feat: 实现 OIDC 服务端会话与请求刷新

使用 AES-256-GCM 保存认证中心令牌，并以随机 Cookie 哈希关联 PostgreSQL 会话。加入闲置与绝对期限、Refresh Token 轮换以及多实例刷新锁。
2026-07-13 19:09:10 +08:00
parent a81a7b5200
commit d345c070ae
16 changed files with 1804 additions and 58 deletions
@@ -1,6 +1,7 @@
 package config

 import (
+	"encoding/base64"
 	"errors"
 	"log/slog"
 	"net/url"
@@ -39,6 +40,13 @@ type Config struct {
 	OIDCGatewayTenantKey            string
 	OIDCBrowserSessionEnabled       bool
 	OIDCSessionCookieSecure         bool
+	OIDCClientID                    string
+	OIDCRedirectURI                 string
+	OIDCPostLogoutRedirectURI       string
+	OIDCSessionEncryptionKey        string
+	OIDCSessionIdleTTLSeconds       int
+	OIDCSessionAbsoluteTTLSeconds   int
+	OIDCSessionRefreshBeforeSeconds int
 	PublicBaseURL                   string
 	WebBaseURL                      string
 	LocalGeneratedStorageDir        string
@@ -87,12 +95,19 @@ func Load() Config {
 		OIDCSessionCookieSecure: env("OIDC_SESSION_COOKIE_SECURE",
 			strconv.FormatBool(!isLocalEnvironment(appEnv)),
 		) == "true",
-		PublicBaseURL:               strings.TrimRight(env("AI_GATEWAY_PUBLIC_BASE_URL", env("PUBLIC_BASE_URL", "")), "/"),
-		WebBaseURL:                  strings.TrimRight(env("AI_GATEWAY_WEB_BASE_URL", env("GATEWAY_WEB_BASE_URL", env("PUBLIC_WEB_BASE_URL", ""))), "/"),
-		LocalGeneratedStorageDir:    env("AI_GATEWAY_GENERATED_STORAGE_DIR", env("LOCAL_GENERATED_STORAGE_DIR", env("AI_GATEWAY_STATIC_STORAGE_DIR", DefaultLocalGeneratedStorageDir))),
-		LocalUploadedStorageDir:     env("AI_GATEWAY_UPLOADED_STORAGE_DIR", env("LOCAL_UPLOADED_STORAGE_DIR", DefaultLocalUploadedStorageDir)),
-		LocalTempAssetTTLHours:      envInt("AI_GATEWAY_LOCAL_TEMP_ASSET_TTL_HOURS", 24),
-		TaskProgressCallbackEnabled: env("TASK_PROGRESS_CALLBACK_ENABLED", "true") == "true",
+		OIDCClientID:                    env("OIDC_CLIENT_ID", ""),
+		OIDCRedirectURI:                 env("OIDC_REDIRECT_URI", ""),
+		OIDCPostLogoutRedirectURI:       env("OIDC_POST_LOGOUT_REDIRECT_URI", ""),
+		OIDCSessionEncryptionKey:        env("OIDC_SESSION_ENCRYPTION_KEY", ""),
+		OIDCSessionIdleTTLSeconds:       envInt("OIDC_SESSION_IDLE_TTL_SECONDS", 1800),
+		OIDCSessionAbsoluteTTLSeconds:   envInt("OIDC_SESSION_ABSOLUTE_TTL_SECONDS", 28800),
+		OIDCSessionRefreshBeforeSeconds: envInt("OIDC_SESSION_REFRESH_BEFORE_SECONDS", 60),
+		PublicBaseURL:                   strings.TrimRight(env("AI_GATEWAY_PUBLIC_BASE_URL", env("PUBLIC_BASE_URL", "")), "/"),
+		WebBaseURL:                      strings.TrimRight(env("AI_GATEWAY_WEB_BASE_URL", env("GATEWAY_WEB_BASE_URL", env("PUBLIC_WEB_BASE_URL", ""))), "/"),
+		LocalGeneratedStorageDir:        env("AI_GATEWAY_GENERATED_STORAGE_DIR", env("LOCAL_GENERATED_STORAGE_DIR", env("AI_GATEWAY_STATIC_STORAGE_DIR", DefaultLocalGeneratedStorageDir))),
+		LocalUploadedStorageDir:         env("AI_GATEWAY_UPLOADED_STORAGE_DIR", env("LOCAL_UPLOADED_STORAGE_DIR", DefaultLocalUploadedStorageDir)),
+		LocalTempAssetTTLHours:          envInt("AI_GATEWAY_LOCAL_TEMP_ASSET_TTL_HOURS", 24),
