vsxd
e52853c49c
test: cover role and user status permission edges
2026-03-17 14:27:25 +08:00
vsxd
033ac54c76
chore: unify build and test entrypoints
2026-03-17 14:09:22 +08:00
vsxd
66cbdd7b57
fix: official site urls removed
2026-03-16 21:25:55 +08:00
tww
3ab76b201a
cli login fix
2026-03-16 17:33:12 +08:00
tww
bd83f91648
cli fix
2026-03-15 20:34:36 +08:00
yun-zhi-ztl
155a59790a
feat(skill): allow withdrawing pending submissions ( #40 )
2026-03-15 04:26:52 -07:00
yun-zhi-ztl
f544d9419d
Merge remote-tracking branch 'origin/main' into feature/project-local
...
# Conflicts:
# server/skillhub-app/src/test/java/com/iflytek/skillhub/compat/ClawHubRegistryControllerTest.java
# server/skillhub-domain/src/main/java/com/iflytek/skillhub/domain/skill/service/SkillQueryService.java
2026-03-15 17:57:58 +08:00
yun-zhi-ztl
39b0f3c852
fix(security): add baseline content security policy
2026-03-15 17:40:20 +08:00
yun-zhi-ztl
458fc6b300
fix(security): enforce admin roles and expand audit log filters
2026-03-15 17:38:51 +08:00
yun-zhi-ztl
d6fac50309
fix(security): harden auth boundaries and metrics access
2026-03-15 17:29:51 +08:00
tww
f38fea85b5
cli
2026-03-15 16:02:54 +08:00
yun-zhi-ztl
2b6f4e335e
refactor(web): move portal APIs under api/web
2026-03-15 15:48:14 +08:00
yun-zhi-ztl
9f4ac978b9
feat(token): support copy hints and expiration updates
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
f3c3c2beeb
feat(token): support configurable expiration times
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
835b0da397
fix(auth): reduce login timing side channels
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
c9b49ad5b0
fix(auth): harden mock auth and rate limit auth flows
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
1d983233de
fix(auth): default new users to USER role
2026-03-15 14:20:07 +08:00
yun-zhi-ztl
bf62b340ab
fix: change api/v1/cli to api/v1
2026-03-14 20:35:50 +08:00
yun-zhi-ztl
05c4842ac5
fix(auth): validate email format on register
2026-03-14 19:47:02 +08:00
yun-zhi-ztl
bf319332c5
feat(token): paginate token list
2026-03-14 19:44:11 +08:00
yun-zhi-ztl
fc9bdffc7d
fix(token): validate name length and uniqueness
2026-03-14 19:38:18 +08:00
yun-zhi-ztl
188f6108d1
feat(auth): improve extensible login method metadata
2026-03-14 18:52:35 +08:00
yun-zhi-ztl
a6cf862e8e
merge(main): sync latest origin/main into feature/project-review
...
Resolved 9 conflicts according to documented strategy:
- .gitignore: kept both entries (docs/review/ + CLAUDE.md)
- ClawHubCompatController.java: manual merge (use @AuthenticationPrincipal + platformRoles)
- ClawHubCompatControllerTest.java: kept ours (HEAD security tests)
- CliControllerTest.java: kept ours (HEAD platform roles tests)
- ReviewPermissionChecker.java: kept ours (stricter permission model)
- SkillPublishService.java: kept theirs (main SUPER_ADMIN bypass + events)
- SkillPublishServiceTest.java: kept theirs (main complete test suite)
- router.tsx: manual merge (HEAD's createLazyRouteComponent + main's privacy/terms)
- markdown-renderer.tsx: kept ours (HEAD frontmatter stripping + styles)
All A1-A9 security fixes preserved. No new logic introduced.
2026-03-14 17:50:38 +08:00
wowo-zZ
56e7baed15
fix(auth): require authentication for skill downloads
...
- Remove download endpoints from permitAll list in SecurityConfig
- Add authentication checks to download tests
- Add login redirect for unauthenticated download attempts in frontend
This prevents unauthorized access to skill package downloads while
maintaining public access to skill metadata and file listings.
2026-03-14 16:54:10 +08:00
vsxd
ac352314f7
Add extensible auth compatibility layer for private SSO
2026-03-13 18:00:22 +08:00
vsxd
14d86c290a
chore(release): v0.1.0-beta.7
2026-03-13 16:05:08 +08:00
yun-zhi-ztl
cab3bc3f8c
Merge branch 'main' into feature/project-review
2026-03-13 13:21:51 +08:00
yun-zhi-ztl
447a34a1d1
merge(main): sync latest origin/main into feature/project-review
2026-03-13 12:49:12 +08:00
vsxd
ac32fce08f
fix(auth): preserve return target across oauth login
2026-03-13 11:59:17 +08:00
yun-zhi-ztl
383bc1edae
fix(admin): replace compat and admin placeholders with real queries
...
