feat: 接入 SSF 实时会话撤销

2026-07-14 17:06:41 +08:00
parent 30ad0e9f2c
commit f30aaeb2d4
28 changed files with 2597 additions and 91 deletions
@@ -136,3 +136,34 @@ func TestValidateRejectsOfflineAccessForBrowserSession(t *testing.T) {
 		t.Fatalf("Validate() error = %v, want offline_access rejection", err)
 	}
 }
+
+func TestSecurityEventsAreOptionalButFailFastWhenPartiallyConfigured(t *testing.T) {
+	if err := (Config{}).Validate(); err != nil {
+		t.Fatalf("disabled security events changed existing config: %v", err)
+	}
+	cfg := Config{AppEnv: "test", OIDCEnabled: true, OIDCSecurityEventsEnabled: true}
+	if err := cfg.Validate(); err == nil || !strings.Contains(err.Error(), "issuer") {
+		t.Fatalf("partial security event config error = %v", err)
+	}
+	cfg.OIDCSecurityEventsTransmitterIssuer = "http://localhost:8080/ssf"
+	cfg.OIDCSecurityEventsPublicEndpoint = "http://localhost:8088/api/v1/security-events/ssf"
+	cfg.OIDCSecurityEventsManagementTokenURL = "http://localhost:8080/oauth/token"
+	cfg.OIDCTenantID = "00000000-0000-4000-8000-000000000003"
+	cfg.OIDCSecurityEventsReceiverAudience = "urn:easyai:ssf:receiver:00000000-0000-4000-8000-000000000002"
+	cfg.OIDCSecurityEventsStreamID = "00000000-0000-4000-8000-000000000001"
+	cfg.OIDCSecurityEventsBearerSecret = "receiver-secret-at-least-16"
+	cfg.OIDCSecurityEventsManagementClientID = "gateway-ssf"
+	cfg.OIDCSecurityEventsManagementClientSecret = "management-secret"
+	cfg.OIDCIntrospectionClientID = "gateway-introspection"
+	cfg.OIDCIntrospectionClientSecret = "introspection-secret"
+	cfg.OIDCSecurityEventsHeartbeatIntervalSeconds = 60
+	cfg.OIDCSecurityEventsStaleAfterSeconds = 180
+	cfg.OIDCSecurityEventsClockSkewSeconds = 60
+	if err := cfg.Validate(); err != nil {
+		t.Fatalf("valid security event config: %v", err)
+	}
+	cfg.OIDCSecurityEventsPublicEndpoint = "http://localhost:8088/wrong-path"
+	if err := cfg.Validate(); err == nil {
+		t.Fatal("non-canonical security event receiver path was accepted")
+	}
+}