| event_payload |
{"ref":"refs/heads/main","befo {"ref":"refs/heads/main","before":"958ef4eaa9c5c873973a94474f7ffb6ab9c16cd2","after":"06556f73ea74b431979b8b819de8e85358843b49","compare_url":"https://gitea.g-hi.com/pengzhiyu/IAM/compare/958ef4eaa9c5c873973a94474f7ffb6ab9c16cd2...06556f73ea74b431979b8b819de8e85358843b49","commits":[{"id":"06556f73ea74b431979b8b819de8e85358843b49","message":"perf: 优化客户端凭据校验与授权查询并补充容量观测\n\nP12 L1 尚未通过，先实现客户端校验、授权查询与观测工具的第一批调整，供另一台 JDK 25 设备编译回归后形成云端测试候选；本提交不代表性能验收通过。\n\n实现内容：\n- 新客户端秘密采用用途独立的版本化 HMAC-SHA256，兼容历史 BCrypt12；通过 V25 显式激活密钥权威并守卫凭据写入\n- 增加普通客户端秘密轮换及认证换代复核，补充协议、密钥策略、部署辅助工具与测试源码\n- 通过 V26 缩小目标企业资格查询，批量计算组织范围，将本地缓存调整为有界 LRU\n- 增加认证、锁、缓存及连接池指标，补充 legacy/hmac/mixed 容量模式、Linux 临时路径与候选摘要核对\n- 更新部署说明和 P12 交接，明确另一设备先完成构建回归，随后再进行云端隔离性能测试\n\n验证：\n- google-java-format 1.35.0 --aosp --dry-run --set-exit-if-changed：51 个新增或修改 Java 文件通过\n- Python AST 解析：11 个新增或修改 Python 文件通过，仅语法检查，未导入或执行脚本\n- git diff --check：通过；新增文档相对文件链接检查通过\n- 当前默认 Java 21，按用户安排未运行 Maven/Spotless 全工程门禁、编译、测试、数据库迁移、容器或压测；须在 JDK 25 设备继续验收\n\nBREAKING CHANGE: 启动前必须准备 IAM_CLIENT_SECRET_KEY_RING_FILE 并以迁移身份显式激活权威集合；写入 HMAC 凭据后不支持直接回退旧二进制\n","url":"https://gitea.g-hi.com/pengzhiyu/IAM/commit/06556f73ea74b431979b8b819de8e85358843b49","author":{"name":"starry","email":"228834386@qq.com","username":"pengzhiyu"},"committer":{"name":"starry","email":"228834386@qq.com","username":"pengzhiyu"},"verification":null,"timestamp":"2026-10-10T17:56:32+08:00","added":["deploy/lab/test-client-secret.py","docs/client-secret-verification.md","docs/handoff/P12-client-secret-rotation-frontend.md","docs/tasks/P12-software-optimization.md","iam-server/src/main/java/com/iam/server/data/LifecycleLockMetrics.java","iam-server/src/main/java/com/iam/server/security/ClientSecretPolicy.java","iam-server/src/main/java/com/iam/server/security/ClientSecretVerifier.java","iam-server/src/main/resources/db/migration/V25__client_secret_hmac.sql","iam-server/src/main/resources/db/migration/V26__targeted_membership_lookup.sql","iam-server/src/test/java/com/iam/server/accounts/ScopeServiceTest.java","iam-server/src/test/java/com/iam/server/authorization/DecisionCacheTest.java","iam-server/src/test/java/com/iam/server/data/LifecycleLockMetricsTest.java","iam-server/src/test/java/com/iam/server/data/TargetedMembershipMigrationIT.java","iam-server/src/test/java/com/iam/server/protocol/CapacityCredentials.java","iam-server/src/test/java/com/iam/server/protocol/CapacityMeters.java","iam-server/src/test/java/com/iam/server/protocol/ClientSecretPolicyIT.java","iam-server/src/test/java/com/iam/server/protocol/ClientSecretRotationIT.java","iam-server/src/test/java/com/iam/server/security/ClientSecretVerifierTest.java","scripts/client-secret-policy.py"],"removed":[],"modified":[".gitignore","deploy/lab/compose.yml","deploy/lab/key-manifest.py","deploy/lab/lab.py","deploy/lab/test-key-manifest.py","docs/02-IAM开发计划.md","docs/accounts.md","docs/deployment-lab.md","docs/machine-tokens.md","docs/oidc.md","iam-server/src/main/java/com/iam/server/IamApplication.java","iam-server/src/main/java/com/iam/server/accounts/AccountConfiguration.java","iam-server/src/main/java/com/iam/server/accounts/AccountStore.java","iam-server/src/main/java/com/iam/server/accounts/ApplicationRegistry.java","iam-server/src/main/java/com/iam/server/accounts/Authorizer.java","iam-server/src/main/java/com/iam/server/accounts/MachineClientService.java","iam-server/src/main/java/com/iam/server/accounts/ScopeService.java","iam-server/src/main/java/com/iam/server