fix(identity): 支持平台用户显式登录 AI Gateway

修复多租户身份配置将所有人类登录都强制解释为租户上下文的问题。Web 现在提供平台与租户两个受控入口，API 严格绑定 context_type、tid、issuer、application 和 subject，并为平台用户建立独立本地投影与可刷新会话。\n\n风险：新增会话身份列保持旧会话可读，新会话一律使用严格约束；未改变租户数据隔离和 API Key 行为。\n\n验证：Go 全量测试与 go vet 通过；PostgreSQL 平台投影、会话和安全事件集成测试通过；前端 lint、141 项测试与生产 build 通过；OpenAPI 生成和迁移安全测试通过。
2026-07-31 14:24:40 +08:00
parent 88c971564a
commit c0296dbf06
29 changed files with 1061 additions and 84 deletions
@@ -0,0 +1,40 @@
+ALTER TABLE gateway_oidc_sessions
+  ADD COLUMN IF NOT EXISTS context_type text,
+  ADD COLUMN IF NOT EXISTS issuer text,
+  ADD COLUMN IF NOT EXISTS application_id text,
+  ADD COLUMN IF NOT EXISTS subject text,
+  ADD COLUMN IF NOT EXISTS tenant_id text;
+
+UPDATE gateway_oidc_sessions session_record
+SET context_type = 'tenant',
+    issuer = binding.issuer,
+    application_id = binding.application_id,
+    subject = user_binding.subject,
+    tenant_id = binding.external_tenant_id
+FROM gateway_oidc_user_bindings user_binding
+JOIN gateway_oidc_tenant_bindings binding
+  ON binding.id = user_binding.tenant_binding_id
+WHERE session_record.oidc_user_binding_id = user_binding.id
+  AND session_record.context_type IS NULL;
+
+ALTER TABLE gateway_oidc_sessions
+  DROP CONSTRAINT IF EXISTS gateway_oidc_sessions_context_identity;
+
+ALTER TABLE gateway_oidc_sessions
+  ADD CONSTRAINT gateway_oidc_sessions_context_identity CHECK (
+    context_type IS NULL
+    OR (
+      context_type IN ('platform', 'tenant')
+      AND issuer IS NOT NULL
+      AND issuer <> ''
+      AND application_id IS NOT NULL
+      AND application_id <> ''
+      AND subject IS NOT NULL
+      AND subject <> ''
+      AND (
+        (context_type = 'platform' AND tenant_id IS NULL)
+        OR
+        (context_type = 'tenant' AND tenant_id IS NOT NULL AND tenant_id <> '')
+      )
+    )
+  );