yun-zhi-ztl
7c2bd553e5
test(token): harden duplicate name regression coverage
2026-03-15 19:08:29 +08:00
yun-zhi-ztl
74ac44ed65
fix(publish): simplify frontmatter validation errors
2026-03-15 18:28:22 +08:00
yun-zhi-ztl
30545d6a8a
fix(publish): clarify precheck failures and avoid duplicate toasts
2026-03-15 18:26:14 +08:00
yun-zhi-ztl
f544d9419d
Merge remote-tracking branch 'origin/main' into feature/project-local
...
# Conflicts:
# server/skillhub-app/src/test/java/com/iflytek/skillhub/compat/ClawHubRegistryControllerTest.java
# server/skillhub-domain/src/main/java/com/iflytek/skillhub/domain/skill/service/SkillQueryService.java
2026-03-15 17:57:58 +08:00
yun-zhi-ztl
b44a7c0b35
fix(security): throttle auth failures and sanitize security logs
2026-03-15 17:44:54 +08:00
yun-zhi-ztl
39b0f3c852
fix(security): add baseline content security policy
2026-03-15 17:40:20 +08:00
yun-zhi-ztl
458fc6b300
fix(security): enforce admin roles and expand audit log filters
2026-03-15 17:38:51 +08:00
yun-zhi-ztl
e827df2aa4
fix(publish): add package prechecks and content validation
2026-03-15 17:33:15 +08:00
yun-zhi-ztl
d6fac50309
fix(security): harden auth boundaries and metrics access
2026-03-15 17:29:51 +08:00
yun-zhi-ztl
c552829367
fix(skill): tighten lifecycle detail and search paging
2026-03-15 17:19:05 +08:00
yun-zhi-ztl
090cb156ac
tune(search): improve semantic reranking quality
2026-03-15 17:09:46 +08:00
yun-zhi-ztl
3a5e8d711e
feat(search): add semantic reranking foundation
2026-03-15 17:07:48 +08:00
yun-zhi-ztl
04eb468a19
feat(skill): add lifecycle management UI
2026-03-15 17:02:03 +08:00
yun-zhi-ztl
cc8ce22c85
feat(report): add skill report backend workflow
2026-03-15 16:41:31 +08:00
yun-zhi-ztl
0bdca1ab81
feat(skill): add lifecycle management APIs
2026-03-15 16:30:10 +08:00
tww
f38fea85b5
cli
2026-03-15 16:02:54 +08:00
yun-zhi-ztl
2b6f4e335e
refactor(web): move portal APIs under api/web
2026-03-15 15:48:14 +08:00
yun-zhi-ztl
17dcb4807a
fix(review): allow super admins to review own skills
2026-03-15 15:39:37 +08:00
yun-zhi-ztl
a7d1ba1952
fix(download): fall back to safe same-origin skill downloads
2026-03-15 14:20:14 +08:00
yun-zhi-ztl
9f4ac978b9
feat(token): support copy hints and expiration updates
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
f3c3c2beeb
feat(token): support configurable expiration times
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
091a5fe190
fix(search): improve short skill query matching
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
835b0da397
fix(auth): reduce login timing side channels
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
1aefa365a7
fix(search): reduce noisy matches for short prefixes
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
cc11f2f023
fix(search): unify prefix vector search behavior
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
c9b49ad5b0
fix(auth): harden mock auth and rate limit auth flows
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
605634290a
fix(publish): allow long skill descriptions
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
6e3582b4bc
fix(admin): avoid runtime role helper dependency
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
984c25d104
fix(publish): reject oversized skill summaries
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
6a53a6f6c7
fix(admin): resolve user ids for role updates
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
149f811b43
fix(auth): localize password change feedback
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
1d983233de
fix(auth): default new users to USER role
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
bace5f0b1b
fix(my-skills): show pending skills after upload
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
bf62b340ab
fix: change api/v1/cli to api/v1
2026-03-14 20:35:50 +08:00
yun-zhi-ztl
9040b8ef3a
chore(api): add concise logs for failed core requests
2026-03-14 20:01:45 +08:00
yun-zhi-ztl
a1083412e1
fix(stars): keep favorites data in sync
2026-03-14 19:51:06 +08:00
yun-zhi-ztl
05c4842ac5
fix(auth): validate email format on register
2026-03-14 19:47:02 +08:00
yun-zhi-ztl
bf319332c5
feat(token): paginate token list
2026-03-14 19:44:11 +08:00
yun-zhi-ztl
fc9bdffc7d
fix(token): validate name length and uniqueness
2026-03-14 19:38:18 +08:00
yun-zhi-ztl
df850d1f63
fix(search): support short skill queries
2026-03-14 19:30:15 +08:00
yun-zhi-ztl
a5d6b6246b
fix(auth): localize login errors and align API error handling
2026-03-14 19:05:20 +08:00
yun-zhi-ztl
188f6108d1
feat(auth): improve extensible login method metadata
2026-03-14 18:52:35 +08:00
yun-zhi-ztl
142685610a
fix(test): update ReviewPermissionCheckerTest for stricter self-review policy
...
