refactor(identity): 统一网页认证配置来源

移除旧 OIDC_* 与 VITE_OIDC_* 业务配置读取，统一使用数据库 Revision 和 SecretStore 引用构建运行时。同步更新 Compose、示例配置、接入文档及集成测试，并保留数据库、SecretStore 和安全事件健康窗口等部署级参数。\n\n验证：go test ./...；go test -race ./...；go vet ./...；pnpm test；pnpm lint；pnpm build；docker compose config -q
2026-07-17 12:31:00 +08:00
parent e0a356ee0c
commit a767dc42c0
18 changed files with 354 additions and 578 deletions
@@ -20,23 +20,26 @@ import (
 )

 type Server struct {
-	ctx                    context.Context
-	cfg                    config.Config
-	store                  *store.Store
-	oidcUserResolver       oidcUserResolver
-	auth                   *auth.Authenticator
-	oidcClient             oidcPublicClient
-	oidcSessions           oidcSessionManager
-	oidcSessionCipher      *oidcsession.Cipher
-	runner                 *runner.Service
-	logger                 *slog.Logger
-	geminiUploadSessions   sync.Map
-	securityEventReceiver  http.Handler
-	securityEventManager   *ssfreceiver.ConnectionManager
-	identityRuntime        *identityruntime.Manager
-	identityPairing        *identity.PairingService
-	identityManagementMu   sync.Mutex
-	identityPairingWorkers sync.Map
+	ctx                        context.Context
+	cfg                        config.Config
+	store                      *store.Store
+	oidcUserResolver           oidcUserResolver
+	auth                       *auth.Authenticator
+	oidcClient                 oidcPublicClient
+	oidcSessions               oidcSessionManager
+	oidcSessionCipher          *oidcsession.Cipher
+	runner                     *runner.Service
+	logger                     *slog.Logger
+	geminiUploadSessions       sync.Map
+	securityEventReceiver      http.Handler
+	securityEventManager       *ssfreceiver.ConnectionManager
+	identityRuntime            *identityruntime.Manager
+	identityPairing            *identity.PairingService
+	identityManagementMu       sync.Mutex
+	identityPairingWorkers     sync.Map
+	identityTestRevision       identity.Revision
+	identityTestCookieSecure   bool
+	identityTestBrowserEnabled bool
 }

 type oidcPublicClient interface {
@@ -72,15 +75,15 @@ func NewServerWithContext(ctx context.Context, cfg config.Config, db *store.Stor
 	server.auth.ServerMainInternalKey = cfg.ServerMainInternalKey
 	server.auth.ServerMainInternalSecret = cfg.ServerMainInternalSecret
 	securityEventMetrics := &ssfreceiver.Metrics{}
-	secretStore, err := securityEventSecretStore(cfg)
+	secretStore, err := identitySecretStore(cfg)
 	if err != nil {
 		panic("invalid identity SecretStore: " + err.Error())
 	}
 	runtimeBuilder := identityruntime.NewRuntimeBuilder(ctx, db, secretStore, identityruntime.RuntimeBuilderConfig{
 		AppEnv: cfg.AppEnv, JWKSCacheTTL: 5 * time.Minute,
-		HeartbeatInterval: time.Duration(cfg.OIDCSecurityEventsHeartbeatIntervalSeconds) * time.Second,
-		StaleAfter:        time.Duration(cfg.OIDCSecurityEventsStaleAfterSeconds) * time.Second,
-		ClockSkew:         time.Duration(cfg.OIDCSecurityEventsClockSkewSeconds) * time.Second,
+		HeartbeatInterval: time.Duration(cfg.IdentitySecurityEventHeartbeatIntervalSeconds) * time.Second,
+		StaleAfter:        time.Duration(cfg.IdentitySecurityEventStaleAfterSeconds) * time.Second,
+		ClockSkew:         time.Duration(cfg.IdentitySecurityEventClockSkewSeconds) * time.Second,
 	}, securityEventMetrics)
 	server.identityRuntime = identityruntime.NewManager(db, runtimeBuilder)
 	if err := server.identityRuntime.LoadActive(ctx); err != nil && logger != nil {
@@ -294,22 +297,22 @@ func NewServerWithContext(ctx context.Context, cfg config.Config, db *store.Stor
 	return server.recover(server.cors(server.protectOIDCSessionCookie(mux)))
 }

-func securityEventSecretStore(cfg config.Config) (ssfreceiver.SecretStore, error) {
-	switch strings.ToLower(strings.TrimSpace(cfg.OIDCSecurityEventsSecretStore)) {
+func identitySecretStore(cfg config.Config) (ssfreceiver.SecretStore, error) {
+	switch strings.ToLower(strings.TrimSpace(cfg.IdentitySecretStore)) {
 	case "", "file":
-		directory := cfg.OIDCSecurityEventsSecretDir
+		directory := cfg.IdentitySecretDir
 		if directory == "" {
-			directory = ".local-secrets/ssf"
+			directory = ".local-secrets/identity"
 		}
 		return ssfreceiver.NewFileSecretStore(directory)
 	case "kubernetes":
 		return ssfreceiver.NewKubernetesSecretStore(ssfreceiver.KubernetesSecretStoreConfig{
-			Namespace: cfg.OIDCSecurityEventsKubernetesNamespace, SecretName: cfg.OIDCSecurityEventsKubernetesSecretName,
-			APIServer: cfg.OIDCSecurityEventsKubernetesAPIServer, TokenFile: cfg.OIDCSecurityEventsKubernetesTokenFile,
-			CAFile: cfg.OIDCSecurityEventsKubernetesCAFile,
+			Namespace: cfg.IdentityKubernetesNamespace, SecretName: cfg.IdentityKubernetesSecretName,
+			APIServer: cfg.IdentityKubernetesAPIServer, TokenFile: cfg.IdentityKubernetesTokenFile,
+			CAFile: cfg.IdentityKubernetesCAFile,
 		})
 	default:
-		return nil, errors.New("unsupported OIDC security event SecretStore")
+		return nil, errors.New("unsupported identity SecretStore")
 	}
 }