chengcheng
a312ad880d
修复 credentials_saved 状态无法恢复、配对与激活并发冲突，以及 SSF 和身份 Secret 生命周期不完整的问题。新增持久化协调器、取消与清理状态机、事务级并发门禁、受控 SSF 凭据交接、禁用后的延迟 Secret 清理，并对生产环境统一认证及 Discovery 端点强制 HTTPS。 验证：go test ./...；go test -race ./internal/auth ./internal/identity ./internal/identityruntime ./internal/securityevents ./internal/httpapi ./internal/store -count=1；go vet ./...；真实 PostgreSQL 并发及清理成功/冲突回滚测试；pnpm openapi。
30 lines
1.4 KiB
SQL
30 lines
1.4 KiB
SQL
SET LOCAL lock_timeout = '10s';
|
|
SET LOCAL statement_timeout = '60s';
|
|
|
|
CREATE TABLE IF NOT EXISTS gateway_identity_pairing_start_reservation (
|
|
singleton boolean PRIMARY KEY DEFAULT true CHECK (singleton),
|
|
attempt_id uuid NOT NULL UNIQUE,
|
|
state text NOT NULL DEFAULT 'starting' CHECK (state IN ('starting','paired')),
|
|
revision_id uuid UNIQUE REFERENCES gateway_identity_configuration_revisions(id) ON DELETE RESTRICT,
|
|
expires_at timestamptz NOT NULL,
|
|
created_at timestamptz NOT NULL DEFAULT now(),
|
|
updated_at timestamptz NOT NULL DEFAULT now(),
|
|
CONSTRAINT gateway_identity_pairing_start_state_check CHECK (
|
|
(state='starting' AND revision_id IS NULL) OR
|
|
(state='paired' AND revision_id IS NOT NULL)
|
|
)
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_gateway_identity_pairing_start_expiry
|
|
ON gateway_identity_pairing_start_reservation(state,expires_at);
|
|
|
|
INSERT INTO gateway_identity_pairing_start_reservation(singleton,attempt_id,state,revision_id,expires_at)
|
|
SELECT true,exchange.id,'paired',revision.id,exchange.expires_at
|
|
FROM gateway_identity_configuration_revisions revision
|
|
JOIN gateway_identity_onboarding_exchanges exchange ON exchange.revision_id=revision.id
|
|
WHERE revision.state IN ('draft','validated','failed')
|
|
AND NOT (exchange.status='cancelled' AND exchange.cleanup_status='completed')
|
|
ORDER BY revision.created_at DESC,exchange.created_at DESC
|
|
LIMIT 1
|
|
ON CONFLICT DO NOTHING;
|