diff --git a/admin/src/api/iam-v2.ts b/admin/src/api/iam-v2.ts new file mode 100644 index 000000000..b4bf71a57 --- /dev/null +++ b/admin/src/api/iam-v2.ts @@ -0,0 +1,37 @@ +import request from '@/utils/request' +export type IdentityOperation = { + kind: 'bind' | 'create_and_bind' | 'unbind' | 'rebind' | 'reconcile' + user_id: number + employee_id?: string + expected_version?: number + new_employee?: { username: string; display_name: string; email?: string } + reason: string +} +const prefix = '/iam/v2' +const opts = { isOpenRetry: false, ignoreCancelToken: true } +export const iamGet = (path: string, params?: Record): Promise => + request.get({ url: prefix + path, params, withCredentials: true }, opts) +export const iamPost = ( + path: string, + params: Record = {}, + key = crypto.randomUUID() +): Promise => + request.post( + { url: prefix + path, params, headers: { 'Idempotency-Key': key }, withCredentials: true }, + opts + ) +export const identityError = (e: any): string => + ({ + REAUTH_REQUIRED: '请先验证当前账号密码，或通过企业微信重新登录。', + ACCOUNT_MISMATCH: '两端账号不一致，请确认身份后重新发起。', + NOT_LINKED: '当前账号还未关联 IAM。', + NOT_AUTHORIZED: 'IAM 尚未授予目标应用访问权限。', + BINDING_CONFLICT: '关联已变更，请刷新后重新确认。', + PROTECTED_ACCOUNT_REVIEW_REQUIRED: '敏感账号需要双侧近期管理员核验，请由统一身份平台审核。', + SERVICE_UNAVAILABLE: '统一身份服务暂时不可用，状态未确认，请稍后重试。', + FEATURE_DISABLED: 'IAM 关联管理尚未启用。', + FORBIDDEN: '没有当前操作权限或目标超出数据范围。', + TRANSACTION_EXPIRED: '验证已过期或已经使用，请重新发起。' + })[e?.error?.code as string] || + e?.error?.code || + '操作未完成，请刷新状态后重试。' diff --git a/admin/src/components/iam-v2/launch.vue b/admin/src/components/iam-v2/launch.vue new file mode 100644 index 000000000..4fc0b1262 --- /dev/null +++ b/admin/src/components/iam-v2/launch.vue @@ -0,0 +1,32 @@ + + diff --git a/admin/src/components/iam-v2/personal.vue b/admin/src/components/iam-v2/personal.vue new file mode 100644 index 000000000..68960a9c8 --- /dev/null +++ b/admin/src/components/iam-v2/personal.vue @@ -0,0 +1,129 @@ + + diff --git a/admin/src/layout/default/components/header/index.vue b/admin/src/layout/default/components/header/index.vue index d73d38ce8..807d92d9e 100644 --- a/admin/src/layout/default/components/header/index.vue +++ b/admin/src/layout/default/components/header/index.vue @@ -22,6 +22,7 @@
+
+ diff --git a/admin/src/views/user/setting.vue b/admin/src/views/user/setting.vue index c7f3448da..bf3c6cd52 100644 --- a/admin/src/views/user/setting.vue +++ b/admin/src/views/user/setting.vue @@ -79,6 +79,7 @@ + 保存 @@ -108,6 +109,7 @@ '; + } +} diff --git a/server/app/adminapi/service/iam/v2/IamV2Manager.php b/server/app/adminapi/service/iam/v2/IamV2Manager.php new file mode 100644 index 000000000..089a97934 --- /dev/null +++ b/server/app/adminapi/service/iam/v2/IamV2Manager.php @@ -0,0 +1,168 @@ +client ??= new IamV2Client(); } + public function binding(int $id, bool $fresh = false): array + { + $row = Db::name('iam_v2_binding')->where('admin_id', $id)->find(); + if (!$fresh && $row && $row['checked_at'] > time() - 30) { return json_decode($row['payload'], true, 32, JSON_THROW_ON_ERROR); } + $result = $this->client->call('GET', '/bindings/by-external/' . $id); + if (($result['binding']['externalAccountId'] ?? (string) $id) !== (string) $id) { throw new RuntimeException('ACCOUNT_MISMATCH'); } + $state = $result['binding']['state'] ?? 'unlinked'; + $version = (int) ($result['binding']['version'] ?? 0); + if ($row && $row['state'] === 'revoked' && $state === 'verified' && $version <= (int) $row['version']) { throw new RuntimeException('BINDING_CONFLICT'); } + if ($row && (int) $row['version'] > $version) { throw new RuntimeException('BINDING_CONFLICT'); } + $values = ['admin_id' => $id, 'employee_id' => $result['employee']['id'] ?? '', 'subject' => $result['employee']['oidcSubject'] ?? '', + 'state' => $state, 'version' => $version, 'payload' => json_encode($result, JSON_THROW_ON_ERROR), 'checked_at' => time()]; + if ($row) { Db::name('iam_v2_binding')->where('admin_id', $id)->update($values); } + else { Db::name('iam_v2_binding')->insert($values); } + $changed = $row && (($row['employee_id'] ?? '') !== ($values['employee_id'] ?? '') || (int) $row['version'] !== $version); + if ($state === 'revoked' || $changed || (($result['employee'] ?? null) && (($result['employee']['status'] ?? '') !== 'active' || !($result['access']['allowed'] ?? false)))) { + self::revoke($id); + } + return $result + ['checked_at' => time()]; + } + public static function revoke(int $id): void + { + IamV2Source::revokeAdmin($id); + foreach (Db::name('admin_session')->where('admin_id', $id)->column('token') as $token) { AdminLogic::expireToken($token); } + } + public function assertLinked(int $id): array + { + $b = $this->binding($id, true); + if (($b['binding']['state'] ?? '') !== 'verified') { throw new RuntimeException('NOT_LINKED'); } + if (($b['employee']['status'] ?? '') !== 'active' || !($b['access']['allowed'] ?? false)) { throw new RuntimeException('NOT_AUTHORIZED'); } + return $b; + } + public function accounts(array $query, int $actor): array + { + $page = max(1, (int) ($query['page'] ?? 1)); $size = min(20, max(1, (int) ($query['pageSize'] ?? 