FenjuFu fa04d2fa23 fix(auth): close API token policy gaps against the authorization list (#729) ... RouteSecurityPolicyRegistry keeps two policy lists — AUTHORIZATION_POLICIES for session/cookie access and API_TOKEN_POLICIES for Bearer tokens — with nothing keeping them in step. Routes the authorization list opens but the token list never registers fall through to the catch-all and answer API token cannot access endpoint: <path>. Register the routes reported in #713 (/api/v1/labels, the star and rating writes) plus the same-class gaps for /api/v1/auth/methods and paths below /api/v1/download, and add a guard test that walks the authorization list and fails when a route is neither token-reachable nor declared session-only. DELETE /api/v1/skills/{id}/star also matched the SUPER_ADMIN rule for DELETE /api/v1/skills/*/*, so un-starring was refused for ordinary accounts on the session path too. Star and rating writes now have their own authorization entries ahead of that rule. Closes #713 Signed-off-by: FenjuFu <fufenjupku@gmail.com>		2026-08-21 16:08:50 +08:00
..
src	fix(auth): close API token policy gaps against the authorization list (#729)	2026-08-21 16:08:50 +08:00
pom.xml	feat(auth): 邮箱验证码重置密码与 SMTP 配置支持 (#273)	2026-04-13 20:27:00 +08:00