018a77b13a
接续 90a3790(扫码 A0+A1+B + step-up 雏形)。蓝本见 AUTH.md。
OIDC 统一到 cdrop 自签 token
- /auth/exchange 先 JWKS 验 id_token 签名(自签 token 的唯一信任锚)再签 cdrop
自签 HS256 access token(绑 sid),不再把 IdP RS256 下发浏览器;验签失败仅告警
并回退 RS256(会话仍建、下次 refresh 自愈),登录不中断
- /auth/refresh oidc 路径仍打 IdP 轮换 refresh_token + 探测 IdP 侧吊销,但同样回
自签 token;createWebSession 改返回行 id
- verify 链保留 RS256 分支仅供桌面端 loopback(其即时吊销留后续)
吊销即时生效 + 被吊销设备自知回退
- verifySelfToken 每请求按 sid 查 web_sessions 行,行删即拒 → 吊销在被吊销设备
下一次请求即生效(不等 TTL),oidc / self / guest 一致
- 前端仅在「服务端以 401 确证会话失效」时 forceLogout 清登录态、回登录页;短期连接
失败(5xx / 网络)一律保留登录态(refreshTokens 改三态 refreshed/invalid/transient,
cookieRefresh 改 discriminated 结果)
- __root 反应式守卫:prod 下失登录态且非认证路由即跳登录页;新增 auth.sessionLost.* 三语
设备列表并入会话列表 + 孤儿自动清除
- GET /api/auth/sessions 统一 web_sessions 与原生客户端设备(桌面 / iOS,自 devices
登记表呈现,native=true,离线也列);同名不重复列出,排除 shortcut 与无会话 browser
- 吊销网页会话连带删其设备登记(无同名在用会话时);原生「登出」走
DELETE /api/devices/{name}(同要求 step-up)
- 新增 DeleteOrphanBrowserDevices(browser 型且无存活 web_session),接入设备清扫器(1h)
应用内扫码 + 聚珍崩溃 / CJK 禁则修复
- 登录页内置 getUserMedia + jsqr 扫码,不再外跳系统应用(避免开错浏览器)
- 修聚珍(cjk-autospace)MutationObserver 与 React 重渲染同子树冲突致的 insertBefore
崩溃:扫码 / 显码 / 批准三状态机页整页跳过聚珍(data-jz-skip)
- 修流动正文未跑 CJK 禁则(jinze 为段落级、须 opt-in):设置 / 快捷指令 / 桌面页一批
hint 补 data-jz-level="paragraph" + justify,短标签 / 状态仍留文本级
step-up 完善
- auth_time 改可选(Casdoor 不下发,原强制致死循环);stepped_up_at 按会话绑定、
StepUpMaxAgeSeconds 窗口内不复要求;新增 POST /api/auth/stepup
- 批准页 persist 编进 step-up returnTo 防整页跳转丢失;scope 随档绑定(信任=full /
仅此次=guest),默认偏安全的「仅此次」
文档与测试
- AUTH.md:折中架构、accounts 薄表、令牌架构、扫码流程、step-up、§4.4 统一会话列表
- 新增 Go 测试:OIDC 自签验证、verifySelfToken 吊销即拒、会话吊销连带删设备、
统一会话列表(含原生 / 不含 shortcut / 不重复)、孤儿清扫、删设备需 step-up
122 lines
2.9 KiB
Go
122 lines
2.9 KiB
Go
// Code generated by sqlc. DO NOT EDIT.
|
|
// versions:
|
|
// sqlc v1.31.1
|
|
// source: devices.sql
|
|
|
|
package db
|
|
|
|
import (
|
|
"context"
|
|
)
|
|
|
|
const deleteDevice = `-- name: DeleteDevice :execrows
|
|
DELETE FROM devices
|
|
WHERE user_id = ? AND name = ?
|
|
`
|
|
|
|
type DeleteDeviceParams struct {
|
|
UserID string `json:"user_id"`
|
|
Name string `json:"name"`
|
|
}
|
|
|
|
func (q *Queries) DeleteDevice(ctx context.Context, arg DeleteDeviceParams) (int64, error) {
|
|
result, err := q.db.ExecContext(ctx, deleteDevice, arg.UserID, arg.Name)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
return result.RowsAffected()
|
|
}
|
|
|
|
const deleteOrphanBrowserDevices = `-- name: DeleteOrphanBrowserDevices :execrows
|
|
DELETE FROM devices
|
|
WHERE type = 'browser'
|
|
AND NOT EXISTS (
|
|
SELECT 1 FROM web_sessions ws
|
|
WHERE ws.user_id = devices.user_id
|
|
AND ws.device_name = devices.name
|
|
AND ws.expires_at > ?
|
|
)
|
|
`
|
|
|
|
// DeleteOrphanBrowserDevices removes browser device rows with no live web_session
|
|
// (the session was revoked or expired), keeping the device list aligned with the
|
|
// session list. The ? is the current epoch second. Native (macos/windows/linux/ios)
|
|
// and shortcut devices are left alone: they legitimately keep no web_session.
|
|
func (q *Queries) DeleteOrphanBrowserDevices(ctx context.Context, expiresAt int64) (int64, error) {
|
|
result, err := q.db.ExecContext(ctx, deleteOrphanBrowserDevices, expiresAt)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
return result.RowsAffected()
|
|
}
|
|
|
|
const deleteStaleDevices = `-- name: DeleteStaleDevices :exec
|
|
DELETE FROM devices
|
|
WHERE last_seen < ?
|
|
`
|
|
|
|
func (q *Queries) DeleteStaleDevices(ctx context.Context, lastSeen int64) error {
|
|
_, err := q.db.ExecContext(ctx, deleteStaleDevices, lastSeen)
|
|
return err
|
|
}
|
|
|
|
const listDevicesByUser = `-- name: ListDevicesByUser :many
|
|
SELECT user_id, name, type, last_seen
|
|
FROM devices
|
|
WHERE user_id = ?
|
|
ORDER BY name
|
|
`
|
|
|
|
func (q *Queries) ListDevicesByUser(ctx context.Context, userID string) ([]Device, error) {
|
|
rows, err := q.db.QueryContext(ctx, listDevicesByUser, userID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
var items []Device
|
|
for rows.Next() {
|
|
var i Device
|
|
if err := rows.Scan(
|
|
&i.UserID,
|
|
&i.Name,
|
|
&i.Type,
|
|
&i.LastSeen,
|
|
); err != nil {
|
|
return nil, err
|
|
}
|
|
items = append(items, i)
|
|
}
|
|
if err := rows.Close(); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := rows.Err(); err != nil {
|
|
return nil, err
|
|
}
|
|
return items, nil
|
|
}
|
|
|
|
const upsertDevice = `-- name: UpsertDevice :exec
|
|
INSERT INTO devices (user_id, name, type, last_seen)
|
|
VALUES (?, ?, ?, ?)
|
|
ON CONFLICT (user_id, name) DO UPDATE SET
|
|
type = excluded.type,
|
|
last_seen = excluded.last_seen
|
|
`
|
|
|
|
type UpsertDeviceParams struct {
|
|
UserID string `json:"user_id"`
|
|
Name string `json:"name"`
|
|
Type string `json:"type"`
|
|
LastSeen int64 `json:"last_seen"`
|
|
}
|
|
|
|
func (q *Queries) UpsertDevice(ctx context.Context, arg UpsertDeviceParams) error {
|
|
_, err := q.db.ExecContext(ctx, upsertDevice,
|
|
arg.UserID,
|
|
arg.Name,
|
|
arg.Type,
|
|
arg.LastSeen,
|
|
)
|
|
return err
|
|
}
|