fix: 修复 OIDC 用户预配与跨标签页登录态

增加受控 JIT 本地用户投影，并使用 HttpOnly Cookie 在新标签页恢复认证中心登录态。补充错误语义、安全校验、自动化测试与回滚配置。
2026-07-13 17:07:52 +08:00
parent 17b1f77e1d
commit a81a7b5200
37 changed files with 2694 additions and 179 deletions
@@ -197,7 +197,7 @@ UPDATE gateway_users
 SET deleted_at = now(),
    status = 'deleted',
    user_key = user_key || ':deleted:' || left(id::text, 8),
-    external_user_id = NULL,
+    external_user_id = CASE WHEN source = 'oidc' THEN external_user_id ELSE NULL END,
    email = NULL,
    updated_at = now()
 WHERE id = $1::uuid AND deleted_at IS NULL`, id)