feat(ssf): 托管机器凭据并支持动态恢复

Gateway 连接表单接收认证中心一次性交付的 machine Client 凭据，后端立即写入 SecretStore，数据库和公开响应只保留引用及公开 Client ID。SSF 管理 Token、Verification 和 RFC 7662 内省统一从动态凭据读取，支持现有连接无重启修复及进程重启恢复，环境变量仅保留为旧部署回退。\n\n验证：go test ./apps/api/...；pnpm nx test web；真实重启、OIDC 登录与 session-revoked 1.29 秒失效验收。
2026-07-17 09:13:57 +08:00
parent 8e33d1d33e
commit ffb85b73af
15 changed files with 327 additions and 90 deletions
@@ -94,13 +94,14 @@ func NewServerWithContext(ctx context.Context, cfg config.Config, db *store.Stor
 		verifier, err := auth.NewOIDCVerifier(auth.OIDCConfig{
 			Issuer: cfg.OIDCIssuer, Audience: cfg.OIDCAudience, TenantID: cfg.OIDCTenantID,
 			RolePrefix: cfg.OIDCRolePrefix, RequiredScopes: cfg.OIDCRequiredScopes,
-			JWKSCacheTTL:               time.Duration(cfg.OIDCJWKSCacheTTLSeconds) * time.Second,
-			IntrospectionEnabled:       cfg.OIDCIntrospectionEnabled,
-			IntrospectionClientID:      cfg.OIDCIntrospectionClientID,
-			IntrospectionClientSecret:  cfg.OIDCIntrospectionClientSecret,
-			SecurityEventEvaluator:     evaluator,
-			IntrospectionObserver:      securityEventMetrics.ObserveIntrospection,
-			JWKSRefreshFailureObserver: func() { securityEventMetrics.ObserveJWKSRefreshFailure("oidc") },
+			JWKSCacheTTL:                    time.Duration(cfg.OIDCJWKSCacheTTLSeconds) * time.Second,
+			IntrospectionEnabled:            cfg.OIDCIntrospectionEnabled,
+			IntrospectionClientID:           cfg.OIDCIntrospectionClientID,
+			IntrospectionClientSecret:       cfg.OIDCIntrospectionClientSecret,
+			IntrospectionCredentialProvider: server.securityEventManager.IntrospectionCredential,
+			SecurityEventEvaluator:          evaluator,
+			IntrospectionObserver:           securityEventMetrics.ObserveIntrospection,
+			JWKSRefreshFailureObserver:      func() { securityEventMetrics.ObserveJWKSRefreshFailure("oidc") },
 		})
 		if err != nil {
 			panic("invalid OIDC configuration: " + err.Error())