Files
Commilitia-Drop/desktop/main.go
T
admin 10cf36ecee 鉴权并入 Auth Broker:委派设备会话统一模型 + 四端迁移
后端(委托 Auth Broker,路径 A):
- 删自建鉴权(OIDC exchange / 自签会话 / step-up / shortcut / web_sessions / accounts),cdrop 不再存任何凭证;鉴权中间件改读边缘注入的 X-Auth-Subject/Scope/Meta/Name/Roles 头(dev 旁路保留);Claims 加 Tier() / Guest()
- internal/brokerclient:mint / revoke(带 X-Broker-App)/ refresh / ListSessions(R1 列举),直连内网、吊销幂等

统一会话模型“委派设备会话”(Delegated Device Sessions):
- 每个客户端(浏览器 / 桌面 / 扫码设备)=一条带 meta(device_id) + label 的 broker 机器会话;Broker 作设备会话唯一注册表(R1 按用户+app 列举 + R2 按 (user,app,meta) 幂等铸造),cdrop 退化为薄覆盖层、不再自存权威会话表
- 新增代铸端点 POST /api/auth/device-session:凭边缘已验明的 X-Auth-Subject 委托 broker 铸 / 轮换设备会话(meta=device_id、按调用方 tier 防越权、sameOrigin CSRF、per-IP 限流);R2 幂等保证同一 device_id 重登原地轮换、不堆重复设备
- 会话列表=R1 权威 + 叠加 type(本地缓存)/ online(Hub presence,按设备名)/ current(meta 匹配本请求 X-Auth-Meta)+ 过滤 meta=""(device-authorize 引导会话残留);devices 表降级为 type/presence 薄缓存(非会话权威),device_id 主键、upsert 按 user 限定
- 吊销按 device_id → 缓存优先 / R1 兜底解析 sid → broker 吊销 + X-Broker-App;扫码登录保留三密钥编排,collect 改委托 broker 铸 + 落缓存行

Web 前端:
- 登录走 broker 全局 SSO 代跳(/api/auth/login 302);bootstrap 经 /api/me 注入身份后代铸设备会话(稳定 device_id 存 localStorage、Web Locks 跨 tab 串行防重复铸造);refresh 走 /api/auth/refresh
- 设备管理按 device_id;改名=同 device_id 重代铸(R2 原地轮换换 label、不产生重复行);登录页反应式守卫修登录回环
- 去 OIDC PKCE / step-up(删 oauth.callback / stepUp)

桌面客户端(Wails):
- loopback PKCE(RFC 8252)改指 broker 设备授权流(/device/authorize + /device/token)拿引导令牌,再代铸出带 meta 的托管设备会话——与浏览器同模型、同管理、同吊销;身份取自代铸响应(修“显示名显示为 UUID”);refresh 保留显示名;稳定 device_id 入桌面配置

iOS 客户端(arch A,原生 SwiftUI + 离屏无头 WebView 引擎 + 原生↔JS 桥):
- 引擎 / 文件管理 / 设备管理 / 应用图标 / 本地化(此前实现,随本次落入版本库)
- 鉴权=引擎自刷(boot 注入 refresh_token)+ broker 轮换经 sessionRotated 回报原生更新 Keychain;去 cookie 同步;Session 加 refreshToken / deviceId

实时 / 健壮性:
- presence 走 Hub union(设备表行 ∪ 表外实时连接,按名去重、live-only 标在线)
- Hub 通道 close 一律在写锁内、非阻塞 send 一律在读锁内,消除 close-vs-send 闭通道 send panic(revoke 每次 Kick 后该路径变热)