/authorization/DecisionCache.java","iam-server/src/main/java/com/iam/server/protocol/InternalProtocolFilter.java","iam-server/src/main/java/com/iam/server/protocol/LocalKeyInitializer.java","iam-server/src/main/java/com/iam/server/protocol/MachineSecretAuthenticationProvider.java","iam-server/src/main/java/com/iam/server/protocol/ProtectedClientProvider.java","iam-server/src/main/java/com/iam/server/protocol/ProtocolConfiguration.java","iam-server/src/main/java/com/iam/server/protocol/ProtocolStore.java","iam-server/src/main/java/com/iam/server/protocol/TransactionalProvider.java","iam-server/src/main/java/com/iam/server/security/DecisionConfiguration.java","iam-server/src/main/java/com/iam/server/security/SecurityConfiguration.java","iam-server/src/main/java/com/iam/server/web/ApplicationController.java","iam-server/src/main/resources/application-local.yml","iam-server/src/main/resources/application.yml","iam-server/src/test/java/com/iam/server/BaselineIT.java","iam-server/src/test/java/com/iam/server/data/AuthorizationMigrationIT.java","iam-server/src/test/java/com/iam/server/data/CapacityCatalogIT.java","iam-server/src/test/java/com/iam/server/data/DisplayNameMigrationIT.java","iam-server/src/test/java/com/iam/server/data/MigrationIT.java","iam-server/src/test/java/com/iam/server/protocol/ApplicationLifecycleIT.java","iam-server/src/test/java/com/iam/server/protocol/ApplicationLifecycleUpgradeIT.java","iam-server/src/test/java/com/iam/server/protocol/CapacityDiagnostics.java","iam-server/src/test/java/com/iam/server/protocol/CapacityDriver.java","iam-server/src/test/java/com/iam/server/protocol/CapacityDriverTest.java","iam-server/src/test/java/com/iam/server/protocol/CapacityObserver.java","iam-server/src/test/java/com/iam/server/protocol/CapacityProbe.java","iam-server/src/test/java/com/iam/server/protocol/CapacitySeed.java","iam-server/src/test/java/com/iam/server/protocol/DataScopeIT.java","iam-server/src/test/java/com/iam/server/protocol/MachineCredentialUpgradeIT.java","iam-server/src/test/java/com/iam/server/protocol/MachineCredentialsIT.java","iam-server/src/test/java/com/iam/server/protocol/MachineResourceIT.java","iam-server/src/test/java/com/iam/server/protocol/MachineTaskIT.java","iam-server/src/test/java/com/iam/server/protocol/P08Environment.java","iam-server/src/test/java/com/iam/server/protocol/ProtocolFixture.java","iam-server/src/test/java/com/iam/server/protocol/ProtocolTestKeys.java","scripts/capacity/README.md","scripts/capacity/catalog.sql","scripts/capacity/environment.py","scripts/capacity/http_report.py","scripts/capacity/metrics_report.py","scripts/capacity/policies/L1.properties","scripts/capacity/prepare.py","scripts/capacity/round.py","scripts/capacity/test_tools.py"]}],"total_commits":0,"head_commit":{"id":"06556f73ea74b431979b8b819de8e85358843b49","message":"perf: 优化客户端凭据校验与授权查询并补充容量观测\n\nP12 L1 尚未通过，先实现客户端校验、授权查询与观测工具的第一批调整，供另一台 JDK 25 设备编译回归后形成云端测试候选；本提交不代表性能验收通过。\n\n实现内容：\n- 新客户端秘密采用用途独立的版本化 HMAC-SHA256，兼容历史 BCrypt12；通过 V25 显式激活密钥权威并守卫凭据写入\n- 增加普通客户端秘密轮换及认证换代复核，补充协议、密钥策略、部署辅助工具与测试源码\n- 通过 V26 缩小目标企业资格查询，批量计算组织范围，将本地缓存调整为有界 LRU\n- 增加认证、锁、缓存及连接池指标，补充 legacy/hmac/mixed 容量模式、Linux 临时路径与候选摘要核对\n- 更新部署说明和 P12 交接，明确另一设备先完成构建回归，随后再进行云端隔离性能测试\n\n验证：\n- google-java-format 1.35.0 --aosp --dry-run --set-exit-if-changed：51 个新增或修改 Java 文件通过\n- Python AST 解析：11 个新增或修改 Python 文件通过，仅语法检查，未导入或执行脚本\n- git diff --check：通过；新增文档相对文件链接检查通过\n- 当前默认 Java 21，按用户安排未运行 Maven/Spotless 全工程门禁、编译、测试、数据库迁移、容器或压测；须在 JDK 25 设备继续验收\n\nBREAKING CHANGE: 启动前必须准备 