扫码登录：cdrop 自签会话原语 + 薄账户层 + 受限访客 + 2FA step-up

身份仍源自 OAuth provider（user_id = OIDC sub），cdrop 在其上自维护一薄层：自签会话令牌 + accounts 表，并新增扫码快速登录。实施蓝本见 AUTH.md。后端 · 自签会话原语 - web_sessions 加 kind/scope/granted_by 列（bootstrap 幂等迁移）；既有 oidc 会话行为不变，新增 self（滑动续期）/ guest（受限·不续）两类 - cdrop 自签 HS256 会话 access token，密钥派生自 SESSION_SECRET，与落盘 AES、 shortcut HS256 三密钥域隔离；jwtauth.verifySelfToken 无状态校验、靠 typ 区分 - requireFullSession 守卫：guest 会话不得改账号 / 再批准设备 / 签长效 token - /auth/refresh 按 kind 分流：self/guest 纯自签、不触 IdP 后端 · 扫码登录（internal/httpapi/qr.go） - qr/start・status・request・approve・deny 五端点 + login_requests 表 + reaper - 三密钥分离：QR 仅含批准信息，会话只投递给持私有 poll_secret 的原设备（偷拍 QR 者无 poll_secret 领不到会话、未登录批不了准） - 会话在新设备侧领取（cookie 不经手机）、单次消费、短 TTL 后端 · 薄账户层与 2FA step-up - accounts 表（键 sub，不含任何凭证）：exchange/refresh upsert match_key / 显示名 / 头像 / roles，供显示与未来管理员开启迁移标记时跨源关联 - step-up（默认关）：开启后 qr/approve 要求新鲜 prompt=login 授权码，后端就地换 id_token、JWKS 验签 + auth_time 窗口 + sub 匹配，provider 2FA 于此往返强制前端（web/） - 显码页 /link/new + 批准页 /link + net/qr.ts，对齐 Theme B、复用 AuthShell 与聚珍排版管线、零新全局样式 - step-up 再认证流：批准前跑 prompt=login PKCE，回调分叉（不消费一次性 code、独立 state key）后带 step_up_code/verifier 调 approve - 三语 i18n qr.*；新增 qrcode 依赖修复 · clipboard sweeper（早已提交的损坏） - ClearExpiredClipboards 因 clipboard.sql 全角注释触发 sqlc 1.31 多字节偏移 bug，生成 SQL 被截断为「UPDATE clipboard_state SET content =」，sweeper 运行期报「incomplete input」、过期剪贴板内容从未清除（短 TTL 暴露保护失效） - 注释改纯 ASCII 并加 bug 警告，重生成得完整 SQL；prod 已验证 sweeper 由 ERROR 转为正常清理（cleared count=1）构建 - .dockerignore：排除本地 node_modules 等，避免宿主原生二进制污染镜像内 vite 构建 - Dockerfile.base：GOPROXY 改为可经 --build-arg 覆盖（默认仍官方代理，受限网络构建时传区域镜像即可，仓库不固化区域值）文档 - 新增 AUTH.md（账户与登录实施蓝本）；README 特性；.env.example / compose.snippet 增配置项（QR / 自签会话 TTL / step-up / match_claim）测试 - 自签 token 密钥域隔离、扫码端到端（领取 / 单次 / poll_secret 校验 / deny / step-up 门）、extractIdentity、web_sessions 升级迁移
2026-06-21 22:43:36 +08:00
parent eda23f79b1
commit 90a3790a98
50 changed files with 4130 additions and 43 deletions
@@ -9,6 +9,43 @@ import (
 	"context"
 )

+const createSelfSession = `-- name: CreateSelfSession :exec
+INSERT INTO web_sessions (id, user_id, refresh_token, device_name, user_agent, kind, scope, granted_by, created_at, last_used_at, expires_at)
+VALUES (?, ?, '', ?, ?, ?, ?, ?, ?, ?, ?)
+`
+
+type CreateSelfSessionParams struct {
+	ID         string `json:"id"`
+	UserID     string `json:"user_id"`
+	DeviceName string `json:"device_name"`
+	UserAgent  string `json:"user_agent"`
+	Kind       string `json:"kind"`
+	Scope      string `json:"scope"`
+	GrantedBy  string `json:"granted_by"`
+	CreatedAt  int64  `json:"created_at"`
+	LastUsedAt int64  `json:"last_used_at"`
+	ExpiresAt  int64  `json:"expires_at"`
+}
+
+// CreateSelfSession inserts a cdrop self-signed session (kind self/guest) that has
+// no IdP refresh_token (stored empty): refresh mints a fresh access token straight
+// from this row without touching the IdP. Used by QR scan-login (AUTH.md 4).
+func (q *Queries) CreateSelfSession(ctx context.Context, arg CreateSelfSessionParams) error {
+	_, err := q.db.ExecContext(ctx, createSelfSession,
+		arg.ID,
+		arg.UserID,
+		arg.DeviceName,
+		arg.UserAgent,
+		arg.Kind,
+		arg.Scope,
+		arg.GrantedBy,
+		arg.CreatedAt,
+		arg.LastUsedAt,
+		arg.ExpiresAt,
+	)
+	return err
+}
+
 const createWebSession = `-- name: CreateWebSession :exec

