feat(identity): 实现统一认证运行时热切换

从 Active Revision 构造并验证 OIDC、BFF Session、Introspection 与 SSF Runtime，在数据库激活成功后原子替换内存引用。请求链路使用不可变快照，失败保留当前运行时，本地管理登录不受影响。\n\n验证：go test ./apps/api/...；go vet ./apps/api/...
2026-07-17 12:05:00 +08:00
parent 96bbd3a2f6
commit a9e23cb237
14 changed files with 797 additions and 152 deletions
@@ -40,7 +40,8 @@ const (
 // @Failure 404 {object} ErrorEnvelope
 // @Router /api/v1/auth/oidc/login [get]
 func (s *Server) startOIDCLogin(w http.ResponseWriter, r *http.Request) {
-	if !s.oidcBrowserSessionReady() {
+	runtime := s.currentIdentityRuntime()
+	if !oidcRuntimeReady(runtime) {
 		writeError(w, http.StatusNotFound, "OIDC browser session is disabled", errorCodeOIDCBrowserSessionDisabled)
 		return
 	}
@@ -53,13 +54,13 @@ func (s *Server) startOIDCLogin(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, "登录后返回地址无效", errorCodeOIDCLoginInvalid)
 		return
 	}
-	encoded, err := s.oidcSessionCipher.EncodeLoginTransaction(transaction)
+	encoded, err := runtime.SessionCipher.EncodeLoginTransaction(transaction)
 	if err != nil {
 		s.logger.ErrorContext(r.Context(), "encode OIDC login transaction failed", "error", err)
 		writeError(w, http.StatusServiceUnavailable, "登录会话初始化失败，请稍后重试", errorCodeOIDCSessionStoreUnavailable)
 		return
 	}
-	authorizationURL, err := s.oidcClient.AuthorizationURL(r.Context(), transaction.State, transaction.Nonce, transaction.PKCEVerifier)
+	authorizationURL, err := runtime.PublicClient.AuthorizationURL(r.Context(), transaction.State, transaction.Nonce, transaction.PKCEVerifier)
 	if err != nil {
 		s.logger.ErrorContext(r.Context(), "load OIDC authorization endpoint failed", "error", err)
 		writeError(w, http.StatusServiceUnavailable, "认证中心暂时不可用，请稍后重试", "OIDC_AUTHORIZATION_UNAVAILABLE")
@@ -68,7 +69,7 @@ func (s *Server) startOIDCLogin(w http.ResponseWriter, r *http.Request) {
 	http.SetCookie(w, &http.Cookie{
 		Name: oidcsession.LoginTransactionCookieName, Value: encoded,
 		Path: s.oidcCallbackCookiePath(), MaxAge: 600, Expires: time.Now().Add(10 * time.Minute),
-		HttpOnly: true, Secure: s.cfg.OIDCSessionCookieSecure, SameSite: http.SameSiteLaxMode,
+		HttpOnly: true, Secure: runtime.CookieSecure, SameSite: http.SameSiteLaxMode,
 	})
 	w.Header().Set("Cache-Control", "no-store")
 	http.Redirect(w, r, authorizationURL, http.StatusSeeOther)
@@ -84,7 +85,8 @@ func (s *Server) startOIDCLogin(w http.ResponseWriter, r *http.Request) {
 // @Failure 503 {object} ErrorEnvelope
 // @Router /api/v1/auth/oidc/callback [get]
 func (s *Server) completeOIDCLogin(w http.ResponseWriter, r *http.Request) {
-	if !s.oidcBrowserSessionReady() {
+	runtime := s.currentIdentityRuntime()
+	if !oidcRuntimeReady(runtime) {
 		writeError(w, http.StatusNotFound, "OIDC browser session is disabled", errorCodeOIDCBrowserSessionDisabled)
 		return
 	}
@@ -94,7 +96,7 @@ func (s *Server) completeOIDCLogin(w http.ResponseWriter, r *http.Request) {
 		s.writeOIDCLoginTransactionError(w, r, "登录事务无效或已过期", oidcLoginFailureCookieMissing)
 		return
 	}
-	transaction, err := s.oidcSessionCipher.DecodeLoginTransaction(cookie.Value, time.Now())
+	transaction, err := runtime.SessionCipher.DecodeLoginTransaction(cookie.Value, time.Now())
 	if err != nil {
 		s.writeOIDCLoginTransactionError(w, r, "登录事务校验失败，请重新登录", oidcLoginFailureTransactionInvalid)
 		return
@@ -107,22 +109,22 @@ func (s *Server) completeOIDCLogin(w http.ResponseWriter, r *http.Request) {
 		s.writeOIDCLoginTransactionError(w, r, "认证中心回调缺少必要参数，请重新登录", oidcLoginFailureAuthorizationResponseMissing)
 		return
 	}
-	tokens, err := s.oidcClient.ExchangeCode(r.Context(), r.URL.Query().Get("code"), transaction.PKCEVerifier)
+	tokens, err := runtime.PublicClient.ExchangeCode(r.Context(), r.URL.Query().Get("code"), transaction.PKCEVerifier)
 	if err != nil || tokens.AccessToken == "" || tokens.RefreshToken == "" || tokens.IDToken == "" {
 		s.writeOIDCCallbackError(w, r, http.StatusUnauthorized, "认证中心登录结果无效，请重新登录", errorCodeOIDCTokenExchangeFailed)
 		return
 	}
-	identity, err := s.auth.AuthenticateOIDCAccessToken(r.Context(), tokens.AccessToken)
+	identity, err := runtime.Verifier.Verify(r.Context(), tokens.AccessToken)
 	if err != nil || identity == nil {
 		s.writeOIDCCallbackError(w, r, http.StatusUnauthorized, "认证中心访问令牌校验失败", errorCodeOIDCTokenExchangeFailed)
 		return
 	}
-	idSubject, err := s.oidcClient.VerifyIDToken(r.Context(), tokens.IDToken, transaction.Nonce)
+	idSubject, err := runtime.PublicClient.VerifyIDToken(r.Context(), tokens.IDToken, transaction.Nonce)
 	if err != nil || idSubject != identity.ID {
 		s.writeOIDCCallbackError(w, r, http.StatusUnauthorized, "认证中心身份令牌校验失败", errorCodeOIDCTokenExchangeFailed)
 		return
 	}
-	projection, err := s.resolveOIDCUserProjection(r.Context(), r, identity)
+	projection, err := s.resolveOIDCUserProjectionForRevision(r.Context(), r, identity, runtime.Revision)
 	if err != nil {
 		s.writeOIDCCallbackProjectionError(w, r, err)
 		return
@@ -131,7 +133,7 @@ func (s *Server) completeOIDCLogin(w http.ResponseWriter, r *http.Request) {
 		s.writeOIDCUserResolutionError(w, r, errors.New("OIDC user resolver returned no local user"))
 		return
 	}
-	rawSession, err := s.oidcSessions.Create(r.Context(), oidcsession.TokenBundle{
+	rawSession, err := runtime.Sessions.Create(r.Context(), oidcsession.TokenBundle{
 		AccessToken: tokens.AccessToken, RefreshToken: tokens.RefreshToken, IDToken: tokens.IDToken,
 	}, projection.User)
 	if err != nil {
@@ -141,12 +143,12 @@ func (s *Server) completeOIDCLogin(w http.ResponseWriter, r *http.Request) {
 	now := time.Now()
 	http.SetCookie(w, &http.Cookie{
 		Name: auth.OIDCSessionCookieName, Value: rawSession, Path: "/",
-		MaxAge: s.cfg.OIDCSessionAbsoluteTTLSeconds, Expires: now.Add(time.Duration(s.cfg.OIDCSessionAbsoluteTTLSeconds) * time.Second),
-		HttpOnly: true, Secure: s.cfg.OIDCSessionCookieSecure, SameSite: http.SameSiteStrictMode,
+		MaxAge: runtime.Revision.SessionAbsoluteSeconds, Expires: now.Add(time.Duration(runtime.Revision.SessionAbsoluteSeconds) * time.Second),
+		HttpOnly: true, Secure: runtime.CookieSecure, SameSite: http.SameSiteStrictMode,
 	})
 	w.Header().Set("Cache-Control", "no-store")
 	s.recordOIDCSessionAudit(r, projection.User)
-	http.Redirect(w, r, s.oidcReturnLocation(transaction.ReturnTo), http.StatusSeeOther)
+	http.Redirect(w, r, oidcReturnLocation(runtime.Revision.WebBaseURL, transaction.ReturnTo), http.StatusSeeOther)
 }

