scriptoriumadmin/skillhub
1
0
Fork 0
mirror of https://github.com/iflytek/skillhub.git synced 2026-09-05 08:05:56 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7
1249 commits 212 branches 25 tags 42 MiB
Commit graph

1249 commits

This branch
This branch
All branches
Author SHA1 Message Date
XiaoSeS
bdb42b1be9
Merge pull request #787 from iflytek/fix/issue-615-audit-atomicity-20260831 
fix(governance): make mutations and audit atomic
 2026-08-31 18:48:30 +08:00
XiaoSeS
a73997c672
Merge pull request #784 from iflytek/fix/concurrent-publish-coordinate-race 
fix(publish): return deterministic conflict on concurrent coordinate race
 2026-08-31 18:47:19 +08:00
XiaoSeS
b22b92fcbc fix(governance): make mutations and audit atomic 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 16:30:33 +08:00
XiaoSeS
182f7bacef fix(publish): flush concurrent coordinate writes 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 16:30:33 +08:00
XiaoSeS
13510609a0
Merge pull request #783 from iflytek/fix/auth-stale-session-public-routes 
fix(auth): allow public routes after session expiry
 2026-08-31 15:25:01 +08:00
XiaoSeS
d1cd3d2afe
Merge pull request #782 from FenjuFu/fix/audit-detail-json 
fix(audit): render audit detail JSON with Jackson instead of string concatenation
 2026-08-31 15:24:06 +08:00
XiaoSeS
8361ea3fcd
Merge pull request #774 from FenjuFu/fix/promotion-pagination 
fix(promotion): paginate review queues
 2026-08-31 15:22:21 +08:00
XiaoSeS
49ef09d989
Merge pull request #773 from FenjuFu/fix/publish-case-insensitive-whitelist 
fix(publish): match allowed filenames case-insensitively
 2026-08-31 15:19:52 +08:00
FenjuFu
d224c5a8ba fix(publish): return deterministic conflict on concurrent coordinate race 
Concurrent publishes for the same (namespace_id, slug, owner_id) or
(skill_id, version) coordinate both pass the check-then-create reads and
race on the database unique constraints. The losing request surfaced an
unhandled DataIntegrityViolationException as HTTP 500.

Translate the constraint violation at both insert points into a
deterministic DomainBadRequestException (error.skill.publish.concurrentConflict),
matching the existing idiom in LabelDefinitionService/ReviewService/
PromotionService. No same-transaction re-read is attempted, so the losing
publish rolls back cleanly and returns a retryable conflict instead of a 500.

Add the i18n key (en/zh) and two unit tests covering the skill-insert and
version-insert races.

Closes #617

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
 2026-08-31 14:27:45 +08:00
XiaoSeS
346acbcfa3 fix(auth): preserve protected invalid-session handling 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 14:00:45 +08:00
XiaoSeS
fe8a0cb21f fix(promotion): clamp emptied queue pages 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 14:00:45 +08:00
XiaoSeS
9f3b10d27a test(publish): cover case-insensitive whitelist variants 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 14:00:45 +08:00
XiaoSeS
98a0e1d2f9 fix(auth): allow public routes after session expiry 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 14:00:45 +08:00
FenjuFu
215ab11b09 fix(audit): render audit detail JSON with Jackson instead of concatenation 
audit_log.detail_json is a JSONB column, so the value has to be valid
JSON or the insert fails. It was built by string concatenation at every
call site, with three inconsistent levels of escaping: none at all in
ClawHubCompatAppService, DeviceAuthWebController, LabelAdminAppService
and SkillLabelAppService; quotes only in ReviewPortalAppService,
SkillLifecycleAppService, NamespaceGovernanceService and
SkillGovernanceService; quotes and backslashes in
PromotionPortalAppService.escapeJson.

None of the three escapes control characters, which JSON forbids raw
inside a string. A reviewer pressing Enter in a review comment therefore
produced a payload PostgreSQL rejects, and because the audit write
happens after the domain mutation, the review was already approved when
the request returned 500.

