全局架构/AUTH/身份与访问控制

ARCHITECTURE DOSSIER · 01

身份与访问控制

OTP、JWT、应用会话、设备身份与权限边界

MIXEDAUTHCODE + RUNTIME + QA

AUTH · COMPONENT TOPOLOGYowner / runtime / truth state

01Client

Web / iOS / Merchantrunning

发起邮箱、手机、钱包或设备登录

Product clientsbrowser / SwiftUI

02Edge

Nginx auth routerunning

TLS、host/path 路由与公开限流

Platform OpsEC2 :443

03Service

reits-authmixed

email OTP、active/previous kid JWT、session liveness/revoke

Identity PlatformGo systemd · 127.0.0.1:8095 · 157b859

im-core verificationrunning

验证码与设备验证能力

Realtime PlatformGo / Docker

Consumer guardsmixed

二次校验 active/client/scope/subject/tenant/object

Every productOpen runtime fb1a1b4 / witness fa9283d · Booking 83d31a0 · others target

04State

ChallengeStore + Session Registrymixed

单实例内存 challenge/limiter；MySQL 会话 liveness 与 append-only event

Identity Platformprocess memory + MySQL jx_reits_auth

CRITICAL SEQUENCE

真实主链与事务边界

每一步都必须能回到调用方、契约、状态 owner 与失败证据；UI 只显示服务端已经确认的真值。

01
Client 通过固定 route 提交邮箱与用途
02
reits-auth 以 client/kind/subject 限流并创建 600s challenge
03
im-core verification 发送并校验 email OTP
04
Auth 先写 auth_sessions 再返回带 iss/aud/client/sid/auth_time/refresh_exp 的 token
05
refresh/introspect/me 校验 registry liveness 与 claim 边界
06
用户可列出并撤销当前/单个/其他同 client 会话，事件写入安全回执
07
业务服务验证 token、active session、租户、required scope 与 object binding

INTERFACE REGISTER

跨项目接口与安全条件

producer、consumer、契约和 guard 同时登记；其中任何一列缺失都不能进入多团队并行开发。

ProducerVersioned contractConsumerSecurity / consistency guard

ClientPOST /otp/request · /otp/verifyreits-auth

IP + subject rate limit

reits-authJWT {sub,iss,aud,client,scopes,sid,auth_time,refresh_exp}Booking / Open Platform

issuer + audience + required scope + tenant/object

reits-authGET /v1/sessions · POST /v1/sessions/{id}/revoke · /current/revoke · /revoke-othersSecurity UI / server adapter

current active session + same subject/client

iOS devicedevice session / MFA contextim-core

device binding + revoke

STATE OWNERSHIP

数据真值与恢复

OTP challenge / limiterreits-auth

STOREin-memory ChallengeStore

RETENTION600s TTL / bounded key-space

RECOVERY进程重启即清空，重新发起

Subjects / JWT sessionsreits-auth

STOREsigned JWT + MySQL auth_sessions

RETENTION1h access / 24h refresh boundary；最多 20 active / subject+client

RECOVERY可逐会话撤销；MariaDB dump 存在，隔离恢复演练未证明

Session audit receiptsreits-auth

STOREMySQL auth_session_events

RETENTIONappend-only policy current；长期 retention 待定义

RECOVERY随 MariaDB dump；不含 token/IP/UA

Device sessionsim-core

STOREPostgreSQL + Redis

RETENTION至撤销/过期

RECOVERYdurable truth from DB

FAILURE MODEL

故障必须怎样收敛

TRIGGERverification 不可用

SYMPTOM验证码请求或校验失败

CONTAIN公开只读面继续；禁止降级为免认证写入

OTP synthetic + error code

TRIGGER未纳入 K19 的消费者只做本地 JWT 校验

SYMPTOMAuth 已撤销但该资源服务器仍可能接受未过期 token

CONTAIN复制 K19 no-cache introspection/active-session guard；强制 client/scope/subject/tenant/object；必要时经审批轮换密钥

Open Platform / Booking 已完成；其余需逐项登记

TRIGGERSession Registry 不可用

SYMPTOMrefresh/introspect/me 与登录发 token fail-closed

CONTAINhealth 仍表示进程存活，ready 返回 503；公共只读面独立

双依赖 readiness + store failure tests

TRIGGERscope 消费遗漏

SYMPTOM低权限 token 执行高风险动作

CONTAIN服务端 deny-by-default

跨服务 contract test

QA RELEASE GATES

不是画完架构图就算完成

这些门禁连接 UI 状态、接口负向路径、运行证据与可恢复性；发布证据必须绑定 exact commit。

AUTH-01

生产旁路必须关闭

完成 · 157b859 config/store preflight + safe external smoke

AUTH-02

client/scope/subject/object 负向测试

K19 17 consumer checks + K20 17/17 cross-process witness

AUTH-03

OTP 限流、过期、重放

source negative 通过；真实生产 OTP E2E 未执行

AUTH-04

会话撤销与设备退出

Auth durable registry/revoke CURRENT；Open Platform / Booking propagation CURRENT；产品 UI、设备联邦与其余消费者 PARTIAL

AUTH-05

active/previous/no-kid 密钥生命周期

K21 Phase A CURRENT；7-row negative matrix PASS；Phase B approval required

← 返回总图资源、包与媒体交付 →