skillhub

mirror of https://github.com/iflytek/skillhub.git synced 2026-08-28 11:25:00 +00:00

History

FenjuFu fa04d2fa23 fix(auth): close API token policy gaps against the authorization list (#729 ) RouteSecurityPolicyRegistry keeps two policy lists — AUTHORIZATION_POLICIES for session/cookie access and API_TOKEN_POLICIES for Bearer tokens — with nothing keeping them in step. Routes the authorization list opens but the token list never registers fall through to the catch-all and answer API token cannot access endpoint: <path>. Register the routes reported in #713 (/api/v1/labels, the star and rating writes) plus the same-class gaps for /api/v1/auth/methods and paths below /api/v1/download, and add a guard test that walks the authorization list and fails when a route is neither token-reachable nor declared session-only. DELETE /api/v1/skills/{id}/star also matched the SUPER_ADMIN rule for DELETE /api/v1/skills//, so un-starring was refused for ordinary accounts on the session path too. Star and rating writes now have their own authorization entries ahead of that rule. Closes #713 Signed-off-by: FenjuFu <fufenjupku@gmail.com>	2026-08-21 16:08:50 +08:00
..
src	fix(auth): close API token policy gaps against the authorization list (#729 )	2026-08-21 16:08:50 +08:00
pom.xml	feat(auth): 邮箱验证码重置密码与 SMTP 配置支持 (#273 )	2026-04-13 20:27:00 +08:00

fix(auth): close API token policy gaps against the authorization list (#729 )

RouteSecurityPolicyRegistry keeps two policy lists — AUTHORIZATION_POLICIES for
session/cookie access and API_TOKEN_POLICIES for Bearer tokens — with nothing
keeping them in step. Routes the authorization list opens but the token list
never registers fall through to the catch-all and answer
API token cannot access endpoint: <path>.

Register the routes reported in #713 (/api/v1/labels, the star and rating
writes) plus the same-class gaps for /api/v1/auth/methods and paths below
/api/v1/download, and add a guard test that walks the authorization list and
fails when a route is neither token-reachable nor declared session-only.

DELETE /api/v1/skills/{id}/star also matched the SUPER_ADMIN rule for
DELETE /api/v1/skills/*/*, so un-starring was refused for ordinary accounts on
the session path too. Star and rating writes now have their own authorization
entries ahead of that rule.

Closes #713

Signed-off-by: FenjuFu <fufenjupku@gmail.com>

2026-08-21 16:08:50 +08:00

src

fix(auth): close API token policy gaps against the authorization list (#729 )

2026-08-21 16:08:50 +08:00

pom.xml

feat(auth): 邮箱验证码重置密码与 SMTP 配置支持 (#273 )

2026-04-13 20:27:00 +08:00