 INSERT INTO web_sessions (id, user_id, refresh_token, device_name, user_agent, created_at, last_used_at, expires_at)
@@ -68,8 +105,28 @@ func (q *Queries) DeleteWebSession(ctx context.Context, id string) error {
 	return err
 }

+const deleteWebSessionForUser = `-- name: DeleteWebSessionForUser :execrows
+DELETE FROM web_sessions
+WHERE id = ? AND user_id = ?
+`
+
+type DeleteWebSessionForUserParams struct {
+	ID     string `json:"id"`
+	UserID string `json:"user_id"`
+}
+
+// DeleteWebSessionForUser drops one session scoped to its owner, so a user can
+// only revoke their own.
+func (q *Queries) DeleteWebSessionForUser(ctx context.Context, arg DeleteWebSessionForUserParams) (int64, error) {
+	result, err := q.db.ExecContext(ctx, deleteWebSessionForUser, arg.ID, arg.UserID)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}
+
 const getWebSession = `-- name: GetWebSession :one
-SELECT id, user_id, refresh_token, device_name, user_agent, created_at, last_used_at, expires_at
+SELECT id, user_id, refresh_token, device_name, user_agent, created_at, last_used_at, expires_at, kind, scope, granted_by
 FROM web_sessions
 WHERE id = ?
 `
@@ -86,10 +143,70 @@ func (q *Queries) GetWebSession(ctx context.Context, id string) (WebSession, err
 		&i.CreatedAt,
 		&i.LastUsedAt,
 		&i.ExpiresAt,
+		&i.Kind,
+		&i.Scope,
+		&i.GrantedBy,
 	)
 	return i, err
 }

+const listWebSessionsByUser = `-- name: ListWebSessionsByUser :many
+SELECT id, user_id, device_name, user_agent, created_at, last_used_at, expires_at, kind, scope, granted_by
+FROM web_sessions
+WHERE user_id = ?
+ORDER BY last_used_at DESC
+`
+
+type ListWebSessionsByUserRow struct {
+	ID         string `json:"id"`
+	UserID     string `json:"user_id"`
+	DeviceName string `json:"device_name"`
+	UserAgent  string `json:"user_agent"`
+	CreatedAt  int64  `json:"created_at"`
+	LastUsedAt int64  `json:"last_used_at"`
+	ExpiresAt  int64  `json:"expires_at"`
+	Kind       string `json:"kind"`
+	Scope      string `json:"scope"`
+	GrantedBy  string `json:"granted_by"`
+}
+
+// ListWebSessionsByUser lists a user's sessions for the management UI (revoke
+// borrowed / guest devices). granted_by ties a scan-approved session to its
+// approver for cascade revocation.
+func (q *Queries) ListWebSessionsByUser(ctx context.Context, userID string) ([]ListWebSessionsByUserRow, error) {
+	rows, err := q.db.QueryContext(ctx, listWebSessionsByUser, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []ListWebSessionsByUserRow
+	for rows.Next() {
+		var i ListWebSessionsByUserRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.UserID,
+			&i.DeviceName,
+			&i.UserAgent,
+			&i.CreatedAt,
+			&i.LastUsedAt,
+			&i.ExpiresAt,
+			&i.Kind,
+			&i.Scope,
+			&i.GrantedBy,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const rotateWebSession = `-- name: RotateWebSession :exec
 UPDATE web_sessions
 SET refresh_token = ?, last_used_at = ?, expires_at = ?
@@ -128,3 +245,23 @@ func (q *Queries) SetWebSessionDevice(ctx context.Context, arg SetWebSessionDevi
 	_, err := q.db.ExecContext(ctx, setWebSessionDevice, arg.DeviceName, arg.ID)
 	return err
 }
+
+const slideWebSession = `-- name: SlideWebSession :exec
+UPDATE web_sessions
+SET last_used_at = ?, expires_at = ?
+WHERE id = ?
+`
+
+type SlideWebSessionParams struct {
+	LastUsedAt int64  `json:"last_used_at"`
+	ExpiresAt  int64  `json:"expires_at"`
+	ID         string `json:"id"`
+}
+
+// SlideWebSession pushes a session's sliding window forward without rotating any
+// token. Self/guest sessions use it on refresh (they have no refresh_token to
+// rotate); oidc sessions keep using RotateWebSession.
+func (q *Queries) SlideWebSession(ctx context.Context, arg SlideWebSessionParams) error {
+	_, err := q.db.ExecContext(ctx, slideWebSession, arg.LastUsedAt, arg.ExpiresAt, arg.ID)
+	return err
+}