20))); + $db = Db::name('admin')->whereNull('delete_time'); + $visible = IamV2Source::visibleIds($actor); + if ($visible !== null) { $db->whereIn('id', $visible ?: [0]); } + if (($query['q'] ?? '') !== '') { $db->whereLike('account|name', '%' . mb_substr((string) $query['q'], 0, 64) . '%'); } + if (($query['state'] ?? '') !== '') { + $ids = Db::name('iam_v2_binding')->where('state', (string) $query['state'])->column('admin_id'); + if ($query['state'] === 'unknown') { $db->whereNotIn('id', Db::name('iam_v2_binding')->column('admin_id')); } + else { $db->whereIn('id', $ids ?: [0]); } + } + $total = (clone $db)->count(); + $items = $db->field('id,account,name,disable,root')->page($page, $size)->select()->toArray(); + foreach ($items as &$r) { + try { $r['iam'] = $this->binding((int) $r['id']); $r['iam']['state'] = $r['iam']['binding']['state'] ?? 'unlinked'; } + catch (\Throwable $e) { $r['iam'] = ['state' => 'unknown', 'error' => 'SERVICE_UNAVAILABLE']; } + } + return ['items' => $items, 'total' => $total]; + } + public static function input(array $input): array + { + $kind = (string) ($input['kind'] ?? ''); + if (!in_array($kind, ['bind', 'create_and_bind', 'unbind', 'rebind', 'reconcile'], true)) { throw new RuntimeException('INVALID_OPERATION'); } + $id = (int) ($input['user_id'] ?? 0); + if ($id < 1 || trim((string) ($input['reason'] ?? '')) === '') { throw new RuntimeException('INVALID_INPUT'); } + $out = ['kind' => $kind, 'externalAccountId' => (string) $id, 'reason' => mb_substr(trim($input['reason']), 0, 500)]; + if (isset($input['employee_id'])) { $out['employeeId'] = (string) $input['employee_id']; } + if (isset($input['expected_version'])) { $out['expectedVersion'] = (int) $input['expected_version']; } + if (in_array($kind, ['unbind','rebind'], true) && !isset($out['expectedVersion'])) { throw new RuntimeException('BINDING_CONFLICT'); } + if ($kind === 'create_and_bind') { + $n = $input['new_employee'] ?? []; + $out['newEmployee'] = ['username' => (string) ($n['username'] ?? ''), 'displayName' => (string) ($n['display_name'] ?? '')]; + if (!preg_match('/^[A-Za-z0-9_.@-]{3,64}$/D', $out['newEmployee']['username']) || trim($out['newEmployee']['displayName']) === '') { throw new RuntimeException('INVALID_INPUT'); } + if (!empty($n['email'])) { + if (!filter_var($n['email'], FILTER_VALIDATE_EMAIL)) { throw new RuntimeException('INVALID_INPUT'); } + $out['newEmployee']['email'] = $n['email']; + } + } + return $out; + } + public static function cap(string $kind): string { return ['create_and_bind' => 'create', 'reconcile' => 'read'][$kind] ?? $kind; } + public function operation(array $session, array $input, string $requestId): array + { + $body = self::input($input); $target = (int) $body['externalAccountId']; $cap = self::cap($body['kind']); + IamV2Source::authorize($session, $cap, [$target]); + $this->binding($target, true); + $body['proof'] = IamV2Source::proof($session, 'management', [$target], ['iam:' . $cap]); + $op = $this->client->call('POST', '/operations', $body, $requestId); + $this->remember('operation', (string) $op['id'], $session, [$target], ['iam:' . $cap]); + if (($op['status'] ?? '') === 'succeeded') { $this->binding($target, true); } + return $op; + } + public function remember(string $kind, string $id, array $session, array $targets, array $caps = []): void + { + $key = hash('sha256', $kind . ':' . $id); + $existing = Db::name('iam_v2_resource')->where('resource_key', $key)->find(); + if ($existing) { if ((int) $existing['actor_id'] !== (int) $session['admin_id']) { throw new RuntimeException('FORBIDDEN'); } return; } + Db::name('iam_v2_resource')->insert(['resource_key' => $key, 'kind' => $kind, 'external_id' => $id, 'actor_id' => $session['admin_id'], + 'payload' => json_encode(['targets' => $targets, 'capabilities' => $caps]), 'created_at' => time()]); + } + public function owned(string $kind, string $id, array $session): array + { + $r = Db::name('iam_v2_resource')->where('resource_key', hash('sha256', $kind . ':' . $id))->where('actor_id', $session['admin_id'])->find(); + if (!$r) { throw new RuntimeException('FORBIDDEN'); } + $payload = json_decode($r['payload'], true, 32, JSON_THROW_ON_ERROR); + IamV2Source::scope((int) $session['admin_id'], $payload['targets']); + return $payload; + } + public function preflight(array $session, array $items): array + { + if (!$items || count($items) > 100) { throw new RuntimeException('INVALID_INPUT'); } + IamV2Source::authorize($session, 'batch'); $mapped = []; $targets = []; $caps = ['iam:batch']; $indexMap = []; $review = []; + foreach ($items as $index => $input) { + try { + $item = self::input($input); $id = (int) $item['externalAccountId']; $cap = self::cap($item['kind']); + IamV2Source::authorize($session, $cap, [$id]); + $indexMap[] = (int) $index; $mapped[] = $item; $targets[] = $id; $caps[] = 'iam:' . $cap; + } catch (RuntimeException $e) { + $review[] = ['index' => (int) $index, 'externalAccountId' => (string) ($input['user_id'] ?? ''), + 'status' => $e->getMessage() === 'PROTECTED_ACCOUNT_REVIEW_REQUIRED' ? 