scriptoriumadmin/skillhub
1
0
Fork 0
mirror of https://github.com/iflytek/skillhub.git synced 2026-09-11 22:51:04 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
796 commits 227 branches 26 tags 47 MiB
Commit graph

88 commits

Author SHA1 Message Date
dongmucat
d945c46785 fix(auth): move OIDC email verification to service layer, add logging 
Revert emailVerified check in EmailDomainAccessPolicy to preserve
backward compatibility with GitHub/GitLab OAuth users. Instead, null
unverified emails in CustomOidcUserService.toOAuthClaims() so
EmailDomainAccessPolicy naturally denies them via null email.

Add SLF4J logging to CustomOidcUserService for OIDC authentication
flow tracing and failure diagnostics.

Add registration ID collision warning to deployment docs.
 2026-04-29 10:36:34 +08:00
dongmucat
fbbd20a5a6 fix(auth): require verified email for domain access 
变更摘要：

- 修复 EMAIL_DOMAIN 准入策略，未验证邮箱不再因域名匹配被放行

- 新增回归测试，覆盖 OIDC 场景下 email_verified=false 的拒绝行为

- 保持修复范围收敛，仅调整策略判定与对应测试

关键文件：

- server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/policy/EmailDomainAccessPolicy.java

- server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/policy/AccessPolicyTest.java
 2026-04-28 16:31:52 +08:00
dongmucat
4f44ea3976 fix(auth): add OIDC sub claim validation and complete env example 
- Add null/blank validation for OIDC sub claim in CustomOidcUserService
- Throw OAuth2AuthenticationException when sub is missing or blank
- Complete .env.release.example with all required OIDC environment variables
- Add test cases for sub validation and providerLogin fallback scenarios
- All 5 tests passing
 2026-04-28 13:49:26 +08:00
dongmucat
bb9f8915e2 feat(auth): support oidc login 2026-04-24 13:45:20 +08:00
wrj97
7be6a36960
feat(auth): add GitLab OAuth2 provider support (#264) 
* feat(auth): add GitLab OAuth2 provider support

Add GitLab as an additional OAuth2 authentication provider alongside
GitHub. This includes:

- GitLab OAuth2 client configuration with customizable base URL
- GitLabClaimsExtractor for handling GitLab-specific user claims
- Multi-provider login UI with provider-specific icons
- Updated localization to use OAuth-agnostic terminology
- JSON type annotation for IdentityBinding entity

* fix(auth): restore oauth redirect and gitlab email checks

* test(auth): align oauth login handler expectation

---------

Co-authored-by: wowo-zZ <zhenggui5228@126.com>
 2026-04-17 19:56:32 +08:00
dongmucat
c419a119f1 merge: sync origin/main into fix/security-hardening-unauth 2026-04-14 10:28:25 +08:00
dongmucat
38ebb13133
feat(auth): 邮箱验证码重置密码与 SMTP 配置支持 (#273) 
* feat(auth): add email-based password reset with SMTP config docs

* test(e2e): stabilize password reset flow

* test(e2e): isolate password reset rate limits

* test(ci): stabilize backend and register e2e

* docs(auth): sanitize smtp setup examples
 2026-04-13 20:27:00 +08:00
dongmucat
27b631a5d6 merge: sync origin/main into fix/security-hardening-unauth 2026-04-10 09:26:19 +08:00
dongmucat
4cc22d0099
fix(auth): avoid extra session rotation after oauth success (#245) 2026-04-09 18:12:24 +08:00
dongmucat
441dc9e0e7 fix(security): close unauthorized metrics and compat access paths 2026-04-07 16:24:15 +08:00
XiaoSeS
86b4d0508b fix(skill): defer version storage deletion until commit (#162) 
* fix(skill): resolve duplicate result error when deleting skill with shared namespace+slug

V13 migration changed the unique constraint from (namespace_id, slug) to
(namespace_id, slug, owner_id), allowing multiple skills with the same
namespace+slug but different owners. The findByNamespaceSlugAndSlug query
returned Optional<Skill> which threw IncorrectResultSizeDataAccessException
when 2 rows matched.

