The starred badge in the top-right corner of skill cards looked
cluttered. Removed it while keeping the subtle star highlight
in the bottom stats area.
Add ability for users to update their display name with optional machine/human review.
Backend:
- Add profile_change_request table (V15 migration)
- Add UserProfileService with moderation workflow
- Add PATCH /api/v1/user/profile and GET /api/v1/user/profile endpoints
- Add ProfileModerationService interface with NoOp implementation
- Add ProfileModerationProperties for machine/human review toggles
- Update AuthController /me to refresh session when displayName changes
- Add i18n messages for profile validation and responses
Frontend:
- Add /settings/profile page with edit-on-click pattern
- Add profileApi.updateProfile() to client
- Update user menu: add "Profile Settings", make "Security Settings" local-only
- Add i18n translations (en/zh) for profile settings
Testing:
- Add UserProfileControllerTest with 8 test cases
- Add UserProfileServiceTest with 6 test cases
- Add AuthControllerTest case for session refresh on displayName change
Non-admin users now see "Submitted for Review" instead of "Published
Successfully" after uploading a skill, based on the status returned
by the backend.
* fix: keep download counts consistent across skill pages
* fix: stabilize empty search ordering across sorts
* fix: show disabled-account reason on login redirect
* fix: mute report input placeholder text
* fix: return skill detail to my skills page
* test: stabilize auth context filter coverage
* feat(publish): increase single file limit to 10MB
* feat(publish): expand allowed file extensions
* feat(publish): extend secret scanning to new text file types
* feat(publish): add content validation for new file types
* refactor(publish): inject configurable limits into SkillPackageArchiveExtractor
* feat(publish): support zip with single root directory wrapper
* feat(publish): expand determineContentType for new file types
* test(publish): update tests for new upload constraints
* fix(web): add REJECTED status label and styling to my-skills page
The resolveStatusLabel and resolveStatusClassName functions were missing
the REJECTED case, causing rejected skills to show raw status string
with no color styling.
* fix: prevent deleting the last remaining version of a skill
Backend: added version count check in SkillGovernanceService.deleteVersion()
Frontend: hide delete button when only one version remains
* test: fix and add tests for last-version deletion guard
- Fix deleteVersion_removesDraftFilesAndBundle: mock findBySkillId to
return 2 versions so the new guard doesn't block the happy path
- Add deleteVersion_rejectsLastRemainingVersion: verify that deleting
the only remaining version is rejected with the correct error code
---------
- Change skill uniqueness constraint from (namespace_id, slug) to
(namespace_id, slug, owner_id) to support per-user skill records
- Reject publish when another owner has a published skill with same slug
- Reject review approval when same-slug conflict exists
- Auto-withdraw pending review versions when submitting a new version
- Resolve visible skill by preferring published skill, then current
user's own skill, to fix wrong skill returned for same-slug queries
- Invalidate all skill query cache on publish to prevent stale data
- Backend: /api/v1/auth/me now fetches fresh roles from DB and updates
session when roles have changed, so users see role changes on page
refresh without re-login
- Frontend: invalidate ['auth', 'me'] cache after admin user mutations
(role change, status change, approve, disable, enable) and account merge
- Login: fix reversed eye icon (Eye=visible, EyeOff=hidden)
- Login: hide browser-native password reveal button to avoid duplicate
- Reset form fields and mutation state when create-token dialog reopens
- Fix delete pagination: check items.length === 0 (post-delete) instead of 1
- Restrict skill download to PUBLISHED versions only
Add responsive text wrapping and overflow handling to token-related
components to prevent layout breaking with long token names or descriptions.
Changes:
- Add min-w-0 to dialog headers to allow flex shrinking
- Add break-all/break-words to prevent text overflow
- Add overflow-hidden to token display container
- Apply max-w-48 constraint to token name column
