Merge pull request #304 from iflytek/feat/oss-02-super-admin-visibility

feat(access): add SUPER_ADMIN platform role support

Author: dongmucat

docs/oss-02-core-semantic-rules.md

@@ -589,13 +589,13 @@ private boolean canDownload(SkillVersion version, Skill skill, String currentUse
 
 | 问题 | 严重程度 | 状态 |
 |------|---------|------|
-| 新增 UPLOADED 状态 | 高 | 待实现 |
-| PRIVATE skill 发布逻辑改动 | 高 | 待实现 |
-| 提交审核接口 | 高 | 待实现 |
-| 撤回审核后进入 UPLOADED | 中 | 待实现 |
-| 同名冲突检查补全 | 中 | 待实现 |
-| 管理员可见 UPLOADED skill | 低 | 待实现 |
-| package_name 唯一性检查 | 低 | 可选 |
+| 新增 UPLOADED 状态 | 高 | 已完成 |
+| PRIVATE skill 发布逻辑改动 | 高 | 已完成 |
+| 提交审核接口 | 高 | 已完成 |
+| 撤回审核后进入 UPLOADED | 中 | 已完成 |
+| 同名冲突检查补全 | 中 | 已完成 |
+| 管理员可见 UPLOADED skill | 低 | 已完成 |
+| package_name 唯一性检查 | 低 | 可选（SaaS Adapter 职责） |
 
 ---
 

server/skillhub-app/src/main/java/com/iflytek/skillhub/filter/AuthContextFilter.java

@@ -73,6 +73,7 @@ protected void doFilterInternal(
                 return;
             }
             request.setAttribute("userId", principal.userId());
+            request.setAttribute("platformRoles", principal.platformRoles() != null ? principal.platformRoles() : java.util.Set.of());
             Map<Long, NamespaceRole> userNsRoles = namespaceMemberRepository.findByUserId(principal.userId()).stream()
                     .collect(Collectors.toMap(
                             NamespaceMember::getNamespaceId,

server/skillhub-app/src/main/resources/messages.properties

@@ -104,7 +104,7 @@ error.skill.lifecycle.noPermission=Only the skill owner or namespace admin can m
 error.skill.version.exists=Version already exists: {0}
 error.skill.version.notFound=Version not found: {0}
 error.skill.version.notPublished=Version is not published: {0}
-error.skill.version.delete.unsupported=Only DRAFT or REJECTED versions can be deleted: {0}
+error.skill.version.delete.unsupported=Only DRAFT, UPLOADED, REJECTED, or SCAN_FAILED versions can be deleted: {0}
 error.skill.version.delete.lastVersion=Cannot delete the last remaining version: {0}
 error.skill.report.reason.required=Please provide a report reason
 error.skill.report.unavailable=This skill cannot be reported right now: {0}

server/skillhub-app/src/main/resources/messages_zh.properties

@@ -104,7 +104,7 @@ error.skill.lifecycle.noPermission=只有技能所有者或命名空间管理员
 error.skill.version.exists=版本已存在：{0}
 error.skill.version.notFound=未找到版本：{0}
 error.skill.version.notPublished=版本未发布：{0}
-error.skill.version.delete.unsupported=只有 DRAFT 或 REJECTED 版本可以删除：{0}
+error.skill.version.delete.unsupported=只有 DRAFT、UPLOADED、REJECTED 或 SCAN_FAILED 版本可以删除：{0}
 error.skill.version.delete.lastVersion=无法删除最后一个版本：{0}
 error.skill.report.reason.required=请填写举报原因
 error.skill.report.unavailable=当前无法举报该技能：{0}

server/skillhub-app/src/test/java/com/iflytek/skillhub/controller/SkillControllerTest.java

@@ -22,6 +22,7 @@
 import java.util.TimeZone;
 
 import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.ArgumentMatchers.anySet;
 import static org.mockito.Mockito.when;
 import static org.mockito.ArgumentMatchers.any;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;

server/skillhub-app/src/test/java/com/iflytek/skillhub/controller/portal/SkillPublishControllerTest.java

@@ -4,6 +4,9 @@
 import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.BDDMockito.given;
 import static org.mockito.Mockito.verify;
+
+import com.iflytek.skillhub.domain.skill.validation.PackageEntry;
+import org.mockito.ArgumentMatchers;
 import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.authentication;
 import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.multipart;
@@ -69,7 +72,7 @@ void publish_recordsMetricsAfterSuccess() throws Exception {
 
         given(skillPublishService.publishFromEntries(
             eq("global"),
-            anyList(),
+            ArgumentMatchers.<List<PackageEntry>>any(),
             eq("usr_1"),
             eq(SkillVisibility.PUBLIC),
             eq(Set.of("SUPER_ADMIN")),
@@ -120,7 +123,7 @@ void publish_passesWarningConfirmationFlag() throws Exception {
 
         given(skillPublishService.publishFromEntries(
             eq("global"),
-            anyList(),
+            ArgumentMatchers.<List<PackageEntry>>any(),
             eq("usr_1"),
             eq(SkillVisibility.PUBLIC),
             eq(Set.of("SUPER_ADMIN")),

server/skillhub-domain/src/main/java/com/iflytek/skillhub/domain/skill/VisibilityChecker.java

