sqlite-web 0.7.2
gitea.db
action
Create
Query
access
access_token
action
action_artifact
action_run
action_run_index
action_run_job
action_runner
action_runner_token
action_schedule
action_schedule_spec
action_task
action_task_output
action_task_step
action_tasks_version
action_variable
app_state
attachment
auth_token
badge
branch
collaboration
comment
commit_status
commit_status_index
commit_status_summary
commit_sync_log
commit_sync_status
dbfs_data
dbfs_meta
deploy_key
email_address
email_hash
external_login_user
follow
gpg_key
gpg_key_import
hook_task
issue
issue_assignees
issue_content_history
issue_dependency
issue_index
issue_label
issue_pin
issue_user
issue_watch
label
language_stat
lfs_lock
lfs_meta_object
login_source
milestone
mirror
notice
notification
oauth2_application
oauth2_authorization_code
oauth2_grant
org_user
package
package_blob
package_blob_upload
package_cleanup_rule
package_file
package_property
package_version
project
project_board
project_issue
protected_branch
protected_tag
public_key
pull_auto_merge
pull_request
push_mirror
reaction
release
renamed_branch
repo_archiver
repo_hidden_file
repo_indexer_status
repo_license
repo_redirect
repo_topic
repo_transfer
repo_unit
repository
review
review_state
secret
session
sqlite_sequence
star
stopwatch
system_setting
task
team
team_invite
team_repo
team_unit
team_user
topic
tracked_time
two_factor
upload
user
user_badge
user_blocking
user_open_id
user_redirect
user_setting
version
watch
webauthn_credential
webhook
Toggle helper tables
Structure
Content
Query
Insert
Drop
Import
Export
Delete row 31207 from action
id
31207
user_id
5
op_type
5
act_user_id
5
repo_id
116
comment_id
0
is_deleted
0
ref_name
refs/heads/main
is_private
0
content
{"Commits":[{"Sha1":"db1b4721f
{"Commits":[{"Sha1":"db1b4721f85189353d42e1b67586d66ba6041c88","Message":"docs(部署): 记录补 §17——D-15 只说对了一半,放开 scope 在信任锚未改前无效;拆出 D-16\n\n动手处理 D-15 前先验前提,结论是前提不成立:就算放开 platform:ops,真实 IdP 令牌照样进不来。\n\n实验:用 IdP 自己的 dev 签名私钥签一个 RS256 access token(形状与真实令牌一致),把三重守卫\n的输入全部凑齐——sub 用 §16 订正后的 users.subject、azp 用白名单里的 demo-console、scope 含\nplatform:ops——打 GET /api/platform/ops/definitions,得 401 INVALID_TOKEN。不是 403、不是 scope、\n不是白名单,是签名根本没被验过:容器 AUTH_JWKS_URI 为空,token-verifier.ts:98 因此走 hs256Secret\n分支,算法集只有 HS 一族。用 IdP 真私钥而不是随便造一把,是为了堵住「那只是密钥不对」的解释。\n\n再深一层:token-verifier.ts:47-50 只认单个 key source 与单个 issuer/audience,而 IdP 是每租户\n一个 issuer、每租户一份 JWKS。单租户 dev 下是配一个 URL 的事,多租户下不是——两边模型没对齐。\n\n本轮不擅自改,两处代价都不小:改 AUTH_JWKS_URI 等于换掉整个运行时的信任锚、所有 HS256 令牌\n当场失效,而这台容器是并行会话共用的常驻 dev 运行时;给客户端放 platform:ops 则因管理 API 没有\n改已有客户端的端点,要新建客户端并同步 PLATFORM_OPS_CLIENT_IDS,且本身是安全裁决。\n\nD-15 照此改写(§16.3 那行改为指向 §17.3,避免两处并存),新拆 D-16 记信任锚与模型不匹配。\n在 D-16 未裁之前,单独放开 scope 是无效功。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T17:00:37-07:00"}],"HeadCommit":{"Sha1":"db1b4721f85189353d42e1b67586d66ba6041c88","Message":"docs(部署): 记录补 §17——D-15 只说对了一半,放开 scope 在信任锚未改前无效;拆出 D-16\n\n动手处理 D-15 前先验前提,结论是前提不成立:就算放开 platform:ops,真实 IdP 令牌照样进不来。\n\n实验:用 IdP 自己的 dev 签名私钥签一个 RS256 access token(形状与真实令牌一致),把三重守卫\n的输入全部凑齐——sub 用 §16 订正后的 users.subject、azp 用白名单里的 demo-console、scope 含\nplatform:ops——打 GET /api/platform/ops/definitions,得 401 INVALID_TOKEN。不是 403、不是 scope、\n不是白名单,是签名根本没被验过:容器 AUTH_JWKS_URI 为空,token-verifier.ts:98 因此走 hs256Secret\n分支,算法集只有 HS 一族。用 IdP 真私钥而不是随便造一把,是为了堵住「那只是密钥不对」的解释。\n\n再深一层:token-verifier.ts:47-50 只认单个 key source 与单个 issuer/audience,而 IdP 是每租户\n一个 issuer、每租户一份 JWKS。单租户 dev 下是配一个 URL 的事,多租户下不是——两边模型没对齐。\n\n本轮不擅自改,两处代价都不小:改 AUTH_JWKS_URI 等于换掉整个运行时的信任锚、所有 HS256 令牌\n当场失效,而这台容器是并行会话共用的常驻 dev 运行时;给客户端放 platform:ops 则因管理 API 没有\n改已有客户端的端点,要新建客户端并同步 PLATFORM_OPS_CLIENT_IDS,且本身是安全裁决。\n\nD-15 照此改写(§16.3 那行改为指向 §17.3,避免两处并存),新拆 D-16 记信任锚与模型不匹配。\n在 D-16 未裁之前,单独放开 scope 是无效功。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T17:00:37-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/fe35d013ca78dcfcec4b634a312cd0266527fe2b...db1b4721f85189353d42e1b67586d66ba6041c88","Len":1}
...
created_unix
1789776041
Delete
Cancel