BCAI/easyai-ai-gateway
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: 修复 OIDC 用户预配与跨标签页登录态

Browse Source 
增加受控 JIT 本地用户投影，并使用 HttpOnly Cookie 在新标签页恢复认证中心登录态。补充错误语义、安全校验、自动化测试与回滚配置。
This commit is contained in:
chengcheng
2026-07-13 17:07:52 +08:00
parent 17b1f77e1d
commit a81a7b5200
37 changed files with 2694 additions and 179 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/web/src/lib/auth-storage.test.ts
+12 -7
View File
@@ -13,16 +13,21 @@ describe('auth storage', () => {
vi.stubGlobal('window', { localStorage: new MemoryStorage(), sessionStorage: new MemoryStorage() });
});
it('keeps OIDC access tokens in session storage and removes persistent tokens', () => {
persistAccessToken('legacy-token');
persistAccessToken('oidc-token', 'session');
expect(readStoredAccessToken()).toBe('oidc-token');
expect(window.localStorage.getItem('easyai_ai_gateway_access_token')).toBeNull();
expect(window.sessionStorage.getItem('easyai_ai_gateway_oidc_access_token')).toBe('oidc-token');
it('persists only explicit local or externally supplied bearer tokens', () => {
persistAccessToken('local-token');
expect(readStoredAccessToken()).toBe('local-token');
expect(window.localStorage.getItem('easyai_ai_gateway_access_token')).toBe('local-token');
expect(window.sessionStorage.getItem('easyai_ai_gateway_oidc_access_token')).toBeNull();
});
it('reads a legacy OIDC session token only for one-time cookie migration', () => {
window.sessionStorage.setItem('easyai_ai_gateway_oidc_access_token', 'legacy-oidc-token');
expect(readStoredAccessToken()).toBe('legacy-oidc-token');
});
it('clears both token stores on logout', () => {
persistAccessToken('oidc-token', 'session');
window.sessionStorage.setItem('easyai_ai_gateway_oidc_access_token', 'legacy-oidc-token');
persistAccessToken('local-token');
persistAccessToken('');
expect(readStoredAccessToken()).toBe('');
});