XiaoSeS dba36ca1b9 fix(auth): bound Feishu userinfo response and stop subject leaking into displayName ... Three defects found reviewing this batch against the R1-A2 spec. Response size limit. The spec's scope line asks for "远程 I/O 超时与响应大小 限制"; only the timeouts were implemented, so a misconfigured or hostile OAUTH2_FEISHU_BASE_URI could stream an unbounded body into the parser. Reads at most 64 KB before parsing, mirroring the 10 MB cap the shared WebClientConfig already applies. Uses InputStream.readNBytes rather than adding commons-io or guava, neither of which skillhub-auth declares. Synthesized displayName. Falling back to "feishu-<open_id>" wrote the external subject into UserAccount.displayName and into UserActivatedEvent, carrying it somewhere event consumers may log it -- against the R1-A gate that logs must not contain the subject. Now stops at name -> en_name like the GitHub and GitLab extractors. Unused mobile attribute. A phone number was extracted into the principal attributes and read by nothing. It is PII the spec did not ask for and it widened the redaction surface for free. Also drops a constructor overload that only passed List.of() through, and a test that duplicated the blank-subject path. Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>		2026-09-21 10:18:37 +08:00
..
src	fix(auth): bound Feishu userinfo response and stop subject leaking into displayName	2026-09-21 10:18:37 +08:00
pom.xml	feat(auth): 邮箱验证码重置密码与 SMTP 配置支持 (#273)	2026-04-13 20:27:00 +08:00