chengcheng
a312ad880d
修复 credentials_saved 状态无法恢复、配对与激活并发冲突，以及 SSF 和身份 Secret 生命周期不完整的问题。新增持久化协调器、取消与清理状态机、事务级并发门禁、受控 SSF 凭据交接、禁用后的延迟 Secret 清理，并对生产环境统一认证及 Discovery 端点强制 HTTPS。 验证：go test ./...；go test -race ./internal/auth ./internal/identity ./internal/identityruntime ./internal/securityevents ./internal/httpapi ./internal/store -count=1；go vet ./...；真实 PostgreSQL 并发及清理成功/冲突回滚测试；pnpm openapi。
20 lines
889 B
SQL
20 lines
889 B
SQL
CREATE TABLE IF NOT EXISTS gateway_identity_secret_cleanup_queue (
|
|
secret_ref text PRIMARY KEY CHECK (secret_ref ~ '^[a-z0-9][a-z0-9-]{0,127}$'),
|
|
not_before timestamptz NOT NULL,
|
|
status text NOT NULL DEFAULT 'pending',
|
|
claim_token uuid,
|
|
lease_expires_at timestamptz,
|
|
created_at timestamptz NOT NULL DEFAULT now(),
|
|
updated_at timestamptz NOT NULL DEFAULT now(),
|
|
CONSTRAINT gateway_identity_secret_cleanup_status_check
|
|
CHECK (status IN ('pending','claimed')),
|
|
CONSTRAINT gateway_identity_secret_cleanup_claim_check
|
|
CHECK (
|
|
(status = 'pending' AND claim_token IS NULL AND lease_expires_at IS NULL) OR
|
|
(status = 'claimed' AND claim_token IS NOT NULL AND lease_expires_at IS NOT NULL)
|
|
)
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_gateway_identity_secret_cleanup_due
|
|
ON gateway_identity_secret_cleanup_queue(status, not_before, lease_expires_at, updated_at);
|