'review' : 'invalid', 'message' => $e->getMessage()]; + } + } + if (!$mapped) { return ['previewId' => null, 'items' => $review, 'expiresAt' => time()]; } + $r = $this->client->call('POST', '/batch/preflight', ['items' => $mapped, + 'proof' => IamV2Source::proof($session, 'management', $targets, array_values(array_unique($caps)))]); + $this->remember('preview', (string) $r['previewId'], $session, $targets, $caps); + $resource = hash('sha256', 'preview:' . $r['previewId']); + $ready = []; + foreach ($r['items'] as &$item) { + $centralIndex = (int) $item['index']; + if (!array_key_exists($centralIndex, $indexMap)) { throw new RuntimeException('INVALID_RESPONSE'); } + $item['index'] = $indexMap[$centralIndex]; + if ($item['status'] === 'ready') { $ready[] = $item['index']; } + } + unset($item); + Db::name('iam_v2_resource')->where('resource_key', $resource)->update(['payload' => json_encode([ + 'targets' => $targets, 'capabilities' => $caps, 'indexMap' => $indexMap, 'ready' => $ready])]); + $r['items'] = array_merge($r['items'], $review); + usort($r['items'], fn($a, $b) => $a['index'] <=> $b['index']); return $r; + } + public function batch(array $session, string $preview, array $indexes, string $key): array + { + $scope = $this->owned('preview', $preview, $session); IamV2Source::authorize($session, 'batch', $scope['targets']); + foreach ($scope['capabilities'] as $cap) { IamV2Source::authorize($session, substr($cap, 4), $scope['targets']); } + $indexes = array_values(array_unique(array_map('intval', $indexes))); + if (!$indexes || array_diff($indexes, $scope['ready'] ?? [])) { throw new RuntimeException('INVALID_INPUT'); } + $indexes = array_map(fn($i) => array_search($i, $scope['indexMap'], true), $indexes); + $r = $this->client->call('POST', '/batch', ['previewId' => $preview, 'indexes' => $indexes, + 'proof' => IamV2Source::proof($session, 'management', $scope['targets'], $scope['capabilities'])], $key); + $this->remember('job', (string) $r['id'], $session, $scope['targets'], $scope['capabilities']); return $r; + } + public function result(array $session, string $kind, string $id, bool $retry = false, array $indexes = []): array + { + $scope = $this->owned($kind, $id, $session); IamV2Source::authorize($session, 'read', [], false); + $path = ($kind === 'job' ? '/jobs/' : '/operations/') . rawurlencode($id); + if ($retry) { + foreach ($scope['capabilities'] as $cap) { IamV2Source::authorize($session, substr($cap, 4), $scope['targets']); } + $r = $this->client->call('POST', $path . '/retry', ['indexes' => $indexes, 'proof' => IamV2Source::proof($session, 'management', $scope['targets'], $scope['capabilities'])]); + } else { $r = $this->client->call('GET', $path); } + foreach ($scope['targets'] as $target) { $this->binding((int) $target, true); } return $r; + } +} diff --git a/server/app/adminapi/service/iam/v2/IamV2Source.php b/server/app/adminapi/service/iam/v2/IamV2Source.php new file mode 100644 index 000000000..f403c5ba2 --- /dev/null +++ b/server/app/adminapi/service/iam/v2/IamV2Source.php @@ -0,0 +1,153 @@ +where('token', $token)->where('expire_time', '>', time())->find(); + if (!$legacy) { throw new RuntimeException('REAUTH_REQUIRED'); } + $admin = self::admin((int) $legacy['admin_id']); + $old = (string) ($_COOKIE[self::COOKIE] ?? ''); + if ($old !== '') { self::revokeSession($old); } + $sid = bin2hex(random_bytes(32)); + $row = ['session_id' => $sid, 'admin_id' => (int) $legacy['admin_id'], 'business_session_id' => $legacy['id'], + 'token_hash' => hash('sha256', $token), 'account_stamp' => self::accountStamp($admin), 'auth_method' => $method, 'auth_time' => $method === 'oidc' ? max(0, min(time(), $authTime ?? 0)) : time(), + 'version' => 1, 'revoked' => 0, 'expires_at' => min((int) $legacy['expire_time'], time() + 43200)]; + Db::name('iam_v2_source_session')->insert($row); + if ($cookie) { + setcookie(self::COOKIE, $sid, ['expires' => $row['expires_at'], 'path' => '/adminapi', 'secure' => true, 'httponly' => true, 'samesite' => 'Lax']); + $_COOKIE[self::COOKIE] = $sid; + } + return $row; + } + private static function accountStamp(array $admin): string + { + return hash('sha256', json_encode([$admin['account'], $admin['password'], $admin['work_wechat_userid'] ?? '', (int) $admin['root']], JSON_THROW_ON_ERROR)); + } + public static function admin(int $id): array + { + $a = Db::name('admin')->where('id', $id)->find(); + if (!$a || (int) $a['disable'] !== 0 || !empty($a['delete_time'])) { throw new RuntimeException('ACCOUNT_DISABLED'); } + return $a; + } + public static function current(string $token, bool $recent = false): array + { + $s = self::check((string) ($_COOKIE[self::COOKIE] ?? '')); + if (!hash_equals($s['token_hash'], hash('sha256', $token))) { throw new RuntimeException('ACCOUNT_MISMATCH'); } + if ($recent && $s['auth_time'] < time() - 300) { throw new RuntimeException('REAUTH_REQUIRED'); } + return $s; + } + public static function check(string $id, ?int $version = null): array + { + $s = Db::name('iam_v2_source_session')->where('session_id', $id)->find(); + if (!$s || (int) $s['revoked'] !