feat: 接入 OIDC 公共客户端登录链路

由 Gateway 服务端完成 PKCE 换码、ID Token 校验、JIT 用户解析和 Session 建立。新增登录、回调、退出与本地会话删除接口，并移除旧的 Access Token Cookie 桥接接口。
2026-07-13 19:09:38 +08:00
parent d345c070ae
commit c5c82bb528
7 changed files with 658 additions and 281 deletions
@@ -5276,20 +5276,13 @@ paths:
      summary: 本地登录
      tags:
      - auth
-  /api/v1/auth/oidc/session:
-    delete:
+  /api/v1/auth/oidc/callback:
+    get:
+      description: Gateway 使用 client_id、授权码和 PKCE verifier 换取 Token，不发送 Client Secret；Token
+        加密存入服务端 Session。
      responses:
-        "204":
-          description: No Content
-      summary: 注销 OIDC 浏览器会话
-      tags:
-      - auth
-    post:
-      description: 验证 Auth Center Access Token 后写入 HttpOnly 会话 Cookie；不会签发 Gateway
-        JWT。
-      responses:
-        "204":
-          description: No Content
+        "303":
+          description: See Other
        "400":
          description: Bad Request
          schema:
@@ -5298,11 +5291,62 @@ paths:
          description: Unauthorized
          schema:
            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "503":
+          description: Service Unavailable
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
+      summary: 完成 OIDC 公共客户端登录
+      tags:
+      - auth
+  /api/v1/auth/oidc/login:
+    get:
+      description: Gateway 生成 state、nonce 和 PKCE S256 参数，并跳转认证中心；浏览器不接触 Token。
+      parameters:
+      - description: 登录后返回的站内相对路径
+        in: query
+        name: returnTo
+        type: string
+      responses:
+        "303":
+          description: See Other
+        "400":
+          description: Bad Request
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
        "404":
          description: Not Found
          schema:
            $ref: '#/definitions/httpapi.ErrorEnvelope'
-      summary: 建立 OIDC 浏览器会话
+      summary: 开始 OIDC 公共客户端登录
+      tags:
+      - auth
+  /api/v1/auth/oidc/logout:
+    post:
+      description: 删除 Gateway Session、撤销公共 Client Refresh Token，并跳转认证中心退出地址。
+      responses:
+        "303":
+          description: See Other
+        "403":
+          description: Forbidden
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "503":
+          description: Service Unavailable
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
+      summary: 注销 OIDC 登录会话
+      tags:
+      - auth
+  /api/v1/auth/oidc/session:
+    delete:
+      responses:
+        "204":
+          description: No Content
+        "503":
+          description: Service Unavailable
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
+      summary: 删除本地 OIDC 浏览器会话
      tags:
      - auth
  /api/v1/auth/register: