Agent Skills › iflytek/skillhub › api-and-namespace-design

api-and-namespace-design

GitHub

定义API设计规范、命名空间坐标体系、RBAC权限模型及ClawHub兼容性层，涵盖OpenAPI契约同步与CSRF安全处理，指导REST接口开发与治理。

.agents/skills/api-and-namespace-design/SKILL.md iflytek/skillhub

Trigger Scenarios

添加或修改REST API端点调整命名空间或用户坐标逻辑开发ClawHub CLI兼容层修改OpenAPI规范或生成类型

Install

npx skills add iflytek/skillhub --skill api-and-namespace-design -g -y

More Options

Non-standard path

npx skills add https://github.com/iflytek/skillhub/tree/main/.agents/skills/api-and-namespace-design -g -y

Use without installing

npx skills use iflytek/skillhub@api-and-namespace-design

指定 Agent (Claude Code)

npx skills add iflytek/skillhub --skill api-and-namespace-design -a claude-code -g -y

安装 repo 全部 skill

npx skills add iflytek/skillhub --all -g -y

预览 repo 内 skill

npx skills add iflytek/skillhub --list

SKILL.md

Frontmatter

{
    "name": "api-and-namespace-design",
    "license": "Apache-2.0",
    "description": "API design conventions, namespace coordinate system, RBAC roles, ClawHub compatibility layer, OpenAPI contract sync rules, and CSRF\/session handling."
}

API and Namespace Design Skill

Trigger

Use this skill when:

Adding or modifying REST API endpoints
Changing namespace, skill, or user coordinate logic
Working on ClawHub CLI compatibility layer
Modifying OpenAPI specifications or generated types
Adding new admin or governance endpoints

Namespace Coordinate System

SkillHub uses a two-axis coordinate model:

@{namespace_slug}/{skill_slug}

@global/my-skill — Global namespace skill
@my-team/my-skill — Team namespace skill (namespace slug is any valid slug)
@department-ops/my-skill — Department namespace skill

Namespace Model

Namespaces (domain/namespace/):

Slug: unique identifier, validated by SlugValidator
Status: ACTIVE, FROZEN, ARCHIVED
Roles: OWNER, ADMIN, MEMBER
Frozen or archived namespaces cannot publish skills

RBAC Roles

Namespace-level (domain/namespace/NamespaceRole):

OWNER — Full control over namespace and all skills
ADMIN — Can manage members, archive skills, publish
MEMBER — Can publish skills to the namespace

Platform-level:

SUPER_ADMIN — Bypasses all permission checks, can publish directly without review

ClawHub Compatibility Layer

ClawHub CLI uses a single-slug model (no / allowed in slugs). Mapping:

SkillHub Coordinate	Canonical Slug	Notes
`@global/my-skill`	`my-skill`	Global namespace omits prefix
`@team-name/my-skill`	`team-name--my-skill`	Double-dash separator

Conflict resolution: -- split takes priority. @global/team-name--my-skill would conflict with @team-name/my-skill, resolved to the team namespace skill. Global skill slugs must NOT contain --.

API Design

Controllers

Controllers in skillhub-app (com.iflytek.skillhub.controller/) are transport only
Responsibilities: extract auth context, bind request params, wrap responses
Complex business logic belongs in domain services (skillhub-domain) or app services
Use Springdoc OpenAPI annotations (@Operation, @ApiResponse) for API documentation
User identity is always String in API inputs and outputs

Request/Response Patterns

DTOs in com.iflytek.skillhub.dto/
ReviewTaskRequest / ReviewTaskResponse for review workflow
Response wrapping handled at controller layer
Validation errors use DomainBadRequestException with i18n message keys

Session and CSRF

Session-based auth with cookie storage
CSRF protection via XSRF-TOKEN cookie and X-XSRF-TOKEN header
Smoke tests validate the full register → login → CSRF → action → logout flow
Mock auth uses X-Mock-User-Id header in local dev

Well-known Discovery

/.well-known/clawhub.json returns { "apiBase": "/api/v1" } for ClawHub CLI auto-discovery.

OpenAPI Contract Sync

When backend API contracts change:

make generate-api

This runs openapi-typescript http://localhost:8080/v3/api-docs -o src/api/generated/schema.d.ts.

Commit the updated web/src/api/generated/schema.d.ts with the PR.

To verify no drift:

./scripts/check-openapi-generated.sh

This starts local dependencies, boots the backend, regenerates the schema, and fails if the checked-in SDK is stale.

Versioning and Tags

Semantic versioning for skill versions (major.minor.patch)
latest tag is system-reserved, read-only, auto-follows Skill.latestVersionId
Custom tags (stable, beta) are manually maintained
latest cannot be moved manually
Auto-generated versions use yyyyMMdd.HHmmss format when no version is specified in SKILL.md

Key API Endpoints

Method	Path	Purpose
`GET`	`/api/v1/auth/me`	Current user info (401 if unauthenticated)
`POST`	`/api/v1/auth/local/login`	Local account login
`POST`	`/api/v1/auth/local/register`	Local account registration
`POST`	`/api/v1/auth/logout`	Logout (302/200/204)
`POST`	`/api/v1/auth/local/change-password`	Password change
`GET`	`/api/v1/namespaces`	List namespaces
`GET`	`/api/v1/labels`	List visible labels (public)
`POST`	`/api/v1/admin/labels`	Create label definition (admin)
`DELETE`	`/api/v1/admin/labels/{slug}`	Delete label definition (admin)
`GET`	`/actuator/health`	Health check
`GET`	`/actuator/prometheus`	Prometheus metrics

Common Pitfalls

Forgetting CSRF token on POST/PUT/DELETE requests (needs X-XSRF-TOKEN header)
Using numeric user IDs in API — all user identities are String
Not regenerating OpenAPI types after adding/changing endpoints
Putting business logic in controllers instead of domain/app services
Assuming namespace slugs follow a specific prefix pattern — they are arbitrary valid slugs