== 0 || $s['expires_at'] <= time() || ($version !== null && (int) $s['version'] !== $version)) { throw new RuntimeException('REAUTH_REQUIRED'); } + $admin = self::admin((int) $s['admin_id']); + if (!hash_equals($s['account_stamp'], self::accountStamp($admin))) { self::revokeSession($id); throw new RuntimeException('REAUTH_REQUIRED'); } + $legacy = Db::name('admin_session')->where('id', $s['business_session_id'])->find(); + if (!$legacy || $legacy['expire_time'] <= time() || (int) $legacy['admin_id'] !== (int) $s['admin_id'] || !hash_equals($s['token_hash'], hash('sha256', $legacy['token']))) { throw new RuntimeException('REAUTH_REQUIRED'); } + return $s; + } + public static function reauth(string $token, string $password): array + { + $legacy = Db::name('admin_session')->where('token', $token)->where('expire_time', '>', time())->find(); + if (!$legacy || $password === '' || strlen($password) > 256) { throw new RuntimeException('REAUTH_REQUIRED'); } + $a = self::admin((int) $legacy['admin_id']); + $limiter = new AdminAccountSafeCache(); + if (!$limiter->isSafe()) { throw new RuntimeException('RATE_LIMITED'); } + // Deliberately does NOT invoke LoginValidate's local-debug password bypass. + if (!hash_equals((string) $a['password'], create_password($password, Config::get('project.unique_identification')))) { + $limiter->record(); throw new RuntimeException('REAUTH_REQUIRED'); + } + $limiter->relieve(); return self::enroll($token, 'password'); + } + public static function capabilities(int $id): array + { + $admin = self::admin($id); + $all = ['read', 'bind', 'create', 'unbind', 'rebind', 'batch']; + if ((int) $admin['root'] === 1) { return $all; } + $perms = AuthLogic::getAuthByAdminId($id); + return array_values(array_filter($all, fn($p) => in_array('iamV2/' . $p, $perms, true))); + } + public static function protectedAccount(int $id): bool + { + $a = self::admin($id); + if ((int) $a['root'] === 1) { return true; } + $roles = Db::name('admin_role')->where('admin_id', $id)->column('role_id'); + if ($roles && Db::name('system_role')->whereIn('id', $roles)->whereIn('name', ['管理员', '系统管理员', '超级管理员'])->whereNull('delete_time')->count() > 0) { return true; } + return count(array_intersect(self::capabilities($id), ['bind','create','unbind','rebind','batch'])) > 0; + } + public static function visibleIds(int $id): ?array + { + $a = self::admin($id); + $a['role_id'] = Db::name('admin_role')->where('admin_id', $id)->column('role_id'); + return \app\common\service\DataScope\DataScopeService::getVisibleAdminIds($id, $a); + } + public static function scope(int $actor, array $targets): void + { + $visible = self::visibleIds($actor); + if ($visible !== null && array_diff(array_map('intval', $targets), $visible)) { throw new RuntimeException('FORBIDDEN'); } + } + public static function authorize(array $session, string $capability, array $targets = [], bool $recent = true): void + { + if (!in_array($capability, self::capabilities((int) $session['admin_id']), true)) { throw new RuntimeException('FORBIDDEN'); } + if ($recent && $session['auth_time'] < time() - 300) { throw new RuntimeException('REAUTH_REQUIRED'); } + self::scope((int) $session['admin_id'], $targets); + foreach ($targets as $id) { + $target = self::admin((int) $id); + // v1 deliberately fails closed: no dual-side central-admin reauth protocol yet. + if (self::protectedAccount((int) $id)) { + throw new RuntimeException('PROTECTED_ACCOUNT_REVIEW_REQUIRED'); + } + } + } + public static function proof(array $session, string $purpose, array $targets = [], array $capabilities = [], ?string $transaction = null, array $extra = []): string + { + self::check($session['session_id'], (int) $session['version']); + $secret = bin2hex(random_bytes(32)); + $payload = ['applicationId' => (string) Config::get('iam.application_id', 'zyt'), 'actorLocalId' => (string) $session['admin_id'], + 'sessionId' => $session['session_id'], 'sessionVersion' => (int) $session['version'], 'authMethod' => $session['auth_method'], + 'authTime' => (int) $session['auth_time'], 'expiresAt' => time() + 60, 'capabilities' => $capabilities, + 'targetLocalIds' => array_map('strval', $targets), 'protectedAccount' => count(array_filter($targets, fn($id) => self::protectedAccount((int) $id))) > 0, 'transactionId' => $transaction]; + $payload += array_intersect_key($extra, array_flip(['oidcNonce', 'state'])); + Db::name('iam_v2_proof')->insert(['proof_hash' => hash('sha256', $secret), 'purpose' => $purpose, 'session_id' => $session['session_id'], + 'payload' => json_encode($payload, JSON_THROW_ON_ERROR), 'expires_at' => time() + 60, 'consumed' => 0]); + return $secret; + } + public static function introspect(string $proof, string $purpose, ?string $transaction = null): array + { + return Db::transaction(function () use ($proof, $purpose, $transaction) { + $hash = hash('sha256', $proof); + $r = Db::name('iam_v2_proof')->where('proof_hash', $hash)->lock(true)->find(); + if (!$r || $r['purpose'] !== $purpose || $r['expires_at'] <= time() || (int) $r['consumed'] !