feat(identity): 增加统一认证配置版本

新增统一认证 Revision 状态机、单 Active 数据库约束、SecretStore 引用字段、Break-glass 与本地租户门禁，并在关键身份变化或禁用时清理旧 BFF Session。\n\n同时实现标准应用接入 Manifest v1 消费端，接入码只进入请求 Body，Exchange Token 只进入 Authorization Header，禁用重定向并限制响应大小。\n\n验证：go test ./...；go vet ./...
2026-07-17 11:52:01 +08:00
parent 2a73e18123
commit c2ce42fead
7 changed files with 1025 additions and 0 deletions
@@ -39,3 +39,27 @@ func TestSecurityEventVerificationStateRepairMigrationExists(t *testing.T) {
 		}
 	}
 }
+
+func TestIdentityConfigurationRevisionMigrationDefinesSecretReferencesAndSingleActiveRevision(t *testing.T) {
+	payload, err := os.ReadFile("../../migrations/0067_identity_configuration_revisions.sql")
+	if err != nil {
+		t.Fatal(err)
+	}
+	content := string(payload)
+	for _, required := range []string{
+		"CREATE TABLE IF NOT EXISTS gateway_identity_configuration_revisions",
+		"machine_credential_ref text",
+		"session_encryption_key_ref text",
+		"WHERE state = 'active'",
+		"CHECK (state IN ('draft','validated','active','superseded','failed'))",
+	} {
+		if !strings.Contains(content, required) {
+			t.Fatalf("identity configuration migration is missing %q", required)
+		}
+	}
+	for _, forbidden := range []string{"machine_secret", "client_secret", "exchange_token text", "onboarding_code text"} {
+		if strings.Contains(strings.ToLower(content), forbidden) {
+			t.Fatalf("identity configuration migration stores forbidden secret field %q", forbidden)
+		}
+	}
+}