feat: 接入 SSF 实时会话撤销

apps/api/internal/oidcsession/service.go

@@ -20,6 +20,7 @@ var (
 	ErrSessionRefreshUnavailable = errors.New("OIDC session refresh is unavailable")
 	ErrSessionStoreUnavailable   = errors.New("OIDC session store is unavailable")
 	ErrGatewayUserDisabled       = errors.New("gateway user is disabled")
+	ErrSecurityStateUnavailable  = errors.New("OIDC security event state is unavailable")
 )
 
 type Repository interface {
@@ -179,11 +180,17 @@ func (s *Service) refresh(ctx context.Context, hash []byte, record store.OIDCSes
 				}
 				return user, nil
 			}
+			if errors.Is(verifyErr, ErrSecurityStateUnavailable) {
+				return nil, verifyErr
+			}
 		}
 		return nil, ErrSessionRefreshUnavailable
 	}
 	user, err := s.verifySessionUser(ctx, record, refreshed.AccessToken)
 	if err != nil {
+		if errors.Is(err, ErrSecurityStateUnavailable) {
+			return nil, err
+		}
 		_ = s.repository.DeleteOIDCSessionByID(ctx, record.ID)
 		return nil, ErrSessionExpired
 	}
@@ -241,12 +248,19 @@ func (s *Service) waitForRefresh(ctx context.Context, hash []byte, original stor
 			}
 			return user, nil
 		}
+		if errors.Is(err, ErrSecurityStateUnavailable) {
+			return nil, err
+		}
 	}
 	return nil, ErrSessionRefreshUnavailable
 }
 
 func (s *Service) verifySessionUser(ctx context.Context, record store.OIDCSession, accessToken string) (*auth.User, error) {
 	user, err := s.verifier.Verify(ctx, accessToken)
+	var requestError *auth.RequestAuthError
+	if errors.As(err, &requestError) && requestError.Status == 503 {
+		return nil, ErrSecurityStateUnavailable
+	}
 	if err != nil || user == nil || user.Source != "oidc" || user.ID != record.ExternalUserID {
 		return nil, ErrSessionInvalid
 	}