 // logoutOIDCSession godoc
@@ -158,13 +160,14 @@ func (s *Server) completeOIDCLogin(w http.ResponseWriter, r *http.Request) {
 // @Failure 503 {object} ErrorEnvelope
 // @Router /api/v1/auth/oidc/logout [post]
 func (s *Server) logoutOIDCSession(w http.ResponseWriter, r *http.Request) {
-	if !s.oidcBrowserSessionReady() {
+	runtime := s.currentIdentityRuntime()
+	if !oidcRuntimeReady(runtime) {
 		writeError(w, http.StatusNotFound, "OIDC browser session is disabled", errorCodeOIDCBrowserSessionDisabled)
 		return
 	}
 	var bundle oidcsession.TokenBundle
 	if cookie, err := r.Cookie(auth.OIDCSessionCookieName); err == nil {
-		bundle, err = s.oidcSessions.Delete(r.Context(), cookie.Value)
+		bundle, err = runtime.Sessions.Delete(r.Context(), cookie.Value)
 		if err != nil {
 			writeError(w, http.StatusServiceUnavailable, "登录会话存储暂时不可用", errorCodeOIDCSessionStoreUnavailable)
 			return
@@ -172,14 +175,14 @@ func (s *Server) logoutOIDCSession(w http.ResponseWriter, r *http.Request) {
 	}
 	s.clearOIDCSessionCookie(w)
 	if bundle.RefreshToken != "" {
-		if err := s.oidcClient.RevokeRefreshToken(r.Context(), bundle.RefreshToken); err != nil {
+		if err := runtime.PublicClient.RevokeRefreshToken(r.Context(), bundle.RefreshToken); err != nil {
 			s.logger.WarnContext(r.Context(), "revoke OIDC refresh token failed", "error", err)
 		}
 	}
 	// Do not put the encrypted-at-rest ID Token into a browser-visible redirect URL.
-	location, err := s.oidcClient.EndSessionURL(r.Context(), "")
+	location, err := runtime.PublicClient.EndSessionURL(r.Context(), "")
 	if err != nil {
-		location = s.cfg.OIDCPostLogoutRedirectURI
+		location = runtime.Revision.WebBaseURL + "/"
 	}
 	w.Header().Set("Cache-Control", "no-store")
 	http.Redirect(w, r, location, http.StatusSeeOther)
@@ -192,9 +195,10 @@ func (s *Server) logoutOIDCSession(w http.ResponseWriter, r *http.Request) {
 // @Failure 503 {object} ErrorEnvelope
 // @Router /api/v1/auth/oidc/session [delete]
 func (s *Server) deleteOIDCBrowserSession(w http.ResponseWriter, r *http.Request) {
-	if s.oidcSessions != nil {
+	runtime := s.currentIdentityRuntime()
+	if runtime != nil && runtime.Sessions != nil {
 		if cookie, err := r.Cookie(auth.OIDCSessionCookieName); err == nil {
-			if _, err := s.oidcSessions.Delete(r.Context(), cookie.Value); err != nil {
+			if _, err := runtime.Sessions.Delete(r.Context(), cookie.Value); err != nil {
 				writeError(w, http.StatusServiceUnavailable, "登录会话存储暂时不可用", errorCodeOIDCSessionStoreUnavailable)
 				return
 			}
@@ -206,33 +210,40 @@ func (s *Server) deleteOIDCBrowserSession(w http.ResponseWriter, r *http.Request
 }

