skillhub

mirror of https://github.com/iflytek/skillhub.git synced 2026-08-28 11:25:00 +00:00

History

dongmucat d7d0790b28 fix(auth): close API token scope filter gap on /api/cli/ routes ApiTokenAuthenticationFilter authenticates /api/cli/** Bearer tokens but ApiTokenScopeFilter.shouldNotFilter() previously skipped them. The result: API token requests on CLI routes were authenticated and authorization-policy-checked, but scope enforcement never ran. Tokens without skill:publish or skill:delete could call /publish, /publish/validate, and DELETE despite the policy table requiring those scopes. Add /api/cli/ to the scope filter's covered prefixes and a filter-level test that confirms a token missing skill:publish is rejected on the new validate endpoint. Update the existing CLI controller tests to grant the appropriate SCOPE_* authorities to their api_token principals so they continue to pass under enforced scopes.	2026-05-18 15:51:19 +08:00
..
src	fix(auth): close API token scope filter gap on /api/cli/ routes	2026-05-18 15:51:19 +08:00
pom.xml	feat(auth): 邮箱验证码重置密码与 SMTP 配置支持 (#273 )	2026-04-13 20:27:00 +08:00

dongmucat d7d0790b28 fix(auth): close API token scope filter gap on /api/cli/ routes

ApiTokenAuthenticationFilter authenticates /api/cli/** Bearer tokens
but ApiTokenScopeFilter.shouldNotFilter() previously skipped them.
The result: API token requests on CLI routes were authenticated and
authorization-policy-checked, but scope enforcement never ran. Tokens
without skill:publish or skill:delete could call /publish, /publish/validate,
and DELETE despite the policy table requiring those scopes.

Add /api/cli/ to the scope filter's covered prefixes and a filter-level
test that confirms a token missing skill:publish is rejected on the new
validate endpoint. Update the existing CLI controller tests to grant
the appropriate SCOPE_* authorities to their api_token principals so
they continue to pass under enforced scopes.

2026-05-18 15:51:19 +08:00

src

fix(auth): close API token scope filter gap on /api/cli/ routes

2026-05-18 15:51:19 +08:00

pom.xml

feat(auth): 邮箱验证码重置密码与 SMTP 配置支持 (#273 )

2026-04-13 20:27:00 +08:00