fix(identity): 完善统一认证配对恢复与安全退役

修复 credentials_saved 状态无法恢复、配对与激活并发冲突，以及 SSF 和身份 Secret 生命周期不完整的问题。新增持久化协调器、取消与清理状态机、事务级并发门禁、受控 SSF 凭据交接、禁用后的延迟 Secret 清理，并对生产环境统一认证及 Discovery 端点强制 HTTPS。验证：go test ./...；go test -race ./internal/auth ./internal/identity ./internal/identityruntime ./internal/securityevents ./internal/httpapi ./internal/store -count=1；go vet ./...；真实 PostgreSQL 并发及清理成功/冲突回滚测试；pnpm openapi。
2026-07-17 18:31:12 +08:00
parent cdfca61304
commit a312ad880d
55 changed files with 9225 additions and 419 deletions
@@ -48,7 +48,7 @@ func TestValidatePairingInputDerivesExactGatewayURIs(t *testing.T) {
 		AuthCenterURL: "https://auth.example.com", PublicBaseURL: "https://api.example.com",
 		WebBaseURL: "https://gateway.example.com", LocalTenantKey: "default",
 	}
-	metadata, err := input.ConsumerMetadata(true)
+	metadata, err := input.ConsumerMetadata(true, "production")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -64,7 +64,7 @@ func TestValidatePairingInputRejectsRemoteHTTPAndURLCredentials(t *testing.T) {
 		{AuthCenterURL: "http://auth.example.com", PublicBaseURL: "https://api.example.com", WebBaseURL: "https://gateway.example.com", LocalTenantKey: "default"},
 		{AuthCenterURL: "https://user:password@auth.example.com", PublicBaseURL: "https://api.example.com", WebBaseURL: "https://gateway.example.com", LocalTenantKey: "default"},
 	} {
-		if _, err := input.ConsumerMetadata(false); err == nil {
+		if _, err := input.ConsumerMetadata(false, "production"); err == nil {
 			t.Fatalf("unsafe pairing input accepted: %#v", input)
 		}
 	}
@@ -75,7 +75,7 @@ func TestNewDraftAppliesSessionDefaultsWithoutPersistingOnboardingCode(t *testin
 		AuthCenterURL: "https://auth.example.com", OnboardingCode: "onb1.must-never-be-persisted",
 		PublicBaseURL: "https://api.example.com", WebBaseURL: "https://gateway.example.com",
 		LocalTenantKey: "default", LegacyJWTEnabled: true,
-	})
+	}, "production")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -87,3 +87,41 @@ func TestNewDraftAppliesSessionDefaultsWithoutPersistingOnboardingCode(t *testin
 		t.Fatalf("draft exposed onboarding code: %s", payload)
 	}
 }
+
+func TestNewDraftAllowsLoopbackHTTPOnlyInLocalEnvironments(t *testing.T) {
+	localInput := PairingInput{
+		AuthCenterURL: "http://localhost:18000", PublicBaseURL: "http://127.0.0.1:18089",
+		WebBaseURL: "http://localhost:5178", LocalTenantKey: "default",
+	}
+	secureInput := PairingInput{
+		AuthCenterURL: "https://auth.example.com", PublicBaseURL: "https://api.example.com",
+		WebBaseURL: "https://gateway.example.com", LocalTenantKey: "default",
+	}
+	for _, test := range []struct {
+		name   string
+		mutate func(*PairingInput)
+	}{
+		{name: "auth center", mutate: func(input *PairingInput) { input.AuthCenterURL = localInput.AuthCenterURL }},
+		{name: "public base", mutate: func(input *PairingInput) { input.PublicBaseURL = localInput.PublicBaseURL }},
+		{name: "web base", mutate: func(input *PairingInput) { input.WebBaseURL = localInput.WebBaseURL }},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			input := secureInput
+			test.mutate(&input)
+			for _, appEnv := range []string{"", "production", "staging"} {
+				if _, err := NewDraft(input, appEnv); err == nil {
+					t.Fatalf("%s accepted loopback HTTP %s URL", appEnv, test.name)
+				}
+			}
+		})
+	}
+	for _, appEnv := range []string{"local", "development", "dev", "test"} {
+		draft, err := NewDraft(localInput, appEnv)
+		if err != nil {
+			t.Fatalf("%s rejected loopback HTTP pairing URLs: %v", appEnv, err)
+		}
+		if draft.AuthCenterURL != localInput.AuthCenterURL || draft.PublicBaseURL != localInput.PublicBaseURL || draft.WebBaseURL != localInput.WebBaseURL {
+			t.Fatalf("%s changed normalized loopback URLs: %#v", appEnv, draft)
+		}
+	}
+}