feat: T-01 JWT 鉴权——auth_service(Auth SDK: HS256/RS256 验签+必填claims显式校验+jti吊销 fail-open) + deps 工厂替换(Bearer 全环境, debug 头降级 dev 兜底) + X-Agent-Type 交叉校验(手册§4.6/§5.4 准入矩阵) + issue_dev_token CLI + redis_gateway exists/set_ex + lifespan 改验 jwt_ready + tests/test_auth_jwt 18 例, 228 绿

2026-09-07 02:23:33 +08:00
parent 725a38d203
commit 36f476f450
10 changed files with 721 additions and 44 deletions
@@ -28,8 +28,12 @@ EMBED_MODEL=bge-m3
 DEEPSEEK_API_KEY=
 DEEPSEEK_BASE_URL=https://api.deepseek.com

-# JWT (dev only — production use RS256 + IdP)
+# JWT (T-01): production uses RS256 public key from IdP; empty path -> HS256 dev secret
+# (HS256 is rejected at startup when APP_ENV != development)
+JWT_PUBLIC_KEY_PATH=
 JWT_DEV_SECRET=change-me-in-dev-only
+JWT_ISSUER=https://idp.jinrong.internal
+JWT_AUDIENCE=agent-gateway

 # Risk thresholds (defaults = frozen rules, see docs/PRD/附-风控规则表.md)
 RISK_ASSESSMENT_VALID_DAYS=365