* [ISSUE #14804] Add shared AI resource search APIs
Expose generic and resource-specific client search APIs backed by the shared AI Resource Search Core, with auth routing, specifications, and integration coverage.
Assisted-by: Claude Code
* [ISSUE #14804] Cover AI search authorization scenarios
Register the generic resource search and MCP client controllers in the authorization integration-test matrix.
Assisted-by: Claude Code
* Remove reflective EnvUtil access from visibility plugin
Assisted-by: Claude Code
* Use first-wins plugin registration and definition normalization
Assisted-by: Claude Code
Centralize plugin execution capabilities and separate core module gates from plugin state. Migrate AI pipeline services to direct PluginConfigSpec lifecycle management with unified runtime ordering and legacy configuration compatibility.
Assisted-by: Claude Code
* Fix config namespace isolation for delete and export
Scope config export-by-ids and batch delete-by-ids to the requested namespace across admin, console, and maintainer SDK paths.
Update specs and IT scenario coverage for namespace-scoped storage ID operations.
Assisted-by: Claude Code
* Document config storage ID selector deprecation
Assisted-by: Claude Code
* Fix config clone namespace isolation
Ensure config clone resolves source IDs within the requested source namespace before writing to the target namespace. Update console and maintainer SDK paths plus API/SDK test specs.
Assisted-by: Claude Code
* Refine config clone service coverage
Extract shared clone logic into ConfigCloneService and move clone behavior coverage from controller tests into service-level tests.
Assisted-by: Claude Code
* Refine config clone source authorization
Add source namespace READ authorization for config clone paths and keep auth identity/resource context available for diagnostics.
Assisted-by: Claude Code
* Refresh legacy console clone namespace assets
Assisted-by: Claude Code
* Fix datasource export namespace isolation tests
* Cover datasource export namespace isolation tests
* Fix auth admin filter test header stubbing
* Stabilize clone source auth checker tests
* Apply spotless to clone auth checker
* feat(auth,ai) support auth ai resource subtype parse
* fix(auth): update AiHttpResourceParserTest for aiType property
Update testGetProperties to expect 2 properties (ACTION + AI_TYPE)
after getProperties() now sets aiType based on URL path.
Add test cases for all AI resource types: a2a, skill, prompt, agentSpec.
Assisted-by: Kiro AI
- Add OidcClientAuthServiceImpl as AbstractClientAuthService SPI implementation
- Add OidcTokenHolder for token lifecycle management with proactive refresh window (20-30s before expiry)
- Add OidcClientContext for configuration loading and OIDC Discovery support
- Add OidcClientConstants for client-side config key definitions
- Extract shared protocol-level constants into OidcProtocolConstants (plugin/auth module) to be reused by both client and server
- Migrate server-side OidcConstants usages to OidcProtocolConstants where applicable
- Remove unused OidcSessionManager dead code
- Register OidcClientAuthServiceImpl in SPI META-INF/services
* refactor(auth): unify anonymous AI access config keys and usage.
* refactor(auth): use constant for identity ID parameter in auth plugin.
* refactor(skills): rename and refactor skill admin model classes to SkillMeta and SkillSummary.
* feat(skill): add update skill visibility scope API.
* feat(plugin): implement SPI-based plugin discovery and management API
Refactor plugin discovery to use SPI pattern and add REST API for plugin control:
SPI-based Discovery:
- Replace hard-coded plugin discovery with PluginProvider SPI pattern
- Add comprehensive tests for UnifiedPluginManager and PluginStatePersistence
- Enable automatic plugin registration for better extensibility
Management API:
- Add PluginControllerV3 with 5 endpoints (list, detail, status, config, availability)
- Create PluginInfoVO and PluginDetailVO for API responses
- Create PluginStatusForm and PluginConfigForm for API requests
- Integrate plugin state checking into all plugin managers
- Add getAllPlugins() methods to expose plugin registries
- Fix core module dependency name for custom-environment-plugin
* fix: UT failed
* fix: UT failed
* refactor(plugin): extract PluginStatePersistence to interface-based design
* fix(plugin): remove auth plugin from critical list to allow custom auth
* feat(plugin): implement config-driven default status for exclusive plugins
* Add AI MCP console api.
