| event_payload |
{"ref":"refs/heads/main","befo {"ref":"refs/heads/main","before":"fe35d013ca78dcfcec4b634a312cd0266527fe2b","after":"db1b4721f85189353d42e1b67586d66ba6041c88","compare_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/compare/fe35d013ca78dcfcec4b634a312cd0266527fe2b...db1b4721f85189353d42e1b67586d66ba6041c88","commits":[{"id":"db1b4721f85189353d42e1b67586d66ba6041c88","message":"docs(部署): 记录补 §17——D-15 只说对了一半，放开 scope 在信任锚未改前无效；拆出 D-16\n\n动手处理 D-15 前先验前提，结论是前提不成立：就算放开 platform:ops，真实 IdP 令牌照样进不来。\n\n实验：用 IdP 自己的 dev 签名私钥签一个 RS256 access token（形状与真实令牌一致），把三重守卫\n的输入全部凑齐——sub 用 §16 订正后的 users.subject、azp 用白名单里的 demo-console、scope 含\nplatform:ops——打 GET /api/platform/ops/definitions，得 401 INVALID_TOKEN。不是 403、不是 scope、\n不是白名单，是签名根本没被验过：容器 AUTH_JWKS_URI 为空，token-verifier.ts:98 因此走 hs256Secret\n分支，算法集只有 HS 一族。用 IdP 真私钥而不是随便造一把，是为了堵住「那只是密钥不对」的解释。\n\n再深一层：token-verifier.ts:47-50 只认单个 key source 与单个 issuer/audience，而 IdP 是每租户\n一个 issuer、每租户一份 JWKS。单租户 dev 下是配一个 URL 的事，多租户下不是——两边模型没对齐。\n\n本轮不擅自改，两处代价都不小：改 AUTH_JWKS_URI 等于换掉整个运行时的信任锚、所有 HS256 令牌\n当场失效，而这台容器是并行会话共用的常驻 dev 运行时；给客户端放 platform:ops 则因管理 API 没有\n改已有客户端的端点，要新建客户端并同步 PLATFORM_OPS_CLIENT_IDS，且本身是安全裁决。\n\nD-15 照此改写（§16.3 那行改为指向 §17.3，避免两处并存），新拆 D-16 记信任锚与模型不匹配。\n在 D-16 未裁之前，单独放开 scope 是无效功。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/db1b4721f85189353d42e1b67586d66ba6041c88","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T17:00:37-07:00","added":[],"removed":[],"modified":["docs/dev部署运行重做记录-2026-09-18.md"]}],"total_commits":0,"head_commit":{"id":"db1b4721f85189353d42e1b67586d66ba6041c88","message":"docs(部署): 记录补 §17——D-15 只说对了一半，放开 scope 在信任锚未改前无效；拆出 D-16\n\n动手处理 D-15 前先验前提，结论是前提不成立：就算放开 platform:ops，真实 IdP 令牌照样进不来。\n\n实验：用 IdP 自己的 dev 签名私钥签一个 RS256 access token（形状与真实令牌一致），把三重守卫\n的输入全部凑齐——sub 用 §16 订正后的 users.subject、azp 用白名单里的 demo-console、scope 含\nplatform:ops——打 GET /api/platform/ops/definitions，得 401 INVALID_TOKEN。不是 403、不是 scope、\n不是白名单，是签名根本没被验过：容器 AUTH_JWKS_URI 为空，token-verifier.ts:98 因此走 hs256Secret\n分支，算法集只有 HS 一族。用 IdP 真私钥而不是随便造一把，是为了堵住「那只是密钥不对」的解释。\n\n再深一层：token-verifier.ts:47-50 只认单个 key source 与单个 issuer/audience，而 IdP 是每租户\n一个 issuer、每租户一份 JWKS。单租户 dev 下是配一个 URL 的事，多租户下不是——两边模型没对齐。\n\n本轮不擅自改，两处代价都不小：改 AUTH_JWKS_URI 等于换掉整个运行时的信任锚、所有 HS256 令牌\n当场失效，而这台容器是并行会话共用的常驻 dev 运行时；给客户端放 platform:ops 则因管理 API 没有\n改已有客户端的端点，要新建客户端并同步 PLATFORM_OPS_CLIENT_IDS，且本身是安全裁决。\n\nD-15 照此改写（§16.3 那行改为指向 §17.3，避免两处并存），新拆 D-16 记信任锚与模型不匹配。\n在 D-16 未裁之前，单独放开 scope 是无效功。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/db1b4721f85189353d42e1b67586d66ba6041c88","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T17:00:37-07:00","added":[],"removed":[],"modified":["docs/dev部署运行重做记录-2026-09-18.md"]},"repository":{"id":116,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"enterprise-platform","full_name":"luoanwu/enterprise-platform","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":21600,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/languages","html_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/enterprise-platform.git","clone_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform.git","original_url":"","website":"","stars_count":0,"forks_count":0,"watchers_count":1,"branch_count":44,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-09-11T07:33:25+08:00","updated_at":"2026-09-19T08:00:04+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"pusher":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"sender":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"}}... |