Files
admin 10cf36ecee 鉴权并入 Auth Broker:委派设备会话统一模型 + 四端迁移
后端(委托 Auth Broker,路径 A):
- 删自建鉴权(OIDC exchange / 自签会话 / step-up / shortcut / web_sessions / accounts),cdrop 不再存任何凭证;鉴权中间件改读边缘注入的 X-Auth-Subject/Scope/Meta/Name/Roles 头(dev 旁路保留);Claims 加 Tier() / Guest()
- internal/brokerclient:mint / revoke(带 X-Broker-App)/ refresh / ListSessions(R1 列举),直连内网、吊销幂等

统一会话模型“委派设备会话”(Delegated Device Sessions):
- 每个客户端(浏览器 / 桌面 / 扫码设备)=一条带 meta(device_id) + label 的 broker 机器会话;Broker 作设备会话唯一注册表(R1 按用户+app 列举 + R2 按 (user,app,meta) 幂等铸造),cdrop 退化为薄覆盖层、不再自存权威会话表
- 新增代铸端点 POST /api/auth/device-session:凭边缘已验明的 X-Auth-Subject 委托 broker 铸 / 轮换设备会话(meta=device_id、按调用方 tier 防越权、sameOrigin CSRF、per-IP 限流);R2 幂等保证同一 device_id 重登原地轮换、不堆重复设备
- 会话列表=R1 权威 + 叠加 type(本地缓存)/ online(Hub presence,按设备名)/ current(meta 匹配本请求 X-Auth-Meta)+ 过滤 meta=""(device-authorize 引导会话残留);devices 表降级为 type/presence 薄缓存(非会话权威),device_id 主键、upsert 按 user 限定
- 吊销按 device_id → 缓存优先 / R1 兜底解析 sid → broker 吊销 + X-Broker-App;扫码登录保留三密钥编排,collect 改委托 broker 铸 + 落缓存行

Web 前端:
- 登录走 broker 全局 SSO 代跳(/api/auth/login 302);bootstrap 经 /api/me 注入身份后代铸设备会话(稳定 device_id 存 localStorage、Web Locks 跨 tab 串行防重复铸造);refresh 走 /api/auth/refresh
- 设备管理按 device_id;改名=同 device_id 重代铸(R2 原地轮换换 label、不产生重复行);登录页反应式守卫修登录回环
- 去 OIDC PKCE / step-up(删 oauth.callback / stepUp)

桌面客户端(Wails):
- loopback PKCE(RFC 8252)改指 broker 设备授权流(/device/authorize + /device/token)拿引导令牌,再代铸出带 meta 的托管设备会话——与浏览器同模型、同管理、同吊销;身份取自代铸响应(修“显示名显示为 UUID”);refresh 保留显示名;稳定 device_id 入桌面配置

iOS 客户端(arch A,原生 SwiftUI + 离屏无头 WebView 引擎 + 原生↔JS 桥):
- 引擎 / 文件管理 / 设备管理 / 应用图标 / 本地化(此前实现,随本次落入版本库)
- 鉴权=引擎自刷(boot 注入 refresh_token)+ broker 轮换经 sessionRotated 回报原生更新 Keychain;去 cookie 同步;Session 加 refreshToken / deviceId

实时 / 健壮性:
- presence 走 Hub union(设备表行 ∪ 表外实时连接,按名去重、live-only 标在线)
- Hub 通道 close 一律在写锁内、非阻塞 send 一律在读锁内,消除 close-vs-send 闭通道 send panic(revoke 每次 Kick 后该路径变热)

配置 / 删旧栈:
- config 改 broker 接入(CDROP_BROKER_* / CDROP_PUBLIC_URL / 按档 TTL),prod 强校验 broker 配置 + PUBLIC_URL(CSRF Origin 守卫不失效)
- 删 auth.go / selftoken.go / shortcut.go / jwks.go + 三表(web_sessions / accounts / shortcut_tokens)及验证链;.env.example / compose.snippet.yaml / Caddyfile.snippet 更新为 broker 模型(人机分流 + 公开端点放行 + X-Auth-Meta 透传)
- 测试全重写:QR / 会话含 mock broker(R1 列举 + R2 幂等);hub 加 close-vs-send 并发回归;config 加 prod 必填校验
2026-06-26 22:10:19 +08:00

