docs: record ZYT IAM integration evidence
This commit is contained in:
+11392
File diff suppressed because one or more lines are too long
@@ -0,0 +1,7 @@
|
||||
object=zyt admin IAM Hub adapter
|
||||
changed_scope=staff/admin OIDC Authorization Code plus PKCE/state/nonce/JWT validation; IAM lazy provisioning and server binding; one-time local session exchange; centralized HMAC revocation; local password lockout; admin login UI and tracked production bundle
|
||||
branch=master
|
||||
original_commit=cf3fbdc5ef5799d8abc7e6c1a650612e40ab441b
|
||||
modified_commit=bd0a3d3b961a8cd683828e908c9281099b527304
|
||||
modified_content_sha256=0f0e168a972f2f7cea93ddb23b1da3f71812c00257216dee476b28d68c61ff5e
|
||||
runtime_test=http://localhost:18081
|
||||
Executable
+19
@@ -0,0 +1,19 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
TARGET=${1:-}
|
||||
CONFIRM=${2:-}
|
||||
ORIGINAL=cf3fbdc5ef5799d8abc7e6c1a650612e40ab441b
|
||||
if [[ -z "$TARGET" || "$CONFIRM" != "--confirm-original" ]]; then
|
||||
echo "usage: $0 TARGET --confirm-original" >&2
|
||||
exit 2
|
||||
fi
|
||||
if [[ ! -d "$TARGET/.git" ]]; then
|
||||
echo "target is not a git checkout" >&2
|
||||
exit 3
|
||||
fi
|
||||
git -C "$TARGET" reset --hard "$ORIGINAL" >/dev/null
|
||||
git -C "$TARGET" clean -fdx >/dev/null
|
||||
echo ROLLBACK_ORIGINAL_COMMIT_RESTORED
|
||||
echo ROLLBACK_HEAD=$(git -C "$TARGET" rev-parse HEAD)
|
||||
test -z "$(git -C "$TARGET" status --porcelain)"
|
||||
echo ROLLBACK_WORKTREE=CLEAN
|
||||
@@ -0,0 +1,101 @@
|
||||
ZYT IAM HUB ADMIN ADAPTER VERIFICATION
|
||||
CHANGED_BRANCH=master
|
||||
CHANGED_FIELD=zyt_admin.iam_subject / iam_managed / iam_revoked_at; zyt_iam_revocation_event; OIDC PKCE/state/nonce/JWT issuer-audience-signature-at_hash validation; IAM provisioning/binding; one-time local session exchange; admin company-login UI and tracked dist
|
||||
ORIGINAL_COMMIT=cf3fbdc5ef5799d8abc7e6c1a650612e40ab441b
|
||||
MODIFIED_COMMIT=bd0a3d3b961a8cd683828e908c9281099b527304
|
||||
MODIFIED_CONTENT_SHA256=0f0e168a972f2f7cea93ddb23b1da3f71812c00257216dee476b28d68c61ff5e
|
||||
|
||||
ARTIFACTS
|
||||
MODIFIED_FILE=/Users/long/Work/zyt/artifacts/MODIFIED_FILE
|
||||
DIFF_FILE=/Users/long/Work/zyt/artifacts/DIFF_FILE
|
||||
VERIFICATION=/Users/long/Work/zyt/artifacts/VERIFICATION.txt
|
||||
ROLLBACK=/Users/long/Work/zyt/artifacts/ROLLBACK.sh
|
||||
|
||||
BASELINE
|
||||
COMMAND=php server/tests/AdminMultiRoleRegressionTest.php && php server/tests/WecomPromotionPoolOperatorContractTest.php
|
||||
INPUT=/Users/long/Work/zyt at cf3fbdc5ef5799d8abc7e6c1a650612e40ab441b before IAM adapter changes
|
||||
LITERAL_OUTPUT=AdminMultiRoleRegressionTest passed
|
||||
LITERAL_OUTPUT=WECOM_PROMOTION_POOL_OPERATOR_CONTRACT_OK
|
||||
EXIT_STATUS=0
|
||||
|
||||
MODIFIED
|
||||
COMMAND=./scripts/verify_iam_hub.sh
|
||||
INPUT=/Users/long/Work/zyt at bd0a3d3b961a8cd683828e908c9281099b527304 with rebuilt server/public/admin
|
||||
LITERAL_OUTPUT=ZYT_IAM_UNIT_CONTRACT=PASS
|
||||
LITERAL_OUTPUT=ZYT_EXISTING_AUTH_REGRESSION=PASS
|
||||
LITERAL_OUTPUT=ZYT_IAM_PHP_LINT=PASS
|
||||
LITERAL_OUTPUT=ZYT_IAM_FRONTEND_DIST=PASS
|
||||
LITERAL_OUTPUT=ZYT_IAM_MIGRATION_CONTRACT=PASS
|
||||
LITERAL_OUTPUT=ZYT_IAM_ADAPTER_VERIFIED
|
||||
EXIT_STATUS=0
|
||||
|
||||
FRONTEND_BUILD
|
||||
COMMAND=PATH="$HOME/.nvm/versions/node/v22.22.3/bin:$PATH" npm run build
|
||||
INPUT=/Users/long/Work/zyt/admin using package-lock.json dependencies
|
||||
LITERAL_OUTPUT=✓ 3871 modules transformed.
