feat: let administrators view and copy encrypted integration credentials

2026-09-27 13:48:26 +08:00
parent 5555a7b342
commit d54bdd9847
38 changed files with 905 additions and 71 deletions
--- a/internal/storage/mysql/migrations/000033_credential_token_vault.up.sql
+++ b/internal/storage/mysql/migrations/000033_credential_token_vault.up.sql
@@ -0,0 +1,6 @@
+-- 管理员可回看当前 Token；旧记录保留为空，导入只补密文，不轮换秘密。
+ALTER TABLE orbit_credentials
+  ADD COLUMN secret_key_id VARCHAR(64) CHARACTER SET ascii COLLATE ascii_bin NULL COMMENT '当前 Token 密文使用的主密钥标识；空表示尚未保管，主密钥不存数据库',
+  ADD COLUMN secret_ciphertext VARBINARY(1024) NULL COMMENT '当前 Token 的 AES-256-GCM nonce 与认证密文；空表示旧凭据仅存摘要',
+  ADD CONSTRAINT ck_credential_ciphertext CHECK ((secret_key_id IS NULL AND secret_ciphertext IS NULL) OR (secret_key_id IS NOT NULL AND secret_ciphertext IS NOT NULL AND LENGTH(secret_key_id)>0 AND LENGTH(secret_ciphertext)>=28)),
+  COMMENT='命名空间凭据、认证摘要、授权范围及可选的当前 Token 密文';