-03-15 19:45:10 +08:00
yun-zhi-ztl
29a08d3c54
feat(skill): allow withdrawing pending submissions
2026-03-15 19:23:20 +08:00
yun-zhi-ztl
7c2bd553e5
test(token): harden duplicate name regression coverage
2026-03-15 19:08:29 +08:00
yun-zhi-ztl
f544d9419d
Merge remote-tracking branch 'origin/main' into feature/project-local
...
# Conflicts:
# server/skillhub-app/src/test/java/com/iflytek/skillhub/compat/ClawHubRegistryControllerTest.java
# server/skillhub-domain/src/main/java/com/iflytek/skillhub/domain/skill/service/SkillQueryService.java
2026-03-15 17:57:58 +08:00
yun-zhi-ztl
b44a7c0b35
fix(security): throttle auth failures and sanitize security logs
2026-03-15 17:44:54 +08:00
yun-zhi-ztl
39b0f3c852
fix(security): add baseline content security policy
2026-03-15 17:40:20 +08:00
yun-zhi-ztl
458fc6b300
fix(security): enforce admin roles and expand audit log filters
2026-03-15 17:38:51 +08:00
yun-zhi-ztl
d6fac50309
fix(security): harden auth boundaries and metrics access
2026-03-15 17:29:51 +08:00
yun-zhi-ztl
c552829367
fix(skill): tighten lifecycle detail and search paging
2026-03-15 17:19:05 +08:00
yun-zhi-ztl
3a5e8d711e
feat(search): add semantic reranking foundation
2026-03-15 17:07:48 +08:00
yun-zhi-ztl
04eb468a19
feat(skill): add lifecycle management UI
2026-03-15 17:02:03 +08:00
yun-zhi-ztl
cc8ce22c85
feat(report): add skill report backend workflow
2026-03-15 16:41:31 +08:00
yun-zhi-ztl
0bdca1ab81
feat(skill): add lifecycle management APIs
2026-03-15 16:30:10 +08:00
tww
f38fea85b5
cli
2026-03-15 16:02:54 +08:00
yun-zhi-ztl
2b6f4e335e
refactor(web): move portal APIs under api/web
2026-03-15 15:48:14 +08:00
yun-zhi-ztl
a7d1ba1952
fix(download): fall back to safe same-origin skill downloads
2026-03-15 14:20:14 +08:00
yun-zhi-ztl
9f4ac978b9
feat(token): support copy hints and expiration updates
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
f3c3c2beeb
feat(token): support configurable expiration times
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
c9b49ad5b0
fix(auth): harden mock auth and rate limit auth flows
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
605634290a
fix(publish): allow long skill descriptions
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
6e3582b4bc
fix(admin): avoid runtime role helper dependency
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
984c25d104
fix(publish): reject oversized skill summaries
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
6a53a6f6c7
fix(admin): resolve user ids for role updates
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
149f811b43
fix(auth): localize password change feedback
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
1d983233de
fix(auth): default new users to USER role
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
bace5f0b1b
fix(my-skills): show pending skills after upload
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
bf62b340ab
fix: change api/v1/cli to api/v1
2026-03-14 20:35:50 +08:00
yun-zhi-ztl
9040b8ef3a
chore(api): add concise logs for failed core requests
2026-03-14 20:01:45 +08:00
yun-zhi-ztl
a1083412e1
fix(stars): keep favorites data in sync
2026-03-14 19:51:06 +08:00
yun-zhi-ztl
05c4842ac5
fix(auth): validate email format on register
2026-03-14 19:47:02 +08:00
yun-zhi-ztl
bf319332c5
feat(token): paginate token list
2026-03-14 19:44:11 +08:00
yun-zhi-ztl
fc9bdffc7d
fix(token): validate name length and uniqueness
2026-03-14 19:38:18 +08:00
yun-zhi-ztl
a5d6b6246b
fix(auth): localize login errors and align API error handling
2026-03-14 19:05:20 +08:00
yun-zhi-ztl
188f6108d1
feat(auth): improve extensible login method metadata
2026-03-14 18:52:35 +08:00
yun-zhi-ztl
a6cf862e8e
merge(main): sync latest origin/main into feature/project-review
...
