scriptoriumadmin/skillhub
1
0
Fork 0
mirror of https://github.com/iflytek/skillhub.git synced 2026-08-27 11:14:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

docs(auth): record issue 640 verification

Browse source 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
This commit is contained in:
XiaoSeS 2026-07-30 18:17:42 +08:00
parent 7dc084c47d
commit c089797979
1 changed files with 71 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

71
docs/verification/issue-640.md Normal file
View file

@ -0,0 +1,71 @@
# Issue #640 unified identity core verification
## Scope
- Issue: <https://github.com/iflytek/skillhub/issues/640>
- Pull request: <https://github.com/iflytek/skillhub/pull/643>
- Integration target: `big-main`
- Validation environment: dedicated Hong Kong test server
- Production/default branch: not modified
This record covers P1 / PR 1 from
`docs/21-unified-identity-federation-design.md`. LDAP, DingTalk, CAS, SAML,
SCIM, trusted gateway, Binding V2, profile-sync redesign, and runtime provider
plugins remain outside this PR.
## Automated gates
The following checks ran on the Hong Kong test server:
| Gate | Result |
|---|---|
| `./mvnw -pl skillhub-app -am test -B` with Java 21 | 671 tests, 0 failures, 0 errors, 1 skipped |
| `pnpm run typecheck` | passed |
| `pnpm run lint` | passed |
| `pnpm run build` | passed; only the existing Vite chunk-size warning remained |
| `scripts/smoke-test.sh` against the isolated deployment | 21 passed, 0 failed |
| DCO | passed |
| CLA | passed |
The server image used for pre-integration runtime validation was
`skillhub-server:identity-core-9818333c`, image ID
`sha256:a9055606ad2a551f12319e66f7056e4bda072a8e14a238882cdbdbeb871cf6c8`.
The clean PR branch was rebuilt from the latest `big-main`; its unified-identity
file tree is identical to the validated feature tree.
## PostgreSQL and runtime scenarios
All database scenarios used isolated PostgreSQL 16 and Redis 7 containers.
They did not connect to or modify the shared test-environment database.
| Scenario | Observable result |
|---|---|
| Fresh migration | Flyway V44 applied successfully and created `identity_provider_state` |
| Fixed GitHub authority vector | `oauth2-github`, `https://github.com`, fingerprint `b2a93d58465e3de9e8b6cd127ba18425ae0f80c49c85f18f76086832923ca619`, state `READY` |
| Concurrent first pin | Two application instances converged to one READY row with the same fingerprint; no unique-constraint error |
| Legacy OAuth binding | Existing `identity_binding` row remained byte-for-byte equivalent while the provider moved through first pin to READY |
| Sticky mismatch | State remained `AUTHORITY_MISMATCH` across two application restarts; provider catalog was empty and the authorization route returned 503 |
| Same-authority recovery | SUPER_ADMIN recovery returned 200, changed the state to READY, wrote `PROVIDER_AUTHORITY_RECOVERED`, and updated the catalog without restart |
| Idempotent recovery | Repeating recovery returned `recovered=false` and did not append an audit record |
| Stale READY mismatch window | Recovery returned 409, persisted `AUTHORITY_MISMATCH`, retained the pinned authority/fingerprint, and wrote no recovery audit |
| Transaction rollback | A forced audit insert failure returned 500; the provider state update rolled back and no audit record was added |
| Unknown provider routes | Authorization and callback routes returned 403 without an upstream redirect |
| V43 to V44 upgrade | A database initialized by `v0.2.15` upgraded successfully and retained its legacy OAuth binding |
| Mixed-version and rollback | Current and `v0.2.15` servers were simultaneously healthy against the V44 database; the old provider endpoint returned 200 |
| Redis session compatibility | A local session created by `v0.2.15` was accepted by the current server for the same user |
## Remaining integration gate
After PR #643 is merged into `big-main`, build immutable Server/Web images from
the merge commit, deploy them to the shared test environment, and verify:
1. health, login catalog, and local-password login through the configured test
domain;
2. unknown provider authorization/callback rejection;
3. V44 migration and READY provider state in the shared database;
4. existing Redis sessions and OAuth bindings;
5. recovery authorization and audit behavior;
6. logs contain no credentials or unexpected identity errors.
Do not merge this work into `main` until the shared-environment gate is
recorded here.