After merge, HEAD's ReviewPermissionChecker prohibits all self-review
(including SKILL_ADMIN/SUPER_ADMIN). Updated tests to reflect this
stricter security model from A2.
2026-03-14 17:52:56 +08:00
yun-zhi-ztl
a6cf862e8e
merge(main): sync latest origin/main into feature/project-review
...
Resolved 9 conflicts according to documented strategy:
- .gitignore: kept both entries (docs/review/ + CLAUDE.md)
- ClawHubCompatController.java: manual merge (use @AuthenticationPrincipal + platformRoles)
- ClawHubCompatControllerTest.java: kept ours (HEAD security tests)
- CliControllerTest.java: kept ours (HEAD platform roles tests)
- ReviewPermissionChecker.java: kept ours (stricter permission model)
- SkillPublishService.java: kept theirs (main SUPER_ADMIN bypass + events)
- SkillPublishServiceTest.java: kept theirs (main complete test suite)
- router.tsx: manual merge (HEAD's createLazyRouteComponent + main's privacy/terms)
- markdown-renderer.tsx: kept ours (HEAD frontmatter stripping + styles)
All A1-A9 security fixes preserved. No new logic introduced.
2026-03-14 17:50:38 +08:00
wowo
b96126a267
Merge pull request #20 from iflytek/bugfix/require-auth-for-download
...
fix: require authentication for downloads and fix download count increment
2026-03-14 17:22:38 +08:00
yun-zhi-ztl
3a5e03fd63
Merge pull request #5 from iflytek/feature/projcet-clawhub
...
feat: add ClawHub registry compatibility layer for public skill installation
2026-03-14 02:21:06 -07:00
wowo-zZ
871278d43a
fix(infra): add @Transactional to incrementDownloadCount
...
The @Modifying query requires a transaction context to execute.
Adding @Transactional at the repository method level ensures the
update query runs within a transaction, even when called from
async event listeners.
This fixes the issue where download counts were not being incremented
after skill downloads due to TransactionRequiredException.
2026-03-14 17:03:58 +08:00
wowo-zZ
56e7baed15
fix(auth): require authentication for skill downloads
...
- Remove download endpoints from permitAll list in SecurityConfig
- Add authentication checks to download tests
- Add login redirect for unauthenticated download attempts in frontend
This prevents unauthorized access to skill package downloads while
maintaining public access to skill metadata and file listings.
2026-03-14 16:54:10 +08:00
wowo-zZ
e97752735c
fix(auth): improve logout flow to always redirect to home
...
- Use window.location.href for full page refresh
- Move redirect to finally block to ensure it always executes
- Fix V7 migration to be a no-op since column is already jsonb
2026-03-14 15:40:53 +08:00
wowo
bd87e701cf
Merge pull request #14 from iflytek/feat/optimize-staging-build
...
feat: optimize development workflow with fast local dev and staging environments
2026-03-14 14:27:48 +08:00