Changed the query to return List<Skill> and added ownerId query param to
DELETE endpoints so the frontend can specify exactly which skill to delete.

* fix(review): keep failed scans reviewable and expose feedback

* fix(skill-delete): delete skills by id

* fix(skill): defer version storage deletion until commit
 2026-03-26 13:54:30 +08:00
yun-zhi-ztl
6e8b257abb feat(notification): add in-app notifications and harden delivery 2026-03-23 12:31:28 +08:00
Xudong Sun
21ba6ee938 fea: implement skill label system end to end (#140) 
* docs(label): add skill label system design spec

Covers data model, permission model, search integration,
API design, and frontend design for the label system.

* docs(label): address spec review findings

- Add CHECK constraint on label_definition.type, deny-by-default in app layer
- Use TIMESTAMPTZ consistently for all new tables
- Add (label_id) index on skill_label for filter performance
- Add label count limits (10 per skill, 100 definitions)
- Detail async rebuild strategy (Spring @Async, batch 50, error isolation)
- Clarify search_vector is GENERATED STORED column, auto-maintained
- Expand SearchQuery with labelSlugs field, detail SQL changes
- Define all API response JSON structures
- Clarify PUT update: no slug in body, full-replace translations
- Clarify hard delete with audit_log
- Add cross-namespace permission boundary (promotion scenario)
- Pre-reserve multi-label API param for future
- Clarify ClawHub compat layer: no label support in phase 1

* docs(label): address second-round spec review findings

- Fix chapter numbering (duplicate "6." → "6." + "7.")
- Move labelSlugs to end of SearchQuery record to reduce breaking change
- Add TIMESTAMPTZ convention note for new tables
- Clarify async rebuild transaction boundary (per-skill independent tx)
- Move rebuildByLabelId to app layer to preserve module boundaries
- Clarify multi-label filter uses OR semantics with AND extension path

* docs(label): fix section numbering in frontend design chapter

* Implement skill label system end to end

* Unify label app services and DTOs

* Add admin label management page

* Add label admin backend tests

* Fix merge fallout in generated schema
 2026-03-20 15:26:41 +08:00
vsxd
a17deb9b7f test(app): cover missing query context paths 2026-03-20 11:33:32 +08:00
vsxd
ef7332d520 refactor(app): clarify query boundaries and workflow owners 2026-03-20 11:33:32 +08:00
yun-zhi-ztl
94ecc4d0b2 feat: add super-admin hard delete skill api (#131) 
* feat: add super-admin hard delete skill api

