鉴权并入 Auth Broker：委派设备会话统一模型 + 四端迁移
后端（委托 Auth Broker，路径 A）： - 删自建鉴权（OIDC exchange / 自签会话 / step-up / shortcut / web_sessions / accounts），cdrop 不再存任何凭证；鉴权中间件改读边缘注入的 X-Auth-Subject/Scope/Meta/Name/Roles 头（dev 旁路保留）；Claims 加 Tier() / Guest() - internal/brokerclient：mint / revoke（带 X-Broker-App）/ refresh / ListSessions（R1 列举），直连内网、吊销幂等 统一会话模型“委派设备会话”（Delegated Device Sessions）： - 每个客户端（浏览器 / 桌面 / 扫码设备）＝一条带 meta(device_id) + label 的 broker 机器会话；Broker 作设备会话唯一注册表（R1 按用户＋app 列举 + R2 按 (user,app,meta) 幂等铸造），cdrop 退化为薄覆盖层、不再自存权威会话表 - 新增代铸端点 POST /api/auth/device-session：凭边缘已验明的 X-Auth-Subject 委托 broker 铸 / 轮换设备会话（meta=device_id、按调用方 tier 防越权、sameOrigin CSRF、per-IP 限流）；R2 幂等保证同一 device_id 重登原地轮换、不堆重复设备 - 会话列表＝R1 权威 + 叠加 type（本地缓存）/ online（Hub presence，按设备名）/ current（meta 匹配本请求 X-Auth-Meta）+ 过滤 meta=""（device-authorize 引导会话残留）；devices 表降级为 type/presence 薄缓存（非会话权威），device_id 主键、upsert 按 user 限定 - 吊销按 device_id → 缓存优先 / R1 兜底解析 sid → broker 吊销 + X-Broker-App；扫码登录保留三密钥编排，collect 改委托 broker 铸 + 落缓存行 Web 前端： - 登录走 broker 全局 SSO 代跳（/api/auth/login 302）；bootstrap 经 /api/me 注入身份后代铸设备会话（稳定 device_id 存 localStorage、Web Locks 跨 tab 串行防重复铸造）；refresh 走 /api/auth/refresh - 设备管理按 device_id；改名＝同 device_id 重代铸（R2 原地轮换换 label、不产生重复行）；登录页反应式守卫修登录回环 - 去 OIDC PKCE / step-up（删 oauth.callback / stepUp） 桌面客户端（Wails）： - loopback PKCE（RFC 8252）改指 broker 设备授权流（/device/authorize + /device/token）拿引导令牌，再代铸出带 meta 的托管设备会话——与浏览器同模型、同管理、同吊销；身份取自代铸响应（修“显示名显示为 UUID”）；refresh 保留显示名；稳定 device_id 入桌面配置 iOS 客户端（arch A，原生 SwiftUI + 离屏无头 WebView 引擎 + 原生↔JS 桥）： - 引擎 / 文件管理 / 设备管理 / 应用图标 / 本地化（此前实现，随本次落入版本库） - 鉴权＝引擎自刷（boot 注入 refresh_token）+ broker 轮换经 sessionRotated 回报原生更新 Keychain；去 cookie 同步；Session 加 refreshToken / deviceId 实时 / 健壮性： - presence 走 Hub union（设备表行 ∪ 表外实时连接，按名去重、live-only 标在线） - Hub 通道 close 一律在写锁内、非阻塞 send 一律在读锁内，消除 close-vs-send 闭通道 send panic（revoke 每次 Kick 后该路径变热） 配置 / 删旧栈： - config 改 broker 接入（CDROP_BROKER_* / CDROP_PUBLIC_URL / 按档 TTL），prod 强校验 broker 配置 + PUBLIC_URL（CSRF Origin 守卫不失效） - 删 auth.go / selftoken.go / shortcut.go / jwks.go + 三表（web_sessions / accounts / shortcut_tokens）及验证链；.env.example / compose.snippet.yaml / Caddyfile.snippet 更新为 broker 模型（人机分流 + 公开端点放行 + X-Auth-Meta 透传） - 测试全重写：QR / 会话含 mock broker（R1 列举 + R2 幂等）；hub 加 close-vs-send 并发回归；config 加 prod 必填校验
This commit is contained in:
+49
-32
@@ -37,7 +37,11 @@ const clientBuffer = 32
|
||||
type Client struct {
|
||||
UserID string
|
||||
DeviceID string
|
||||
ch chan Event
|
||||
// Type is the client-declared device type (browser / macos / windows / linux / ios).
|
||||
// It lets presence label a live device that has no devices-table row (a global-SSO
|
||||
// browser or a broker-authenticated desktop).
