feat: 实现 OIDC 服务端会话与请求刷新

使用 AES-256-GCM 保存认证中心令牌，并以随机 Cookie 哈希关联 PostgreSQL 会话。加入闲置与绝对期限、Refresh Token 轮换以及多实例刷新锁。

apps/api/internal/auth/oidc_session_cookie_test.go

@@ -1,50 +1,23 @@
 package auth
 
 import (
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rand"
-	"encoding/json"
+	"context"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 	"time"
-
-	"github.com/golang-jwt/jwt/v5"
 )
 
-func TestAuthenticateAcceptsValidatedOIDCSessionCookie(t *testing.T) {
-	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var issuer string
-	issuerServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch r.URL.Path {
-		case "/.well-known/openid-configuration":
-			_ = json.NewEncoder(w).Encode(map[string]any{"issuer": issuer, "jwks_uri": issuer + "/jwks"})
-		case "/jwks":
-			_ = json.NewEncoder(w).Encode(map[string]any{"keys": []any{ecJWK("ec-key", &key.PublicKey)}})
-		default:
-			http.NotFound(w, r)
-		}
-	}))
-	defer issuerServer.Close()
-	issuer = issuerServer.URL
-
-	verifier, err := NewOIDCVerifier(OIDCConfig{
-		Issuer: issuer, Audience: "gateway-api", TenantID: "tenant-1", RolePrefix: "gateway.",
-		RequiredScopes: []string{"gateway.access"}, HTTPClient: issuerServer.Client(),
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
+func TestAuthenticateResolvesOpaqueOIDCSessionCookie(t *testing.T) {
 	authenticator := New("local-jwt-secret", "", "")
-	authenticator.OIDCVerifier = verifier
-	raw := signedOIDCToken(t, issuer, "ec-key", jwt.SigningMethodES256, key, nil)
+	var resolved string
+	authenticator.OIDCSessionResolver = func(_ context.Context, raw string) (*User, error) {
+		resolved = raw
+		return &User{ID: "platform-subject", Source: "oidc", Roles: []string{"user"}}, nil
+	}
 
 	request := httptest.NewRequest(http.MethodGet, "/api/v1/me", nil)
-	request.AddCookie(&http.Cookie{Name: OIDCSessionCookieName, Value: raw})
+	request.AddCookie(&http.Cookie{Name: OIDCSessionCookieName, Value: "opaque-session-id"})
 	user, err := authenticator.Authenticate(request)
 	if err != nil {
 		t.Fatalf("authenticate OIDC session cookie: %v", err)
@@ -52,8 +25,8 @@ func TestAuthenticateAcceptsValidatedOIDCSessionCookie(t *testing.T) {
 	if user.ID != "platform-subject" || user.Source != "oidc" {
 		t.Fatalf("unexpected session user: %#v", user)
 	}
-	if user.TokenExpiresAt.Before(time.Now().Add(50 * time.Minute)) {
-		t.Fatalf("token expiry was not retained: %v", user.TokenExpiresAt)
+	if resolved != "opaque-session-id" {
+		t.Fatalf("session resolver received %q", resolved)
 	}
 }
 
@@ -84,3 +57,19 @@ func TestAuthenticateRejectsInvalidOIDCSessionCookie(t *testing.T) {
 		t.Fatal("invalid OIDC session cookie was accepted")
 	}
 }
+
+func TestPublicRouteIgnoresExpiredOptionalOIDCSession(t *testing.T) {
+	authenticator := New("local-jwt-secret", "", "")
+	authenticator.OIDCSessionResolver = func(context.Context, string) (*User, error) {
+		return nil, &RequestAuthError{Status: http.StatusUnauthorized, Code: "OIDC_SESSION_EXPIRED", Message: "expired"}
+	}
+	request := httptest.NewRequest(http.MethodGet, "/api/v1/public/catalog/providers", nil)
+	request.AddCookie(&http.Cookie{Name: OIDCSessionCookieName, Value: "opaque-session-id"})
+	recorder := httptest.NewRecorder()
+	authenticator.Require(PermissionPublic, http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	})).ServeHTTP(recorder, request)
+	if recorder.Code != http.StatusNoContent {
+		t.Fatalf("public route status = %d, want %d", recorder.Code, http.StatusNoContent)
+	}
+}