| event_payload |
{"ref":"refs/heads/main","befo {"ref":"refs/heads/main","before":"7a4b69367b18f4e284218704981b54c0ee10d2b6","after":"ec0f1c04d60b56c0fa19a2c06fc89e7a64b69c4d","compare_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/compare/7a4b69367b18f4e284218704981b54c0ee10d2b6...ec0f1c04d60b56c0fa19a2c06fc89e7a64b69c4d","commits":[{"id":"ec0f1c04d60b56c0fa19a2c06fc89e7a64b69c4d","message":"docs(部署): 记录补 §14——工作台登录第一次真正走通，以及 200 分支为什么在浏览器里测不了\n\n同源托管记录 §6 那一行挂着「工作台 OIDC 公开客户端仍未在身份模块登记」，以及由此导致的\n「forward_auth 的 200 分支未实测」。本节走通前者，后者只关掉一半。\n\n卡住的不是配置。登录页显示「缺配置」容易读成填个环境变量就行，实际是 demo 租户里\n根本没有回调为 http://localhost:3010/callback/ 的客户端；而登记它要过 IdpManagementGuard\n（idp:manage ∧ 管理客户端 ∧ 活跃管理员授权），也就是必须先有人以管理员身份走完托管登录——\n那一步要人工提交口令，这正是它一直没做的原因。\n\n登记出来的客户端只给 openid profile，不给 idp:manage：登记用的是 demo-console 的管理权，\n不是把管理权发给一个跑在浏览器里的公开客户端。\n\n实测走通全链（作用域 = 本机 dev，证据等级 = 运行态链路 + 真实浏览器）：SSO 未再要口令、\n同意屏、换令牌、令牌只落 sessionStorage 两键（无 localStorage 无 cookie）、登录页显示出\n与库中 admin@demo.test 一致的 subject（即没踩同源托管记录的 D-10）、userinfo 200、\n带令牌读 modules 200。userinfo 正是 forward_auth 的校验端点，服务端语义上 200 分支成立。\n\n但浏览器跨源那一半关不掉，且是设计使然：带 Authorization 的跨源请求先发 OPTIONS 预检，\n预检按规范不带该头，forward_auth 收到无令牌的 OPTIONS 就 401，真请求发不出去。终态是\n同源托管故无影响，但 :3010 这个 dev 形态永远走不通网关。这与 §11「两个键、两个进程」\n是同一族问题的两面：跨源这件事，代理和网关都不替你解决。\n\n新登记 D-11（服务端直连验 200 分支未做——本轮令牌只在浏览器里，不把有效 bearer 打进\n命令行与日志）与 D-12（登录后顶栏的 hydration 告警）。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/ec0f1c04d60b56c0fa19a2c06fc89e7a64b69c4d","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T16:11:45-07:00","added":[],"removed":[],"modified":["docs/dev部署运行重做记录-2026-09-18.md"]}],"total_commits":0,"head_commit":{"id":"ec0f1c04d60b56c0fa19a2c06fc89e7a64b69c4d","message":"docs(部署): 记录补 §14——工作台登录第一次真正走通，以及 200 分支为什么在浏览器里测不了\n\n同源托管记录 §6 那一行挂着「工作台 OIDC 公开客户端仍未在身份模块登记」，以及由此导致的\n「forward_auth 的 200 分支未实测」。本节走通前者，后者只关掉一半。\n\n卡住的不是配置。登录页显示「缺配置」容易读成填个环境变量就行，实际是 demo 租户里\n根本没有回调为 http://localhost:3010/callback/ 的客户端；而登记它要过 IdpManagementGuard\n（idp:manage ∧ 管理客户端 ∧ 活跃管理员授权），也就是必须先有人以管理员身份走完托管登录——\n那一步要人工提交口令，这正是它一直没做的原因。\n\n登记出来的客户端只给 openid profile，不给 idp:manage：登记用的是 demo-console 的管理权，\n不是把管理权发给一个跑在浏览器里的公开客户端。\n\n实测走通全链（作用域 = 本机 dev，证据等级 = 运行态链路 + 真实浏览器）：SSO 未再要口令、\n同意屏、换令牌、令牌只落 sessionStorage 两键（无 localStorage 无 cookie）、登录页显示出\n与库中 admin@demo.test 一致的 subject（即没踩同源托管记录的 D-10）、userinfo 200、\n带令牌读 modules 200。userinfo 正是 forward_auth 的校验端点，服务端语义上 200 分支成立。\n\n但浏览器跨源那一半关不掉，且是设计使然：带 Authorization 的跨源请求先发 OPTIONS 预检，\n预检按规范不带该头，forward_auth 收到无令牌的 OPTIONS 就 401，真请求发不出去。终态是\n同源托管故无影响，但 :3010 这个 dev 形态永远走不通网关。这与 §11「两个键、两个进程」\n是同一族问题的两面：跨源这件事，代理和网关都不替你解决。\n\n新登记 D-11（服务端直连验 200 分支未做——本轮令牌只在浏览器里，不把有效 bearer 打进\n命令行与日志）与 D-12（登录后顶栏的 hydration 告警）。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/ec0f1c04d60b56c0fa19a2c06fc89e7a64b69c4d","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T16:11:45-07:00","added":[],"removed":[],"modified":["docs/dev部署运行重做记录-2026-09-18.md"]},"repository":{"id":116,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"enterprise-platform","full_name":"luoanwu/enterprise-platform","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":20460,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/languages","html_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/enterprise-platform.git","clone_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform.git","original_url":"","website":"","stars_count":0,"forks_count":0,"watchers_count":1,"branch_count":44,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-09-11T07:33:25+08:00","updated_at":"2026-09-19T07:10:07+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"pusher":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"sender":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"}}... |