The per-endpoint quotas were compile-time constants in the @RateLimit
annotation, so operators could not tune them or turn limiting off without
rebuilding (#726).
Add RateLimitProperties (skillhub.ratelimit) with a global `enabled` toggle
and per-category threshold overrides, and have RateLimitInterceptor resolve
the effective authenticated/anonymous limit and window from config, falling
back to the annotation defaults. Unset categories keep the built-in values,
so behavior is unchanged until an override is provided; `enabled=false`
disables quota checks entirely. All configurable via SKILLHUB_RATELIMIT_*
environment variables.
Closes#726
Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
Resolve open npm Dependabot alerts for the web app and docs site by refreshing dependency overrides and lockfiles.
Also sets the staging web forwarded-proto default so `make staging` can render the shared Nginx template when using the bare nginx image.
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
Add two entries collected from community support, to both the zh docs and
the en i18n mirror:
- FAQ: installing a skill via CLI reporting `namespace not found` — set the
registry / log in with an API token, and use the correct namespace slug
(`@team/skill` -> `team--skill`); the web UI Install button provides a
ready-made command.
- Troubleshooting: PostgreSQL container failing to start with
`operation not permitted` on bind mounts — fix data volume ownership
(`chown 999:999`), check SELinux, or use the `runtime.sh` script.
Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
RouteSecurityPolicyRegistry keeps two policy lists — AUTHORIZATION_POLICIES for
session/cookie access and API_TOKEN_POLICIES for Bearer tokens — with nothing
keeping them in step. Routes the authorization list opens but the token list
never registers fall through to the catch-all and answer
API token cannot access endpoint: <path>.
Register the routes reported in #713 (/api/v1/labels, the star and rating
writes) plus the same-class gaps for /api/v1/auth/methods and paths below
/api/v1/download, and add a guard test that walks the authorization list and
fails when a route is neither token-reachable nor declared session-only.
DELETE /api/v1/skills/{id}/star also matched the SUPER_ADMIN rule for
DELETE /api/v1/skills/*/*, so un-starring was refused for ordinary accounts on
the session path too. Star and rating writes now have their own authorization
entries ahead of that rule.
Closes#713
Signed-off-by: FenjuFu <fufenjupku@gmail.com>
* fix(security): publish scan task after transaction commit
SecurityScanService.triggerScan is @Transactional but published the Redis
Stream scan task inline, before the transaction committed. The stream
consumer could receive the task before the skill_version / security_audit
rows were visible, fail with "SkillVersion not found" / "SecurityAudit not
found", exhaust its immediate retries while the publishing transaction was
still open, and leave the committed version stuck in SCANNING.
Defer the publish to an afterCommit transaction synchronization so the
consumer only ever sees the task once the rows are committed and visible; on
rollback the task is never published. Falls back to an inline publish when
called outside a transaction.
Closes#612
Signed-off-by: FenjuFu <fufenjupku@gmail.com>
* test(security): cover scan task after-commit publishing
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
* refactor(security): hide scan publish transaction callback
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
---------
Signed-off-by: FenjuFu <fufenjupku@gmail.com>
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
Co-authored-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
Add a compact Related Projects module to README and README_zh pointing to
the sibling iFlytek Astron open-source projects (astron-agent, astron-rpa),
so visitors can discover the wider ecosystem.
Signed-off-by: FenjuFu <fufenjupku@gmail.com>
Add a section to README and README_zh clarifying that SkillHub is a
registry and governance platform, complementary to open skill
collections like anthropics/skills. Includes a comparison table, a
publish-into-SkillHub snippet using the shared SKILL.md format, and a
licensing caveat for the source-available document skills.
Signed-off-by: FenjuFu <fufenjupku@gmail.com>