== 0) { throw new RuntimeException('TRANSACTION_EXPIRED'); } + $p = json_decode($r['payload'], true, 32, JSON_THROW_ON_ERROR); + if (($p['transactionId'] ?? null) !== $transaction) { throw new RuntimeException('ACCOUNT_MISMATCH'); } + $session = self::check($p['sessionId'], (int) $p['sessionVersion']); + foreach ($p['capabilities'] as $cap) { + if (!str_starts_with($cap, 'iam:')) { throw new RuntimeException('FORBIDDEN'); } + self::authorize($session, substr($cap, 4), $p['targetLocalIds']); + } + if (Db::name('iam_v2_proof')->where('proof_hash', $hash)->where('consumed', 0)->update(['consumed' => 1]) !== 1) { throw new RuntimeException('TRANSACTION_EXPIRED'); } + return ['active' => true] + $p; + }); + } + public static function revokeSession(string $id): void + { + Db::name('iam_v2_source_session')->where('session_id', $id)->inc('version')->update(['revoked' => 1]); + } + public static function revokeAdmin(int $id): void + { + Db::name('iam_v2_source_session')->where('admin_id', $id)->where('revoked', 0)->inc('version')->update(['revoked' => 1]); + } +} diff --git a/server/config/iam.php b/server/config/iam.php index 60def3bc9..4abcc79c2 100644 --- a/server/config/iam.php +++ b/server/config/iam.php @@ -2,6 +2,12 @@ // Optional integration: disabled installations never touch IAM or its transaction store. return [ + 'v2_enabled' => env('iam.v2_enabled', false), + 'v2_token' => env('iam.v2_token', ''), + 'v2_introspection_token' => env('iam.v2_introspection_token', ''), + 'v2_event_secret' => env('iam.v2_event_secret', ''), + 'erp_url' => env('iam.erp_url', ''), + 'portal_url' => env('iam.portal_url', ''), 'enabled' => env('iam.enabled', false), 'issuer' => env('iam.issuer', ''), 'client_id' => env('iam.client_id', 'zyt'), diff --git a/server/database/migrations/20261029_iam_v2.sql b/server/database/migrations/20261029_iam_v2.sql new file mode 100644 index 000000000..4cbdeb9ef --- /dev/null +++ b/server/database/migrations/20261029_iam_v2.sql @@ -0,0 +1,59 @@ +-- Additive only. Preserve all six tables and the legacy iam_local_identity ledger on rollback. +-- Apply with configured table prefix (default zyt_). No existing roles/accounts are changed. +CREATE TABLE IF NOT EXISTS zyt_iam_v2_source_session ( + session_id CHAR(64) CHARACTER SET ascii COLLATE ascii_bin PRIMARY KEY, + admin_id INT UNSIGNED NOT NULL, business_session_id INT UNSIGNED NOT NULL, + token_hash CHAR(64) CHARACTER SET ascii COLLATE ascii_bin NOT NULL, + account_stamp CHAR(64) CHARACTER SET ascii COLLATE ascii_bin NOT NULL, + auth_method VARCHAR(16) NOT NULL, auth_time INT UNSIGNED NOT NULL, + version INT UNSIGNED NOT NULL DEFAULT 1, revoked TINYINT NOT NULL DEFAULT 0, + expires_at INT UNSIGNED NOT NULL, INDEX idx_admin (admin_id), INDEX idx_expiry (expires_at) +) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4; +CREATE TABLE IF NOT EXISTS zyt_iam_v2_proof ( + proof_hash CHAR(64) CHARACTER SET ascii COLLATE ascii_bin PRIMARY KEY, + purpose VARCHAR(32) NOT NULL, session_id CHAR(64) NOT NULL, payload TEXT NOT NULL, + expires_at INT UNSIGNED NOT NULL, consumed TINYINT NOT NULL DEFAULT 0, INDEX idx_expiry(expires_at) +) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4; +CREATE TABLE IF NOT EXISTS zyt_iam_v2_binding ( + admin_id INT UNSIGNED PRIMARY KEY, employee_id VARCHAR(128) NOT NULL DEFAULT '', + subject VARCHAR(255) NOT NULL DEFAULT '', state VARCHAR(32) NOT NULL, + version BIGINT UNSIGNED NOT NULL DEFAULT 0, payload MEDIUMTEXT NOT NULL, + checked_at INT UNSIGNED NOT NULL DEFAULT 0, INDEX idx_employee(employee_id), INDEX idx_subject(subject) +) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4; +CREATE TABLE IF NOT EXISTS zyt_iam_v2_resource ( + resource_key CHAR(64) CHARACTER SET ascii COLLATE ascii_bin PRIMARY KEY, + kind VARCHAR(32) NOT NULL, external_id VARCHAR(128) NOT NULL, actor_id INT UNSIGNED NOT NULL, + payload MEDIUMTEXT NOT NULL, created_at INT UNSIGNED NOT NULL, INDEX idx_actor(actor_id) +) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4; +CREATE TABLE IF NOT EXISTS zyt_iam_v2_flow ( + flow_key CHAR(64) CHARACTER SET ascii COLLATE ascii_bin PRIMARY KEY, + kind VARCHAR(32) NOT NULL, payload TEXT NOT NULL, expires_at INT UNSIGNED NOT NULL, + consumed TINYINT NOT NULL DEFAULT 0, INDEX idx_expiry(expires_at) +) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4; +CREATE TABLE IF NOT EXISTS zyt_iam_v2_event ( + event_id VARCHAR(128) CHARACTER SET ascii COLLATE ascii_bin PRIMARY KEY, digest CHAR(64) NOT NULL, received_at INT UNSIGNED NOT NULL +) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4; + +START TRANSACTION; +SET @iam_parent := (SELECT pid FROM zyt_system_menu WHERE component='permission/admin/index' LIMIT 1); +INSERT INTO zyt_system_menu (pid,type,name,icon,sort,perms,paths,component,selected,params,is_cache,is_show,is_disable,create_time,update_time) +SELECT COALESCE(@iam_parent,0),'C','IAM关联管理','el-icon-Connection',85,'iamV2/read','identity-management','permission/identity/index','','',0,1,0,UNIX_TIMESTAMP(),UNIX_TIMESTAMP() +FROM DUAL WHERE NOT EXISTS (SELECT 1 FROM zyt_system_menu WHERE perms='iamV2/read'); +SET @iam_menu := (SELECT id FROM zyt_system_menu WHERE