fix: 修复 OIDC 用户预配与跨标签页登录态

增加受控 JIT 本地用户投影，并使用 HttpOnly Cookie 在新标签页恢复认证中心登录态。补充错误语义、安全校验、自动化测试与回滚配置。
2026-07-13 17:07:52 +08:00
parent 17b1f77e1d
commit a81a7b5200
37 changed files with 2694 additions and 179 deletions
@@ -4951,18 +4951,22 @@ paths:
          description: OK
          schema:
            $ref: '#/definitions/httpapi.PlayableAPIKeyListResponse'
-        "400":
-          description: Bad Request
-          schema:
-            $ref: '#/definitions/httpapi.ErrorEnvelope'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "403":
+          description: Forbidden
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "503":
+          description: Service Unavailable
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
      security:
      - BearerAuth: []
      summary: 列出 Playground API Key
@@ -4982,10 +4986,18 @@ paths:
          description: Unauthorized
          schema:
            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "403":
+          description: Forbidden
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "503":
+          description: Service Unavailable
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
      security:
      - BearerAuth: []
      summary: 列出 API Key
@@ -5017,10 +5029,18 @@ paths:
          description: Unauthorized
          schema:
            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "403":
+          description: Forbidden
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "503":
+          description: Service Unavailable
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
      security:
      - BearerAuth: []
      summary: 创建 API Key
@@ -5153,18 +5173,22 @@ paths:
          description: OK
          schema:
            $ref: '#/definitions/httpapi.AccessRuleListResponse'
-        "400":
-          description: Bad Request
-          schema:
-            $ref: '#/definitions/httpapi.ErrorEnvelope'
        "401":
          description: Unauthorized
          schema:
            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "403":
+          description: Forbidden
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "503":
+          description: Service Unavailable
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
      security:
      - BearerAuth: []
      summary: 列出 API Key 访问规则
@@ -5252,6 +5276,35 @@ paths:
      summary: 本地登录
      tags:
      - auth
+  /api/v1/auth/oidc/session:
+    delete:
+      responses:
+        "204":
+          description: No Content
+      summary: 注销 OIDC 浏览器会话
+      tags:
+      - auth
+    post:
+      description: 验证 Auth Center Access Token 后写入 HttpOnly 会话 Cookie；不会签发 Gateway
+        JWT。
+      responses:
+        "204":
+          description: No Content
+        "400":
+          description: Bad Request
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "401":
+          description: Unauthorized
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "404":
+          description: Not Found
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
+      summary: 建立 OIDC 浏览器会话
+      tags:
+      - auth
  /api/v1/auth/register:
    post:
      consumes:
@@ -5589,6 +5642,14 @@ paths:
          description: Unauthorized
          schema:
            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "403":
+          description: Forbidden
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "503":
+          description: Service Unavailable
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
      security:
      - BearerAuth: []
      summary: 获取当前用户
@@ -6135,10 +6196,18 @@ paths:
          description: Unauthorized
          schema:
            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "403":
+          description: Forbidden
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "503":
+          description: Service Unavailable
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
      security:
      - BearerAuth: []
      summary: 列出任务
@@ -6532,10 +6601,18 @@ paths:
          description: Unauthorized
          schema:
            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "403":
+          description: Forbidden
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "503":
+          description: Service Unavailable
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
      security:
      - BearerAuth: []
      summary: 列出任务
@@ -6691,10 +6768,18 @@ paths:
          description: Unauthorized
          schema:
            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "403":
+          description: Forbidden
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "503":
+          description: Service Unavailable
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
      security:
      - BearerAuth: []
      summary: 获取当前用户组策略
@@ -6720,10 +6805,18 @@ paths:
          description: Unauthorized
          schema:
            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "403":
+          description: Forbidden
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "503":
+          description: Service Unavailable
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
      security:
      - BearerAuth: []
      summary: 获取钱包摘要
@@ -6778,10 +6871,18 @@ paths:
          description: Unauthorized
          schema:
            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "403":
+          description: Forbidden
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "503":
+          description: Service Unavailable
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
      security:
      - BearerAuth: []
      summary: 列出钱包交易
@@ -7473,10 +7574,18 @@ paths:
          description: Unauthorized
          schema:
            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "403":
+          description: Forbidden
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
        "500":
          description: Internal Server Error
          schema:
            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "503":
+          description: Service Unavailable
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
      security:
      - BearerAuth: []
      summary: 列出任务