配置 / 删旧栈:
- config 改 broker 接入(CDROP_BROKER_* / CDROP_PUBLIC_URL / 按档 TTL),prod 强校验 broker 配置 + PUBLIC_URL(CSRF Origin 守卫不失效)
- 删 auth.go / selftoken.go / shortcut.go / jwks.go + 三表(web_sessions / accounts / shortcut_tokens)及验证链;.env.example / compose.snippet.yaml / Caddyfile.snippet 更新为 broker 模型(人机分流 + 公开端点放行 + X-Auth-Meta 透传)
- 测试全重写:QR / 会话含 mock broker(R1 列举 + R2 幂等);hub 加 close-vs-send 并发回归;config 加 prod 必填校验
2026-06-26 22:10:19 +08:00

104 lines
3.5 KiB
Go

package main
import (
"embed"
"os"
"runtime"
"github.com/wailsapp/wails/v2"
"github.com/wailsapp/wails/v2/pkg/options"
"github.com/wailsapp/wails/v2/pkg/options/assetserver"
"cdrop-desktop/platform"
)
//go:embed all:frontend/dist
var assets embed.FS
func main() {
// Create an instance of the app structure
app := NewApp()
// Reverse-proxy /api/* to the backend so the embedded web UI can keep its
// same-origin relative URLs (see platform.NewAPIProxy). SSE streams through.
apiProxy, err := platform.NewAPIProxy(app.apiBase)
if err != nil {
println("Error:", err.Error())
return
}
// Windows: Wails' custom-scheme AssetServer buffers a handler's response until
// it returns, so the long-lived SSE never reaches the WebView (device list
// never loads, status stuck on "connecting"). Serve /api from a loopback HTTP
// origin instead — WebView2's normal network stack streams it — and point the
// page there via the injected api_base. macOS streams the custom scheme fine,
// so it keeps api_base="" (same-origin relative /api through apiProxy).
webAPIBase := ""
if runtime.GOOS == "windows" {
if base, lerr := platform.StartLocalAPIServer(app.apiBase); lerr == nil {
webAPIBase = base
} else {
println("local api server:", lerr.Error())
}
}
// Tell the backend this is a native desktop client, not a browser, so the
// device list shows the right kind. The page forwards it as X-Device-Type.
deviceType := platform.DeviceType()
// Restore the persisted login + device name by injecting them into index.html
// at load — the wails:// scheme has no persistent WebView storage (see
// session.go).
session, _ := platform.LoadSession()
// Heal a stale display identity (older builds baked the subject UUID and no avatar into
// the on-disk session) from the authoritative /api/me, and re-persist, BEFORE injecting it
// — so the name + picture are correct on every launch instead of depending on a fragile
// per-launch WebView /api/me (the source of the intermittent UUID regression). Bounded +
// best-effort: offline keeps the persisted identity.
session = platform.HealIdentity(session, app.apiBase)
// When the OS starts us at login, the autostart entry appends a --hidden flag
// (see SetLaunchAtLogin). Come up straight to the menu bar / tray with no
// window — the user didn't open the app, so don't steal focus. The frontend
// still loads, so clipboard sync runs in the background. A manual launch has
// no flag and shows the window as usual.
hidden := launchedHidden()
app.startHidden = hidden
// Create application with options
err = wails.Run(&options.App{
Title: "cdrop",
Width: 1024,
Height: 768,
StartHidden: hidden,
AssetServer: &assetserver.Options{
Assets: assets,
Handler: apiProxy,
Middleware: platform.SessionInjectMiddleware(session, platform.ResolveDeviceName(), webAPIBase, deviceType),
},
BackgroundColour: &options.RGBA{R: 27, G: 38, B: 54, A: 1},
Menu: app.buildMenu(),
OnStartup: app.startup,
OnBeforeClose: app.beforeClose,
Bind: []interface{}{
app,
},
})
if err != nil {
println("Error:", err.Error())
}
}
// launchedHidden reports whether this process was started by the login autostart
// entry, which appends a --hidden flag to the launch command (see
// SetLaunchAtLogin on each platform). Manual launches never carry it.
func launchedHidden() bool {
for _, arg := range os.Args[1:] {
if arg == "--hidden" {
return true
}
}
return false
}