Reuse the active RequestMappingHandlerMapping for authorization method lookup, retain a deprecated legacy fallback, and add auth-enabled integration coverage for module permissions and ambiguous URI forms.
Assisted-by: Claude Code
Centralize plugin execution capabilities and separate core module gates from plugin state. Migrate AI pipeline services to direct PluginConfigSpec lifecycle management with unified runtime ordering and legacy configuration compatibility.
Assisted-by: Claude Code
Move OIDC settings into PluginConfigSpec with immutable plugin-owned runtime state, standard keys, legacy aliases, specs, and API coverage.
Assisted-by: Claude Code
* [ISSUE #15164] Make skill ZIP entry and size limits configurable
The hard-coded 500-entry and 50 MB caps in SkillZipParser were originally
introduced as Zip-Bomb hardening, but they also reject legitimate large
skill uploads — particularly skills with many small asset files. Expose
both bounds via existing EnvUtil properties so operators can raise them
without code changes:
- nacos.ai.skill.zip.max-entries (default 500)
- nacos.ai.skill.zip.max-uncompressed-size-mb (default 50)
Non-positive overrides are ignored and fall back to the default to keep
the security guard intact, and SkillZipParser still operates correctly
when the Nacos environment has not been initialized (e.g. unit tests),
preserving existing call sites.
* [ISSUE #15164] Sharpen SkillZipParser limits tests and dedupe resolver helpers
Self-review follow-up for the previous commit:
- Replace the previous "raised limit" parseSkillFromZip test, whose
catch clause only checked for the absence of a specific message, with
a direct invocation of unzipToEntries that asserts all 601 entries
are returned when the configured cap is above the input size. The
old form silently passed even if parseSkillFromZip succeeded for an
unrelated reason.
- Add a parallel "environment missing" fallback test for the
uncompressed-size resolver to match the coverage of the entry-count
resolver.
- Extract resolvePositiveIntProperty(...) so resolveMaxZipEntries and
resolveMaxUncompressedBytes share one implementation of "env-aware,
non-positive-rejected" property reading.
* [ISSUE #15164] Make skill ZIP upload-size limit configurable
Address the remaining hard-coded skill upload caps surfaced in the
issue triage (Sunrisea's #3 / #4): the 10 MB MAX_UPLOAD_ZIP_BYTES guard
applied at both the controller entrance (SkillRequestUtil) and the
parser entrance (SkillZipParser parseSkillFromZip /
parseMultipleSkillsFromZip). Without this knob, raising the entry-count
and uncompressed-size caps was not enough to actually let a large skill
through — the request was rejected before either guard ran.
- Introduce nacos.ai.skill.zip.max-upload-size-mb (default 10 MB) and
SkillZipParser#resolveMaxUploadBytes(), reusing the existing
resolvePositiveIntProperty helper so the three configurable knobs
share one implementation.
- Route SkillRequestUtil#validateAndExtractZipBytes,
SkillZipParser#parseSkillFromZip, and
SkillZipParser#parseMultipleSkillsFromZip through the new resolver.
- Keep Constants.Skills#MAX_UPLOAD_ZIP_BYTES as the documented default
for backward compatibility; the Javadoc now points runtime callers
at the resolver.
- Document the new property next to the other ai.skill.zip knobs in
application.properties, including a reminder that the Spring
multipart cap (spring.servlet.multipart.max-file-size) must be
raised in lockstep — Tomcat rejects oversize uploads first.
- Add five tests in SkillZipParserLimitsConfigTest covering default,
positive override, non-positive fallback, missing-environment
fallback, and an end-to-end parseSkillFromZip rejection driven by
an incompressible 2 MB payload against a 1 MB configured cap.
* [ISSUE #15164] Align upload-size default with Constants and Random import style
Two small follow-ups from a second pass on the previous commit:
- Derive DEFAULT_MAX_UPLOAD_SIZE_MB from Constants.Skills#MAX_UPLOAD_ZIP_BYTES
so the public constant stays the single source of truth. Previously the
default lived as a literal 10 in SkillZipParser and a literal 10L * 1024 * 1024
in Constants, which could drift if one was updated without the other.
