sync: stale skill detection, sentry filtering, claim removal, review improvements
Stale Detection: - Detect skills removed/moved from GitHub (3 consecutive 404s threshold) - Hide stale skills from browse/search, show warning banner on detail page - Serve cached files with isStale flag when GitHub returns 404 - Add stale-check crawler command for batch verification - CLI shows warning when installing stale skills from cache Sentry & Error Handling: - Filter browser extension errors and add denyUrls - Anti-inflation measures and sentinel recalibration for curation Claim & Removal: - Enhanced ClaimForm with repo-level removal support - Add repo-removal-request API endpoint with tests - Improved owner page with bilingual content Review Pipeline: - Review version and reviewer tracking in submit API - Source format filter for pending reviews - Updated review tests Other: - Updated i18n strings (en/fa) - BrowseFilters improvements - Dockerfile updates Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
airano
163
apps/web/app/api/skills/repo-removal-request/route.test.ts
Normal file
163
apps/web/app/api/skills/repo-removal-request/route.test.ts
Normal file
@@ -0,0 +1,163 @@
|
||||
import { describe, it, expect, vi, beforeEach } from 'vitest';
|
||||
import { NextRequest } from 'next/server';
|
||||
|
||||
// Mock auth
|
||||
const mockAuth = vi.fn();
|
||||
vi.mock('@/lib/auth', () => ({
|
||||
auth: () => mockAuth(),
|
||||
}));
|
||||
|
||||
// Mock sanitize
|
||||
vi.mock('@/lib/sanitize', () => ({
|
||||
sanitizeReason: (r: string) => r,
|
||||
}));
|
||||
|
||||
// Mock db
|
||||
vi.mock('@skillhub/db', () => ({
|
||||
createDb: vi.fn(() => ({})),
|
||||
userQueries: {
|
||||
getByGithubId: vi.fn(),
|
||||
upsertFromGithub: vi.fn(),
|
||||
},
|
||||
skillQueries: {
|
||||
countByRepo: vi.fn(),
|
||||
blockByRepo: vi.fn(),
|
||||
},
|
||||
discoveredRepoQueries: {
|
||||
blockRepo: vi.fn(),
|
||||
},
|
||||
}));
|
||||
|
||||
import { POST } from './route';
|
||||
import { userQueries, skillQueries, discoveredRepoQueries } from '@skillhub/db';
|
||||
|
||||
function createMockUser(overrides: Partial<{ id: string; githubId: string }> = {}) {
|
||||
return {
|
||||
id: 'user-123',
|
||||
githubId: 'gh-12345',
|
||||
username: 'rawveg',
|
||||
...overrides,
|
||||
};
|
||||
}
|
||||
|
||||
function createRequest(body: unknown) {
|
||||
return new NextRequest('http://localhost:3000/api/skills/repo-removal-request', {
|
||||
method: 'POST',
|
||||
body: JSON.stringify(body),
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
});
|
||||
}
|
||||
|
||||
describe('/api/skills/repo-removal-request', () => {
|
||||
beforeEach(() => {
|
||||
vi.clearAllMocks();
|
||||
vi.stubGlobal('fetch', vi.fn());
|
||||
});
|
||||
|
||||
describe('POST', () => {
|
||||
it('should return 401 when not authenticated', async () => {
|
||||
mockAuth.mockResolvedValue(null);
|
||||
|
||||
const response = await POST(createRequest({ repoUrl: 'rawveg/skillsforge-marketplace' }));
|
||||
const data = await response.json();
|
||||
|
||||
expect(response.status).toBe(401);
|
||||
expect(data.code).toBe('AUTH_REQUIRED');
|
||||
});
|
||||
|
||||
it('should return 400 for missing repoUrl', async () => {
|
||||
mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'rawveg' } });
|
||||
|
||||
const response = await POST(createRequest({}));
|
||||
|
||||
expect(response.status).toBe(400);
|
||||
});
|
||||
|
||||
it('should return 400 PARSE_ERROR for invalid repo format', async () => {
|
||||
mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'rawveg' } });
|
||||
const mockUser = createMockUser();
|
||||
vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
|
||||
|
||||
const response = await POST(createRequest({ repoUrl: 'not-a-valid-format' }));
|
||||
const data = await response.json();
|
||||
|
||||
expect(response.status).toBe(400);
|
||||
expect(data.code).toBe('PARSE_ERROR');
|
||||
});
|
||||
|
||||
it('should return 404 INVALID_REPO when repo not found on GitHub', async () => {
|
||||
mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'rawveg' } });
|
||||
const mockUser = createMockUser();
|
||||
vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
|
||||
vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
|
||||
ok: false,
|
||||
status: 404,
|
||||
} as any));
|
||||
|
||||
const response = await POST(createRequest({ repoUrl: 'rawveg/skillsforge-marketplace' }));
|
||||
const data = await response.json();
|
||||
|
||||