+		TaskProgressCallbackEnabled:     env("TASK_PROGRESS_CALLBACK_ENABLED", "true") == "true",
 		TaskProgressCallbackURL: env("TASK_PROGRESS_CALLBACK_URL",
 			strings.TrimRight(env("SERVER_MAIN_BASE_URL", "http://localhost:3000"), "/")+"/internal/platform/task-progress-callbacks",
 		),
@@ -110,6 +125,29 @@ func (c Config) Validate() error {
 		return errors.New("OIDC_GATEWAY_TENANT_KEY is required when OIDC_JIT_PROVISIONING_ENABLED=true")
 	}
 	if c.OIDCEnabled && c.OIDCBrowserSessionEnabled {
+		for _, scope := range c.OIDCRequiredScopes {
+			if strings.EqualFold(strings.TrimSpace(scope), "offline_access") {
+				return errors.New("OIDC_REQUIRED_SCOPES cannot contain offline_access for browser sessions")
+			}
+		}
+		if strings.TrimSpace(c.OIDCClientID) == "" {
+			return errors.New("OIDC_CLIENT_ID is required when OIDC browser sessions are enabled")
+		}
+		if !validPublicRedirectURL(c.OIDCRedirectURI) {
+			return errors.New("OIDC_REDIRECT_URI must be an exact HTTPS URL (localhost HTTP is allowed for development)")
+		}
+		if !validPublicRedirectURL(c.OIDCPostLogoutRedirectURI) {
+			return errors.New("OIDC_POST_LOGOUT_REDIRECT_URI must be an exact HTTPS URL (localhost HTTP is allowed for development)")
+		}
+		if _, err := c.OIDCSessionEncryptionKeyBytes(); err != nil {
+			return err
+		}
+		if c.OIDCSessionIdleTTLSeconds <= 0 || c.OIDCSessionAbsoluteTTLSeconds <= c.OIDCSessionIdleTTLSeconds {
+			return errors.New("OIDC session idle TTL must be positive and shorter than the absolute TTL")
+		}
+		if c.OIDCSessionRefreshBeforeSeconds <= 0 || c.OIDCSessionRefreshBeforeSeconds >= c.OIDCSessionIdleTTLSeconds {
+			return errors.New("OIDC_SESSION_REFRESH_BEFORE_SECONDS must be positive and shorter than the idle TTL")
+		}
 		if !isLocalEnvironment(c.AppEnv) && !c.OIDCSessionCookieSecure {
 			return errors.New("OIDC_SESSION_COOKIE_SECURE must be true outside local development and tests")
 		}
@@ -122,6 +160,28 @@ func (c Config) Validate() error {
 	return nil
 }

+func (c Config) OIDCSessionEncryptionKeyBytes() ([]byte, error) {
+	raw := strings.TrimSpace(c.OIDCSessionEncryptionKey)
+	for _, encoding := range []*base64.Encoding{base64.RawStdEncoding, base64.StdEncoding, base64.RawURLEncoding, base64.URLEncoding} {
+		decoded, err := encoding.DecodeString(raw)
+		if err == nil && len(decoded) == 32 {
+			return decoded, nil
+		}
+	}
+	return nil, errors.New("OIDC_SESSION_ENCRYPTION_KEY must be a base64-encoded 32-byte random key")
+}
+
+func validPublicRedirectURL(raw string) bool {
+	parsed, err := url.Parse(strings.TrimSpace(raw))
+	if err != nil || parsed.Host == "" || parsed.User != nil || parsed.RawQuery != "" || parsed.Fragment != "" {
+		return false
+	}
+	if parsed.Scheme == "https" {
+		return true
+	}
+	return parsed.Scheme == "http" && (parsed.Hostname() == "localhost" || parsed.Hostname() == "127.0.0.1")
+}
+
 func isLocalEnvironment(value string) bool {
 	switch strings.ToLower(strings.TrimSpace(value)) {
 	case "development", "dev", "local", "test":