* fix: address hard delete review feedback

* fix: add missing unarchive skill locale

* docs: add skill detail hard delete design

* feat: add owner hard delete flow for skill details
 2026-03-20 11:02:02 +08:00
vsxd
2868c10467 refactor(app): slim portal controllers and sync backend findings 2026-03-20 10:09:03 +08:00
vsxd
9bad6a38e2 chore(release): v0.1.0 2026-03-19 20:25:18 +08:00
vsxd
25de227f1b refactor: consolidate backend workflow and security policies 2026-03-19 15:20:08 +08:00
vsxd
8ef53d0fdd docs: enrich backend code documentation 2026-03-19 13:37:21 +08:00
vsxd
0814b8939c refactor: unify backend time handling in utc 2026-03-18 17:16:55 +08:00
vsxd
72054dee0f Allow anonymous downloads for global public skills 2026-03-17 20:25:26 +08:00
vsxd
e52853c49c test: cover role and user status permission edges 2026-03-17 14:27:25 +08:00
vsxd
033ac54c76 chore: unify build and test entrypoints 2026-03-17 14:09:22 +08:00
vsxd
66cbdd7b57 fix: official site urls removed 2026-03-16 21:25:55 +08:00
tww
3ab76b201a cli login fix 2026-03-16 17:33:12 +08:00
tww
bd83f91648 cli fix 2026-03-15 20:34:36 +08:00
yun-zhi-ztl
155a59790a feat(skill): allow withdrawing pending submissions (#40) 2026-03-15 04:26:52 -07:00
yun-zhi-ztl
f544d9419d Merge remote-tracking branch 'origin/main' into feature/project-local 
# Conflicts:
#	server/skillhub-app/src/test/java/com/iflytek/skillhub/compat/ClawHubRegistryControllerTest.java
#	server/skillhub-domain/src/main/java/com/iflytek/skillhub/domain/skill/service/SkillQueryService.java
 2026-03-15 17:57:58 +08:00
yun-zhi-ztl
39b0f3c852 fix(security): add baseline content security policy 2026-03-15 17:40:20 +08:00
yun-zhi-ztl
458fc6b300 fix(security): enforce admin roles and expand audit log filters 2026-03-15 17:38:51 +08:00
yun-zhi-ztl
d6fac50309 fix(security): harden auth boundaries and metrics access 2026-03-15 17:29:51 +08:00
tww
f38fea85b5 cli 2026-03-15 16:02:54 +08:00
yun-zhi-ztl
2b6f4e335e refactor(web): move portal APIs under api/web 2026-03-15 15:48:14 +08:00
yun-zhi-ztl
9f4ac978b9 feat(token): support copy hints and expiration updates 2026-03-15 14:20:07 +08:00
yun-zhi-ztl
f3c3c2beeb feat(token): support configurable expiration times 2026-03-15 14:20:07 +08:00
yun-zhi-ztl
835b0da397 fix(auth): reduce login timing side channels 2026-03-15 14:20:07 +08:00
yun-zhi-ztl
c9b49ad5b0 fix(auth): harden mock auth and rate limit auth flows 2026-03-15 14:20:07 +08:00
yun-zhi-ztl
1d983233de fix(auth): default new users to USER role 2026-03-15 14:20:07 +08:00
yun-zhi-ztl
bf62b340ab fix: change api/v1/cli to api/v1 2026-03-14 20:35:50 +08:00
yun-zhi-ztl
05c4842ac5 fix(auth): validate email format on register 2026-03-14 19:47:02 +08:00
yun-zhi-ztl
bf319332c5 feat(token): paginate token list 2026-03-14 19:44:11 +08:00
yun-zhi-ztl
fc9bdffc7d fix(token): validate name length and uniqueness 2026-03-14 19:38:18 +08:00
yun-zhi-ztl
188f6108d1 feat(auth): improve extensible login method metadata 2026-03-14 18:52:35 +08:00
yun-zhi-ztl
a6cf862e8e merge(main): sync latest origin/main into feature/project-review 
Resolved 9 conflicts according to documented strategy:
- .gitignore: kept both entries (docs/review/ + CLAUDE.md)
- ClawHubCompatController.java: manual merge (use @AuthenticationPrincipal + platformRoles)
- ClawHubCompatControllerTest.java: kept ours (HEAD security tests)
- CliControllerTest.java: kept ours (HEAD platform roles tests)
- ReviewPermissionChecker.java: kept ours (stricter permission model)
- SkillPublishService.java: kept theirs (main SUPER_ADMIN bypass + events)
- SkillPublishServiceTest.java: kept theirs (main complete test suite)
- router.tsx: manual merge (HEAD's createLazyRouteComponent + main's privacy/terms)
- markdown-renderer.tsx: kept ours (HEAD frontmatter stripping + styles)

All A1-A9 security fixes preserved. No new logic introduced.
 2026-03-14 17:50:38 +08:00
wowo-zZ
56e7baed15 fix(auth): require authentication for skill downloads 
- Remove download endpoints from permitAll list in SecurityConfig
- Add authentication checks to download tests
- Add login redirect for unauthenticated download attempts in frontend

This prevents unauthorized access to skill package downloads while
maintaining public access to skill metadata and file listings.
 2026-03-14 16:54:10 +08:00
vsxd
ac352314f7 Add extensible auth compatibility layer for private SSO 2026-03-13 18:00:22 +08:00
vsxd
14d86c290a chore(release): v0.1.0-beta.7 2026-03-13 16:05:08 +08:00
yun-zhi-ztl
cab3bc3f8c Merge branch 'main' into feature/project-review 2026-03-13 13:21:51 +08:00
yun-zhi-ztl
447a34a1d1 merge(main): sync latest origin/main into feature/project-review 2026-03-13 12:49:12 +08:00