|
||||
Type string
|
||||
ch chan Event
|
||||
}
|
||||
|
||||
func (c *Client) Events() <-chan Event { return c.ch }
|
||||
@@ -67,10 +71,13 @@ func New(devices DeviceLister) *Hub {
|
||||
|
||||
// Connect registers a new SSE client and announces presence to the user's other devices.
|
||||
// If a client for (userID, deviceID) already exists (e.g., a tab refresh), its channel is closed.
|
||||
func (h *Hub) Connect(ctx context.Context, userID, deviceID string) *Client {
|
||||
// deviceType is the caller's declared device type, surfaced in presence for a live device
|
||||
// that has no devices-table row.
|
||||
func (h *Hub) Connect(ctx context.Context, userID, deviceID, deviceType string) *Client {
|
||||
c := &Client{
|
||||
UserID: userID,
|
||||
DeviceID: deviceID,
|
||||
Type: deviceType,
|
||||
ch: make(chan Event, clientBuffer),
|
||||
}
|
||||
|
||||
@@ -115,10 +122,15 @@ func (h *Hub) Disconnect(c *Client) {
|
||||
|
||||
// SendTo routes an event to a specific (userID, deviceID). Reports whether
|
||||
// the target was online and the event was queued.
|
||||
//
|
||||
// The send happens while still holding the read lock so it can never race a Kick / Connect-
|
||||
// replace / Close that closes the channel (those hold the write lock): a send on a closed
|
||||
// channel panics even inside a select, so close-vs-send must be mutually exclusive. The send
|
||||
// is non-blocking (select default), so holding the read lock across it is brief.
|
||||
func (h *Hub) SendTo(userID, deviceID string, ev Event) bool {
|
||||
h.mu.RLock()
|
||||
defer h.mu.RUnlock()
|
||||
c, ok := h.users[userID][deviceID]
|
||||
h.mu.RUnlock()
|
||||
if !ok {
|
||||
return false
|
||||
}
|
||||
@@ -132,10 +144,12 @@ func (h *Hub) SendTo(userID, deviceID string, ev Event) bool {
|
||||
}
|
||||
}
|
||||
|
||||
// Broadcast fans an event out to every live client of a user.
|
||||
// Broadcast fans an event out to every live client of a user. The non-blocking sends run
|
||||
// under the read lock so they can't race a concurrent channel close (see SendTo).
|
||||
func (h *Hub) Broadcast(userID string, ev Event) {
|
||||
clients := h.snapshotClients(userID)
|
||||
for _, c := range clients {
|
||||
h.mu.RLock()
|
||||
defer h.mu.RUnlock()
|
||||
for _, c := range h.users[userID] {
|
||||
select {
|
||||
case c.ch <- ev:
|
||||
default:
|
||||
@@ -153,20 +167,20 @@ func (h *Hub) Online(userID, deviceID string) bool {
|
||||
return ok
|
||||
}
|
||||
|
||||
// Kick force-removes a (userID, deviceID) entry from the hub and closes its
|
||||
// event channel; the SSE handler exits on the next iteration. 与 Connect 的
|
||||
// 旧通道关闭模式一致（与并发 SendTo 之间存在极窄竞态，但 Kick 罕用，可接受）。
|
||||
// Kick force-removes a (userID, deviceID) entry from the hub and closes its event channel;
|
||||
// the SSE handler exits on the next iteration. The close happens UNDER the write lock — the
|
||||
// same discipline as Connect-replace and Close — so it can never race a send from
|
||||
// publishPresence / Broadcast / SendTo (those hold the read lock), which would otherwise
|
||||
// panic on a send to a closed channel. revokeDevice now Kicks on every logout / device
|
||||
// delete / session revoke, so this path is hot, not rare.
|
||||
func (h *Hub) Kick(userID, deviceID string) {
|
||||
h.mu.Lock()
|
||||
c, ok := h.users[userID][deviceID]
|
||||
if ok {
|
||||
defer h.mu.Unlock()
|
||||
if c, ok := h.users[userID][deviceID]; ok {
|
||||
delete(h.users[userID], deviceID)
|
||||
if len(h.users[userID]) == 0 {
|
||||
delete(h.users, userID)
|
||||
}
|
||||
}
|
||||
h.mu.Unlock()
|
||||
if ok {
|
||||
close(c.ch)
|
||||
}
|
||||
}
|
||||
@@ -194,44 +208,47 @@ func (h *Hub) Close() {
|
||||
h.users = map[string]map[string]*Client{}
|
||||
}
|
||||
|
||||
func (h *Hub) snapshotClients(userID string) []*Client {
|
||||
h.mu.RLock()
|
||||
defer h.mu.RUnlock()
|
||||
src := h.users[userID]
|
||||
out := make([]*Client, 0, len(src))
|
||||
for _, c := range src {
|
||||
out = append(out, c)
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
func (h *Hub) publishPresence(ctx context.Context, userID string) {
|
||||
devs, err := h.devices.ListDevicesByUser(ctx, userID)
|
||||
if err != nil {
|
||||
// Log but continue with an empty managed-device set: a transient DB error must
|
||||
// not blank out the presence of live, unmanaged devices that need no row.
