openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-21 19:25:25 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

[PR #334] feat: expose moderation v2 API and schema contracts #333

New Issue
Open
opened 2026-02-15 17:16:58 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:16:58 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/openclaw/clawhub/pull/334
Author: @ArthurzKV
Created: 2/15/2026
Status: 🔄 Open

Base: main ← Head: codex/skill-verification-v2-clawhub-api

📝 Commits (2)

  • d637cbc feat: expose moderation v2 API and schema contracts
  • 485fae8 fix: return moderation JSON for hidden owner views

📊 Changes

7 files changed (+1714 additions, -1303 deletions)

View changed files

📝 convex/httpApiV1.handlers.test.ts (+840 -718)
📝 convex/httpApiV1/skillsV1.ts (+369 -218)
📝 packages/clawdhub/src/schema/schemas.ts (+204 -178)
📝 packages/schema/dist/schemas.d.ts (+39 -0)
📝 packages/schema/dist/schemas.js (+41 -0)
📝 packages/schema/dist/schemas.js.map (+1 -1)
📝 packages/schema/src/schemas.ts (+220 -188)

📄 Description

Summary

Adds moderation v2 API and schema contracts with additive compatibility for existing clients.

Scope

  • Extends GET /api/v1/skills/:slug moderation payload with additive normalized fields.
  • Adds detailed GET /api/v1/skills/:slug/moderation endpoint.
  • Updates API handler tests for compatibility and new payload behavior.
  • Extends shared and CLI-facing schema packages for new moderation contract.

Notes

  • Legacy booleans (isSuspicious, isMalwareBlocked) are preserved.
  • Backend moderation engine/pipeline is delivered in a separate core PR.

Greptile Summary

This PR adds moderation v2 API contracts: extending the GET /api/v1/skills/:slug response with normalized moderation fields (verdict, reasonCodes, summary, engineVersion, updatedAt), and introducing a new GET /api/v1/skills/:slug/moderation endpoint with role-based access control (owner/staff see full evidence, public callers see redacted evidence). Both schema packages (packages/schema and packages/clawdhub) are updated with ApiV1SkillModerationResponseSchema. Legacy booleans (isSuspicious, isMalwareBlocked) are preserved for backward compatibility.

  • The new /moderation endpoint has an access-control gap: for API-token owners of hidden (non-malware) skills, the getBySlug public query returns null (since it uses Convex session auth, not API-token auth for ownership), causing the endpoint to fall through to a plaintext error response instead of the structured JSON moderation payload.
  • The moderationEvidence field is accessed via an unsafe as cast on result.skill, but this field doesn't exist in the Convex schema or getBySlug query yet (the backend pipeline is noted as a separate PR). Evidence will always be [] until that lands.
  • Test coverage for the new moderation endpoint is present but tests mock the query directly, so they don't exercise the actual getBySlug query's ownership/visibility logic.

Confidence Score: 3/5

  • The schema and handler changes are additive, but the moderation endpoint has an access-control gap that prevents API-token owners from getting structured moderation data for their hidden skills.
  • The v2 fields are properly defaulted and backward-compatible, and the schema contracts are consistent across packages. However, the /moderation endpoint's reliance on getBySlug (which uses Convex session auth) means API-token owners of hidden skills get plaintext errors instead of the JSON moderation payload — defeating the purpose of the endpoint for that key use case. The moderationEvidence type cast is also fragile. Score reflects that the core feature works for public/flagged skills but has a meaningful gap for owner access.
  • convex/httpApiV1/skillsV1.ts — the moderation endpoint access path needs attention for hidden-skill owner access via API tokens.

