jim800121chen
22f0837ba8
從 edge-ai-platform POC 轉為正式產品的雲端後端，含以下整合階段：
- Phase 0：雛形骨架 — `cmd/api-server` (REST :3721) + `cmd/remote-proxy`
(tunnel :3800 / internal :3801) 雙 binary 共用 internal/，沿用 POC 的
WebSocket+yamux tunnel 協定但解耦 relay 與 API
- Phase 0.6：OIDC BFF 接 Innovedus Member Center
- internal/oidc package（coreos/go-oidc + PKCE S256 + state + nonce）
- internal/usersession package（HMAC-SHA256 cookie + RotateSessionID
防 session fixation, OWASP ASVS V3.2.1）
- 4 個 OIDC handler（/api/auth/login｜callback｜me｜logout）+ AuthMiddleware
- 完全拔除 StaticAuthProvider，OIDC 是唯一認證路徑
- 9 個 ADR（含 ADR-010 BFF / ADR-011 取代 static auth /
ADR-012 pending session shared cookie / ADR-013 PKCE-only public client）
- Phase 0.7：A1 改造 + security audit 修復
- OIDC ClientSecret 變選填，支援 stage MC 的 public PKCE-only client
（AuthStyleInParams 強制 token endpoint 不送 client_secret）
- 預留 ServiceClient* 欄位給未來 client_credentials grant
- 移除 13+ 處 resolveUserID(uc, StaticUserID) fallback 改 strict mode
（Audit C1：multi-tenant 隔離破口）
- Pairing exchange MarkUsed 失敗 abort + revoke session token（Audit M3）
- 新增 all_endpoints_require_auth_test 整合測試（51 endpoint × 401）
驗證：go test -race -count=3 ./... 17 packages 全綠 / go vet 0 warning
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
59 lines
2.3 KiB
Modula-2
59 lines
2.3 KiB
Modula-2
module visiona-backend
|
||
|
||
go 1.26
|
||
|
||
// 依賴狀態：
|
||
// - B2 引入 testify（單元測試）
|
||
// - B3 引入 gorilla/websocket + hashicorp/yamux（relay + tunnel client + wsconn）
|
||
// - B4 引入 gin-gonic/gin + gin-contrib/cors + google/uuid（api-server router / middleware / id）
|
||
// 後續任務會加入：
|
||
// - github.com/go-playground/validator/v10 (B5 request validation)
|
||
// - github.com/aws/aws-sdk-go-v2 (可選，S3 儲存層)
|
||
|
||
require (
|
||
github.com/coreos/go-oidc/v3 v3.18.0
|
||
github.com/gin-contrib/cors v1.7.7
|
||
github.com/gin-gonic/gin v1.12.0
|
||
github.com/go-jose/go-jose/v4 v4.1.4
|
||
github.com/google/uuid v1.6.0
|
||
github.com/gorilla/websocket v1.5.3
|
||
github.com/hashicorp/yamux v0.1.2
|
||
github.com/stretchr/testify v1.11.1
|
||
golang.org/x/oauth2 v0.36.0
|
||
)
|
||
|
||
require (
|
||
github.com/bytedance/gopkg v0.1.3 // indirect
|
||
github.com/bytedance/sonic v1.15.0 // indirect
|
||
github.com/bytedance/sonic/loader v0.5.0 // indirect
|
||
github.com/cloudwego/base64x v0.1.6 // indirect
|
||
github.com/davecgh/go-spew v1.1.1 // indirect
|
||
github.com/gabriel-vasile/mimetype v1.4.12 // indirect
|
||
github.com/gin-contrib/sse v1.1.0 // indirect
|
||
github.com/go-playground/locales v0.14.1 // indirect
|
||
github.com/go-playground/universal-translator v0.18.1 // indirect
|
||
github.com/go-playground/validator/v10 v10.30.1 // indirect
|
||
github.com/goccy/go-json v0.10.5 // indirect
|
||
github.com/goccy/go-yaml v1.19.2 // indirect
|
||
github.com/json-iterator/go v1.1.12 // indirect
|
||
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
|
||
github.com/leodido/go-urn v1.4.0 // indirect
|
||
github.com/mattn/go-isatty v0.0.20 // indirect
|
||
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
||
github.com/modern-go/reflect2 v1.0.2 // indirect
|
||
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
|
||
github.com/pmezard/go-difflib v1.0.0 // indirect
|
||
github.com/quic-go/qpack v0.6.0 // indirect
|
||
github.com/quic-go/quic-go v0.59.0 // indirect
|
||
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
|
||
github.com/ugorji/go/codec v1.3.1 // indirect
|
||
go.mongodb.org/mongo-driver/v2 v2.5.0 // indirect
|
||
golang.org/x/arch v0.23.0 // indirect
|
||
golang.org/x/crypto v0.48.0 // indirect
|
||
golang.org/x/net v0.51.0 // indirect
|
||
golang.org/x/sys v0.41.0 // indirect
|
||
golang.org/x/text v0.35.0 // indirect
|
||
google.golang.org/protobuf v1.36.10 // indirect
|
||
gopkg.in/yaml.v3 v3.0.1 // indirect
|
||
)
|