fix: avoid admin dependency on login entrypoints

server/auth_audit.go

@@ -93,7 +93,8 @@ func checkUserLoginIPWhitelist(tenantID types.TenantID, uid types.Uid, remoteAdd
 		if errors.Is(err, types.ErrUnsupported) {
 			return nil
 		}
-		return err
+		logs.Warn.Printf("login ip whitelist user lookup failed tenant:%d uid:%s err:%v", tenantID, uid, err)
+		return nil
 	}
 	if result == nil || len(result.Items) == 0 {
 		return nil
@@ -118,7 +119,8 @@ func checkUserLoginIPWhitelist(tenantID types.TenantID, uid types.Uid, remoteAdd
 func checkTenantLoginIPWhitelist(tenantID types.TenantID, platform, remoteAddr string) error {
 	config, err := loadTenantLoginIPWhitelist(tenantID)
 	if err != nil {
-		return err
+		logs.Warn.Printf("login ip whitelist tenant lookup failed tenant:%d platform:%s err:%v", tenantID, platform, err)
+		return nil
 	}
 	if config == nil {
 		return nil
@@ -154,7 +156,7 @@ func loadTenantLoginIPWhitelist(tenantID types.TenantID) (*tenantLoginIPWhitelis
 			result := cached.config
 			return &result, nil
 		}
-		return nil, err
+		config = &tenantLoginIPWhitelistConfig{TenantID: tenantID, AppList: []string{}, WebList: []string{}}
 	}
 	if config == nil {
 		config = &tenantLoginIPWhitelistConfig{TenantID: tenantID, AppList: []string{}, WebList: []string{}}

server/store/store.go

@@ -296,6 +296,16 @@ func (tenantsMapper) GetByCode(code string) (*types.Tenant, error) {
 	if tenant, ok := tenantByCodeCache.get(code); ok {
 		return cloneTenant(tenant), nil
 	}
+	tenantAdp, ok := adp.(adapter.TenantAdapter)
+	if ok {
+		if tenant, err := tenantAdp.TenantGetByCode(code); err == nil && tenant != nil {
+			tenantByCodeCache.set(code, cloneTenant(tenant))
+			tenantByIDCache.set(strconv.FormatInt(int64(tenant.ID), 10), cloneTenant(tenant))
+			return tenant, nil
+		} else if err != nil && !errors.Is(err, types.ErrNotFound) {
+			logs.Warn.Printf("local tenant by code lookup failed: code=%s err=%v", code, err)
+		}
+	}
 	if adminInternalConfigProvider != nil {
 		if tenant, err := adminInternalConfigProvider.GetTenantByCode(code); err == nil && tenant != nil {
 			tenantByCodeCache.set(code, cloneTenant(tenant))
@@ -305,16 +315,10 @@ func (tenantsMapper) GetByCode(code string) (*types.Tenant, error) {
 			logs.Warn.Printf("admin internal tenant by code fallback failed: code=%s err=%v", code, err)
 		}
 	}
-	tenantAdp, ok := adp.(adapter.TenantAdapter)
 	if !ok {
 		return nil, types.ErrUnsupported
 	}
-	tenant, err := tenantAdp.TenantGetByCode(code)
+	return tenantAdp.TenantGetByCode(code)
-	if err == nil && tenant != nil {
-		tenantByCodeCache.set(code, cloneTenant(tenant))
-		tenantByIDCache.set(strconv.FormatInt(int64(tenant.ID), 10), cloneTenant(tenant))
-	}
-	return tenant, err
 }
 