IAM_CLIENT_SECRET_KEY_RING_FILE 并以迁移身份显式激活权威集合；写入 HMAC 凭据后不支持直接回退旧二进制\n","url":"https://gitea.g-hi.com/pengzhiyu/IAM/commit/06556f73ea74b431979b8b819de8e85358843b49","author":{"name":"starry","email":"228834386@qq.com","username":"pengzhiyu"},"committer":{"name":"starry","email":"228834386@qq.com","username":"pengzhiyu"},"verification":null,"timestamp":"2026-10-10T17:56:32+08:00","added":["deploy/lab/test-client-secret.py","docs/client-secret-verification.md","docs/handoff/P12-client-secret-rotation-frontend.md","docs/tasks/P12-software-optimization.md","iam-server/src/main/java/com/iam/server/data/LifecycleLockMetrics.java","iam-server/src/main/java/com/iam/server/security/ClientSecretPolicy.java","iam-server/src/main/java/com/iam/server/security/ClientSecretVerifier.java","iam-server/src/main/resources/db/migration/V25__client_secret_hmac.sql","iam-server/src/main/resources/db/migration/V26__targeted_membership_lookup.sql","iam-server/src/test/java/com/iam/server/accounts/ScopeServiceTest.java","iam-server/src/test/java/com/iam/server/authorization/DecisionCacheTest.java","iam-server/src/test/java/com/iam/server/data/LifecycleLockMetricsTest.java","iam-server/src/test/java/com/iam/server/data/TargetedMembershipMigrationIT.java","iam-server/src/test/java/com/iam/server/protocol/CapacityCredentials.java","iam-server/src/test/java/com/iam/server/protocol/CapacityMeters.java","iam-server/src/test/java/com/iam/server/protocol/ClientSecretPolicyIT.java","iam-server/src/test/java/com/iam/server/protocol/ClientSecretRotationIT.java","iam-server/src/test/java/com/iam/server/security/ClientSecretVerifierTest.java","scripts/client-secret-policy.py"],"removed":[],"modified":[".gitignore","deploy/lab/compose.yml","deploy/lab/key-manifest.py","deploy/lab/lab.py","deploy/lab/test-key-manifest.py","docs/02-IAM开发计划.md","docs/accounts.md","docs/deployment-lab.md","docs/machine-tokens.md","docs/oidc.md","iam-server/src/main/java/com/iam/server/IamApplication.java","iam-server/src/main/java/com/iam/server/accounts/AccountConfiguration.java","iam-server/src/main/java/com/iam/server/accounts/AccountStore.java","iam-server/src/main/java/com/iam/server/accounts/ApplicationRegistry.java","iam-server/src/main/java/com/iam/server/accounts/Authorizer.java","iam-server/src/main/java/com/iam/server/accounts/MachineClientService.java","iam-server/src/main/java/com/iam/server/accounts/ScopeService.java","iam-server/src/main/java/com/iam/server/authorization/DecisionCache.java","iam-server/src/main/java/com/iam/server/protocol/InternalProtocolFilter.java","iam-server/src/main/java/com/iam/server/protocol/LocalKeyInitializer.java","iam-server/src/main/java/com/iam/server/protocol/MachineSecretAuthenticationProvider.java","iam-server/src/main/java/com/iam/server/protocol/ProtectedClientProvider.java","iam-server/src/main/java/com/iam/server/protocol/ProtocolConfiguration.java","iam-server/src/main/java/com/iam/server/protocol/ProtocolStore.java","iam-server/src/main/java/com/iam/server/protocol/TransactionalProvider.java","iam-server/src/main/java/com/iam/server/security/DecisionConfiguration.java","iam-server/src/main/java/com/iam/server/security/SecurityConfiguration.java","iam-server/src/main/java/com/iam/server/web/ApplicationController.java","iam-server/src/main/resources/application-local.yml","iam-server/src/main/resources/application.yml","iam-server/src/test/java/com/iam/server/BaselineIT.java","iam-server/src/test/java/com/iam/server/data/AuthorizationMigrationIT.java","iam-server/src/test/java