* Add AI MCP resource parser.
* Add mcp server console api inner implementation without tool operation.
* Add endpoint Specification for mcp api.
* Abstract some remote relative server spec into McpServerRemoteServiceConfig.
* Support handle mcp server tool.
* Support handle mcp server endpoint and fix some tools bug.
* Change auth plugin return boolean to AuthResult.
* set AuthContext result as AuthResult.
* Refactor to remove using AuthConfigs, replaced with NacosAuthConfig.
* Refactor to remove using AuthConfigs, replaced with NacosAuthConfig.
* Move AuthConfigs to default auth plugin impl module.
* Add old API Compatibility annotation logic and control namespace api.
* Add Compatibility annotation for old console module API.
* Add Compatibility annotation for old core module API.
* Add Compatibility annotation for old naming module API.
* Add Compatibility annotation for old config module API.
* Add Compatibility annotation for old default auth plugin module API.
* Add api compatibility configuration to application.properties.
* Add unit test for compatibility.
* [ISSUE #12017] Git Test
* Git Test
* [ISSUE #12017] Fix Git Test
* Fix Git Test
* [ISSUE #12017] Splitting server and console authentication
* Add ApiType annotations
* Update configuration file to add fields
* Update console authentication status fetch
* Update `application.properties` - Reuse `nacos.core.auth.enabled` and add `nacos.core.auth.console.enabled`
* Update `AuthConfigs` - Modify `isAuthEnabled()` to manage plugin initialization
* Update `AbstractProtocolAuthService` - Implement `isAuthEnabled()` method for `Secured` annotation and configuration-based authentication
* Update `RemoteRequestAuthFilter` - Use `authConfigs.isAuthEnabled()` for initialization and `protocolAuthService.authEnabled(secured)` for authentication checks
* [ISSUE #12017] Update the location of the authentication judgment
* Update the location of the authentication judgment
* 提交测试
* [ISSUE #12017] Add console backend configuration handling with proxy and handler layers
* Add ConfigHandler interface for defining configuration operations
* Add ConfigInnerHandler to handle internal configuration logic
* Add ConfigProxy to delegate configuration tasks based on deployment type
* Add ConfigController to utilize ConfigProxy for configuration operations
* Update ConsoleConfig to get development type
* [ISSUE #12017] Fix checkstyle format
* Fix checkstyle format
* Add configuration file fields
* [ISSUE #12017] Update ConsoleConfigController route
* Update ConsoleConfigController route
* [ISSUE #12017] Fix CI PMD violation
* Delete unnecessary comments
* [ISSUE #12017] Update ConsoleConfigController return format
* Update ConsoleConfigController return format
* [ISSUE #12017] Update ConsoleConfigController publishConfig
* Update ConsoleConfigController publishConfig
* [ISSUE #12017] Updated the backend of the console's config section
* Added parameter validation and return value encapsulation to the Controller section
* Put business operations into the handler layer
* A total of 9 APIs are involved in the config section.
* [ISSUE #12017] Updating the config section backend methods
* Updating the config section backend methods
* [ISSUE #12017] Add unit tests for the config section
* Add unit tests for the config section
* Update uri of query method
* [ISSUE #12017] Delete redundant error codes
* Delete redundant error codes
---------
Co-authored-by: rickonzhang <2239164929@qq.com>
* [ISSUE #8214] Add ldap auth plugin
- move the config of ldap from NacosAuthConfig to LdapAuthConfig
Close#8214
* [ISSUE #8214] Resolve CI error
* [ISSUE #8214] The constants of Ldap move to the plugin-impl module
杨翊 SionYang