perms='iamV2/read' LIMIT 1); +INSERT INTO zyt_system_menu (pid,type,name,icon,sort,perms,paths,component,selected,params,is_cache,is_show,is_disable,create_time,update_time) +SELECT @iam_menu,'A','绑定IAM','',0,'iamV2/bind','','','','',0,1,0,UNIX_TIMESTAMP(),UNIX_TIMESTAMP() +FROM DUAL WHERE NOT EXISTS (SELECT 1 FROM zyt_system_menu WHERE perms='iamV2/bind'); +INSERT INTO zyt_system_menu (pid,type,name,icon,sort,perms,paths,component,selected,params,is_cache,is_show,is_disable,create_time,update_time) +SELECT @iam_menu,'A','创建并关联IAM','',0,'iamV2/create','','','','',0,1,0,UNIX_TIMESTAMP(),UNIX_TIMESTAMP() +FROM DUAL WHERE NOT EXISTS (SELECT 1 FROM zyt_system_menu WHERE perms='iamV2/create'); +INSERT INTO zyt_system_menu (pid,type,name,icon,sort,perms,paths,component,selected,params,is_cache,is_show,is_disable,create_time,update_time) +SELECT @iam_menu,'A','解除IAM关联','',0,'iamV2/unbind','','','','',0,1,0,UNIX_TIMESTAMP(),UNIX_TIMESTAMP() +FROM DUAL WHERE NOT EXISTS (SELECT 1 FROM zyt_system_menu WHERE perms='iamV2/unbind'); +INSERT INTO zyt_system_menu (pid,type,name,icon,sort,perms,paths,component,selected,params,is_cache,is_show,is_disable,create_time,update_time) +SELECT @iam_menu,'A','更换IAM关联','',0,'iamV2/rebind','','','','',0,1,0,UNIX_TIMESTAMP(),UNIX_TIMESTAMP() +FROM DUAL WHERE NOT EXISTS (SELECT 1 FROM zyt_system_menu WHERE perms='iamV2/rebind'); +INSERT INTO zyt_system_menu (pid,type,name,icon,sort,perms,paths,component,selected,params,is_cache,is_show,is_disable,create_time,update_time) +SELECT @iam_menu,'A','批量IAM任务','',0,'iamV2/batch','','','','',0,1,0,UNIX_TIMESTAMP(),UNIX_TIMESTAMP() +FROM DUAL WHERE NOT EXISTS (SELECT 1 FROM zyt_system_menu WHERE perms='iamV2/batch'); +COMMIT; +-- Deliberately no system_role_menu grants: assign capabilities explicitly after review. diff --git a/server/tests/IamV2RouteContractTest.php b/server/tests/IamV2RouteContractTest.php new file mode 100644 index 000000000..6f3483b13 --- /dev/null +++ b/server/tests/IamV2RouteContractTest.php @@ -0,0 +1,24 @@ + false') && str_contains($client,'CURLOPT_SSL_VERIFYPEER => true'), 'TLS fixed host no redirect'); +requireContract(str_contains($config,"'v2_enabled' => env('iam.v2_enabled', false)"), 'default OFF'); +requireContract(!str_contains($controller,"'token' =>"), 'no business token callback'); +requireContract(str_contains($controller,"verifiedIdToken()") && str_contains($controller,"'oidcNonce' =>"), 'self-link independently verifiable OIDC token and nonce'); +requireContract(!str_contains($controller,"request->post('employeeId'"), 'no browser chosen personal employee'); +echo "PASS IamV2RouteContractTest: fixed POST callbacks, auto-route method gate, origin/service authentication, live proof authorization, target scope, dedicated TLS client, default-off, personal OIDC proof\n"; diff --git a/server/tests/IamV2SourceTest.php b/server/tests/IamV2SourceTest.php new file mode 100644 index 000000000..9f66efbef --- /dev/null +++ b/server/tests/IamV2SourceTest.php @@ -0,0 +1,104 @@ +getMessage() === $message, $message . ' got ' . $e->getMessage()); return; } throw new RuntimeException('accepted ' . $message); } +$app = new think\App(dirname(__DIR__) . '/'); think\Container::setInstance($app); +$file = tempnam(sys_get_temp_dir(), 'zyt-iamv2-'); +$app->config->set(['default'=>'fixture','connections'=>['fixture'=>['type'=>'sqlite','database'=>$file,'prefix'=>'','fields_strict'=>true]]], 'database'); +$manager = new think\DbManager(); $manager->setConfig($app->config->get('database')); $app->instance('think\Db', $manager); +$app->config->set(['data_scope'=>['enabled'=>false], 'unique_identification'=>'fixture'], 'project'); +$app->config->set(['application_id'=>'zyt'], 'iam'); +try { + foreach ([ + 'CREATE TABLE admin (id INTEGER PRIMARY KEY,account TEXT,name TEXT,password TEXT,disable INTEGER,root INTEGER,delete_time INTEGER)', + 'CREATE TABLE admin_session (id INTEGER PRIMARY KEY,admin_id INTEGER,terminal INTEGER,token TEXT,expire_time INTEGER,update_time INTEGER)', + 'CREATE TABLE admin_role (admin_id INTEGER,role_id INTEGER)', + 'CREATE TABLE system_role (id INTEGER PRIMARY KEY,name TEXT,delete_time INTEGER)', + 'CREATE TABLE system_role_menu (role_id INTEGER,menu_id INTEGER)', + 'CREATE TABLE system_menu (id INTEGER PRIMARY KEY,is_disable INTEGER,perms TEXT)', + 'CREATE TABLE iam_v2_source_session (session_id TEXT PRIMARY KEY,admin_id INTEGER,business_session_id INTEGER,token_hash TEXT,account_stamp TEXT,auth_method TEXT,auth_time INTEGER,version INTEGER,revoked INTEGER,expires_at INTEGER)', + 'CREATE TABLE iam_v2_proof (proof_hash TEXT PRIMARY KEY,purpose TEXT,session_id TEXT,payload TEXT,expires_at INTEGER,consumed INTEGER)', + 'CREATE TABLE iam_v2_flow (flow_key TEXT PRIMARY KEY,kind TEXT,payload TEXT,expires_at INTEGER,consumed INTEGER)', + 'CREATE TABLE iam_v2_binding (admin_id INTEGER PRIMARY KEY,employee_id TEXT,subject TEXT,state TEXT,version INTEGER,payload TEXT,checked_at INTEGER)', + 'CREATE TABLE iam_v2_event (event_id TEXT PRIMARY KEY, digest TEXT, received_at INTEGER)', + 'CREATE TABLE iam_v2_resource (resource_key TEXT