thiagonogueira 217e7f4042 feat(skills): let skill owners yank a published version (#866) ... * feat(auth): expose skill lifecycle routes to API tokens With an API token, v0.2.19 can remove a whole skill (DELETE /api/v1/skills/{ns}/{slug} with skill:delete) but cannot archive or unarchive a skill, nor delete a single draft/rejected version. Those three routes are opened by AUTHORIZATION_POLICIES (authenticated fallback) yet have no entry in API_TOKEN_POLICIES, so a bearer request falls through to "unsupported" and is rejected with 403. That contradicts the contract written above SESSION_ONLY_ROUTES in RouteSecurityPolicyRegistry: bearer tokens are rejected on exactly the listed session-only routes and nowhere else, and anything else the authorization list opens must be reachable with a token holding the required scope. Add API-token policies for both the /api/v1 and /api/web prefixes that SkillLifecycleController serves: - POST .../skills/{ns}/{slug}/archive and .../unarchive require skill:publish. They are owner-level operations, gated by the same assertCanManageLifecycle check as publishing, so they sit at the same scope tier. - DELETE .../skills/{ns}/{slug}/versions/{version} requires skill:delete, matching the existing whole-skill delete. Whole-skill DELETE on /api/web stays session-only as documented; the new version-delete pattern does not overlap it. No scope allow-list exists outside the registry (TokenController and ApiTokenScopeService accept any scope string), so no other change is needed for tokens to carry these scopes. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DdnYX4jTS3JwMMP9JCGxzU * feat(skills): let skill owners yank a published version Yanking a published version is only available through POST /api/v1/admin/skills/versions/{versionId}/yank, which is session-only (SESSION_ONLY_ROUTES covers /api/v1/admin/**) and requires SKILL_ADMIN or SUPER_ADMIN. A skill owner therefore cannot pull a broken release themselves, neither from the web surface nor from a script holding an API token. In package registries yank is an act of the publisher: `cargo yank` and PyPI's "yank release" are performed by the package owner, not by a registry admin, because the goal is to stop new installs of a bad release while keeping the artifact available for lock files. SkillHub already lets owners archive, unarchive, rerelease and delete draft versions through SkillLifecycleController under the assertCanManageLifecycle rule (owner, or namespace ADMIN/OWNER); yank belongs on the same surface with the same rule. Changes: - SkillGovernanceService: add an owner-checked yankVersion(skill, version, actor, roles, ip, ua, reason) that runs assertCanManageLifecycle and then the same yank logic as the admin variant, now shared in yankVersionInternal. The admin entry point is unchanged for AdminSkillController. - SkillLifecycleAppService / GovernanceWorkflowAppService: resolve skill and version by namespace/slug/version, delegate to the new domain method, and return SkillLifecycleMutationResponse with action YANK and the resulting version status. The YANK_SKILL_VERSION audit record and SkillVersionYankedEvent are emitted by the domain service exactly as for the admin path. - SkillLifecycleController: POST /{namespace}/{slug}/versions/{version}/yank on both /api/v1/skills and /api/web/skills, optional body AdminSkillActionRequest (reason). - RouteSecurityPolicyRegistry: require skill:yank for the new route on both prefixes, so tokens can reach it as the SESSION_ONLY_ROUTES comment promises for every route the authorization list opens. The admin yank stays session-only. No allow-list of scopes exists outside the registry; the docs' scope enumeration is updated to include skill:yank. - Tests: RouteSecurityPolicyRegistryTest (scope required on both prefixes, admin route still closed), SkillGovernanceServiceTest (owner and namespace ADMIN allowed, MEMBER forbidden, unpublished rejected), SkillLifecycleControllerTest (envelope with and without body). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DdnYX4jTS3JwMMP9JCGxzU * fix(auth): complete API token lifecycle access Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * fix(skills): align owner lifecycle token access Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> --------- Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> Co-authored-by: Thiago Nascimento Nogueira <thiago.nascimento.nogueira@emeal.nttdata.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> Co-authored-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>		2026-09-17 18:48:05 +08:00
..
src	feat(skills): let skill owners yank a published version (#866)	2026-09-17 18:48:05 +08:00
pom.xml	feat(auth): 邮箱验证码重置密码与 SMTP 配置支持 (#273)	2026-04-13 20:27:00 +08:00