Files
Commilitia-Drop/internal/db/clipboard.sql.go
T
admin 90a3790a98 扫码登录:cdrop 自签会话原语 + 薄账户层 + 受限访客 + 2FA step-up
身份仍源自 OAuth provider(user_id = OIDC sub),cdrop 在其上自维护一薄层:
自签会话令牌 + accounts 表,并新增扫码快速登录。实施蓝本见 AUTH.md。

后端 · 自签会话原语
- web_sessions 加 kind/scope/granted_by 列(bootstrap 幂等迁移);既有 oidc
  会话行为不变,新增 self(滑动续期)/ guest(受限·不续)两类
- cdrop 自签 HS256 会话 access token,密钥派生自 SESSION_SECRET,与落盘 AES、
  shortcut HS256 三密钥域隔离;jwtauth.verifySelfToken 无状态校验、靠 typ 区分
- requireFullSession 守卫:guest 会话不得改账号 / 再批准设备 / 签长效 token
- /auth/refresh 按 kind 分流:self/guest 纯自签、不触 IdP

后端 · 扫码登录(internal/httpapi/qr.go)
- qr/start・status・request・approve・deny 五端点 + login_requests 表 + reaper
- 三密钥分离:QR 仅含批准信息,会话只投递给持私有 poll_secret 的原设备
  (偷拍 QR 者无 poll_secret 领不到会话、未登录批不了准)
- 会话在新设备侧领取(cookie 不经手机)、单次消费、短 TTL

后端 · 薄账户层与 2FA step-up
- accounts 表(键 sub,不含任何凭证):exchange/refresh upsert match_key /
  显示名 / 头像 / roles,供显示与未来管理员开启迁移标记时跨源关联
- step-up(默认关):开启后 qr/approve 要求新鲜 prompt=login 授权码,后端就地
  换 id_token、JWKS 验签 + auth_time 窗口 + sub 匹配,provider 2FA 于此往返强制

前端(web/)
- 显码页 /link/new + 批准页 /link + net/qr.ts,对齐 Theme B、复用 AuthShell
  与聚珍排版管线、零新全局样式
- step-up 再认证流:批准前跑 prompt=login PKCE,回调分叉(不消费一次性 code、
  独立 state key)后带 step_up_code/verifier 调 approve
- 三语 i18n qr.*;新增 qrcode 依赖

修复 · clipboard sweeper(早已提交的损坏)
- ClearExpiredClipboards 因 clipboard.sql 全角注释触发 sqlc 1.31 多字节偏移
  bug,生成 SQL 被截断为「UPDATE clipboard_state SET content =」,sweeper 运行
  期报「incomplete input」、过期剪贴板内容从未清除(短 TTL 暴露保护失效)
- 注释改纯 ASCII 并加 bug 警告,重生成得完整 SQL;prod 已验证 sweeper 由 ERROR
  转为正常清理(cleared count=1)

构建
- .dockerignore:排除本地 node_modules 等,避免宿主原生二进制污染镜像内 vite 构建
- Dockerfile.base:GOPROXY 改为可经 --build-arg 覆盖(默认仍官方代理,受限网络
  构建时传区域镜像即可,仓库不固化区域值)

文档
- 新增 AUTH.md(账户与登录实施蓝本);README 特性;.env.example /
  compose.snippet 增配置项(QR / 自签会话 TTL / step-up / match_claim)

测试
- 自签 token 密钥域隔离、扫码端到端(领取 / 单次 / poll_secret 校验 / deny /
  step-up 门)、extractIdentity、web_sessions 升级迁移
2026-06-21 22:43:36 +08:00

94 lines
2.9 KiB
Go

// Code generated by sqlc. DO NOT EDIT.
// versions:
// sqlc v1.31.1
// source: clipboard.sql
package db
import (
"context"
)
const clearExpiredClipboards = `-- name: ClearExpiredClipboards :execrows
UPDATE clipboard_state
SET content = NULL, source_device = NULL
WHERE content IS NOT NULL AND updated_at < ?
`
// ClearExpiredClipboards empties content older than the cutoff (content /
// source_device set NULL) for the short-TTL exposure limit; the row is kept.
// Called periodically by the clipboard sweeper.
//
// ASCII only: sqlc 1.31.x miscomputes byte offsets on multibyte comments and
// truncates the generated SQL const. This query was silently cut to "SET content ="
// (the sweeper then failed at runtime with "incomplete input"). Keep ASCII.
func (q *Queries) ClearExpiredClipboards(ctx context.Context, updatedAt int64) (int64, error) {
result, err := q.db.ExecContext(ctx, clearExpiredClipboards, updatedAt)
if err != nil {
return 0, err
}
return result.RowsAffected()
}
const getClipboard = `-- name: GetClipboard :one
SELECT user_id, content_type, content, source_device, updated_at, version, origin_ts
FROM clipboard_state
WHERE user_id = ?
`
func (q *Queries) GetClipboard(ctx context.Context, userID string) (ClipboardState, error) {
row := q.db.QueryRowContext(ctx, getClipboard, userID)
var i ClipboardState
err := row.Scan(
&i.UserID,
&i.ContentType,
&i.Content,
&i.SourceDevice,
&i.UpdatedAt,
&i.Version,
&i.OriginTs,
)
return i, err
}
const upsertClipboard = `-- name: UpsertClipboard :one
INSERT INTO clipboard_state (user_id, content_type, content, source_device, updated_at, version, origin_ts)
VALUES (?, ?, ?, ?, ?, 1, ?)
ON CONFLICT (user_id) DO UPDATE SET
content_type = excluded.content_type,
content = excluded.content,
source_device = excluded.source_device,
updated_at = excluded.updated_at,
version = clipboard_state.version + 1,
origin_ts = excluded.origin_ts
WHERE excluded.origin_ts > clipboard_state.origin_ts
RETURNING version
`
type UpsertClipboardParams struct {
UserID string `json:"user_id"`
ContentType string `json:"content_type"`
Content *string `json:"content"`
SourceDevice *string `json:"source_device"`
UpdatedAt int64 `json:"updated_at"`
OriginTs int64 `json:"origin_ts"`
}
// New rows start version 1; conflicts bump version by 1 (per-user monotonic).
// LWW: the DO UPDATE only runs when the new origin_ts is strictly greater than
// the stored one, so a delayed / out-of-order older copy changes nothing and
// RETURNING yields no row (the service reads sql.ErrNoRows as "stale, rejected").
func (q *Queries) UpsertClipboard(ctx context.Context, arg UpsertClipboardParams) (int64, error) {
row := q.db.QueryRowContext(ctx, upsertClipboard,
arg.UserID,
arg.ContentType,
arg.Content,
arg.SourceDevice,
arg.UpdatedAt,
arg.OriginTs,
)
var version int64
err := row.Scan(&version)
return version, err
}