mirror of
https://github.com/iflytek/skillhub.git
synced 2026-08-28 11:25:00 +00:00
168135bc6b
RouteSecurityPolicyRegistry keeps two policy lists — AUTHORIZATION_POLICIES for session/cookie access and API_TOKEN_POLICIES for Bearer tokens — with nothing keeping them in step. Routes the authorization list opens but the token list never registers fall through to the catch-all and answer API token cannot access endpoint: <path>. Register the routes reported in #713 (/api/v1/labels, the star and rating writes) plus the same-class gaps for /api/v1/auth/methods and paths below /api/v1/download, and add a guard test that walks the authorization list and fails when a route is neither token-reachable nor declared session-only. DELETE /api/v1/skills/{id}/star also matched the SUPER_ADMIN rule for DELETE /api/v1/skills/*/*, so un-starring was refused for ordinary accounts on the session path too. Star and rating writes now have their own authorization entries ahead of that rule. Closes #713 Signed-off-by: FenjuFu <fufenjupku@gmail.com> |
||
|---|---|---|
| .. | ||
| .mvn | ||
| scripts | ||
| skillhub-app | ||
| skillhub-auth | ||
| skillhub-domain | ||
| skillhub-infra | ||
| skillhub-notification | ||
| skillhub-search | ||
| skillhub-storage | ||
| .dockerignore | ||
| Dockerfile | ||
| Dockerfile.dev | ||
| mvnw | ||
| mvnw.cmd | ||
| pom.xml | ||