ci: 复用部署服务器缓存并支持 HTTPS 同源登录

internal/handler/identity.go

@@ -35,10 +35,13 @@ type IdentityOptions struct {
 	Limiter          LoginLimiter
 	DevelopmentLogin bool
 	SecureCookie     bool
+	PublicOrigin     string
 }
 
 const sessionCookie = "veyra_admin_session"
 
+type publicOriginContextKey struct{}
+
 func bindIdentity(r *gin.Engine, options IdentityOptions) {
 	r.SetTrustedProxies(nil)
 	adminAuth := func(c *gin.Context) { authenticate(c, options, "admin") }
@@ -210,6 +213,9 @@ func sameOrigin(r *http.Request) bool {
 	if err != nil || origin.Host == "" || origin.User != nil || origin.Path != "" || origin.RawQuery != "" || origin.Fragment != "" {
 		return false
 	}
+	if expected, _ := r.Context().Value(publicOriginContextKey{}).(string); expected != "" {
+		return origin.Host == r.Host && origin.Scheme+"://"+origin.Host == expected
+	}
 	scheme := "http"
 	if r.TLS != nil {
 		scheme = "https"