scriptoriumadmin/skillhub
1
0
Fork 0
mirror of https://github.com/iflytek/skillhub.git synced 2026-09-05 08:05:56 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7
1260 commits 212 branches 25 tags 42 MiB
Commit graph

1260 commits

This branch
This branch
All branches
Author SHA1 Message Date
XiaoSeS
fa13dd54ee test(review): validate progress query on postgres 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:42 +08:00
XiaoSeS
83599f9317 fix(review): prevent progress offset overflow 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:42 +08:00
XiaoSeS
39861bc6d8 test(review): strengthen exact-sha coverage 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:42 +08:00
XiaoSeS
918ef9d265 test(review): filter known CSP browser warning 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
a568d22526 fix(review): restrict version history to reviewers 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
3e77365a5d fix(review): complete progress history workflow 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
b8b0fba3d4 fix(theme): polish dark notification states 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
7995c00683 feat(review): add author review progress and attempt history 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
ebac94a043 feat(theme): add browser-local light and dark mode 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
ac42c2346c
Merge pull request #786 from iflytek/fix/issue-613-oauth-concurrency-20260831 
fix(auth): converge concurrent identity binding
 2026-08-31 18:49:41 +08:00
XiaoSeS
bdb42b1be9
Merge pull request #787 from iflytek/fix/issue-615-audit-atomicity-20260831 
fix(governance): make mutations and audit atomic
 2026-08-31 18:48:30 +08:00
XiaoSeS
a73997c672
Merge pull request #784 from iflytek/fix/concurrent-publish-coordinate-race 
fix(publish): return deterministic conflict on concurrent coordinate race
 2026-08-31 18:47:19 +08:00
XiaoSeS
3a29f6d750 fix(auth): converge concurrent identity binding 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 16:30:33 +08:00
XiaoSeS
b22b92fcbc fix(governance): make mutations and audit atomic 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 16:30:33 +08:00
XiaoSeS
182f7bacef fix(publish): flush concurrent coordinate writes 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 16:30:33 +08:00
XiaoSeS
13510609a0
Merge pull request #783 from iflytek/fix/auth-stale-session-public-routes 
fix(auth): allow public routes after session expiry
 2026-08-31 15:25:01 +08:00
XiaoSeS
d1cd3d2afe
Merge pull request #782 from FenjuFu/fix/audit-detail-json 
fix(audit): render audit detail JSON with Jackson instead of string concatenation
 2026-08-31 15:24:06 +08:00
XiaoSeS
8361ea3fcd
Merge pull request #774 from FenjuFu/fix/promotion-pagination 
fix(promotion): paginate review queues
 2026-08-31 15:22:21 +08:00
XiaoSeS
49ef09d989
Merge pull request #773 from FenjuFu/fix/publish-case-insensitive-whitelist 
fix(publish): match allowed filenames case-insensitively
 2026-08-31 15:19:52 +08:00
FenjuFu
d224c5a8ba fix(publish): return deterministic conflict on concurrent coordinate race 
Concurrent publishes for the same (namespace_id, slug, owner_id) or
(skill_id, version) coordinate both pass the check-then-create reads and
race on the database unique constraints. The losing request surfaced an
unhandled DataIntegrityViolationException as HTTP 500.

Translate the constraint violation at both insert points into a
deterministic DomainBadRequestException (error.skill.publish.concurrentConflict),
matching the existing idiom in LabelDefinitionService/ReviewService/
PromotionService. No same-transaction re-read is attempted, so the losing
publish rolls back cleanly and returns a retryable conflict instead of a 500.

Add the i18n key (en/zh) and two unit tests covering the skill-insert and
version-insert races.

Closes #617

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
 2026-08-31 14:27:45 +08:00
XiaoSeS
346acbcfa3 fix(auth): preserve protected invalid-session handling 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 14:00:45 +08:00
XiaoSeS
fe8a0cb21f fix(promotion): clamp emptied queue pages 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 14:00:45 +08:00
XiaoSeS
9f3b10d27a test(publish): cover case-insensitive whitelist variants 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 14:00:45 +08:00
XiaoSeS
98a0e1d2f9 fix(auth): allow public routes after session expiry 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 14:00:45 +08:00
FenjuFu
215ab11b09 fix(audit): render audit detail JSON with Jackson instead of concatenation 
audit_log.detail_json is a JSONB column, so the value has to be valid
JSON or the insert fails. It was built by string concatenation at every
call site, with three inconsistent levels of escaping: none at all in
ClawHubCompatAppService, DeviceAuthWebController, LabelAdminAppService
and SkillLabelAppService; quotes only in ReviewPortalAppService,
SkillLifecycleAppService, NamespaceGovernanceService and
SkillGovernanceService; quotes and backslashes in
PromotionPortalAppService.escapeJson.

None of the three escapes control characters, which JSON forbids raw
inside a string. A reviewer pressing Enter in a review comment therefore
produced a payload PostgreSQL rejects, and because the audit write
happens after the domain mutation, the review was already approved when
the request returned 500.

Add AuditDetail, which renders the payload through Jackson, and route
all 29 construction sites through it. 17 of those interpolate a string
value and are the actual defect surface; the numeric and constant ones
are converted too so there is one way to build audit detail and no
hand-rolled example left to copy.

