mirror of
https://github.com/iflytek/skillhub.git
synced 2026-09-24 00:55:35 +00:00
a59b11b2f0
* feat(auth): expose skill lifecycle routes to API tokens
With an API token, v0.2.19 can remove a whole skill (DELETE
/api/v1/skills/{ns}/{slug} with skill:delete) but cannot archive or
unarchive a skill, nor delete a single draft/rejected version. Those
three routes are opened by AUTHORIZATION_POLICIES (authenticated
fallback) yet have no entry in API_TOKEN_POLICIES, so a bearer request
falls through to "unsupported" and is rejected with 403.
That contradicts the contract written above SESSION_ONLY_ROUTES in
RouteSecurityPolicyRegistry: bearer tokens are rejected on exactly the
listed session-only routes and nowhere else, and anything else the
authorization list opens must be reachable with a token holding the
required scope.
Add API-token policies for both the /api/v1 and /api/web prefixes that
SkillLifecycleController serves:
- POST .../skills/{ns}/{slug}/archive and .../unarchive require
skill:publish. They are owner-level operations, gated by the same
assertCanManageLifecycle check as publishing, so they sit at the same
scope tier.
- DELETE .../skills/{ns}/{slug}/versions/{version} requires
skill:delete, matching the existing whole-skill delete.
Whole-skill DELETE on /api/web stays session-only as documented; the
new version-delete pattern does not overlap it. No scope allow-list
exists outside the registry (TokenController and ApiTokenScopeService
accept any scope string), so no other change is needed for tokens to
carry these scopes.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DdnYX4jTS3JwMMP9JCGxzU
* fix(auth): complete API token lifecycle access
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
---------
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
Co-authored-by: Thiago Nascimento Nogueira <thiago.nascimento.nogueira@emeal.nttdata.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Co-authored-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
|
||
|---|---|---|
| .. | ||
| api | ||
| prds | ||
| research | ||
| skillhub | ||
| superpowers | ||
| 00-product-direction.md | ||
| 01-system-architecture.md | ||
| 02-domain-model.md | ||
| 03-authentication-design.md | ||
| 04-search-architecture.md | ||
| 05-business-flows.md | ||
| 06-api-design.md | ||
| 07-skill-protocol.md | ||
| 08-frontend-architecture.md | ||
| 09-deployment.md | ||
| 10-delivery-roadmap.md | ||
| 11-auth-extensibility-and-private-sso.md | ||
| 12-private-sso-integration-playbook.md | ||
| 13-parallel-workflow.md | ||
| 14-skill-lifecycle.md | ||
| 15-backend-time-governance-plan.md | ||
| 16-backend-time-inventory.md | ||
| 17-backend-annotation-findings.md | ||
| 18-frontend-annotation-findings.md | ||
| 19-smtp-password-reset-email-setup.md | ||
| 20-cloud-url-builtin-skills-setup.md | ||
| 21-official-starter-skills-plan.md | ||
| 22-builtin-skills-candidate-pool.md | ||
| 23-builtin-skills-first-round-test-report.md | ||
| 24-compliance-metadata-design.md | ||
| 25-skill-suites.md | ||
| 2026-03-20-skill-label-system-design.md | ||
| 2026-04-08-issue-automation-design.md | ||
| 2026-07-31-observability-construction-plan.md | ||
| 2026-08-13-personal-namespace-provisioning.md | ||
| ai-changes-cli-oauth-device-flow.md | ||
| CONTENT_SAFETY.md | ||
| dev-workflow.md | ||
| e2e.md | ||
| hermes-integration-en.md | ||
| hermes-integration.md | ||
| observability-decision-map.md | ||
| observability-developer-guide.md | ||
| openclaw-integration-en.md | ||
| openclaw-integration.md | ||
| oss-01-core-contract-freeze.md | ||
| oss-02-core-semantic-rules.md | ||
| pr-batch-test-runtime.md | ||
| PRIVACY_AND_DATA_GOVERNANCE.md | ||
| RISCV64.md | ||
| security-scanning.md | ||