fix(identity): 完善统一认证配对恢复与安全退役

修复 credentials_saved 状态无法恢复、配对与激活并发冲突，以及 SSF 和身份 Secret 生命周期不完整的问题。新增持久化协调器、取消与清理状态机、事务级并发门禁、受控 SSF 凭据交接、禁用后的延迟 Secret 清理，并对生产环境统一认证及 Discovery 端点强制 HTTPS。验证：go test ./...；go test -race ./internal/auth ./internal/identity ./internal/identityruntime ./internal/securityevents ./internal/httpapi ./internal/store -count=1；go vet ./...；真实 PostgreSQL 并发及清理成功/冲突回滚测试；pnpm openapi。
2026-07-17 18:31:12 +08:00
parent cdfca61304
commit a312ad880d
55 changed files with 9225 additions and 419 deletions
@@ -161,6 +161,7 @@ func TestOIDCSessionCSRFAcceptsOnlyAllowedOriginForCookieWrites(t *testing.T) {
 	}{
 		{name: "missing origin", method: http.MethodPost, wantStatus: http.StatusForbidden},
 		{name: "foreign origin", method: http.MethodDelete, origin: "https://evil.example", wantStatus: http.StatusForbidden},
+		{name: "foreign origin cannot read cookie authenticated data", method: http.MethodGet, origin: "https://evil.example", wantStatus: http.StatusForbidden},
 		{name: "allowed origin", method: http.MethodPatch, origin: "https://gateway.example.com", wantStatus: http.StatusNoContent},
 		{name: "safe request", method: http.MethodGet, wantStatus: http.StatusNoContent},
 		{name: "explicit bearer bypasses cookie csrf", method: http.MethodPost, bearer: true, wantStatus: http.StatusNoContent},
@@ -181,6 +182,94 @@ func TestOIDCSessionCSRFAcceptsOnlyAllowedOriginForCookieWrites(t *testing.T) {
 	}
 }

+func TestOIDCSessionCSRFMalformedAuthorizationCannotBypassForeignOrigin(t *testing.T) {
+	authenticator := auth.New("local-jwt-secret", "", "")
+	authenticator.OIDCSessionResolver = func(context.Context, string) (*auth.User, error) {
+		return &auth.User{ID: "manager", Source: "gateway", Roles: []string{"manager"}}, nil
+	}
+	server := &Server{
+		auth:                       authenticator,
+		identityTestRevision:       identity.Revision{WebBaseURL: "https://gateway.example.com"},
+		identityTestBrowserEnabled: true,
+	}
+	called := false
+	handler := server.protectOIDCSessionCookie(server.requireAdmin(auth.PermissionManager, http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		called = true
+		w.WriteHeader(http.StatusNoContent)
+	})))
+	request := httptest.NewRequest(http.MethodPost, "/api/admin/system/identity/disable", nil)
+	request.Header.Set("Origin", "https://evil.example.com")
+	request.Header.Set("Authorization", "malformed")
+	request.AddCookie(&http.Cookie{Name: auth.OIDCSessionCookieName, Value: "manager-session"})
+	recorder := httptest.NewRecorder()
+
+	handler.ServeHTTP(recorder, request)
+	if recorder.Code != http.StatusForbidden || called {
+		t.Fatalf("malformed Authorization CSRF status=%d handler_called=%t", recorder.Code, called)
+	}
+}
+
+func TestAdminRouteRejectsManagerJWTInQueryAndAcceptsAuthorizationHeader(t *testing.T) {
+	authenticator := auth.New("local-jwt-secret", "", "")
+	managerToken, err := authenticator.SignJWT(&auth.User{ID: "manager", Source: "gateway", Roles: []string{"manager"}}, time.Hour)
+	if err != nil {
+		t.Fatal(err)
+	}
+	server := &Server{auth: authenticator}
+	handler := server.requireAdmin(auth.PermissionManager, http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+
+	queryRequest := httptest.NewRequest(http.MethodPost, "/api/admin/system/identity/disable?key="+managerToken, nil)
+	queryRecorder := httptest.NewRecorder()
+	handler.ServeHTTP(queryRecorder, queryRequest)
+	if queryRecorder.Code != http.StatusUnauthorized {
+		t.Fatalf("query manager JWT status=%d, want 401", queryRecorder.Code)
+	}
+
+	headerRequest := httptest.NewRequest(http.MethodPost, "/api/admin/system/identity/disable", nil)
+	headerRequest.Header.Set("Authorization", "Bearer "+managerToken)
+	headerRecorder := httptest.NewRecorder()
+	handler.ServeHTTP(headerRecorder, headerRequest)
+	if headerRecorder.Code != http.StatusNoContent {
+		t.Fatalf("Authorization manager JWT status=%d, want 204", headerRecorder.Code)
+	}
+}
+
+func TestCORSUsesOnlyCurrentActiveIdentityWebOriginWithoutRestart(t *testing.T) {
+	server := &Server{
+		cfg: config.Config{CORSAllowedOrigin: "https://bootstrap.example.com"},
+		identityTestRevision: identity.Revision{
+			ID: "active-revision", State: identity.RevisionActive, WebBaseURL: "https://gateway.example.com",
+		},
+	}
+	handler := server.cors(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(http.StatusNoContent) }))
+	request := func(origin string) *httptest.ResponseRecorder {
+		r := httptest.NewRequest(http.MethodOptions, "/api/admin/system/identity/configuration", nil)
+		r.Header.Set("Origin", origin)
+		r.Header.Set("Access-Control-Request-Method", http.MethodGet)
+		w := httptest.NewRecorder()
+		handler.ServeHTTP(w, r)
+		return w
+	}
+
+	active := request("https://gateway.example.com")
+	if active.Header().Get("Access-Control-Allow-Origin") != "https://gateway.example.com" || active.Header().Get("Access-Control-Allow-Credentials") != "true" {
+		t.Fatalf("active Web origin headers=%v", active.Header())
+	}
+	if evil := request("https://evil.example.com"); evil.Header().Get("Access-Control-Allow-Origin") != "" {
+		t.Fatalf("evil origin was allowed: headers=%v", evil.Header())
+	}
+
+	server.identityTestRevision = identity.Revision{}
+	if disabled := request("https://gateway.example.com"); disabled.Header().Get("Access-Control-Allow-Origin") != "" {
+		t.Fatalf("disabled Revision retained dynamic origin: headers=%v", disabled.Header())
+	}
+	if bootstrap := request("https://bootstrap.example.com"); bootstrap.Header().Get("Access-Control-Allow-Origin") != "https://bootstrap.example.com" {
+		t.Fatalf("deployment bootstrap origin stopped working: headers=%v", bootstrap.Header())
+	}
+}
+
 func TestOIDCSessionCSRFIsInactiveWhenOIDCIsDisabled(t *testing.T) {
 	server := &Server{}
 	request := httptest.NewRequest(http.MethodPost, "/api/v1/auth/login", nil)