PRIMARY KEY,kind TEXT,external_id TEXT,actor_id INTEGER,payload TEXT,created_at INTEGER)', + ] as $sql) { Db::execute($sql); } + Db::name('admin')->insertAll([['id'=>1,'account'=>'operator','name'=>'Synthetic Operator','password'=>'not-real','disable'=>0,'root'=>1],['id'=>2,'account'=>'employee','name'=>'Synthetic Employee','password'=>'not-real','disable'=>0,'root'=>0]]); + Db::name('admin_session')->insertAll([['id'=>1,'admin_id'=>1,'terminal'=>1,'token'=>'fixture-token-1','expire_time'=>time()+3600],['id'=>2,'admin_id'=>2,'terminal'=>1,'token'=>'fixture-token-2','expire_time'=>time()+3600]]); + denies(fn()=>IamV2Source::current('fixture-token-1'),'REAUTH_REQUIRED'); + $s1=IamV2Source::enroll('fixture-token-1','password',false); $s2=IamV2Source::enroll('fixture-token-1','password',false); + ok($s1['session_id']!==$s2['session_id'],'independent browser sessions despite same business token'); + $_COOKIE[IamV2Source::COOKIE]=$s1['session_id']; + ok(IamV2Source::current('fixture-token-1')['auth_method']==='password','immutable method'); + denies(fn()=>IamV2Source::current('fixture-token-2'),'ACCOUNT_MISMATCH'); + denies(fn()=>IamV2Source::enroll('fixture-token-1','legacy',false),'REAUTH_REQUIRED'); + IamV2Source::authorize($s1,'bind',[2]); + denies(fn()=>IamV2Source::authorize($s1,'bind',[1]),'PROTECTED_ACCOUNT_REVIEW_REQUIRED'); + $proof=IamV2Source::proof($s1,'launch',[1],[],'tx-fixture'); + ok(!str_contains(json_encode(Db::name('iam_v2_proof')->select()->toArray()),$proof),'proof plaintext never stored'); + denies(fn()=>IamV2Source::introspect($proof,'management','tx-fixture'),'TRANSACTION_EXPIRED'); + denies(fn()=>IamV2Source::introspect($proof,'launch','other'),'ACCOUNT_MISMATCH'); + $claims=IamV2Source::introspect($proof,'launch','tx-fixture'); + ok($claims['active'] && $claims['actorLocalId']==='1' && !isset($claims['token']),'service claims no business token'); + denies(fn()=>IamV2Source::introspect($proof,'launch','tx-fixture'),'TRANSACTION_EXPIRED'); + IamV2Flow::put('launch','intent',['sessionId'=>$s1['session_id']]); + denies(fn()=>IamV2Flow::take('launch','intent',$s2['session_id']),'ACCOUNT_MISMATCH'); + IamV2Flow::take('launch','intent',$s1['session_id']); denies(fn()=>IamV2Flow::take('launch','intent',$s1['session_id']),'TRANSACTION_EXPIRED'); + $expired=IamV2Source::proof($s1,'launch'); Db::name('iam_v2_proof')->where('proof_hash',hash('sha256',$expired))->update(['expires_at'=>time()-1]); + denies(fn()=>IamV2Source::introspect($expired,'launch'),'TRANSACTION_EXPIRED'); + $oldAuth=$s1['auth_time']; Db::name('admin_session')->where('id',1)->update(['update_time'=>time()+30,'expire_time'=>time()+7200]); + ok(IamV2Source::check($s1['session_id'])['auth_time']===$oldAuth,'business renewal never freshens authentication'); + Db::name('admin')->where('id',1)->update(['disable'=>1]); denies(fn()=>IamV2Source::check($s1['session_id']),'ACCOUNT_DISABLED'); Db::name('admin')->where('id',1)->update(['disable'=>0]); + Db::name('admin_session')->where('id',1)->update(['token'=>'rotated']); denies(fn()=>IamV2Source::check($s1['session_id']),'REAUTH_REQUIRED'); Db::name('admin_session')->where('id',1)->update(['token'=>'fixture-token-1']); + IamV2Source::revokeSession($s1['session_id']); denies(fn()=>IamV2Source::check($s1['session_id']),'REAUTH_REQUIRED'); ok(IamV2Source::check($s2['session_id'])['revoked']===0,'revoking one browser preserves other independent session'); + $calls=[];$cfg=['v2_enabled'=>true,'api_url'=>'https://iam.example.test/api','public_url'=>'https://zyt.example.test','erp_url'=>'https://erp.example.test','v2_token'=>str_repeat('v',32),'application_id'=>'zyt']; + $client=new IamV2Client($cfg,function($method,$url,$headers,$body)use(&$calls){$calls[]=compact('method','url','headers','body');return ['status'=>200,'body'=>json_encode(['binding'=>null,'employee'=>null,'access'=>['allowed'=>false]])];}); + $service=new IamV2Manager($client);$service->binding(2);$service->binding(2);ok(count($calls)===1,'30 second read cache'); + Db::name('iam_v2_binding')->where('admin_id',2)->update(['checked_at'=>time()-31]);$service->binding(2);ok(count($calls)===2,'missed revocation compensation after 30 seconds'); + $binding=['binding'=>['state'=>'verified','version'=>2,'externalAccountId'=>'2'],'employee'=>['id'=>'employee-fixture','status'=>'active','oidcSubject'=>'subject-fixture'],'access'=>['allowed'=>true]]; + Db::name('iam_v2_binding')->where('admin_id',2)->update(['employee_id'=>'employee-fixture','state'=>'verified','version'=>2,'payload'=>json_encode($binding)]); + $secret=str_repeat('e',32);$revoked=[]; + $event=['id'=>'evt-fixture','employeeId'=>'employee-fixture','applicationIds'=>['zyt'],'reason'=>'revoked','occurredAt'=>gmdate('Y-m-d\TH:i:s\Z'),'bindingVersion'=>1]; + $raw=json_encode($event);$sig='sha256='.hash_hmac('sha256',$raw,$secret); + denies(fn()=>IamV2Events::accept($raw,'invalid','evt-fixture',$secret),'FORBIDDEN'); + denies(fn()=>IamV2Events::accept($raw,$sig,'another-event',$secret),'INVALID_EVENT'); + $revoke=function($id)use(&$revoked){$revoked[]=$id;}; + IamV2Events::accept($raw,$sig,'evt-fixture',$secret,$revoke);ok($revoked===[],'older