feat(identity): 接入认证中心多租户登录

支持 Manifest V2 动态 tid 验证、Tenant Context 同步和租户内 JIT 投影，并保留 Manifest V1 与旧 Session 兼容。\n\n增加 tenantHint、租户切换、普通注册关闭及 application/principal/tenant 两级 SSF 撤销；迁移、定向安全测试和本地双租户跨仓 E2E 已通过。\n\nrelease_required=true；未执行 Release、Staging 或真实链路。
2026-07-28 17:28:35 +08:00
parent 0b02e62c72
commit 5c679ff13f
45 changed files with 2986 additions and 139 deletions
@@ -33,6 +33,27 @@ func TestLoginTransactionIsEncryptedAndBounded(t *testing.T) {
 	}
 }

+func TestLoginTransactionEncryptsTenantHint(t *testing.T) {
+	now := time.Date(2026, 7, 28, 12, 0, 0, 0, time.UTC)
+	cipher, _ := NewCipher(bytes.Repeat([]byte{9}, 32))
+	tenantHint := "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa"
+	transaction, err := NewLoginTransactionWithTenantHint("/", tenantHint, now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	encoded, err := cipher.EncodeLoginTransaction(transaction)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(encoded, tenantHint) {
+		t.Fatal("login transaction cookie contains plaintext tenant hint")
+	}
+	decoded, err := cipher.DecodeLoginTransaction(encoded, now)
+	if err != nil || decoded.TenantHint != tenantHint {
+		t.Fatalf("decoded transaction=%+v err=%v", decoded, err)
+	}
+}
+
 func TestValidReturnToRejectsOpenRedirects(t *testing.T) {
 	for _, value := range []string{"https://evil.example", "//evil.example", "/\\evil", "", "workspace"} {
 		if ValidReturnTo(value) {