Add AuditDetail, which renders the payload through Jackson, and route
all 29 construction sites through it. 17 of those interpolate a string
value and are the actual defect surface; the numeric and constant ones
are converted too so there is one way to build audit detail and no
hand-rolled example left to copy.

SkillHardDeleteService.toAuditPayload already did this correctly with a
LinkedHashMap and an ObjectMapper; AuditDetail is that shape extracted.
The service itself is left alone rather than changing its constructor
signature for no behavior gain.

Output is byte-identical for values that were already escaped correctly,
so the existing exact-string assertions in AdminSearchControllerTest and
PromotionPortalAppServiceTest are unchanged. null still means "no
detail": the builder returns null rather than {} when no field is set.

Addresses the JSON half of #615. The transaction half -- the domain
mutation and the audit write not sharing one transaction -- is a
separate design decision about whether an audit failure should roll back
a review, and is not bundled here.

Signed-off-by: FenjuFu <fufenjupku@gmail.com>
 2026-08-30 18:39:48 +08:00
XiaoSeS
b896c698cd
Merge pull request #780 from iflytek/fix/cli-fingerprint-order 
fix(cli): stabilize namespace sync fingerprints
 2026-08-29 16:43:12 +08:00
XiaoSeS
9443731dc4 fix(cli): stabilize namespace sync fingerprints 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 16:39:27 +08:00
XiaoSeS
20d3dc24ac
Merge pull request #779 from iflytek/fix/server-storage-uid-compat 
fix(deploy): preserve storage volume ownership
 2026-08-29 16:14:52 +08:00
XiaoSeS
aa4ea17c4a fix(deploy): preserve storage volume ownership 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 15:58:55 +08:00
XiaoSeS
1335c4e3ff
Merge pull request #778 from iflytek/feature/revert-public-release-skill 
docs(release): remove public release workflow
 2026-08-29 15:50:28 +08:00
XiaoSeS
fcc9dfd616 docs(release): remove public release workflow 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 15:47:25 +08:00
XiaoSeS
d3adc95ce0
Merge pull request #777 from iflytek/docs/release-domain-validation-gate 
docs(release): add verified publishing workflow
 2026-08-29 15:45:02 +08:00
XiaoSeS
1136e9ef5d
Merge pull request #776 from iflytek/feature/fix-subpath-redirect-scheme 
fix(web): preserve HTTPS in sub-path redirects
 2026-08-29 15:43:31 +08:00
XiaoSeS
33483ec20f docs(release): add verified publishing workflow 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 15:39:23 +08:00
XiaoSeS
e9e570133d fix(web): preserve HTTPS in sub-path redirects 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 15:29:42 +08:00
XiaoSeS
337d3d973d
Merge pull request #775 from iflytek/fix/cli-namespace-sync-server-route 
fix(cli): add namespace sync manifest endpoint
 2026-08-29 15:16:27 +08:00
XiaoSeS
60fed4d94f fix(auth): support bearer tokens behind sub-path proxies 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 15:05:09 +08:00
XiaoSeS
2babc0935b fix(cli): add namespace sync manifest endpoint 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 14:06:34 +08:00
FenjuFu
817426c50f fix(promotion): paginate review queues 
Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
 2026-08-28 23:29:58 +08:00
FenjuFu
e9ac6c162a fix(publish): match allowed filenames case-insensitively 
Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
 2026-08-28 17:57:01 +08:00
XiaoSeS
c11a51c75f
docs(weekly): publish 2026 W35 report
Some checks failed
Deploy Docs / build (push) Has been cancelled
Details
Security / Dependency Review (push) Has been cancelled
