admin
018a77b13a
接续 90a3790（扫码 A0+A1+B + step-up 雏形）。蓝本见 AUTH.md。
OIDC 统一到 cdrop 自签 token
- /auth/exchange 先 JWKS 验 id_token 签名（自签 token 的唯一信任锚）再签 cdrop
自签 HS256 access token（绑 sid），不再把 IdP RS256 下发浏览器；验签失败仅告警
并回退 RS256（会话仍建、下次 refresh 自愈），登录不中断
- /auth/refresh oidc 路径仍打 IdP 轮换 refresh_token + 探测 IdP 侧吊销，但同样回
自签 token；createWebSession 改返回行 id
- verify 链保留 RS256 分支仅供桌面端 loopback（其即时吊销留后续）
吊销即时生效 + 被吊销设备自知回退
- verifySelfToken 每请求按 sid 查 web_sessions 行，行删即拒 → 吊销在被吊销设备
下一次请求即生效（不等 TTL），oidc / self / guest 一致
- 前端仅在「服务端以 401 确证会话失效」时 forceLogout 清登录态、回登录页；短期连接
失败（5xx / 网络）一律保留登录态（refreshTokens 改三态 refreshed/invalid/transient，
cookieRefresh 改 discriminated 结果）
- __root 反应式守卫：prod 下失登录态且非认证路由即跳登录页；新增 auth.sessionLost.* 三语
设备列表并入会话列表 + 孤儿自动清除
- GET /api/auth/sessions 统一 web_sessions 与原生客户端设备（桌面 / iOS，自 devices
登记表呈现，native=true，离线也列）；同名不重复列出，排除 shortcut 与无会话 browser
- 吊销网页会话连带删其设备登记（无同名在用会话时）；原生「登出」走
DELETE /api/devices/{name}（同要求 step-up）
- 新增 DeleteOrphanBrowserDevices（browser 型且无存活 web_session），接入设备清扫器（1h）
应用内扫码 + 聚珍崩溃 / CJK 禁则修复
- 登录页内置 getUserMedia + jsqr 扫码，不再外跳系统应用（避免开错浏览器）
- 修聚珍（cjk-autospace）MutationObserver 与 React 重渲染同子树冲突致的 insertBefore
崩溃：扫码 / 显码 / 批准三状态机页整页跳过聚珍（data-jz-skip）
- 修流动正文未跑 CJK 禁则（jinze 为段落级、须 opt-in）：设置 / 快捷指令 / 桌面页一批
hint 补 data-jz-level="paragraph" + justify，短标签 / 状态仍留文本级
step-up 完善
- auth_time 改可选（Casdoor 不下发，原强制致死循环）；stepped_up_at 按会话绑定、
StepUpMaxAgeSeconds 窗口内不复要求；新增 POST /api/auth/stepup
- 批准页 persist 编进 step-up returnTo 防整页跳转丢失；scope 随档绑定（信任=full /
仅此次=guest），默认偏安全的「仅此次」
文档与测试
- AUTH.md：折中架构、accounts 薄表、令牌架构、扫码流程、step-up、§4.4 统一会话列表
- 新增 Go 测试：OIDC 自签验证、verifySelfToken 吊销即拒、会话吊销连带删设备、
统一会话列表（含原生 / 不含 shortcut / 不重复）、孤儿清扫、删设备需 step-up
70 lines
2.7 KiB
SQL
70 lines
2.7 KiB
SQL
-- web_sessions: browser "passwordless re-login". The opaque cookie token is
|
|
-- never stored; id holds its SHA-256, so a DB leak yields no usable cookie.
|
|
-- refresh_token is AES-256-GCM ciphertext (key lives in the container env, not
|
|
-- the DB). 7-day sliding window: every refresh rotates the token and pushes
|
|
-- expires_at forward; idle sessions are reaped by DeleteExpiredWebSessions.
|
|
|
|
-- name: CreateWebSession :exec
|
|
INSERT INTO web_sessions (id, user_id, refresh_token, device_name, user_agent, created_at, last_used_at, expires_at)
|
|
VALUES (?, ?, ?, ?, ?, ?, ?, ?);
|
|
|
|
-- name: GetWebSession :one
|
|
SELECT id, user_id, refresh_token, device_name, user_agent, created_at, last_used_at, expires_at, kind, scope, granted_by, stepped_up_at
|
|
FROM web_sessions
|
|
WHERE id = ?;
|
|
|
|
-- SetSessionSteppedUp stamps the moment this session last passed step-up re-auth;
|
|
-- sensitive actions within the freshness window then skip re-auth (AUTH.md 6).
|
|
-- name: SetSessionSteppedUp :exec
|
|
UPDATE web_sessions
|
|
SET stepped_up_at = ?
|
|
WHERE id = ?;
|
|
|
|
-- name: RotateWebSession :exec
|
|
UPDATE web_sessions
|
|
SET refresh_token = ?, last_used_at = ?, expires_at = ?
|
|
WHERE id = ?;
|
|
|
|
-- name: SetWebSessionDevice :exec
|
|
UPDATE web_sessions
|
|
SET device_name = ?
|
|
WHERE id = ?;
|
|
|
|
-- name: DeleteWebSession :exec
|
|
DELETE FROM web_sessions
|
|
WHERE id = ?;
|
|
|
|
-- name: DeleteExpiredWebSessions :execrows
|
|
DELETE FROM web_sessions
|
|
WHERE expires_at < ?;
|
|
|
|
-- CreateSelfSession inserts a cdrop self-signed session (kind self/guest) that has
|
|
-- no IdP refresh_token (stored empty): refresh mints a fresh access token straight
|
|
-- from this row without touching the IdP. Used by QR scan-login (AUTH.md 4).
|
|
-- name: CreateSelfSession :exec
|
|
INSERT INTO web_sessions (id, user_id, refresh_token, device_name, user_agent, kind, scope, granted_by, created_at, last_used_at, expires_at)
|
|
VALUES (?, ?, '', ?, ?, ?, ?, ?, ?, ?, ?);
|
|
|
|
-- SlideWebSession pushes a session's sliding window forward without rotating any
|
|
-- token. Self/guest sessions use it on refresh (they have no refresh_token to
|
|
-- rotate); oidc sessions keep using RotateWebSession.
|
|
-- name: SlideWebSession :exec
|
|
UPDATE web_sessions
|
|
SET last_used_at = ?, expires_at = ?
|
|
WHERE id = ?;
|
|
|
|
-- ListWebSessionsByUser lists a user's sessions for the management UI (revoke
|
|
-- borrowed / guest devices). granted_by ties a scan-approved session to its
|
|
-- approver for cascade revocation.
|
|
-- name: ListWebSessionsByUser :many
|
|
SELECT id, user_id, device_name, user_agent, created_at, last_used_at, expires_at, kind, scope, granted_by
|
|
FROM web_sessions
|
|
WHERE user_id = ?
|
|
ORDER BY last_used_at DESC;
|
|
|
|
-- DeleteWebSessionForUser drops one session scoped to its owner, so a user can
|
|
-- only revoke their own.
|
|
-- name: DeleteWebSessionForUser :execrows
|
|
DELETE FROM web_sessions
|
|
WHERE id = ? AND user_id = ?;
|