- Use a top-level import for java.util.Random in the limits-config test to
match the import style used elsewhere in the codebase (every other test
uses the short name with an import rather than a fully qualified one).
* [ISSUE #15164] Make AgentSpec ZIP limits configurable, mirroring skill
Mirrors the SkillZipParser changes from this PR onto AgentSpecZipParser
in response to maintainer review feedback ("Can add agentspec zip
entries and bytes size configurable together?"). The three hard-coded
caps applied at the controller entrance (AgentSpecRequestUtil) and the
parser entrance (AgentSpecZipParser parseAgentSpecFromZip) are now
overridable via EnvUtil properties, with defaults unchanged so existing
deployments behave identically:
- nacos.ai.agentspec.zip.max-upload-size-mb (default 50 MB,
derived from Constants.AgentSpecs#MAX_UPLOAD_ZIP_BYTES so the public
constant remains the single source of truth)
- nacos.ai.agentspec.zip.max-entries (default 500)
- nacos.ai.agentspec.zip.max-uncompressed-size-mb (default 50)
The resolver helpers and resolvePositiveIntProperty implementation are
direct copies of the SkillZipParser pattern from earlier commits on
this PR so the two parsers stay symmetric. Non-positive overrides are
rejected and fall back to the default to keep the Zip-Bomb / DoS guards
intact. AgentSpecZipParserLimitsConfigTest mirrors
SkillZipParserLimitsConfigTest with 16 cases: per-resolver defaults,
positive override accepted, non-positive override ignored,
missing-environment fallback, and end-to-end parseAgentSpecFromZip
rejections driven by the configured caps (including an incompressible
2 MB payload against a 1 MB configured upload cap).
* [ISSUE #15038] docs(auth): clarify SDK and admin auth scopes
Assisted-by: Claude Code
* [ISSUE #15038] docs(auth): clarify console.enabled scope
Mirror the same hint already added for auth.enabled and auth.admin.enabled:
nacos.core.auth.console.enabled controls /v3/console/* HTTP request
authentication only.
Addresses review feedback from @KomachiSion on PR #15134.
Assisted-by: Claude Code
Expose nacos.extension.ai.enabled in console module state and use it to hide AI registry routes and sidebar entries in the new console.
Disable remote AI console handlers when the AI extension switch is off.
Assisted-by: Claude Code
* feat(visibility): add support to enable or disable visibility plugin via config.
* feat(visibility): add support to enable or disable visibility plugin via config.
* [ai-registry-adaptor] Rename mcp-registry module to ai-registry
* [ai-registry-adaptor] Update unit tests for ai-registry rename
* [bootstrap] Separate mcp/skill registry enable switches and migrate port config
* fix: correct license comment indentation in AbstractNacosRestTemplate
* feat(console): support dual UI switching between new and legacy console
- Add ConsoleRedirectController to redirect root `/` to default UI based on
`nacos.console.ui.default` config (defaults to "next")
- Add `console_ui_default` field to server state API
- Move old UI build output to `/legacy/` path, new UI to `/next/` path
- Fix new UI API baseURL to work correctly under `/next/` sub-path
- Fix old UI API baseURL and resource paths to use absolute references
- Add UI version switch buttons to both consoles (bottom-right corner)
- Update security ignore URLs for `/next/**` and `/legacy/**`
- Add build copy scripts for both UIs
🤖 Generated with [Qoder][https://qoder.com]
* fix(console): add forward mappings for /next/ and /legacy/ directory URLs
Spring Boot static resource handler does not serve index.html for
subdirectory URLs. Add explicit forward rules so /next/ and /legacy/
resolve to their respective index.html files.
