dongmucat ace0cb2dd8 fix(auth): address CAS SSO review — XXE, AccessPolicy, timeouts, release wiring ... Blockers: - Harden XML parsing against XXE (disallow DOCTYPE, external entities/DTDs, enable FEATURE_SECURE_PROCESSING) and switch to UTF-8 byte decoding. - Generalize AccessPolicy.evaluate from OAuthClaims to IdentityClaims; extract IdentityAuthenticator so OAuth and CAS share allow/deny/pending evaluation. CAS callback now goes through the policy instead of bypassing it with a direct bindOrCreate call. - Configure JDK HttpClient with connect/read timeouts (5s/10s) and disable HTTP redirects to prevent ticket exfiltration via a malicious CAS server. Major: - Require HTTPS for skillhub.auth.cas.service-url in addition to server-url. - Stop logging raw service tickets; log claims.subject() instead. - Remove the dead authCasEnabled web flag — the backend AuthMethodCatalog is the single source of truth for CAS visibility, matching how OAuth works. - Wire SKILLHUB_AUTH_CAS_* env vars into compose.release.yml and add a fully documented section in .env.release.example. Minor: - CasProtocolVersion enum replaces string comparisons in the validator. - JSON multi-value array attributes are preserved as List<String> instead of silently dropping all but the first element. - AuthMethod.methodType union adds 'CAS_REDIRECT'. - application.yml notes that service-url must equal ${SKILLHUB_PUBLIC_BASE_URL}/api/v1/auth/cas/callback. Tests: - CasTicketValidatorTest tightens URL matching to assert ticket/service/format parameters and adds XXE + billion-laughs regression cases. - IdentityAuthenticatorTest covers ALLOW / PENDING / DENY paths. - AuthMethodCatalogTest exercises both cas.enabled=true and =false. - isExternalRedirectMethod predicate extracted and unit-tested.		2026-05-27 15:19:11 +08:00
..
src	fix(auth): address CAS SSO review — XXE, AccessPolicy, timeouts, release wiring	2026-05-27 15:19:11 +08:00
pom.xml	fix: migrate scanner stream to redisson and refine audit status labels` (#153)	2026-03-24 14:56:16 +08:00