skillhub/server/skillhub-auth
XiaoSeS a3c07725e5
feat(publish): skill upload limits, nested SKILL.md, session fix (#364)
* feat(publish): increase max file count from 100 to 500

Configurable via SKILLHUB_PUBLISH_MAX_FILE_COUNT env var.

* feat(publish): support SKILL.md in subdirectory with warning for ignored files

When SKILL.md is found in a single subdirectory (e.g. my-skill/SKILL.md),
promote that directory's contents to root and discard files outside it.
Discarded files are reported as warnings through the existing confirm flow.

* feat(publish): pass extraction warnings through confirm flow

When files are ignored during SKILL.md subdirectory promotion,
warnings are surfaced to the user via the existing precheck confirm dialog.

* fix(security): add invalidSessionStrategy to return 401 on expired session

Handles the case where Spring Security detects an invalid session cookie,
returning a clean 401 JSON response instead of triggering cascading exceptions.
Closes #360 (part 1/2)

* fix(security): handle session invalidation IllegalStateException as 401

Catches IllegalStateException with "Session was invalidated" message and
returns 401 instead of letting it fall through to the generic 500 handler.
Non-session IllegalStateExceptions are re-thrown to the catch-all handler.
Closes #360 (part 2/2)

* feat(publish): filter macOS metadata and add integration tests

Skip __MACOSX/, .DS_Store, and ._ resource fork entries during zip
extraction. Add integration tests for nested SKILL.md warning flow,
session invalidation 401 response, and macOS metadata filtering.

* test(publish): add real-world macOS zip and edge case integration tests

Covers: macOS zip with nested SKILL.md + __MACOSX + .DS_Store + stray files,
simple macOS single-folder case, and missing SKILL.md fallback behavior.
2026-04-30 11:20:51 +08:00
..
src feat(publish): skill upload limits, nested SKILL.md, session fix (#364) 2026-04-30 11:20:51 +08:00
pom.xml feat(auth): 邮箱验证码重置密码与 SMTP 配置支持 (#273) 2026-04-13 20:27:00 +08:00