event cannot revoke newer binding'); + ok(IamV2Events::accept($raw,$sig,'evt-fixture',$secret,$revoke)['duplicate'],'signed event idempotence'); + $event['id']='evt-new';$event['bindingVersion']=3;$raw=json_encode($event);$sig='sha256='.hash_hmac('sha256',$raw,$secret); + IamV2Events::accept($raw,$sig,'evt-new',$secret,$revoke);ok($revoked===[2],'valid event revokes exact identity'); + $event['reason']='changed';$other=json_encode($event);denies(fn()=>IamV2Events::accept($other,'sha256='.hash_hmac('sha256',$other,$secret),'evt-new',$secret,$revoke),'INVALID_EVENT'); + $event['id']='future';$event['occurredAt']=gmdate('Y-m-d\TH:i:s\Z',time()+120);$future=json_encode($event);denies(fn()=>IamV2Events::accept($future,'sha256='.hash_hmac('sha256',$future,$secret),'future',$secret,$revoke),'TRANSACTION_EXPIRED'); + $binding['binding']['version']=3; + $stale=new IamV2Manager(new IamV2Client($cfg,fn()=>['status'=>200,'body'=>json_encode($binding)])); + denies(fn()=>$stale->binding(2,true),'BINDING_CONFLICT'); + $beforeUsers=Db::name('admin')->select()->toArray();$batchCalls=[]; + $batchClient=new IamV2Client($cfg,function($method,$url,$headers,$body)use(&$batchCalls){ + $data=json_decode($body,true);$batchCalls[]=$data; + $claims=IamV2Source::introspect($data['proof'],'management'); + ok($claims['targetLocalIds']===['2'],'only authorized safe target in central proof'); + ok(in_array('iam:bind',$claims['capabilities'],true),'explicit binding capability'); + if(str_ends_with($url,'/batch/preflight'))return ['status'=>200,'body'=>json_encode(['previewId'=>'preview-fixture','items'=>[['index'=>0,'externalAccountId'=>'2','status'=>'ready']],'expiresAt'=>time()+300])]; + ok($data['indexes']===[0],'original selected index mapped to central filtered index'); + return ['status'=>200,'body'=>json_encode(['id'=>'job-fixture','status'=>'pending','items'=>[]])]; + }); + $batchService=new IamV2Manager($batchClient); + $preview=$batchService->preflight($s2,[['kind'=>'bind','user_id'=>1,'employee_id'=>'protected','reason'=>'fixture'],['kind'=>'bind','user_id'=>2,'employee_id'=>'normal','reason'=>'fixture']]); + ok($preview['items'][0]['status']==='review' && $preview['items'][1]['index']===1,'bulk protected skipped, original indexes retained'); + denies(fn()=>$batchService->batch($s2,'preview-fixture',[0],'fixture-key'),'INVALID_INPUT'); + $job=$batchService->batch($s2,'preview-fixture',[1],'fixture-key');ok($job['id']==='job-fixture','explicit safe selection starts job'); + ok(Db::name('admin')->select()->toArray()===$beforeUsers,'preflight/job orchestration never changes local accounts/roles'); + denies(fn()=>IamV2Manager::input(['kind'=>'rebind','user_id'=>2,'reason'=>'fixture']),'BINDING_CONFLICT'); + denies(fn()=>IamV2Manager::input(['kind'=>'create_and_bind','user_id'=>2,'reason'=>'fixture','new_employee'=>['username'=>'invalid /','display_name'=>'Name']]),'INVALID_INPUT'); + Db::name('admin')->where('id',1)->update(['password'=>'new-credential']); + denies(fn()=>IamV2Source::check($s2['session_id']),'REAUTH_REQUIRED'); + ok((int) Db::name('iam_v2_source_session')->where('session_id',$s2['session_id'])->value('version')===2,'credential change increments source revocation version'); + $legacy=$cfg; unset($legacy['v2_token']); $legacy['application_token']=str_repeat('l',32); denies(fn()=>new IamV2Client($legacy),'SERVICE_UNAVAILABLE'); + denies(fn()=>IamV2Client::https('https://iam.example.test/path?override=1'),'INVALID_FIXED_URL'); +} finally { @unlink($file); } +echo "PASS IamV2SourceTest: independent browser SID, legacy reauth, live DB, scope, protected accounts, single-use proof/intent, expiry, immutable authTime, disabled/rotated/revoked sessions, 30s compensation, signed event replay/digest/future/version, revoked tombstone, batch protected filtering/index mapping, selected-only execution, no local account mutation, credential-change revocation\n"; diff --git a/server/tests/IamV2UiTest.mjs b/server/tests/IamV2UiTest.mjs new file mode 100644 index 000000000..4d9d4a4a2 --- /dev/null +++ b/server/tests/IamV2UiTest.mjs @@ -0,0 +1,31 @@ +import assert from 'node:assert/strict' +import fs from 'node:fs' +import vm from 'node:vm' +import { createRequire } from 'node:module' +const require = createRequire(import.meta.url), ts = require('typescript'), sfc = require('@vue/compiler-sfc') +const root = new URL('../../',import.meta.url) +const files=['admin/src/components/iam-v2/launch.vue','admin/src/components/iam-v2/personal.vue','admin/src/views/permission/identity/index.vue'] +for(const file of files){ + const source=fs.readFileSync(new URL(file,root),'utf8'), {descriptor,errors}=sfc.parse(source,{filename:file}) + assert.deepEqual(errors,[]) + const script=sfc.compileScript(descriptor,{id:file}) + const template=sfc.compileTemplate({source:descriptor.template.content,filename:file,id:file,compilerOptions:{bindingMetadata:script.bindings}}) + assert.deepEqual(template.errors,[],file) +} +const source=fs.readFileSync(new URL(files[0],root),'utf8'), script=source.match(/