fix(identity): 完善统一认证配对恢复与安全退役

修复 credentials_saved 状态无法恢复、配对与激活并发冲突，以及 SSF 和身份 Secret 生命周期不完整的问题。新增持久化协调器、取消与清理状态机、事务级并发门禁、受控 SSF 凭据交接、禁用后的延迟 Secret 清理，并对生产环境统一认证及 Discovery 端点强制 HTTPS。验证：go test ./...；go test -race ./internal/auth ./internal/identity ./internal/identityruntime ./internal/securityevents ./internal/httpapi ./internal/store -count=1；go vet ./...；真实 PostgreSQL 并发及清理成功/冲突回滚测试；pnpm openapi。
2026-07-17 18:31:12 +08:00
parent cdfca61304
commit a312ad880d
55 changed files with 9225 additions and 419 deletions
@@ -43,6 +43,16 @@ func TestSecurityEventConnectionWriteHeaders(t *testing.T) {
 	if _, ok := requiredConnectionIdempotencyKey(recorder, request); ok || recorder.Code != http.StatusBadRequest {
 		t.Fatalf("missing Idempotency-Key status=%d", recorder.Code)
 	}
+	request = httptest.NewRequest(http.MethodPut, "/connection", nil)
+	recorder = httptest.NewRecorder()
+	if matchConnectionVersion(recorder, request, 0) || recorder.Code != http.StatusPreconditionRequired {
+		t.Fatalf("initial connection without If-Match status=%d", recorder.Code)
+	}
+	request.Header.Set("If-Match", `W/"0"`)
+	recorder = httptest.NewRecorder()
+	if !matchConnectionVersion(recorder, request, 0) {
+		t.Fatalf("initial zero version was rejected: status=%d", recorder.Code)
+	}

 	request = httptest.NewRequest(http.MethodPost, "/connection/verify", nil)
 	request.Header.Set("If-Match", `W/"7"`)