🤖 Generated with [Qoder][https://qoder.com]
* feat(console-ui): adapt contextPath for both new and legacy UIs
- Use relative paths (./, ../) instead of absolute paths for all static
assets, API URLs, SSE endpoints, and UI switching links
- New UI: change Vite base to './', use import.meta.env.BASE_URL for
image paths, compute API baseURL dynamically from window.location
- Legacy UI: change webpack contextPath to relative, fix font paths,
add dynamic contextPath for SSE URLs, fix Monaco editor path
- Fix 17 TypeScript errors (unused imports, React 19 type strictness)
- Add Namespace.namespaceDesc field to match API response
- Update README.md for both UIs with build & deploy instructions
- Deploy build artifacts to console static resource directories
🤖 Generated with [Qoder][https://qoder.com]
* feat(console-ui-next): redesign settings center and reorder sidebar
- Remove Studio-related settings (studioUrl, studioProject) from settings center
- Redesign settings page with improved visual hierarchy:
- Add page description and section description text
- Use icon badge with colored background for section header
- Move API key hint from tooltip to inline helper text
- Integrate save button inside card with border separator
- Follow space-y-2.5 form spacing convention
- Reorder sidebar: AI Registry moved to top, children reordered to
Skill > Prompt > Agent > MCP, default expanded
- Update i18n files (en-US, zh-CN) accordingly
- Deploy updated build artifacts to static/next/
🤖 Generated with [Qoder][https://qoder.com]
* docs: translate README files to English for both UIs
🤖 Generated with [Qoder][https://qoder.com]
* refactor(plugin): Refactor default database plugin, split database plugins and move depend jdbc to plugins dir.
* fix(ci): update JaCoCo report paths for datasource plugins in CI workflow
* fix(pom): update maven-antrun-plugin version and correct task tags
* feat(build): activate dev profile by default for plugin dependencies
* feat: Support JDK 17+ and macOS ARM64, update dependencies
- [istio] Upgrade os-maven-plugin to 1.7.1 for macOS ARM64 support.
- [istio] Split protobuf-maven-plugin executions to prevent file locking issues.
- [bootstrap] Add dev profile to include default plugins for development.
* fix(ai): Fix when nacos.extension.ai.enabled is false, nacos start failed.
* fix(ai): Fix when nacos.extension.ai.enabled is false, nacos start failed.
* add more mcp registry data structure support and use jackson annotation for properties alias
* add more mcp registry data structure support and use jackson annotation for properties alias
* rename package name to packageInfo
* correct registry name in maven module
* add ui support
* add remote headers support
* remote examples
* disable test for package
* Feat support mcp registry api (#13376)
* Support tag fuzzy search (#13387)
* support tag fuzzy search
* support tag fuzzy search
* Merge pull request #13391 from luoxiner/support-mcp-multi-version
Feat Support Mcp Registry
* Add copyright for mcp-adapter pom.
* Support version in ai maintainer sdk and fix some errors when build (#13401)
* add version for ai maintainer sdk and support display mcp server config
* fix pmd errors
* fix empty endpoint
* remote publish api
* fix tag fuzzy search sql unit test (#13402)
* Fix unit test.
---------
Co-authored-by: Xin Luo <65529035+luoxiner@users.noreply.github.com>
Co-authored-by: Sunrisea <49605583+Sunrisea@users.noreply.github.com>
Co-authored-by: luoxin.luo <luoxin.luo@alibaba-inc.com>
* Use Page to replace List result for some maintainer api.
* Support namespace page.
* uniform Namespace model to api。
* Support console get server state from nacos-server
* Fix update namespace invalid problem.
* console support setting admin password.
* Add Console maintainer client auth plugin to support identity request.
* Support Nacos Console get users info from nacos server.
* Support Nacos Console get role and permission info from nacos server.
* Fix NPE by AuthConfig loading Circular Dependencies.
* Support start up with console only mode: step1 - basic start up.
* Support start up with console only mode: step2 - solve server state to fix console ui loading.
杨翊 SionYang