Details
Security / CodeQL (java-kotlin) (push) Has been cancelled
Details
Security / CodeQL (javascript-typescript) (push) Has been cancelled
Details
Security / CodeQL (python) (push) Has been cancelled
Details
Deploy Docs / Deploy (push) Has been cancelled
Details 
Merge reviewed W35 weekly report mirror.
 2026-08-28 17:22:18 +08:00
XiaoSeS
56ed2dcadd docs(weekly): mirror 2026-W35 report 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-28 17:18:57 +08:00
XiaoSeS
f993ad6533
Merge pull request #712 from Vast-Stars/feat/personal-namespace-provisioning 
feat(namespace): auto-provision a personal namespace on registration
 2026-08-28 17:04:21 +08:00
XiaoSeS
37e3c63236
Merge pull request #688 from iflytek/fix/auth-email-assurance-guard-main 
fix(auth): enforce trusted OAuth identity attributes
 2026-08-28 17:04:15 +08:00
XiaoSeS
eeb63613f2 fix(namespace): enable personal provisioning by default 2026-08-28 16:42:26 +08:00
XiaoSeS
ee0f0763db refactor(namespace): keep personal provisioning configuration-only 2026-08-28 15:55:29 +08:00
XiaoSeS
7beb1be356 fix(namespace): skip system accounts during provisioning 2026-08-28 15:27:39 +08:00
XiaoSeS
04bb414b37 fix(namespace): use stable random personal namespace slugs 2026-08-28 15:19:56 +08:00
XiaoSeS
dc31bb97f4 Revert "feat(namespace): backfill personal namespaces for existing accounts" 
This reverts commit 2d50437e4f.
 2026-08-28 15:19:56 +08:00
XiaoSeS
fbf6887e9d Revert "fix(namespace): stop the backfill from querying with a null keyword" 
This reverts commit 639e081ca7.
 2026-08-28 15:19:56 +08:00
XiaoSeS
e80fb986f7 Revert "fix(web): stop the settings form from reverting the saved value" 
This reverts commit 4fe6948f87.
 2026-08-28 15:19:56 +08:00
XiaoSeS
eba2762b5b Revert "feat(namespace): let operators choose which namespaces new accounts join" 
This reverts commit a9e7f43e5a.
 2026-08-28 15:19:56 +08:00
XiaoSeS
0221c17113 Revert "feat(web): pick default namespaces from a list instead of typing slugs" 
This reverts commit 7247defd5d.
 2026-08-28 15:19:56 +08:00
XiaoSeS
c91c2ca408 fix(auth): make GitHub email assurance resilient 2026-08-28 15:08:07 +08:00
XiaoSeS
71fbc8357a
Merge pull request #724 from 15258725278/release/cli-v0.1.10 
feat(cli): add namespace workspace sync
 2026-08-28 10:22:24 +08:00
XiaoSeS
c32bced109
Merge pull request #748 from myml/fix/security-csp-policy 
fix(security): harden CSP policy and hide nginx server tokens
 2026-08-28 10:22:14 +08:00
XiaoSeS
c825d896a4
Merge pull request #762 from FenjuFu/fix/code-scanning-alerts-2026-08 
fix(security): resolve CodeQL findings
 2026-08-28 10:22:04 +08:00
XiaoSeS
2e78f79e83
Merge pull request #765 from iflytek/fix/pr735-subscription-authorization-20260827
Some checks are pending
Security / Dependency Review (push) Waiting to run
Details
Security / CodeQL (java-kotlin) (push) Waiting to run
Details
Security / CodeQL (javascript-typescript) (push) Waiting to run
Details
Security / CodeQL (python) (push) Waiting to run
Details 
fix(subscription): enforce current visibility for subscribers
 2026-08-27 17:48:08 +08:00
XiaoSeS
7476c9e0d2
fix(skill-card): resolve author display names in summaries 
Maintainer follow-up for #751; batch-loads owner display names and preserves summary constructor compatibility.
 2026-08-27 17:45:34 +08:00
XiaoSeS
1544ae4775 fix(skill-card): add owner summary compatibility overload 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-27 17:30:15 +08:00
XiaoSeS
ec9689dbc8 fix(skill-card): preserve owner fields when adding labels 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-27 17:28:09 +08:00