fix: 修复 OIDC 用户预配与跨标签页登录态

增加受控 JIT 本地用户投影，并使用 HttpOnly Cookie 在新标签页恢复认证中心登录态。补充错误语义、安全校验、自动化测试与回滚配置。
2026-07-13 17:07:52 +08:00
parent 17b1f77e1d
commit a81a7b5200
37 changed files with 2694 additions and 179 deletions
@@ -0,0 +1,31 @@
+import {
+  createOIDCBrowserSession,
+  GatewayApiError,
+  getCurrentUser,
+  OIDC_BROWSER_SESSION_CREDENTIAL,
+} from '../api';
+import { persistAccessToken } from './auth-storage';
+
+type CurrentUser = Awaited<ReturnType<typeof getCurrentUser>>;
+
+export interface RestoredOIDCBrowserSession {
+  credential: typeof OIDC_BROWSER_SESSION_CREDENTIAL;
+  user: CurrentUser;
+}
+
+export async function activateOIDCBrowserSession(accessToken: string) {
+  if (!accessToken.trim()) throw new Error('统一认证未返回 Access Token');
+  await createOIDCBrowserSession(accessToken);
+  persistAccessToken('');
+  return OIDC_BROWSER_SESSION_CREDENTIAL;
+}
+
+export async function restoreOIDCBrowserSession(): Promise<RestoredOIDCBrowserSession | null> {
+  try {
+    const user = await getCurrentUser(OIDC_BROWSER_SESSION_CREDENTIAL);
+    return { credential: OIDC_BROWSER_SESSION_CREDENTIAL, user };
+  } catch (error) {
+    if (error instanceof GatewayApiError && error.details.status === 401) return null;
+    throw error;
+  }
+}