Implement compat search through SkillSearchAppService instead of returning an empty placeholder list, and map search results back to canonical slugs for the compatibility API.
Replace hard-coded admin user and audit-log payloads with repository-backed application services. User management now supports paged search and status filters, validates managed statuses and role codes, prevents USER_ADMIN from assigning SUPER_ADMIN, and persists role/status changes against the real repositories. Audit logs now read from the audit_log table through a dedicated query repository/service with filterable pagination.
Align admin response DTOs with the frontend contract, add domain not-found handling for localized 404 responses, and cover the new behavior with controller and service regression tests. Verified with targeted skillhub-app tests plus full server mvn test.
2026-03-13 11:46:21 +08:00
vsxd
84dd08503d
merge: bring feature/project-init into main for beta3
...
# Conflicts:
# scripts/smoke-test.sh
2026-03-13 11:45:56 +08:00
vsxd
6a9e0845d4
Complete phase 3 and 4 backend workflows
2026-03-13 11:36:34 +08:00
vsxd
76808ca794
test(auth): align auth module tests with current flows
2026-03-13 11:32:50 +08:00
vsxd
5bb2eb0d98
fix(auth): grant global membership to new users
2026-03-13 11:29:01 +08:00
yun-zhi-ztl
ad8bb9c6fd
fix(security): whitelist only public skill GET routes
...
- require authentication for skill star and rating GET endpoints before the public skill-read rules
- keep documented public skill detail, version, download, resolve, and tag listing endpoints readable anonymously
- add regression coverage for anonymous star and rating access denial plus public tag listing
2026-03-13 11:12:18 +08:00
yun-zhi-ztl
ec8f7ec838
fix(auth): enforce api token scopes and active-user checks
...
- parse stored api token scopes and attach SCOPE authorities during authentication
- reject disabled users from establishing api token sessions and stop touching last-used for inactive accounts
- add an api-token-only scope filter that limits tokens to documented publish and token-management endpoints
2026-03-13 11:04:52 +08:00
vsxd
3cee8fbb5a
fix(phase4): harden smoke checks and metrics access
2026-03-13 10:56:28 +08:00
vsxd
0ca38e73ba
merge: bring phase4 worktree implementation into feature/project-init
...
# Conflicts:
# server/skillhub-app/src/main/java/com/iflytek/skillhub/controller/cli/CliPublishController.java
# server/skillhub-app/src/main/java/com/iflytek/skillhub/controller/portal/SkillPublishController.java
# server/skillhub-storage/src/main/java/com/iflytek/skillhub/storage/LocalFileStorageService.java
# web/src/app/router.tsx
2026-03-13 10:35:42 +08:00
vsxd
b982011614
fix(ops): align smoke test with csrf and metrics access
2026-03-13 10:23:46 +08:00
vsxd
07ea0fa822
merge: bring phase4 worktree implementation into main
...
# Conflicts:
# server/skillhub-app/src/main/java/com/iflytek/skillhub/controller/cli/CliPublishController.java
# server/skillhub-app/src/main/java/com/iflytek/skillhub/controller/portal/SkillPublishController.java
# server/skillhub-storage/src/main/java/com/iflytek/skillhub/storage/LocalFileStorageService.java
# web/src/app/router.tsx
2026-03-13 10:20:19 +08:00
vsxd
33c44fb9cc
feat(phase4): complete auth, governance, observability, and ops polish
2026-03-13 10:17:48 +08:00
vsxd
62d9d88546
chore(release): cut v0.1.0-beta.2
2026-03-13 10:13:50 +08:00
vsxd
d4deb2fb74
fix: address review-reported auth and publish issues
2026-03-13 10:06:25 +08:00
vsxd
f7798dddc5
Revert "merge: bring review fixes into feature/project-init"
...
This reverts commit 92f63f8b8978e16f0fe7
2026-03-13 10:06:14 +08:00
vsxd
5bb887b292
fix: address review-reported auth and publish issues
2026-03-12 22:29:51 +08:00
vsxd
8c5b4d176a
feat(auth): add local username-password login
2026-03-12 21:59:28 +08:00
tlzhu3
444a52f802
fix(auth): complete device flow token exchange
2026-03-12 21:42:15 +08:00
vsxd
3c9b95fd98
refactor(auth): remove local auth flow
2026-03-12 21:36:49 +08:00
vsxd
e63531ca3d
feat(dev): stabilize local env and phase3 flows
2026-03-12 21:33:25 +08:00
vsxd
05ec9bfbc2
feat(auth): add local username-password login
2026-03-12 21:27:01 +08:00
