倪程伟 bccc5767ed feat(webchat): visitorToken revocation + 7-day expiry + Caffeine cache (epic #355 PR 2) ... Closes the "no way to ban a single visitor without burning the global JWT secret" gap from the epic. Two changes: 1. Token format: HMAC payload now includes exp, format is `<base64sig>.<expEpochSec>`. Default TTL 7 days (VISITOR_TOKEN_TTL_SECONDS). Expiry participates in the HMAC, so bumping it client-side invalidates the signature. /stream still mints fresh tokens on first contact — a revoked visitor can start a new /stream (gets a new token), they just can't use the old one on management endpoints. 2. WebChatTokenRevocationService — DB-backed registry (webchat_revoked_visitor table from V148) with a 5-minute Caffeine cache in front. revoke() / unrevoke() / isRevoked(). The cache accepts up to 10min eventual consistency across instances — webchat is low-volume, and a fresh node sees revocations immediately on cold cache. DB remains source of truth. WebChatController.verifyVisitorToken becomes an instance method that chains verifyVisitorTokenSignature (static, HMAC + exp) with isRevoked (instance, DB + cache). All 9 management endpoints now check revocation transitively. Admin endpoint: POST /api/v1/admin/webchat/revoked-visitor (and DELETE to un-revoke). Mounted under /api/v1/admin/** so it requires a MateClaw JWT — visitors can't reach it. Records an audit row (action=webchat.revoke- visitor, resourceType=CHANNEL) via AuditEventService. Tests: - WebChatTokenRevocationTest (@SpringBootTest, 7 cases): revoke blocks /sessions with 401, un-revoke restores, double-revoke idempotent, expired token rejected even without revocation, /stream unaffected (signature still verifies), admin endpoint inserts row + audit. - WebChatVisitorTokenTest extended to 16 cases — added expired-token, tampered-exp, and "differs when exp differs" coverage; existing verify_* cases moved to verifyVisitorTokenSignature (the static half). Regression: WebChatSchemaFieldsTest (5/5), WebChatCreateSessionTest (9/9), WebChatSessionManagementTest (5/5), WebChatStopStreamTest (5/5). Part of epic #355.		2026-06-18 06:33:17 +08:00
..
vip/mate	feat(webchat): visitorToken revocation + 7-day expiry + Caffeine cache (epic #355 PR 2)	2026-06-18 06:33:17 +08:00