chore(merge): 整合最新 main 与统一认证变更

合并远端生产 CI、依赖与 API 文档改动，保留统一认证和 SSF 能力。由于远端生产基线已占用 0062，将尚未发布的身份迁移整理为 0063 至 0068 的最终增量 Schema，移除仅用于开发期草稿升级的破坏性迁移步骤。验证：go test ./...。其余生产门禁在合并提交后继续执行。
2026-07-17 19:06:37 +08:00
parent 5b8178b703 6cc24fa978
commit 4426eeccf7
100 changed files with 9673 additions and 1799 deletions
@@ -0,0 +1,56 @@
+CREATE TABLE IF NOT EXISTS gateway_identity_configuration_revisions (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  state text NOT NULL DEFAULT 'draft' CHECK (state IN ('draft','validated','active','superseded','failed')),
+  schema_version integer NOT NULL DEFAULT 1 CHECK (schema_version = 1),
+  auth_center_url text NOT NULL,
+  issuer text,
+  tenant_id text,
+  application_id text,
+  audience text,
+  browser_client_id text,
+  machine_client_id text,
+  scopes jsonb NOT NULL DEFAULT '[]'::jsonb CHECK (jsonb_typeof(scopes) = 'array'),
+  capabilities jsonb NOT NULL DEFAULT '[]'::jsonb CHECK (jsonb_typeof(capabilities) = 'array'),
+  role_prefix text NOT NULL DEFAULT 'gateway.',
+  local_tenant_key text NOT NULL,
+  public_base_url text NOT NULL,
+  web_base_url text NOT NULL,
+  jit_enabled boolean NOT NULL DEFAULT true,
+  legacy_jwt_enabled boolean NOT NULL DEFAULT false,
+  token_introspection boolean NOT NULL DEFAULT false,
+  session_revocation boolean NOT NULL DEFAULT false,
+  security_event_issuer text,
+  security_event_configuration_url text,
+  security_event_audience text,
+  machine_credential_ref text,
+  session_encryption_key_ref text,
+  session_idle_seconds integer NOT NULL DEFAULT 1800 CHECK (session_idle_seconds > 0),
+  session_absolute_seconds integer NOT NULL DEFAULT 28800 CHECK (session_absolute_seconds > session_idle_seconds),
+  session_refresh_seconds integer NOT NULL DEFAULT 60 CHECK (session_refresh_seconds > 0 AND session_refresh_seconds < session_idle_seconds),
+  version bigint NOT NULL DEFAULT 1 CHECK (version > 0),
+  last_error_category text,
+  last_trace_id text,
+  last_audit_id text,
+  validated_at timestamptz,
+  activated_at timestamptz,
+  superseded_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CHECK (machine_credential_ref IS NULL OR machine_credential_ref ~ '^[a-z0-9][a-z0-9-]{0,127}$'),
+  CHECK (session_encryption_key_ref IS NULL OR session_encryption_key_ref ~ '^[a-z0-9][a-z0-9-]{0,127}$')
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_gateway_identity_configuration_single_active
+  ON gateway_identity_configuration_revisions ((true)) WHERE state = 'active';
+
+CREATE INDEX IF NOT EXISTS idx_gateway_identity_configuration_revisions_created
+  ON gateway_identity_configuration_revisions(created_at DESC);
+
+CREATE TABLE IF NOT EXISTS gateway_identity_management_requests (
+  operation text NOT NULL,
+  idempotency_key text NOT NULL,
+  request_hash text NOT NULL,
+  response jsonb NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (operation, idempotency_key)
+);