refactor(aegis): 重构 Extractor/Verifier/Decryptor 架构，清晰化职责边界#31
Merged
heliannuuthus merged 4 commits intomainfrom Mar 5, 2026
Merged
refactor(aegis): 重构 Extractor/Verifier/Decryptor 架构，清晰化职责边界#31heliannuuthus merged 4 commits intomainfrom
heliannuuthus merged 4 commits intomainfrom
Conversation
- Verifier 不再导出构造方法，统一通过 Decryptor.Verifier(clientID) 获取 - 新增 extractor 组件持有 audience(id) 和 signKeyProvider，嵌入 Decryptor - Verifier 内置 audience 校验（paseto.ForAudience），移除 middleware 层冗余检查 - NewFactory/NewGinFactory 去掉 signKeyProvider 参数，内部自动创建 PublicKeyFetcher - service.go 统一走 Decryptor 管理 Verifier，去掉独立的 verifiers map
- 删除 LoadKeyFunc/LoadKeysFunc 函数式适配器和 From 方法，统一为 SingleOf/MultiOf 入口 - SeedProvider 导出，Encrypt()/Sign() 返回新实例避免 mutate 陷阱 - NewExtractor 返回 *Extractor 避免 mutex 复制风险 - RelationChecker 缓存 Issuer 实例避免重复 Argon2id 派生 - NewFactory/NewGinFactory 改为显式接收 encrypt/sign Provider - 清理无用的 Fetcher/Loader 接口
- Extractor 改为非导出的纯桥梁（audience + Provider + ExtractKID），不再管理 Verifier 实例 - Decryptor 不再嵌入 Extractor，改为持有引用；统一管理 per-clientID 的 Verifier 工厂 - Decryptor 构造方法内化 Extractor 创建，外部只需传 audience + 两个 Provider - ExtractKID 从 paseto 工具包内化到 extractor，footer.go 不再暴露解析函数 - Footer 的 ParseFooter 改为 Unmarshal 方法，ExtractKID 改为非导出 - 字段命名语义化：id → audience / clientID - Interpreter 中 DetectType + ParseToken 延迟到验签后一次执行
heliannuuthus
changed the title
- 移除 ComputeSID/ComputePIDFromSeed/ComputeLIDFromSeed 及 paserkSecretPrefix（无引用） - example.toml: redis 改为结构化配置，captcha 扁平化，移除废弃 sso 段 - wire_gen.go: make generate 重新生成
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
audience+Provider+ExtractKID，不再管理 Verifier 实例和缓存(audience, encryptKeyProvider, publicKeyProvider)audience、Provider、ExtractKID能力，自身管理 typed key 缓存和 rebuildParseFooter改为Footer.Unmarshal方法，ExtractKID内化到 extractor，不再对外暴露解析细节Decryptor.Verifier(clientID)路由Changes
架构变更
Extractor：导出 → 非导出（extractor），纯数据桥梁Decryptor：嵌入*Extractor→ 持有extractor *extractor引用，避免方法提升语义泄漏Verifier：嵌入*Extractor→ 嵌入*extractor，构造方法非导出NewDecryptor签名：(ext *Extractor, encryptKeyProvider)→(audience, encryptKeyProvider, publicKeyProvider)命名优化
id→audience（Extractor/Decryptor）id→clientID（Verifier）Test plan