195 lines
5.3 KiB
Go

// Code generated by sqlc. DO NOT EDIT.
// versions:
// sqlc v1.31.1
// source: devices.sql
package db
import (
"context"
)
const createDevice = `-- name: CreateDevice :exec
INSERT INTO devices (device_id, user_id, name, type, tier, broker_sid, created_at, last_seen)
VALUES (?, ?, ?, ?, ?, ?, ?, ?)
ON CONFLICT (device_id) DO UPDATE SET
name = excluded.name,
type = excluded.type,
tier = excluded.tier,
broker_sid = excluded.broker_sid,
last_seen = excluded.last_seen
WHERE devices.user_id = excluded.user_id
`
type CreateDeviceParams struct {
DeviceID string `json:"device_id"`
UserID string `json:"user_id"`
Name string `json:"name"`
Type string `json:"type"`
Tier string `json:"tier"`
BrokerSid string `json:"broker_sid"`
CreatedAt int64 `json:"created_at"`
LastSeen int64 `json:"last_seen"`
}
// devices: cdrop-managed devices (scan-login / native pairing). device_id is a
// stable opaque cdrop-generated id that doubles as the session<->device join key
// (passed to the broker as meta, echoed back as X-Auth-Meta on /verify). broker_sid
// is the broker's session id, stored privately to revoke on device removal. tier is
// a redundant cache of the broker scope (full/guest). name is human-readable and can
// change without changing the device's identity (device_id is the key).
//
// ASCII only: sqlc 1.31.x miscomputes byte offsets on multibyte comments and corrupts
// every generated SQL const in the file. Keep this file pure ASCII.
// CreateDevice records a device on scan-login collect / proxy-mint (or native pairing). Keyed
// on device_id, so a re-pair with the same id refreshes the row (incl. the new broker_sid).
// The WHERE on the upsert scopes the update to the owning user so a (cryptographically
// impossible) cross-user device_id collision can never reassign the row owner; user_id is
// immutable for a given device_id.
func (q *Queries) CreateDevice(ctx context.Context, arg CreateDeviceParams) error {
_, err := q.db.ExecContext(ctx, createDevice,
arg.DeviceID,
arg.UserID,
arg.Name,
arg.Type,
arg.Tier,
arg.BrokerSid,
arg.CreatedAt,
arg.LastSeen,
)
return err
}
const deleteDevice = `-- name: DeleteDevice :execrows
DELETE FROM devices
WHERE device_id = ? AND user_id = ?
`
type DeleteDeviceParams struct {
DeviceID string `json:"device_id"`
UserID string `json:"user_id"`
}
func (q *Queries) DeleteDevice(ctx context.Context, arg DeleteDeviceParams) (int64, error) {
result, err := q.db.ExecContext(ctx, deleteDevice, arg.DeviceID, arg.UserID)
if err != nil {
return 0, err
}
return result.RowsAffected()
}
const deleteStaleDevices = `-- name: DeleteStaleDevices :exec
DELETE FROM devices
WHERE last_seen < ?
`
func (q *Queries) DeleteStaleDevices(ctx context.Context, lastSeen int64) error {
_, err := q.db.ExecContext(ctx, deleteStaleDevices, lastSeen)
return err
}
const getDevice = `-- name: GetDevice :one
SELECT device_id, user_id, name, type, tier, broker_sid, created_at, last_seen
FROM devices
WHERE device_id = ?
`
func (q *Queries) GetDevice(ctx context.Context, deviceID string) (Device, error) {
row := q.db.QueryRowContext(ctx, getDevice, deviceID)
var i Device
err := row.Scan(
&i.DeviceID,
&i.UserID,
&i.Name,
&i.Type,
&i.Tier,
&i.BrokerSid,
&i.CreatedAt,
&i.LastSeen,
)
return i, err
}
const listDevicesByUser = `-- name: ListDevicesByUser :many
SELECT device_id, user_id, name, type, tier, broker_sid, created_at, last_seen
FROM devices
WHERE user_id = ?
ORDER BY name
`
func (q *Queries) ListDevicesByUser(ctx context.Context, userID string) ([]Device, error) {
rows, err := q.db.QueryContext(ctx, listDevicesByUser, userID)
if err != nil {
return nil, err
}
defer rows.Close()
var items []Device
for rows.Next() {
var i Device
if err := rows.Scan(
&i.DeviceID,
&i.UserID,
&i.Name,
&i.Type,
&i.Tier,
&i.BrokerSid,
&i.CreatedAt,
&i.LastSeen,
); err != nil {
return nil, err
}
items = append(items, i)
}
if err := rows.Close(); err != nil {
return nil, err
}
if err := rows.Err(); err != nil {
return nil, err
}
return items, nil
}
const renameDevice = `-- name: RenameDevice :execrows
UPDATE devices SET name = ?
WHERE device_id = ? AND user_id = ?
`
type RenameDeviceParams struct {
Name string `json:"name"`
DeviceID string `json:"device_id"`
UserID string `json:"user_id"`
}
func (q *Queries) RenameDevice(ctx context.Context, arg RenameDeviceParams) (int64, error) {
result, err := q.db.ExecContext(ctx, renameDevice, arg.Name, arg.DeviceID, arg.UserID)
if err != nil {
return 0, err
}
return result.RowsAffected()
}
const touchDevice = `-- name: TouchDevice :exec
UPDATE devices SET last_seen = ?, tier = ? WHERE device_id = ? AND user_id = ?
`
type TouchDeviceParams struct {
LastSeen int64 `json:"last_seen"`
Tier string `json:"tier"`
DeviceID string `json:"device_id"`
UserID string `json:"user_id"`
}
// TouchDevice refreshes last_seen + tier on each authenticated request. Update-only:
// the row is created at collect time, so a missing row (e.g. a device authorized via
// the broker's own device flow, not cdrop's) simply isn't cdrop-managed and no-ops.
func (q *Queries) TouchDevice(ctx context.Context, arg TouchDeviceParams) error {
_, err := q.db.ExecContext(ctx, touchDevice,
arg.LastSeen,
arg.Tier,
arg.DeviceID,
arg.UserID,
)
return err
}