 func (s *Server) oidcBrowserSessionReady() bool {
-	return s.cfg.OIDCEnabled && s.cfg.OIDCBrowserSessionEnabled && s.auth != nil && s.auth.OIDCVerifier != nil &&
-		s.oidcClient != nil && s.oidcSessions != nil && s.oidcSessionCipher != nil
+	return oidcRuntimeReady(s.currentIdentityRuntime())
+}
+
+func oidcRuntimeReady(runtime *identityRequestRuntime) bool {
+	return runtime != nil && runtime.BrowserEnabled && runtime.Verifier != nil && runtime.PublicClient != nil && runtime.Sessions != nil && runtime.SessionCipher != nil
 }

 func (s *Server) clearOIDCLoginCookie(w http.ResponseWriter) {
 	http.SetCookie(w, &http.Cookie{
 		Name: oidcsession.LoginTransactionCookieName, Value: "", Path: s.oidcCallbackCookiePath(),
-		Expires: time.Unix(1, 0), MaxAge: -1, HttpOnly: true, Secure: s.cfg.OIDCSessionCookieSecure, SameSite: http.SameSiteLaxMode,
+		Expires: time.Unix(1, 0), MaxAge: -1, HttpOnly: true, Secure: s.oidcCookieSecure(), SameSite: http.SameSiteLaxMode,
 	})
 }