|
||||
LITERAL_OUTPUT=✓ built in 54.04s
|
||||
LITERAL_OUTPUT=文件正在复制 ==> ../server/public/admin
|
||||
LITERAL_OUTPUT=文件已复制 ==> ../server/public/admin
|
||||
EXIT_STATUS=0
|
||||
|
||||
TYPECHECK_BOUNDARY
|
||||
COMMAND=npm run type-check; search output for src/api/user.ts, src/stores/modules/user.ts and src/views/account/login.vue
|
||||
INPUT=/Users/long/Work/zyt/admin
|
||||
LITERAL_OUTPUT=TYPECHECK_EXIT_STATUS=2
|
||||
LITERAL_OUTPUT=CHANGED_FILE_TYPE_ERRORS=NONE
|
||||
LITERAL_OUTPUT=BASELINE_ERROR_COUNT=60
|
||||
EXIT_STATUS=0
|
||||
RESULT=the repository-wide Vue typecheck retains 60 existing errors outside the IAM files; all changed IAM frontend paths are absent from the error output and the production build succeeds.
|
||||
|
||||
ESLINT_BOUNDARY
|
||||
COMMAND=ESLINT_USE_FLAT_CONFIG=false ./node_modules/.bin/eslint src/api/user.ts src/stores/modules/user.ts src/views/account/login.vue
|
||||
INPUT=/Users/long/Work/zyt/admin with repository package-lock dependencies
|
||||
LITERAL_OUTPUT=ESLint: 9.39.3
|
||||
LITERAL_OUTPUT=Error [ERR_PACKAGE_PATH_NOT_EXPORTED]: Package subpath './recommended' is not defined by "exports" in @vue/eslint-config-typescript/package.json
|
||||
EXIT_STATUS=2
|
||||
RESULT=the repository ESLint configuration fails before loading source files; changed files were formatted with the repository Prettier and validated by the successful production build.
|
||||
|
||||
MIGRATION_RUNTIME
|
||||
COMMAND=apply server/sql/1.9.20260908/add_iam_hub_admin_identity.sql twice to an isolated MySQL 5.7 database and query information_schema
|
||||
INPUT=ephemeral Docker MySQL 5.7 with a minimal zyt_admin table
|
||||
LITERAL_OUTPUT=COLUMNS=iam_subject,iam_managed,iam_revoked_at
|
||||
LITERAL_OUTPUT=UNIQUE_SUBJECT_INDEX=1
|
||||
LITERAL_OUTPUT=REVOCATION_TABLE=1
|
||||
LITERAL_OUTPUT=SECOND_RUN_EXIT_STATUS=0
|
||||
EXIT_STATUS=0
|
||||
RESULT=the migration is repeatable on MySQL 5.7 and creates the identity fields, unique subject index and revocation audit table.
|
||||
|
||||
BROWSER_OIDC_RUNTIME
|
||||
COMMAND=CUA open http://localhost:18081/admin/login; click 公司员工统一登录; complete Keycloak authentication; read final URL and DOM
|
||||
INPUT=isolated ZYT MySQL database, committed PHP/Vue build, IAM Hub zyt entitlement and Keycloak zyt client
|
||||
LITERAL_OUTPUT=URL=http://localhost:18081/admin/workbench
|
||||
LITERAL_OUTPUT=DOM menuitem=工作台
|
||||
LITERAL_OUTPUT=DOM user=统一登录测试员工
|
||||
LITERAL_OUTPUT=DOM heading=数据工作台
|
||||
EXIT_STATUS=0
|
||||
RESULT=the browser completed Authorization Code plus PKCE, lazy-provisioned/reused a passwordless IAM-managed ZYT administrator, consumed the fragment exchange code and entered the authorized workbench.
|
||||
|
||||
REVOCATION_RUNTIME
|
||||
COMMAND=disable sso-e2e in IAM Hub; wait for zyt delivery; call ZYT userinfo with the previous token; query isolated ZYT database
|
||||
INPUT=application=zyt webhook=http://host.docker.internal:18081/adminapi/iam/revocation reason=zyt integration e2e
|
||||
LITERAL_OUTPUT=ZYT_REVOCATION disable_http=200 delivery=delivered access_before=1 access_after=-1 disable=1,revoked=1,session_expired=1,audits=1
|
||||
EXIT_STATUS=0
|
||||
RESULT=IAM Hub signed delivery reached the actual ZYT controller; the local administrator was disabled, every session expired and one audit event persisted.
|
||||
|
||||
REENABLE_RUNTIME
|
||||
COMMAND=enable sso-e2e in IAM Hub; repeat browser OIDC login; query isolated ZYT database
|
||||
INPUT=previously IAM-revoked ZYT administrator
|
||||
LITERAL_OUTPUT=IAM_ZYT_EMPLOYEE_ENABLE=200
|
||||
LITERAL_OUTPUT=URL=http://localhost:18081/admin/workbench
|
||||
LITERAL_OUTPUT=ZYT_REENABLE_LOCAL account=iam_f58a2fdf8da48d159446,managed=1,disable=0,revoked_at=0,active_sessions=1,audit_events=1
|
||||
EXIT_STATUS=0
|
||||
RESULT=central re-enable plus the next successful SSO restored the IAM-revoked local administrator without bypassing local manual-disable semantics.
|
||||
|
||||
ROLLBACK
|
||||
COMMAND=/Users/long/Work/zyt/artifacts/ROLLBACK.sh /tmp/zyt-iam-rollback-copy --confirm-original
|
||||
INPUT=a separate clone containing modified commit bd0a3d3b961a8cd683828e908c9281099b527304
|
||||
LITERAL_OUTPUT=ROLLBACK_ORIGINAL_COMMIT_RESTORED
|
||||
LITERAL_OUTPUT=ROLLBACK_HEAD=cf3fbdc5ef5799d8abc7e6c1a650612e40ab441b
|
||||
LITERAL_OUTPUT=ROLLBACK_WORKTREE=CLEAN
|
||||
EXIT_STATUS=0
|
||||
RESTORED_STATUS=separate copy restored to the pre-IAM commit and behavior; /Users/long/Work/zyt remains on the modified implementation.
|
||||
Reference in New Issue
Block a user