feat(identity): 实现统一认证运行时热切换

从 Active Revision 构造并验证 OIDC、BFF Session、Introspection 与 SSF Runtime，在数据库激活成功后原子替换内存引用。请求链路使用不可变快照，失败保留当前运行时，本地管理登录不受影响。\n\n验证：go test ./apps/api/...；go vet ./apps/api/...
2026-07-17 12:05:00 +08:00
parent 96bbd3a2f6
commit a9e23cb237
14 changed files with 797 additions and 152 deletions
@@ -58,6 +58,29 @@ func TestAuthenticateRejectsInvalidOIDCSessionCookie(t *testing.T) {
 	}
 }

+func TestAuthenticatorReadsOIDCSessionResolverAndLegacyPolicyDynamically(t *testing.T) {
+	authenticator := New("local-jwt-secret", "", "")
+	currentUser := &User{ID: "first", Roles: []string{"manager"}}
+	authenticator.OIDCSessionResolverProvider = func(ctx context.Context, sessionID string) (*User, error) {
+		return currentUser, nil
+	}
+	authenticator.LegacyJWTEnabledProvider = func() bool { return false }
+	request := httptest.NewRequest(http.MethodGet, "/", nil)
+	request.AddCookie(&http.Cookie{Name: OIDCSessionCookieName, Value: "opaque-session-id"})
+	user, err := authenticator.Authenticate(request)
+	if err != nil || user.ID != "first" {
+		t.Fatalf("first runtime session resolution failed: user=%#v err=%v", user, err)
+	}
+	currentUser = &User{ID: "second", Roles: []string{"manager"}}
+	user, err = authenticator.Authenticate(request)
+	if err != nil || user.ID != "second" {
+		t.Fatalf("swapped runtime session resolution failed: user=%#v err=%v", user, err)
+	}
+	if authenticator.legacyJWTEnabled() {
+		t.Fatal("dynamic legacy JWT policy was ignored")
+	}
+}
+
 func TestPublicRouteIgnoresExpiredOptionalOIDCSession(t *testing.T) {
 	authenticator := New("local-jwt-secret", "", "")
 	authenticator.OIDCSessionResolver = func(context.Context, string) (*User, error) {