 // GetByID resolves an internal tenant ID to its registry record.
@@ -326,6 +330,16 @@ func (tenantsMapper) GetByID(id types.TenantID) (*types.Tenant, error) {
 	if tenant, ok := tenantByIDCache.get(idKey); ok {
 		return cloneTenant(tenant), nil
 	}
+	tenantAdp, ok := adp.(adapter.TenantAdapter)
+	if ok {
+		if tenant, err := tenantAdp.TenantGetByID(id); err == nil && tenant != nil {
+			tenantByIDCache.set(idKey, cloneTenant(tenant))
+			tenantByCodeCache.set(tenant.Code, cloneTenant(tenant))
+			return tenant, nil
+		} else if err != nil && !errors.Is(err, types.ErrNotFound) {
+			logs.Warn.Printf("local tenant by id lookup failed: tenant=%d err=%v", id, err)
+		}
+	}
 	if adminInternalConfigProvider != nil {
 		if tenant, err := adminInternalConfigProvider.GetTenantByID(id); err == nil && tenant != nil {
 			tenantByIDCache.set(idKey, cloneTenant(tenant))
@@ -335,22 +349,29 @@ func (tenantsMapper) GetByID(id types.TenantID) (*types.Tenant, error) {
 			logs.Warn.Printf("admin internal tenant by id fallback failed: tenant=%d err=%v", id, err)
 		}
 	}
-	tenantAdp, ok := adp.(adapter.TenantAdapter)
 	if !ok {
 		return nil, types.ErrUnsupported
 	}
-	tenant, err := tenantAdp.TenantGetByID(id)
+	return tenantAdp.TenantGetByID(id)
-	if err == nil && tenant != nil {
-		tenantByIDCache.set(idKey, cloneTenant(tenant))
-		tenantByCodeCache.set(tenant.Code, cloneTenant(tenant))
-	}
-	return tenant, err
 }
 
 func (tenantsMapper) ListActive(limit int) ([]types.Tenant, error) {
 	if limit <= 0 {
 		limit = 1000
 	}
+	tenantAdp, ok := adp.(adapter.TenantAdapter)
+	if ok {
+		if tenants, err := tenantAdp.TenantListActive(limit); err == nil {
+			for i := range tenants {
+				tenant := tenants[i]
+				tenantByIDCache.set(strconv.FormatInt(int64(tenant.ID), 10), cloneTenant(&tenant))
+				tenantByCodeCache.set(tenant.Code, cloneTenant(&tenant))
+			}
+			return tenants, nil
+		} else {
+			logs.Warn.Printf("local active tenants lookup failed: err=%v", err)
+		}
+	}
 	if adminInternalConfigProvider != nil {
 		if tenants, err := adminInternalConfigProvider.ListActiveTenants(limit); err == nil {
 			for i := range tenants {
@@ -363,7 +384,6 @@ func (tenantsMapper) ListActive(limit int) ([]types.Tenant, error) {
 			logs.Warn.Printf("admin internal active tenants fallback failed: err=%v", err)
 		}
 	}
-	tenantAdp, ok := adp.(adapter.TenantAdapter)
 	if !ok {
 		return nil, types.ErrUnsupported
 	}

server/tenant_login_ip_whitelist_test.go

@@ -69,3 +69,15 @@ func TestCheckTenantLoginIPWhitelistEmptyMeansUnrestricted(t *testing.T) {
 		t.Fatalf("未配置渠道白名单时不应限制登录: %v", err)
 	}
 }
+
+func TestCheckTenantLoginIPWhitelistProviderFailureAllowsLogin(t *testing.T) {
+	resetTenantLoginIPWhitelistTestState(t)
+	tenantID := types.TenantID(1)
+	loginIPWhitelistProvider = staticTenantLoginIPWhitelistProvider{err: errors.New("admin timeout")}
+	if err := checkTenantLoginIPWhitelist(tenantID, "ios", "203.0.113.10:443"); err != nil {
+		t.Fatalf("白名单配置服务失败时不应阻断登录: %v", err)
+	}
+	if err := checkTenantLoginIPWhitelist(tenantID, "web", "198.51.100.8:443"); err != nil {
+		t.Fatalf("白名单失败空配置应被短暂缓存并继续放行: %v", err)
+	}
+}