fix(identity): 完善统一认证配对恢复与安全退役

修复 credentials_saved 状态无法恢复、配对与激活并发冲突，以及 SSF 和身份 Secret 生命周期不完整的问题。新增持久化协调器、取消与清理状态机、事务级并发门禁、受控 SSF 凭据交接、禁用后的延迟 Secret 清理，并对生产环境统一认证及 Discovery 端点强制 HTTPS。验证：go test ./...；go test -race ./internal/auth ./internal/identity ./internal/identityruntime ./internal/securityevents ./internal/httpapi ./internal/store -count=1；go vet ./...；真实 PostgreSQL 并发及清理成功/冲突回滚测试；pnpm openapi。
2026-07-17 18:31:12 +08:00
parent cdfca61304
commit a312ad880d
55 changed files with 9225 additions and 419 deletions
@@ -43,6 +43,7 @@ func TestOIDCVerifierAcceptsRS256AndES256StableClaims(t *testing.T) {
 	defer server.Close()
 	issuer = server.URL
 	verifier, err := NewOIDCVerifier(OIDCConfig{
+		AppEnv: "test",
 		Issuer: issuer, Audience: "gateway-api", TenantID: "tenant-1",
 		RolePrefix: "gateway.", RequiredScopes: []string{"gateway.access"}, HTTPClient: server.Client(),
 	})
@@ -85,6 +86,7 @@ func TestOIDCVerifierRejectsMissingOrMismatchedSecurityClaims(t *testing.T) {
 	defer server.Close()
 	issuer = server.URL
 	verifier, _ := NewOIDCVerifier(OIDCConfig{
+		AppEnv: "test",
 		Issuer: issuer, Audience: "gateway-api", TenantID: "tenant-1", RolePrefix: "gateway.",
 		RequiredScopes: []string{"gateway.access"}, HTTPClient: server.Client(),
 	})
@@ -139,6 +141,7 @@ func TestOIDCVerifierFailsClosedWhenIntrospectionMarksSessionInactive(t *testing
 	defer server.Close()
 	issuer = server.URL
 	verifier, err := NewOIDCVerifier(OIDCConfig{
+		AppEnv: "test",
 		Issuer: issuer, Audience: "gateway-api", TenantID: "tenant-1", RolePrefix: "gateway.",
 		RequiredScopes: []string{"gateway.access"}, HTTPClient: server.Client(),
 		IntrospectionEnabled: true,
@@ -182,6 +185,7 @@ func TestOIDCSecurityEventEvaluationUsesWatermarkAndFallbackIntrospection(t *tes
 	issuer = server.URL
 	evaluation := OIDCSecurityEventEvaluation{RequireIntrospection: true}
 	verifier, err := NewOIDCVerifier(OIDCConfig{
+		AppEnv: "test",
 		Issuer: issuer, Audience: "gateway-api", TenantID: "tenant-1", RolePrefix: "gateway.",
 		RequiredScopes: []string{"gateway.access"}, HTTPClient: server.Client(),
 		IntrospectionEnabled:  true,
@@ -227,6 +231,72 @@ func TestOIDCSecurityEventEvaluationUsesWatermarkAndFallbackIntrospection(t *tes
 	}
 }

+func TestOIDCVerifierRejectsLoopbackHTTPDiscoveryEndpointsInProduction(t *testing.T) {
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var issuer, jwksURI, introspectionEndpoint string
+	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, request *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		switch request.URL.Path {
+		case "/.well-known/openid-configuration":
+			_ = json.NewEncoder(w).Encode(map[string]string{
+				"issuer": issuer, "jwks_uri": jwksURI, "introspection_endpoint": introspectionEndpoint,
+			})
+		case "/jwks":
+			_ = json.NewEncoder(w).Encode(map[string]any{"keys": []any{rsaJWK("rsa-key", &key.PublicKey)}})
+		default:
+			http.NotFound(w, request)
+		}
+	}))
+	defer server.Close()
+	issuer = server.URL
+
+	for _, test := range []struct {
+		name          string
+		jwks          string
+		introspection string
+	}{
+		{name: "JWKS", jwks: "http://127.0.0.1:1/jwks"},
+		{name: "introspection", jwks: issuer + "/jwks", introspection: "http://localhost:1/introspect"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			jwksURI, introspectionEndpoint = test.jwks, test.introspection
+			config := OIDCConfig{
+				AppEnv: "production", Issuer: issuer, Audience: "gateway-api", TenantID: "tenant-1", RolePrefix: "gateway.",
+				HTTPClient: server.Client(),
+			}
+			if test.introspection != "" {
+				config.IntrospectionEnabled = true
+				config.IntrospectionCredentialProvider = func(context.Context) (string, []byte, error) {
+					return "gateway-machine", []byte("machine-secret-long-enough"), nil
+				}
+			}
+			verifier, createErr := NewOIDCVerifier(config)
+			if createErr != nil {
+				t.Fatal(createErr)
+			}
+			if validateErr := verifier.ValidateConfiguration(context.Background()); validateErr == nil {
+				t.Fatalf("production accepted loopback HTTP %s endpoint", test.name)
+			}
+		})
+	}
+}
+
+func TestOIDCURLPolicyAllowsLoopbackHTTPOnlyInLocalEnvironments(t *testing.T) {
+	for _, appEnv := range []string{"", "production", "staging"} {
+		if err := validatePublicURL("http://127.0.0.2:18003/issuer/easyai", appEnv); err == nil {
+			t.Fatalf("%s accepted loopback HTTP OIDC URL", appEnv)
+		}
+	}
+	for _, appEnv := range []string{"local", "development", "dev", "test"} {
+		if err := validatePublicURL("http://127.0.0.2:18003/issuer/easyai", appEnv); err != nil {
+			t.Fatalf("%s rejected loopback HTTP OIDC URL: %v", appEnv, err)
+		}
+	}
+}
+
 func signedOIDCToken(t *testing.T, issuer, kid string, method jwt.SigningMethod, key any, mutate func(jwt.MapClaims)) string {
 	t.Helper()
 	now := time.Now()