Resolved 9 conflicts according to documented strategy:
- .gitignore: kept both entries (docs/review/ + CLAUDE.md)
- ClawHubCompatController.java: manual merge (use @AuthenticationPrincipal + platformRoles)
- ClawHubCompatControllerTest.java: kept ours (HEAD security tests)
- CliControllerTest.java: kept ours (HEAD platform roles tests)
- ReviewPermissionChecker.java: kept ours (stricter permission model)
- SkillPublishService.java: kept theirs (main SUPER_ADMIN bypass + events)
- SkillPublishServiceTest.java: kept theirs (main complete test suite)
- router.tsx: manual merge (HEAD's createLazyRouteComponent + main's privacy/terms)
- markdown-renderer.tsx: kept ours (HEAD frontmatter stripping + styles)
All A1-A9 security fixes preserved. No new logic introduced.
2026-03-14 17:50:38 +08:00
wowo
b96126a267
Merge pull request #20 from iflytek/bugfix/require-auth-for-download
...
fix: require authentication for downloads and fix download count increment
2026-03-14 17:22:38 +08:00
yun-zhi-ztl
3a5e03fd63
Merge pull request #5 from iflytek/feature/projcet-clawhub
...
feat: add ClawHub registry compatibility layer for public skill installation
2026-03-14 02:21:06 -07:00
wowo-zZ
56e7baed15
fix(auth): require authentication for skill downloads
...
- Remove download endpoints from permitAll list in SecurityConfig
- Add authentication checks to download tests
- Add login redirect for unauthenticated download attempts in frontend
This prevents unauthorized access to skill package downloads while
maintaining public access to skill metadata and file listings.
2026-03-14 16:54:10 +08:00
wowo-zZ
e97752735c
fix(auth): improve logout flow to always redirect to home
...
- Use window.location.href for full page refresh
- Move redirect to finally block to ensure it always executes
- Fix V7 migration to be a no-op since column is already jsonb
2026-03-14 15:40:53 +08:00
wowo
bd87e701cf
Merge pull request #14 from iflytek/feat/optimize-staging-build
...
feat: optimize development workflow with fast local dev and staging environments
2026-03-14 14:27:48 +08:00
wowo-zZ
5254cd155e
update
2026-03-14 13:54:39 +08:00
wowo-zZ
d631b0e20a
fix(ops): resolve storage permission and audit log JSONB type issues
...
Fixes two critical issues when deploying with runtime.sh:
1. Storage Permission Error
- Problem: AccessDeniedException when publishing skills
- Root cause: /var/lib/skillhub/storage owned by root, but app runs as 'app' user
- Solution: Pre-create storage directory with correct permissions in Dockerfile
2. Audit Log JSONB Type Error
- Problem: PostgreSQL JSONB type mismatch when recording audit logs
- Root cause: Missing type mapping annotation in AuditLog entity
- Solution: Add @JdbcTypeCode(SqlTypes.JSON) annotation and V7 migration
Changes:
- server/Dockerfile: Add storage directory creation and permission setup
- server/skillhub-domain/.../AuditLog.java: Add @JdbcTypeCode annotation
- server/skillhub-app/.../V7__fix_audit_log_jsonb_type.sql: Migration for existing data
Impact:
- New deployments: Issues resolved automatically
- Existing deployments: Flyway auto-applies V7 migration on upgrade
2026-03-14 11:23:19 +08:00
vsxd
ac352314f7
Add extensible auth compatibility layer for private SSO
2026-03-13 18:00:22 +08:00
vsxd
9ae9b93ca7
Refine production compose runtime config
2026-03-13 17:00:47 +08:00
vsxd
14d86c290a
chore(release): v0.1.0-beta.7
2026-03-13 16:05:08 +08:00
yun-zhi-ztl
f96fa74413
feat(compat): add clawhub registry adapter
2026-03-13 16:04:33 +08:00
vsxd
3682a4646b
Auto-publish skills submitted by super admins
2026-03-13 15:36:56 +08:00
yun-zhi-ztl
cab3bc3f8c
Merge branch 'main' into feature/project-review
2026-03-13 13:21:51 +08:00
