fix: 修复 OIDC 用户预配与跨标签页登录态

增加受控 JIT 本地用户投影，并使用 HttpOnly Cookie 在新标签页恢复认证中心登录态。补充错误语义、安全校验、自动化测试与回滚配置。
2026-07-13 17:07:52 +08:00
parent 17b1f77e1d
commit a81a7b5200
37 changed files with 2694 additions and 179 deletions
@@ -33,6 +33,10 @@ func writeErrorWithDetails(w http.ResponseWriter, status int, message string, de
 	writeJSON(w, status, map[string]any{"error": errorPayload})
 }

+func writeLocalUserRequired(w http.ResponseWriter) {
+	writeError(w, http.StatusForbidden, "该账号尚未开通 EasyAI Gateway", errorCodeGatewayUserNotProvisioned)
+}
+
 func sendSSE(w http.ResponseWriter, event string, payload any) {
 	bytes, _ := json.Marshal(payload)
 	_, _ = fmt.Fprintf(w, "event: %s\n", event)