feat: 统一 Commilitia Drop 全客户端命名与分发

internal/jwtauth/claims.go

@@ -15,7 +15,7 @@ type Claims struct {
 	Avatar string   // X-Auth-Avatar (profile picture URL from the broker account); may be empty
 	Groups []string // X-Auth-Roles, comma-split
 	// Scope is the raw X-Auth-Scope: a global SSO user is "full"; a cdrop delegated
-	// session is "app:cdrop:<tier>". Tier() reads the capability grade off the end.
+	// session is "app:commilitia-drop:<tier>". Tier() reads the capability grade off the end.
 	Scope string
 	// DeviceID is X-Auth-Meta: the cdrop device_id this session was minted for — the
 	// join key to the devices row. Empty for an unmanaged caller (e.g. a global SSO
@@ -24,7 +24,7 @@ type Claims struct {
 }
 
 // ScopeTier returns the capability grade — the last colon-separated segment of a broker
-// scope ("app:cdrop:guest" → "guest", "full" → "full"). A tierless scope is its own tier.
+// scope ("app:commilitia-drop:guest" → "guest", "full" → "full"). A tierless scope is its own tier.
 // Shared by Claims.Tier() and the session-list overlay so the two never diverge.
 func ScopeTier(scope string) string {
 	if i := strings.LastIndex(scope, ":"); i >= 0 {

internal/jwtauth/middleware.go

@@ -150,7 +150,7 @@ func bearerToken(r *http.Request) (string, bool) {
 
 func unauthorized(w http.ResponseWriter, reason string) {
 	w.Header().Set("Content-Type", "application/json; charset=utf-8")
-	w.Header().Set("WWW-Authenticate", `Bearer realm="cdrop"`)
+	w.Header().Set("WWW-Authenticate", `Bearer realm="Commilitia Drop"`)
 	w.WriteHeader(http.StatusUnauthorized)
 	_ = json.NewEncoder(w).Encode(map[string]string{
 		"error":  "unauthorized",

internal/jwtauth/middleware_test.go

@@ -38,7 +38,7 @@ func TestMiddleware_ProdReadsAuthHeaders(t *testing.T) {
 	a := New(&config.Config{AuthMode: "prod"}, &fakeDeviceStore{})
 	r := httptest.NewRequest(http.MethodGet, "/api/me", nil)
 	r.Header.Set("X-Auth-Subject", "user-1")
-	r.Header.Set("X-Auth-Scope", "app:cdrop:guest")
+	r.Header.Set("X-Auth-Scope", "app:commilitia-drop:guest")
 	r.Header.Set("X-Auth-Meta", "dev_abc")
 	r.Header.Set("X-Auth-Name", "Alice")
 	r.Header.Set("X-Auth-Roles", "admin, user")
@@ -54,7 +54,7 @@ func TestMiddleware_ProdReadsAuthHeaders(t *testing.T) {
 		t.Errorf("claims wrong: %+v", c)
 	}
 	if !c.Guest() {
-		t.Error("app:cdrop:guest scope should mark Guest()")
+		t.Error("app:commilitia-drop:guest scope should mark Guest()")
 	}
 	if len(c.Groups) != 2 || c.Groups[0] != "admin" || c.Groups[1] != "user" {
 		t.Errorf("groups: got %v", c.Groups)
@@ -78,7 +78,7 @@ func TestMiddleware_TouchesManagedDevice(t *testing.T) {
 	a := New(&config.Config{AuthMode: "prod"}, fs)
 	r := httptest.NewRequest(http.MethodGet, "/api/me", nil)
 	r.Header.Set("X-Auth-Subject", "user-1")
-	r.Header.Set("X-Auth-Scope", "app:cdrop:full")
+	r.Header.Set("X-Auth-Scope", "app:commilitia-drop:full")
 	r.Header.Set("X-Auth-Meta", "dev_x")
 	runMiddleware(a, r)
 	if len(fs.touched) != 1 {
@@ -133,10 +133,10 @@ func TestClaimsTier(t *testing.T) {
 		tier  string
 		guest bool
 	}{
-		{"app:cdrop:guest", "guest", true},
-		{"app:cdrop:full", "full", false},
+		{"app:commilitia-drop:guest", "guest", true},
+		{"app:commilitia-drop:full", "full", false},
 		{"full", "full", false},
-		{"app:cdrop", "cdrop", false},
+		{"app:commilitia-drop", "commilitia-drop", false},
 		{"", "", false},
 	}
 	for _, tc := range cases {