|
||||
slog.Error("presence: list devices failed", "user", userID, "err", err)
|
||||
return
|
||||
}
|
||||
|
||||
now := time.Now().Unix()
|
||||
// Hold the read lock across the build AND the sends: the non-blocking sends below must
|
||||
// be mutually exclusive with any channel close (Kick / Connect-replace / Close hold the
|
||||
// write lock), or a send could hit a closed channel and panic.
|
||||
h.mu.RLock()
|
||||
defer h.mu.RUnlock()
|
||||
live := h.users[userID]
|
||||
items := make([]PresenceDevice, 0, len(devs))
|
||||
seen := make(map[string]bool, len(devs))
|
||||
items := make([]PresenceDevice, 0, len(devs)+len(live))
|
||||
for _, d := range devs {
|
||||
_, online := live[d.Name]
|
||||
items = append(items, PresenceDevice{
|
||||
Name: d.Name, Type: d.Type, Online: online, LastSeen: d.LastSeen,
|
||||
})
|
||||
seen[d.Name] = true
|
||||
}
|
||||
clients := make([]*Client, 0, len(live))
|
||||
for _, c := range live {
|
||||
clients = append(clients, c)
|
||||
// Live connections without a devices-table row — a global-SSO browser before 代铸, or a
|
||||
// device whose cache row hasn't landed yet. They are reachable on the hub (clipboard /
|
||||
// signaling already route to them), so they must appear as online peers too.
|
||||
for name, c := range live {
|
||||
if seen[name] {
|
||||
continue
|
||||
}
|
||||
items = append(items, PresenceDevice{
|
||||
Name: name, Type: c.Type, Online: true, LastSeen: now,
|
||||
})
|
||||
}
|
||||
h.mu.RUnlock()
|
||||
|
||||
ev := Event{
|
||||
Type: "presence",
|
||||
Data: map[string]any{"devices": items},
|
||||
}
|
||||
for _, c := range clients {
|
||||
for _, c := range live {
|
||||
select {
|
||||
case c.ch <- ev:
|
||||
default:
|
||||
|
||||
@@ -2,6 +2,8 @@ package hub
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"sync"
|
||||
"sync/atomic"
|
||||
"testing"
|
||||
"time"
|
||||
@@ -44,7 +46,7 @@ func TestConnectFiresPresenceEvent(t *testing.T) {
|
||||
h := New(lister)
|
||||
defer h.Close()
|
||||
|
||||
c := h.Connect(context.Background(), "alice", "tab-1")
|
||||
c := h.Connect(context.Background(), "alice", "tab-1", "browser")
|
||||
defer h.Disconnect(c)
|
||||
|
||||
ev := waitForEvent(t, c, "presence", time.Second)
|
||||
@@ -65,11 +67,11 @@ func TestSecondClientSeesFirstAsOnline(t *testing.T) {
|
||||
h := New(lister)
|
||||
defer h.Close()
|
||||
|
||||
c1 := h.Connect(context.Background(), "alice", "tab-1")
|
||||
c1 := h.Connect(context.Background(), "alice", "tab-1", "browser")
|
||||
defer h.Disconnect(c1)
|
||||
_ = waitForEvent(t, c1, "presence", time.Second)
|
||||
|
||||
c2 := h.Connect(context.Background(), "alice", "tab-2")
|
||||
c2 := h.Connect(context.Background(), "alice", "tab-2", "browser")
|
||||
defer h.Disconnect(c2)
|
||||
|
||||
// c2 receives its own presence (announced on Connect).
|
||||
@@ -94,12 +96,28 @@ func TestSecondClientSeesFirstAsOnline(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
// A live device with no devices-table row (global-SSO browser / broker-auth desktop)
|
||||
// must still appear in presence as online, labelled by its declared type.
