fix(auth): decode GitHub signing keys as standard Base64 / 修复 GitHub 登录密钥解码

scripts/deploy.ts

@@ -10,6 +10,7 @@ import { previewOrigin } from '../src/forwarding/security.ts';
 import { maskSecrets, prepareEncryptionSecret, readWorkerSecretNames, readWorkerVariable } from './deployment-secrets.ts';
 import { prepareAuthentication, requiredAuthSecrets } from './deployment-auth.ts';
 import { readWorkspaceState, updateWorkspaceState } from './workspace-state.ts';
+import { verifyGithubDeployment } from './deployment-health.ts';
 
 const root = fileURLToPath(new URL('../', import.meta.url));
 const generatedConfig = '.wrangler.generated.toml';
@@ -90,6 +91,10 @@ async function main(): Promise<void> {
   for (const name of ['ENCRYPTION_KEY', ...requiredAuthSecrets(settings.authProvider)]) {
     if (!deployedSecrets.has(name)) throw new Error(`部署后缺少 Worker Secret：${name}。`);
   }
+  if (settings.authProvider === 'github') {
+    await verifyGithubDeployment(hostname, settings.githubClientId!);
+    console.log('GitHub 登录入口签名与 D1 工作区验收通过（真实 GitHub 授权仍需管理员登录完成）。');
+  }
   // 预览 Worker 只做代理入口和 DO 绑定，不执行迁移、不写入任何 Secret。
   if (settings.deployPreview) {
     const previewConfig = createPreviewDeploymentConfig(template, settings, preview!);

scripts/deployment-health.ts

@@ -0,0 +1,34 @@
+/**
+ * 在正式入口验证 GitHub 登录，不跟随跳转、不访问用户资料。
+ * Secret 名称齐全不代表运行时可用：必须实际签发 flow Cookie 并读取 D1 工作区。
+ */
+export async function verifyGithubDeployment(
+  hostname: string,
+  clientId: string,
+  fetcher: typeof fetch = fetch,
+): Promise<void> {
+  const origin = `https://${hostname}`;
+  async function probe(path: string): Promise<Response> {
+    try {
+      return await fetcher(`${origin}${path}`, { redirect: 'manual', signal: AbortSignal.timeout(30_000) });
+    } catch {
+      // 不把网络异常的原始内容或带 OAuth state 的响应头写入部署日志。
+      throw new Error(`GitHub 登录入口验收无法连接 ${path}，请检查正式域名的 DNS、证书及网络后重跑 Deploy。`);
+    }
+  }
+  const login = await probe('/auth/login');
+  const location = login.headers.get('Location');
+  const target = location && URL.canParse(location, origin) ? new URL(location, origin) : null;
+  if (login.status !== 302 || target?.origin !== 'https://github.com'
+    || target.pathname !== '/login/oauth/authorize'
+    || target.searchParams.get('client_id') !== clientId
+    || target.searchParams.get('redirect_uri') !== `${origin}/auth/callback`
+    || !login.headers.getSetCookie().some((value) => value.startsWith('__Host-edgessh-oauth='))) {
+    throw new Error(`GitHub 登录入口验收失败（/auth/login HTTP ${login.status}）。请检查 Worker 配置与正式入口，修复后重跑 Deploy；不要更换 ENCRYPTION_KEY。`);
+  }
+  const account = await probe('/api/auth/me');
+  // 无 Cookie 的请求必须拒绝授权；500/503 表示数据库或认证状态仍不可用。
+  if (account.status !== 401) {
+    throw new Error(`GitHub 工作区验收失败（/api/auth/me HTTP ${account.status}）。请检查 D1 迁移与认证方式是否部署完成，再重跑 Deploy。`);
+  }
+}