feat(auth): last-login audit fields + ADR-0069 status (P1 completion)

[os-zhuang]

概述

任务是「评估现有代码,不要重复开发」——评估结论:ADR-0069 P1(密码策略 D1 / 账号锁定 D2 / 强制 MFA D3)+ 大部分 P2 早已实现并合并(auth-manager.ts 里 assertPasswordComplexity/assertPasswordNotReused/HIBP 插件/assertAccountNotLocked/recordSignInOutcome/computeAuthGate→MFA_REQUIRED,settings manifest 字段全齐),只是 ADR 文档还标 Proposed。

本 PR 不重复开发已有功能,只补上评估中发现的唯一 P1 缺口 + 纠正文档滞后。

变更

D7 唯一缺口:last-login 审计字段

• platform-objects:sys_user 新增 last_login_at(datetime)+ last_login_ip(text, 45 = IPv6 最大长度),readonly / Admin 分组。
• plugin-auth:AuthManager.stampLastLogin 在每次成功 /sign-in/email 的 after-hook 里写入,独立于锁定阈值(recordSignInOutcome 在锁定关闭时 no-op,审计不应受此影响)。IP 取自可信转发头(x-forwarded-for → cf-connecting-ip → x-real-ip,与 D5 IP 白名单中间件同优先级),截断到列宽。best-effort:绝不把有效登录变成错误。
• 4 个单测(Date 时间戳 + IP、锁定关闭时仍写、IP 超长截断、引擎失败不抛)。

文档纠偏

• ADR-0069 状态 Proposed → Accepted — P1 + P2 implemented,新增「实现状态矩阵」逐条标注已落地 vs 剩余 P2 缺口(per-org sys_organization.allowed_ip_ranges、多节点共享限流 store)。

验证

• 单测:plugin-auth 5 文件、platform-objects 2 文件全绿。
• 真实 app 实测(showcase --fresh :39620,Playwright,见 PR 讨论附图):
  • last_login_at 登录后落库、last_login_ip 从 x-forwarded-for 取到 198.51.100.22(本 PR 改动)
  • 现有 D1:弱密码被 PASSWORD_POLICY_VIOLATION 拒、强密码通过
  • 现有 D2:失败 3 次后锁定,正确密码也返回 403 ACCOUNT_LOCKED

剩余(不在本 PR,建议后续)

• P2 缺口:per-org / per-user allowed_ip_ranges 记录级字段(现仅全局设置);限流共享 store(现为内存,多节点 gap)。
• 这两项已在 ADR-0069 实现状态矩阵中标注。

关联

• [umbrella][security] 授权全生命周期缺口地图 — 包开发 → 生产上线(P0–P3) #2561 P1(企业认证)· ADR-0069 D7 / 状态更新

🤖 Generated with Claude Code

https://claude.ai/code/session_014y5kiH3aPLWtRRRGcVrXcT

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jul 4, 2026 9:28am

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/platform-objects, @objectstack/plugin-auth.

11 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/concepts/implementation-status.mdx(via @objectstack/plugin-auth)
• content/docs/concepts/packages.mdx(via @objectstack/platform-objects, @objectstack/plugin-auth)
• content/docs/concepts/setup-app.mdx(via @objectstack/platform-objects)
• content/docs/getting-started/cli.mdx(via @objectstack/plugin-auth)
• content/docs/guides/auth-sso.mdx(via @objectstack/plugin-auth)
• content/docs/guides/authentication.mdx(via @objectstack/plugin-auth)
• content/docs/guides/kernel-services.mdx(via @objectstack/plugin-auth)
• content/docs/guides/packages.mdx(via @objectstack/platform-objects, @objectstack/plugin-auth)
• content/docs/guides/plugins.mdx(via @objectstack/plugin-auth)
• content/docs/guides/production-readiness.mdx(via @objectstack/plugin-auth)
• content/docs/releases/v9.mdx(via @objectstack/plugin-auth)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.