SkillHardDeleteService.toAuditPayload already did this correctly with a
LinkedHashMap and an ObjectMapper; AuditDetail is that shape extracted.
The service itself is left alone rather than changing its constructor
signature for no behavior gain.

Output is byte-identical for values that were already escaped correctly,
so the existing exact-string assertions in AdminSearchControllerTest and
PromotionPortalAppServiceTest are unchanged. null still means "no
detail": the builder returns null rather than {} when no field is set.

Addresses the JSON half of #615. The transaction half -- the domain
mutation and the audit write not sharing one transaction -- is a
separate design decision about whether an audit failure should roll back
a review, and is not bundled here.

Signed-off-by: FenjuFu <fufenjupku@gmail.com>
 2026-08-30 18:39:48 +08:00
XiaoSeS
b896c698cd
Merge pull request #780 from iflytek/fix/cli-fingerprint-order 
fix(cli): stabilize namespace sync fingerprints
 2026-08-29 16:43:12 +08:00
XiaoSeS
9443731dc4 fix(cli): stabilize namespace sync fingerprints 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 16:39:27 +08:00
XiaoSeS
20d3dc24ac
Merge pull request #779 from iflytek/fix/server-storage-uid-compat 
fix(deploy): preserve storage volume ownership
 2026-08-29 16:14:52 +08:00
XiaoSeS
aa4ea17c4a fix(deploy): preserve storage volume ownership 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 15:58:55 +08:00
XiaoSeS
1335c4e3ff
Merge pull request #778 from iflytek/feature/revert-public-release-skill 
docs(release): remove public release workflow
 2026-08-29 15:50:28 +08:00
XiaoSeS
fcc9dfd616 docs(release): remove public release workflow 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 15:47:25 +08:00
XiaoSeS
d3adc95ce0
Merge pull request #777 from iflytek/docs/release-domain-validation-gate 
docs(release): add verified publishing workflow
 2026-08-29 15:45:02 +08:00
XiaoSeS
1136e9ef5d
Merge pull request #776 from iflytek/feature/fix-subpath-redirect-scheme 
fix(web): preserve HTTPS in sub-path redirects
 2026-08-29 15:43:31 +08:00
XiaoSeS
33483ec20f docs(release): add verified publishing workflow 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 15:39:23 +08:00
XiaoSeS
e9e570133d fix(web): preserve HTTPS in sub-path redirects 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 15:29:42 +08:00
XiaoSeS
337d3d973d
Merge pull request #775 from iflytek/fix/cli-namespace-sync-server-route 
fix(cli): add namespace sync manifest endpoint
 2026-08-29 15:16:27 +08:00
XiaoSeS
60fed4d94f fix(auth): support bearer tokens behind sub-path proxies 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 15:05:09 +08:00
XiaoSeS
2babc0935b fix(cli): add namespace sync manifest endpoint 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 14:06:34 +08:00
FenjuFu
817426c50f fix(promotion): paginate review queues 
Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
 2026-08-28 23:29:58 +08:00
FenjuFu
e9ac6c162a fix(publish): match allowed filenames case-insensitively 
Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
 2026-08-28 17:57:01 +08:00
XiaoSeS
c11a51c75f
docs(weekly): publish 2026 W35 report
Some checks failed
Deploy Docs / build (push) Has been cancelled
Details
Security / Dependency Review (push) Has been cancelled
Details
Security / CodeQL (java-kotlin) (push) Has been cancelled
Details
Security / CodeQL (javascript-typescript) (push) Has been cancelled
Details
Security / CodeQL (python) (push) Has been cancelled
Details
Deploy Docs / Deploy (push) Has been cancelled
Details 
Merge reviewed W35 weekly report mirror.
 2026-08-28 17:22:18 +08:00
XiaoSeS
56ed2dcadd docs(weekly): mirror 2026-W35 report 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-28 17:18:57 +08:00
XiaoSeS
f993ad6533
Merge pull request #712 from Vast-Stars/feat/personal-namespace-provisioning 
feat(namespace): auto-provision a personal namespace on registration
 2026-08-28 17:04:21 +08:00
XiaoSeS
37e3c63236
Merge pull request #688 from iflytek/fix/auth-email-assurance-guard-main 
fix(auth): enforce trusted OAuth identity attributes
 2026-08-28 17:04:15 +08:00
XiaoSeS
eeb63613f2 fix(namespace): enable personal provisioning by default 2026-08-28 16:42:26 +08:00
XiaoSeS
ee0f0763db refactor(namespace): keep personal provisioning configuration-only 2026-08-28 15:55:29 +08:00
XiaoSeS
7beb1be356 fix(namespace): skip system accounts during provisioning 2026-08-28 15:27:39 +08:00
XiaoSeS
04bb414b37 fix(namespace): use stable random personal namespace slugs 2026-08-28 15:19:56 +08:00
XiaoSeS
dc31bb97f4 Revert "feat(namespace): backfill personal namespaces for existing accounts" 
This reverts commit 2d50437e4f.
 2026-08-28 15:19:56 +08:00
XiaoSeS
fbf6887e9d Revert "fix(namespace): stop the backfill from querying with a null keyword" 
This reverts commit 639e081ca7.
 2026-08-28 15:19:56 +08:00