expect(response.status).toBe(404);
|
||||
expect(data.code).toBe('INVALID_REPO');
|
||||
});
|
||||
|
||||
it('should return 403 NOT_OWNER when requester is not repo owner', async () => {
|
||||
mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'other-user' } });
|
||||
const mockUser = createMockUser({ githubId: 'gh-12345' });
|
||||
vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
|
||||
vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
|
||||
ok: true,
|
||||
json: async () => ({ owner: { login: 'rawveg' } }),
|
||||
} as any));
|
||||
|
||||
const response = await POST(createRequest({ repoUrl: 'rawveg/skillsforge-marketplace' }));
|
||||
const data = await response.json();
|
||||
|
||||
expect(response.status).toBe(403);
|
||||
expect(data.code).toBe('NOT_OWNER');
|
||||
});
|
||||
|
||||
it('should block all skills and return success when owner removes repo', async () => {
|
||||
mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'rawveg' } });
|
||||
const mockUser = createMockUser();
|
||||
vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
|
||||
vi.mocked(skillQueries.countByRepo).mockResolvedValue(16 as any);
|
||||
vi.mocked(skillQueries.blockByRepo).mockResolvedValue(undefined);
|
||||
vi.mocked(discoveredRepoQueries.blockRepo).mockResolvedValue(undefined);
|
||||
vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
|
||||
ok: true,
|
||||
json: async () => ({ owner: { login: 'rawveg' } }),
|
||||
} as any));
|
||||
|
||||
const response = await POST(createRequest({ repoUrl: 'rawveg/skillsforge-marketplace', reason: 'I want my skills removed' }));
|
||||
const data = await response.json();
|
||||
|
||||
expect(response.status).toBe(200);
|
||||
expect(data.success).toBe(true);
|
||||
expect(data.blockedCount).toBe(16);
|
||||
expect(data.repo).toBe('rawveg/skillsforge-marketplace');
|
||||
expect(skillQueries.blockByRepo).toHaveBeenCalledWith(expect.anything(), 'rawveg', 'skillsforge-marketplace');
|
||||
expect(discoveredRepoQueries.blockRepo).toHaveBeenCalledWith(expect.anything(), 'rawveg/skillsforge-marketplace');
|
||||
});
|
||||
|
||||
it('should accept full GitHub URL format', async () => {
|
||||
mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'rawveg' } });
|
||||
const mockUser = createMockUser();
|
||||
vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
|
||||
vi.mocked(skillQueries.countByRepo).mockResolvedValue(0 as any);
|
||||
vi.mocked(skillQueries.blockByRepo).mockResolvedValue(undefined);
|
||||
vi.mocked(discoveredRepoQueries.blockRepo).mockResolvedValue(undefined);
|
||||
vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
|
||||
ok: true,
|
||||
json: async () => ({ owner: { login: 'rawveg' } }),
|
||||
} as any));
|
||||
|
||||
const response = await POST(createRequest({ repoUrl: 'https://github.com/rawveg/skillsforge-marketplace' }));
|
||||
const data = await response.json();
|
||||
|
||||
expect(response.status).toBe(200);
|
||||
expect(data.success).toBe(true);
|
||||
expect(data.repo).toBe('rawveg/skillsforge-marketplace');
|
||||
});
|
||||
});
|
||||
});
|
||||
158
apps/web/app/api/skills/repo-removal-request/route.ts
Normal file
158
apps/web/app/api/skills/repo-removal-request/route.ts
Normal file
@@ -0,0 +1,158 @@
|
||||
import type { NextRequest } from 'next/server';
|
||||
import { NextResponse } from 'next/server';
|
||||
import { auth } from '@/lib/auth';
|
||||
import { createDb, skillQueries, discoveredRepoQueries, userQueries } from '@skillhub/db';
|
||||
import { sanitizeReason } from '@/lib/sanitize';
|
||||
|
||||
export const dynamic = 'force-dynamic';
|
||||
|
||||
const db = createDb();
|
||||
|
||||
function parseOwnerRepo(input: string): { owner: string; repo: string } | null {
|
||||
try {
|
||||
if (input.startsWith('https://') || input.startsWith('http://')) {
|
||||
const url = new URL(input);
|
||||
if (!url.hostname.includes('github.com')) return null;
|
||||
const parts = url.pathname.split('/').filter(Boolean);
|
||||
if (parts.length < 2) return null;
|
||||
return { owner: parts[0], repo: parts[1] };
|
||||
}
|
||||
const parts = input.split('/').filter(Boolean);
|
||||
if (parts.length < 2) return null;
|
||||
return { owner: parts[0], repo: parts[1] };
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* POST /api/skills/repo-removal-request
|
||||
* Block all skills from a GitHub repository at once.
|
||||
* Verifies the authenticated user owns the repo, then blocks all skills and
|
||||
* prevents the repo from being re-indexed.