/com/iam/server/data/CapacityCatalogIT.java","iam-server/src/test/java/com/iam/server/data/DisplayNameMigrationIT.java","iam-server/src/test/java/com/iam/server/data/MigrationIT.java","iam-server/src/test/java/com/iam/server/protocol/ApplicationLifecycleIT.java","iam-server/src/test/java/com/iam/server/protocol/ApplicationLifecycleUpgradeIT.java","iam-server/src/test/java/com/iam/server/protocol/CapacityDiagnostics.java","iam-server/src/test/java/com/iam/server/protocol/CapacityDriver.java","iam-server/src/test/java/com/iam/server/protocol/CapacityDriverTest.java","iam-server/src/test/java/com/iam/server/protocol/CapacityObserver.java","iam-server/src/test/java/com/iam/server/protocol/CapacityProbe.java","iam-server/src/test/java/com/iam/server/protocol/CapacitySeed.java","iam-server/src/test/java/com/iam/server/protocol/DataScopeIT.java","iam-server/src/test/java/com/iam/server/protocol/MachineCredentialUpgradeIT.java","iam-server/src/test/java/com/iam/server/protocol/MachineCredentialsIT.java","iam-server/src/test/java/com/iam/server/protocol/MachineResourceIT.java","iam-server/src/test/java/com/iam/server/protocol/MachineTaskIT.java","iam-server/src/test/java/com/iam/server/protocol/P08Environment.java","iam-server/src/test/java/com/iam/server/protocol/ProtocolFixture.java","iam-server/src/test/java/com/iam/server/protocol/ProtocolTestKeys.java","scripts/capacity/README.md","scripts/capacity/catalog.sql","scripts/capacity/environment.py","scripts/capacity/http_report.py","scripts/capacity/metrics_report.py","scripts/capacity/policies/L1.properties","scripts/capacity/prepare.py","scripts/capacity/round.py","scripts/capacity/test_tools.py"]},"repository":{"id":125,"owner":{"id":16,"login":"pengzhiyu","login_name":"","source_id":0,"full_name":"","email":"228834386@qq.com","avatar_url":"https://gitea.g-hi.com/avatar/bcd8cfbb58b96e4afa8ab5f6ac09cb16","html_url":"https://gitea.g-hi.com/pengzhiyu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-07-15T09:26:56+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"pengzhiyu"},"name":"IAM","full_name":"pengzhiyu/IAM","description":"Identity and Access Management(身份识别与访问管理)","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":99286,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/pengzhiyu/IAM/languages","html_url":"https://gitea.g-hi.com/pengzhiyu/IAM","url":"https://gitea.g-hi.com/api/v1/repos/pengzhiyu/IAM","link":"","ssh_url":"git@gitea.g-hi.com:pengzhiyu/IAM.git","clone_url":"https://gitea.g-hi.com/pengzhiyu/IAM.git","original_url":"","website":"","stars_count":0,"forks_count":0,"watchers_count":1,"branch_count":1,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-10-08T17:04:24+08:00","updated_at":"2026-10-10T13:44:43+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"pusher":{"id":16,"login":"pengzhiyu","login_name":"","source_id":0,"full_name":"","email":"16+pengzhiyu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/bcd8cfbb58b96e4afa8ab5f6ac09cb16","html_url":"https://gitea.g-hi.com/pengzhiyu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-07-15T09:26:56+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"pengzhiyu"},"sender":{"id":16,"login":"pengzhiyu","login_name":"","source_id":0,"full_name":"","email":"16+pengzhiyu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/bcd8cfbb58b96e4afa8ab5f6ac09cb16","html_url":"https://gitea.g-hi.com/pengzhiyu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-07-15T09:26:56+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"pengzhiyu"}}... |