mirror of
https://github.com/iflytek/skillhub.git
synced 2026-10-15 04:18:20 +00:00
2014716904
Yanking a published version is only available through
POST /api/v1/admin/skills/versions/{versionId}/yank, which is
session-only (SESSION_ONLY_ROUTES covers /api/v1/admin/**) and requires
SKILL_ADMIN or SUPER_ADMIN. A skill owner therefore cannot pull a
broken release themselves, neither from the web surface nor from a
script holding an API token.
In package registries yank is an act of the publisher: `cargo yank`
and PyPI's "yank release" are performed by the package owner, not by a
registry admin, because the goal is to stop new installs of a bad
release while keeping the artifact available for lock files. SkillHub
already lets owners archive, unarchive, rerelease and delete draft
versions through SkillLifecycleController under the
assertCanManageLifecycle rule (owner, or namespace ADMIN/OWNER); yank
belongs on the same surface with the same rule.
Changes:
- SkillGovernanceService: add an owner-checked yankVersion(skill,
version, actor, roles, ip, ua, reason) that runs
assertCanManageLifecycle and then the same yank logic as the admin
variant, now shared in yankVersionInternal. The admin entry point is
unchanged for AdminSkillController.
- SkillLifecycleAppService / GovernanceWorkflowAppService: resolve
skill and version by namespace/slug/version, delegate to the new
domain method, and return SkillLifecycleMutationResponse with action
YANK and the resulting version status. The YANK_SKILL_VERSION audit
record and SkillVersionYankedEvent are emitted by the domain service
exactly as for the admin path.
- SkillLifecycleController: POST /{namespace}/{slug}/versions/{version}/yank
on both /api/v1/skills and /api/web/skills, optional body
AdminSkillActionRequest (reason).
- RouteSecurityPolicyRegistry: require skill:yank for the new route on
both prefixes, so tokens can reach it as the SESSION_ONLY_ROUTES
comment promises for every route the authorization list opens. The
admin yank stays session-only. No allow-list of scopes exists outside
the registry; the docs' scope enumeration is updated to include
skill:yank.
- Tests: RouteSecurityPolicyRegistryTest (scope required on both
prefixes, admin route still closed), SkillGovernanceServiceTest
(owner and namespace ADMIN allowed, MEMBER forbidden, unpublished
rejected), SkillLifecycleControllerTest (envelope with and without
body).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DdnYX4jTS3JwMMP9JCGxzU
|
||
|---|---|---|
| .. | ||
| api | ||
| prds | ||
| research | ||
| skillhub | ||
| superpowers | ||
| 00-product-direction.md | ||
| 01-system-architecture.md | ||
| 02-domain-model.md | ||
| 03-authentication-design.md | ||
| 04-search-architecture.md | ||
| 05-business-flows.md | ||
| 06-api-design.md | ||
| 07-skill-protocol.md | ||
| 08-frontend-architecture.md | ||
| 09-deployment.md | ||
| 10-delivery-roadmap.md | ||
| 11-auth-extensibility-and-private-sso.md | ||
| 12-private-sso-integration-playbook.md | ||
| 13-parallel-workflow.md | ||
| 14-skill-lifecycle.md | ||
| 15-backend-time-governance-plan.md | ||
| 16-backend-time-inventory.md | ||
| 17-backend-annotation-findings.md | ||
| 18-frontend-annotation-findings.md | ||
| 19-smtp-password-reset-email-setup.md | ||
| 20-cloud-url-builtin-skills-setup.md | ||
| 21-official-starter-skills-plan.md | ||
| 22-builtin-skills-candidate-pool.md | ||
| 23-builtin-skills-first-round-test-report.md | ||
| 24-compliance-metadata-design.md | ||
| 2026-03-20-skill-label-system-design.md | ||
| 2026-04-08-issue-automation-design.md | ||
| 2026-07-31-observability-construction-plan.md | ||
| 2026-08-13-personal-namespace-provisioning.md | ||
| CONTENT_SAFETY.md | ||
| dev-workflow.md | ||
| e2e.md | ||
| hermes-integration-en.md | ||
| hermes-integration.md | ||
| observability-decision-map.md | ||
| observability-developer-guide.md | ||
| openclaw-integration-en.md | ||
| openclaw-integration.md | ||
| oss-01-core-contract-freeze.md | ||
| oss-02-core-semantic-rules.md | ||
| pr-batch-test-runtime.md | ||
| PRIVACY_AND_DATA_GOVERNANCE.md | ||
| RISCV64.md | ||
| security-scanning.md | ||