@@ -3,6 +3,7 @@
 import com.iflytek.skillhub.domain.namespace.NamespaceRole;
 
 import java.util.Map;
+import java.util.Set;
 
 /**
  * Evaluates whether a caller may read a skill based on publication state, visibility, ownership,
@@ -11,6 +12,13 @@
 public class VisibilityChecker {
 
     public boolean canAccess(Skill skill, String currentUserId, Map<Long, NamespaceRole> userNamespaceRoles) {
+        return canAccess(skill, currentUserId, userNamespaceRoles, Set.of());
+    }
+
+    public boolean canAccess(Skill skill, String currentUserId, Map<Long, NamespaceRole> userNamespaceRoles, Set<String> platformRoles) {
+        if (isSuperAdmin(platformRoles)) {
+            return true;
+        }
         if (skill.isHidden()) {
             return isOwner(skill, currentUserId) || isAdminOrAbove(userNamespaceRoles.get(skill.getNamespaceId()));
         }
@@ -31,4 +39,8 @@ private boolean isOwner(Skill skill, String currentUserId) {
     private boolean isAdminOrAbove(NamespaceRole role) {
         return role == NamespaceRole.ADMIN || role == NamespaceRole.OWNER;
     }
+
+    private boolean isSuperAdmin(Set<String> platformRoles) {
+        return platformRoles != null && platformRoles.contains("SUPER_ADMIN");
+    }
 }

server/skillhub-domain/src/main/java/com/iflytek/skillhub/domain/skill/service/SkillQueryService.java

@@ -30,6 +30,7 @@
 import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
+import java.util.Set;
 import java.util.stream.Collectors;
 
 /**
@@ -149,11 +150,14 @@ public SkillDetailDTO getSkillDetail(
             String skillSlug,
             String currentUserId,
             Map<Long, NamespaceRole> userNsRoles) {
-
         Namespace namespace = findNamespace(namespaceSlug);
         Skill skill = resolveVisibleSkill(namespace.getId(), skillSlug, currentUserId);
 
-        // Visibility check
+        if (namespace.getStatus() == com.iflytek.skillhub.domain.namespace.NamespaceStatus.ARCHIVED
+                && !isNamespaceMember(namespace.getId(), currentUserId, userNsRoles)) {
+            throw new DomainForbiddenException("error.namespace.archived", namespaceSlug);
+        }
+
         if (!visibilityChecker.canAccess(skill, currentUserId, userNsRoles)) {
             throw new DomainForbiddenException("error.skill.access.denied", skillSlug);
         }
@@ -198,6 +202,15 @@ public SkillDetailDTO getSkillDetail(
         );
     }
 
+    public SkillDetailDTO getSkillDetail(
+            String namespaceSlug,
+            String skillSlug,
+            String currentUserId,
+            Map<Long, NamespaceRole> userNsRoles,
+            Set<String> platformRoles) {
+        return getSkillDetail(namespaceSlug, skillSlug, currentUserId, userNsRoles);
+    }
+
     /**
      * Lists skills within a namespace after filtering out records the caller is
      * not allowed to discover.

server/skillhub-domain/src/test/java/com/iflytek/skillhub/domain/skill/VisibilityCheckerTest.java

@@ -5,6 +5,7 @@
 import org.junit.jupiter.api.Test;
 
 import java.util.Map;
+import java.util.Set;
 
 import static org.junit.jupiter.api.Assertions.*;
 
@@ -158,4 +159,34 @@ void testHiddenSkillAccessibleByNamespaceAdmin() {
         boolean canAccess = checker.canAccess(hiddenPublicSkill, ADMIN_USER_ID, roles);
         assertTrue(canAccess);
     }
+
+    @Test
+    void testSuperAdminCanAccessPrivateSkill() {
+        boolean canAccess = checker.canAccess(privateSkill, OTHER_USER_ID, Map.of(), Set.of("SUPER_ADMIN"));
+        assertTrue(canAccess);
+    }
+
+    @Test
+    void testSuperAdminCanAccessHiddenSkill() {
+        boolean canAccess = checker.canAccess(hiddenPublicSkill, OTHER_USER_ID, Map.of(), Set.of("SUPER_ADMIN"));
+        assertTrue(canAccess);
+    }
+
+    @Test
+    void testSuperAdminCanAccessUnpublishedSkill() {
+        boolean canAccess = checker.canAccess(unpublishedPublicSkill, OTHER_USER_ID, Map.of(), Set.of("SUPER_ADMIN"));
+        assertTrue(canAccess);
+    }
+
+    @Test
+    void testNonSuperAdminPlatformRolesDoNotGrantAccess() {
+        boolean canAccess = checker.canAccess(privateSkill, OTHER_USER_ID, Map.of(), Set.of("REVIEWER"));
+        assertFalse(canAccess);
+    }
+
+    @Test
+    void testEmptyPlatformRolesDoNotGrantAccess() {
+        boolean canAccess = checker.canAccess(privateSkill, OTHER_USER_ID, Map.of(), Set.of());
+        assertFalse(canAccess);
+    }
 }