Last reviewed commit: d637cbc

Context used:

  • Context from dashboard - AGENTS.md (source)

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/openclaw/clawhub/pull/334 **Author:** [@ArthurzKV](https://github.com/ArthurzKV) **Created:** 2/15/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `codex/skill-verification-v2-clawhub-api` --- ### 📝 Commits (2) - [`d637cbc`](https://github.com/openclaw/clawhub/commit/d637cbc13d958d90a1ae28495b49295b5403f568) feat: expose moderation v2 API and schema contracts - [`485fae8`](https://github.com/openclaw/clawhub/commit/485fae89718bff497598d168755cc8e3991e8e3f) fix: return moderation JSON for hidden owner views ### 📊 Changes **7 files changed** (+1714 additions, -1303 deletions) <details> <summary>View changed files</summary> 📝 `convex/httpApiV1.handlers.test.ts` (+840 -718) 📝 `convex/httpApiV1/skillsV1.ts` (+369 -218) 📝 `packages/clawdhub/src/schema/schemas.ts` (+204 -178) 📝 `packages/schema/dist/schemas.d.ts` (+39 -0) 📝 `packages/schema/dist/schemas.js` (+41 -0) 📝 `packages/schema/dist/schemas.js.map` (+1 -1) 📝 `packages/schema/src/schemas.ts` (+220 -188) </details> ### 📄 Description ## Summary Adds moderation v2 API and schema contracts with additive compatibility for existing clients. ## Scope - Extends `GET /api/v1/skills/:slug` moderation payload with additive normalized fields. - Adds detailed `GET /api/v1/skills/:slug/moderation` endpoint. - Updates API handler tests for compatibility and new payload behavior. - Extends shared and CLI-facing schema packages for new moderation contract. ## Notes - Legacy booleans (`isSuspicious`, `isMalwareBlocked`) are preserved. - Backend moderation engine/pipeline is delivered in a separate core PR. <!-- greptile_comment --> <h3>Greptile Summary</h3> This PR adds moderation v2 API contracts: extending the `GET /api/v1/skills/:slug` response with normalized moderation fields (`verdict`, `reasonCodes`, `summary`, `engineVersion`, `updatedAt`), and introducing a new `GET /api/v1/skills/:slug/moderation` endpoint with role-based access control (owner/staff see full evidence, public callers see redacted evidence). Both schema packages (`packages/schema` and `packages/clawdhub`) are updated with `ApiV1SkillModerationResponseSchema`. Legacy booleans (`isSuspicious`, `isMalwareBlocked`) are preserved for backward compatibility. - The new `/moderation` endpoint has an access-control gap: for API-token owners of hidden (non-malware) skills, the `getBySlug` public query returns `null` (since it uses Convex session auth, not API-token auth for ownership), causing the endpoint to fall through to a plaintext error response instead of the structured JSON moderation payload. - The `moderationEvidence` field is accessed via an unsafe `as` cast on `result.skill`, but this field doesn't exist in the Convex schema or `getBySlug` query yet (the backend pipeline is noted as a separate PR). Evidence will always be `[]` until that lands. - Test coverage for the new moderation endpoint is present but tests mock the query directly, so they don't exercise the actual `getBySlug` query's ownership/visibility logic. <h3>Confidence Score: 3/5</h3> - The schema and handler changes are additive, but the moderation endpoint has an access-control gap that prevents API-token owners from getting structured moderation data for their hidden skills. - The v2 fields are properly defaulted and backward-compatible, and the schema contracts are consistent across packages. However, the `/moderation` endpoint's reliance on `getBySlug` (which uses Convex session auth) means API-token owners of hidden skills get plaintext errors instead of the JSON moderation payload — defeating the purpose of the endpoint for that key use case. The `moderationEvidence` type cast is also fragile. Score reflects that the core feature works for public/flagged skills but has a meaningful gap for owner access. - `convex/httpApiV1/skillsV1.ts` — the moderation endpoint access path needs attention for hidden-skill owner access via API tokens. <sub>Last reviewed commit: d637cbc</sub> <!-- greptile_other_comments_section --> **Context used:** - Context from `dashboard` - AGENTS.md ([source](https://app.greptile.com/review/custom-context?memory=a1d58d20-b4dd-4cbb-973a-9fd7824e1921)) <!-- /greptile_comment --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-15 17:16:58 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#333
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?