|
||||
func TestLiveOnlyDeviceAppearsInPresence(t *testing.T) {
|
||||
h := New(&fakeLister{}) // empty managed-device set
|
||||
defer h.Close()
|
||||
|
||||
c := h.Connect(context.Background(), "alice", "macbook", "macos")
|
||||
defer h.Disconnect(c)
|
||||
|
||||
ev := waitForEvent(t, c, "presence", time.Second)
|
||||
devs, _ := ev.Data.(map[string]any)["devices"].([]PresenceDevice)
|
||||
if len(devs) != 1 || devs[0].Name != "macbook" || devs[0].Type != "macos" || !devs[0].Online {
|
||||
t.Errorf("live-only device should appear online in presence: %+v", devs)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSendToRoutesEvent(t *testing.T) {
|
||||
lister := &fakeLister{}
|
||||
h := New(lister)
|
||||
defer h.Close()
|
||||
|
||||
c := h.Connect(context.Background(), "alice", "tab-1")
|
||||
c := h.Connect(context.Background(), "alice", "tab-1", "browser")
|
||||
defer h.Disconnect(c)
|
||||
_ = waitForEvent(t, c, "presence", time.Second)
|
||||
|
||||
@@ -124,11 +142,11 @@ func TestReconnectClosesOldChannel(t *testing.T) {
|
||||
h := New(&fakeLister{})
|
||||
defer h.Close()
|
||||
|
||||
old := h.Connect(context.Background(), "alice", "tab-1")
|
||||
old := h.Connect(context.Background(), "alice", "tab-1", "browser")
|
||||
// drain the initial presence so we can detect close
|
||||
<-old.Events()
|
||||
|
||||
_ = h.Connect(context.Background(), "alice", "tab-1")
|
||||
_ = h.Connect(context.Background(), "alice", "tab-1", "browser")
|
||||
|
||||
select {
|
||||
case _, ok := <-old.Events():
|
||||
@@ -146,7 +164,7 @@ func TestDisconnectRemovesFromOnlineSet(t *testing.T) {
|
||||
})
|
||||
defer h.Close()
|
||||
|
||||
c := h.Connect(context.Background(), "alice", "tab-1")
|
||||
c := h.Connect(context.Background(), "alice", "tab-1", "browser")
|
||||
if !h.Online("alice", "tab-1") {
|
||||
t.Fatal("client should be online after Connect")
|
||||
}
|
||||
@@ -156,6 +174,36 @@ func TestDisconnectRemovesFromOnlineSet(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
// TestConcurrentKickAndPresenceNoPanic hammers Kick (which closes channels under the write
|
||||
// lock) against publishPresence / Broadcast / SendTo (non-blocking sends under the read lock).
|
||||
// Before the close-vs-send fix this raced into a "send on closed channel" panic that crashed
|
||||
// the whole process; now close and send are mutually exclusive. Run with -race.
|
||||
func TestConcurrentKickAndPresenceNoPanic(t *testing.T) {
|
||||
h := New(&fakeLister{
|
||||
devices: []db.Device{{UserID: "u", Name: "d", Type: "browser"}},
|
||||
})
|
||||
defer h.Close()
|
||||
|
||||
const workers = 16
|
||||
const iters = 200
|
||||
var wg sync.WaitGroup
|
||||
for i := 0; i < workers; i += 1 {
|
||||
wg.Add(1)
|
||||
go func(n int) {
|
||||
defer wg.Done()
|
||||
name := fmt.Sprintf("d%d", n)
|
||||
for j := 0; j < iters; j += 1 {
|
||||
h.Connect(context.Background(), "u", name, "browser")
|
||||
h.PublishPresence(context.Background(), "u")
|
||||
h.Broadcast("u", Event{Type: "x"})
|
||||
h.SendTo("u", name, Event{Type: "y"})
|
||||
h.Kick("u", name)
|
||||
}
|
||||
}(i)
|
||||
}
|
||||
wg.Wait()
|
||||
}
|
||||
|
||||
// TestGracePeriod uses a tiny grace so the test runs fast.
|
||||
func TestGracePeriodDelaysOfflinePresence(t *testing.T) {
|
||||
h := New(&fakeLister{
|
||||
@@ -167,9 +215,9 @@ func TestGracePeriodDelaysOfflinePresence(t *testing.T) {
|
||||
h.grace = 100 * time.Millisecond
|
||||
defer h.Close()
|
||||
|
||||
c1 := h.Connect(context.Background(), "alice", "tab-1")
|
||||
c1 := h.Connect(context.Background(), "alice", "tab-1", "browser")
|
||||
defer h.Disconnect(c1)
|
||||
c2 := h.Connect(context.Background(), "alice", "tab-2")
|
||||
c2 := h.Connect(context.Background(), "alice", "tab-2", "browser")
|
||||
// Drain initial presence frames
|
||||
_ = waitForEvent(t, c1, "presence", time.Second)
|
||||
_ = waitForEvent(t, c1, "presence", time.Second)
|
||||
|
||||
Reference in New Issue
Block a user