|
||||
*/
|
||||
export async function POST(request: NextRequest) {
|
||||
try {
|
||||
const session = await auth();
|
||||
|
||||
if (!session?.user?.githubId || !session.user.username) {
|
||||
return NextResponse.json(
|
||||
{ error: 'Authentication required', code: 'AUTH_REQUIRED' },
|
||||
{ status: 401 }
|
||||
);
|
||||
}
|
||||
|
||||
const body = await request.json();
|
||||
const { repoUrl, reason } = body;
|
||||
|
||||
if (!repoUrl) {
|
||||
return NextResponse.json(
|
||||
{ error: 'repoUrl is required', code: 'INVALID_INPUT' },
|
||||
{ status: 400 }
|
||||
);
|
||||
}
|
||||
|
||||
const parsed = parseOwnerRepo(String(repoUrl).trim());
|
||||
if (!parsed) {
|
||||
return NextResponse.json(
|
||||
{ error: 'Invalid format. Use https://github.com/owner/repo or owner/repo', code: 'PARSE_ERROR' },
|
||||
{ status: 400 }
|
||||
);
|
||||
}
|
||||
|
||||
const { owner, repo } = parsed;
|
||||
const username = session.user.username;
|
||||
|
||||
// Get or create user
|
||||
let dbUser = await userQueries.getByGithubId(db, session.user.githubId);
|
||||
if (!dbUser) {
|
||||
dbUser = await userQueries.upsertFromGithub(db, {
|
||||
githubId: session.user.githubId,
|
||||
username: session.user.username,
|
||||
displayName: session.user.name || undefined,
|
||||
email: session.user.email || undefined,
|
||||
avatarUrl: session.user.image || undefined,
|
||||
});
|
||||
}
|
||||
if (!dbUser) {
|
||||
return NextResponse.json(
|
||||
{ error: 'Failed to create user record', code: 'USER_CREATE_FAILED' },
|
||||
{ status: 500 }
|
||||
);
|
||||
}
|
||||
|
||||
// Verify repo ownership via GitHub API
|
||||
let isOwner = false;
|
||||
let githubError: string | null = null;
|
||||
|
||||
try {
|
||||
const repoResponse = await fetch(
|
||||
`https://api.github.com/repos/${owner}/${repo}`,
|
||||
{
|
||||
headers: {
|
||||
Accept: 'application/vnd.github.v3+json',
|
||||
'User-Agent': 'SkillHub',
|
||||
},
|
||||
signal: AbortSignal.timeout(10000),
|
||||
}
|
||||
);
|
||||
|
||||
if (repoResponse.ok) {
|
||||
const repoData = await repoResponse.json();
|
||||
if (repoData.owner?.login?.toLowerCase() === username.toLowerCase()) {
|
||||
isOwner = true;
|
||||
}
|
||||
} else if (repoResponse.status === 404) {
|
||||
return NextResponse.json(
|
||||
{ error: 'Repository not found on GitHub', code: 'INVALID_REPO' },
|
||||
{ status: 404 }
|
||||
);
|
||||
} else if (repoResponse.status === 403) {
|
||||
githubError = 'GitHub API rate limit exceeded. Please try again later.';
|
||||
}
|
||||
} catch (fetchError) {
|
||||
console.error('GitHub API fetch error:', fetchError);
|
||||
githubError = 'Failed to verify repository ownership';
|
||||
}
|
||||
|
||||
if (githubError) {
|
||||
return NextResponse.json(
|
||||
{ error: githubError, code: 'GITHUB_ERROR' },
|
||||
{ status: 502 }
|
||||
);
|
||||
}
|
||||
|
||||
if (!isOwner) {
|
||||
return NextResponse.json(
|
||||
{ error: 'You are not the owner of this repository', code: 'NOT_OWNER' },
|
||||
{ status: 403 }
|
||||
);
|
||||
}
|
||||
|
||||
// Count skills before blocking (for response message)
|
||||
const blockedCount = await skillQueries.countByRepo(db, owner, repo);
|
||||
|
||||
// Block all skills from the repo
|
||||
await skillQueries.blockByRepo(db, owner, repo);
|
||||
|
||||
// Block the discovered_repo entry to prevent re-indexing
|
||||
await discoveredRepoQueries.blockRepo(db, `${owner}/${repo}`);
|
||||
|
||||
const sanitizedReason = reason ? sanitizeReason(String(reason)) : undefined;
|
||||
console.log(
|
||||
`[RepoRemoval] ${username} removed ${owner}/${repo} (${blockedCount} skills blocked)${sanitizedReason ? ` — ${sanitizedReason}` : ''}`
|
||||
);
|
||||
|
||||
return NextResponse.json({
|
||||
success: true,
|
||||
blockedCount,
|
||||
repo: `${owner}/${repo}`,
|
||||
});
|
||||
} catch (error) {
|
||||
console.error('Error processing repo removal request:', error);
|
||||
return NextResponse.json(
|
||||
{ error: 'Internal server error', code: 'SERVER_ERROR' },
|
||||
{ status: 500 }
|
||||
);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user