 func (s *Server) oidcCallbackCookiePath() string {
-	if parsed, err := url.Parse(strings.TrimSpace(s.cfg.OIDCRedirectURI)); err == nil && strings.HasPrefix(parsed.Path, "/") {
-		return parsed.Path
-	}
 	return "/api/v1/auth/oidc/callback"
 }

 func (s *Server) clearOIDCSessionCookie(w http.ResponseWriter) {
 	http.SetCookie(w, &http.Cookie{
 		Name: auth.OIDCSessionCookieName, Value: "", Path: "/",
-		Expires: time.Unix(1, 0), MaxAge: -1, HttpOnly: true, Secure: s.cfg.OIDCSessionCookieSecure, SameSite: http.SameSiteStrictMode,
+		Expires: time.Unix(1, 0), MaxAge: -1, HttpOnly: true, Secure: s.oidcCookieSecure(), SameSite: http.SameSiteStrictMode,
 	})
 }

 func (s *Server) oidcReturnLocation(returnTo string) string {
-	if base := strings.TrimRight(strings.TrimSpace(s.cfg.WebBaseURL), "/"); base != "" {
+	if runtime := s.currentIdentityRuntime(); runtime != nil {
+		return oidcReturnLocation(runtime.Revision.WebBaseURL, returnTo)
+	}
+	return returnTo
+}
+
+func oidcReturnLocation(webBaseURL, returnTo string) string {
+	if base := strings.TrimRight(strings.TrimSpace(webBaseURL), "/"); base != "" {
 		return base + returnTo
 	}
 	return returnTo
@@ -255,7 +266,10 @@ func (s *Server) writeOIDCLoginTransactionError(w http.ResponseWriter, r *http.R
 }

 func (s *Server) writeOIDCCallbackErrorWithDiagnostics(w http.ResponseWriter, r *http.Request, status int, message, code, reason, diagnosticID string) {
-	base := strings.TrimRight(strings.TrimSpace(s.cfg.WebBaseURL), "/")
+	base := ""
+	if runtime := s.currentIdentityRuntime(); runtime != nil {
+		base = strings.TrimRight(strings.TrimSpace(runtime.Revision.WebBaseURL), "/")
+	}
 	if parsed, err := url.Parse(base); base != "" && err == nil && parsed.Host != "" && (parsed.Scheme == "https" || parsed.Scheme == "http" && (parsed.Hostname() == "localhost" || parsed.Hostname() == "127.0.0.1")) {
 		query := parsed.Query()
 		query.Set("oidcError", code)
@@ -320,9 +334,6 @@ func (s *Server) recordOIDCSessionAudit(r *http.Request, user *auth.User) {
 }

 func (s *Server) startOIDCSessionCleanup(ctx context.Context) {
-	if s.oidcSessions == nil {
-		return
-	}
 	go func() {
 		ticker := time.NewTicker(15 * time.Minute)
 		defer ticker.Stop()
@@ -331,7 +342,11 @@ func (s *Server) startOIDCSessionCleanup(ctx context.Context) {
 			case <-ctx.Done():
 				return
 			case <-ticker.C:
-				if _, err := s.oidcSessions.Cleanup(ctx); err != nil {
+				runtime := s.currentIdentityRuntime()
+				if runtime == nil || runtime.Sessions == nil {
+					continue
+				}
+				if _, err := runtime.Sessions.Cleanup(ctx); err != nil {
 					s.logger.WarnContext(ctx, "cleanup expired OIDC sessions failed", "error", err)
 				}
 			}
@@ -341,7 +356,8 @@ func (s *Server) startOIDCSessionCleanup(ctx context.Context) {

 func (s *Server) protectOIDCSessionCookie(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if !s.cfg.OIDCEnabled || !s.cfg.OIDCBrowserSessionEnabled || isSafeHTTPMethod(r.Method) || hasExplicitCredential(r) {
+		runtime := s.currentIdentityRuntime()
+		if runtime == nil || !runtime.BrowserEnabled || isSafeHTTPMethod(r.Method) || hasExplicitCredential(r) {
 			next.ServeHTTP(w, r)
 			return
 		}
@@ -350,7 +366,7 @@ func (s *Server) protectOIDCSessionCookie(next http.Handler) http.Handler {
 			return
 		}
 		origin := strings.TrimSpace(r.Header.Get("Origin"))
-		if origin == "" || !originAllowed(origin, s.cfg.CORSAllowedOrigin) {
+		if origin == "" || !originMatchesBaseURL(origin, runtime.Revision.WebBaseURL) {
 			writeError(w, http.StatusForbidden, "browser session request origin was rejected", errorCodeOIDCSessionCSRF)
 			return
 		}