fix(identity): 完善统一认证配对恢复与安全退役

修复 credentials_saved 状态无法恢复、配对与激活并发冲突，以及 SSF 和身份 Secret 生命周期不完整的问题。新增持久化协调器、取消与清理状态机、事务级并发门禁、受控 SSF 凭据交接、禁用后的延迟 Secret 清理，并对生产环境统一认证及 Discovery 端点强制 HTTPS。验证：go test ./...；go test -race ./internal/auth ./internal/identity ./internal/identityruntime ./internal/securityevents ./internal/httpapi ./internal/store -count=1；go vet ./...；真实 PostgreSQL 并发及清理成功/冲突回滚测试；pnpm openapi。
2026-07-17 18:31:12 +08:00
parent cdfca61304
commit a312ad880d
55 changed files with 9225 additions and 419 deletions
@@ -0,0 +1,89 @@
+SET LOCAL lock_timeout = '10s';
+SET LOCAL statement_timeout = '60s';
+
+-- 0071 was briefly released with only the singleton reservation lease fields.
+-- Add the durable lifecycle columns without rewriting that already-applied
+-- migration, then reconcile the singleton with the canonical outstanding
+-- pairing (when one exists).
+ALTER TABLE gateway_identity_pairing_start_reservation
+  ADD COLUMN IF NOT EXISTS state text,
+  ADD COLUMN IF NOT EXISTS revision_id uuid,
+  ADD COLUMN IF NOT EXISTS updated_at timestamptz;
+
+UPDATE gateway_identity_pairing_start_reservation
+SET state=CASE WHEN revision_id IS NULL THEN 'starting' ELSE 'paired' END,
+    updated_at=COALESCE(updated_at,created_at,now())
+WHERE state IS NULL
+   OR state NOT IN ('starting','paired')
+   OR (state='starting' AND revision_id IS NOT NULL)
+   OR (state='paired' AND revision_id IS NULL)
+   OR updated_at IS NULL;
+
+WITH canonical_pairing AS (
+  SELECT exchange.id AS attempt_id,
+         revision.id AS revision_id,
+         exchange.expires_at
+  FROM gateway_identity_configuration_revisions revision
+  JOIN gateway_identity_onboarding_exchanges exchange
+    ON exchange.revision_id=revision.id
+  WHERE revision.state IN ('draft','validated','failed')
+    AND NOT (exchange.status='cancelled' AND exchange.cleanup_status='completed')
+  ORDER BY revision.created_at DESC,exchange.created_at DESC
+  LIMIT 1
+)
+INSERT INTO gateway_identity_pairing_start_reservation(
+  singleton,attempt_id,state,revision_id,expires_at,updated_at
+)
+SELECT true,attempt_id,'paired',revision_id,expires_at,now()
+FROM canonical_pairing
+ON CONFLICT (singleton) DO UPDATE
+SET attempt_id=EXCLUDED.attempt_id,
+    state=EXCLUDED.state,
+    revision_id=EXCLUDED.revision_id,
+    expires_at=EXCLUDED.expires_at,
+    updated_at=now();
+
+ALTER TABLE gateway_identity_pairing_start_reservation
+  ALTER COLUMN state SET DEFAULT 'starting',
+  ALTER COLUMN state SET NOT NULL,
+  ALTER COLUMN updated_at SET DEFAULT now(),
+  ALTER COLUMN updated_at SET NOT NULL;
+
+ALTER TABLE gateway_identity_pairing_start_reservation
+  DROP CONSTRAINT IF EXISTS gateway_identity_pairing_start_state_value_check,
+  DROP CONSTRAINT IF EXISTS gateway_identity_pairing_start_state_check;
+
+ALTER TABLE gateway_identity_pairing_start_reservation
+  ADD CONSTRAINT gateway_identity_pairing_start_state_value_check
+    CHECK (state IN ('starting','paired')),
+  ADD CONSTRAINT gateway_identity_pairing_start_state_check CHECK (
+    (state='starting' AND revision_id IS NULL) OR
+    (state='paired' AND revision_id IS NOT NULL)
+  );
+
+DO $migration$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1
+    FROM pg_constraint
+    WHERE conrelid='gateway_identity_pairing_start_reservation'::regclass
+      AND contype='f'
+      AND pg_get_constraintdef(oid) LIKE 'FOREIGN KEY (revision_id)%'
+  ) THEN
+    ALTER TABLE gateway_identity_pairing_start_reservation
+      ADD CONSTRAINT gateway_identity_pairing_start_revision_fk
+      FOREIGN KEY (revision_id)
+      REFERENCES gateway_identity_configuration_revisions(id)
+      ON DELETE RESTRICT;
+  END IF;
+END
+$migration$;
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_gateway_identity_pairing_start_revision_unique
+  ON gateway_identity_pairing_start_reservation(revision_id)
+  WHERE revision_id IS NOT NULL;
+
+DROP INDEX IF EXISTS idx_gateway_identity_pairing_start_expiry;
+
+CREATE INDEX idx_gateway_identity_pairing_start_expiry
+  ON gateway_identity_pairing_start_reservation(state,expires_at);