IDENTITY & ACCESS SECURITY
身份与安全状态 正式身份、邮箱验证、Session、设备和 License 风险状态的服务端快照。
FAIL CLOSED · AUDITED 账户 License 设备 安全 Sessions PRODUCTION AUTH CHANNEL UNCONFIGURED 正式认证服务尚未配置
SESSION NO FORMAL SESSION HttpOnly · Secure · SameSite=Lax
RESEARCH SCOPE RESEARCH ONLY 受控研究写入
SAFETY NO TRADING 券商、支付与实盘永久关闭
正式认证服务尚未配置 Authentication session required PRODUCTION_AUTH_CHANNEL_CONFIGURED=false · FAIL CLOSED 当前用户 NOT AUTHENTICATED
邮箱验证 UNVERIFIED
用户状态 NOT AVAILABLE
License 状态 NOT ASSIGNED
Demo Auth 生产环境 DISABLED
COOKIE & TOKEN POLICY
Session 防护 OPAQUE TOKENS Access Cookie HttpOnly · Secure · Lax
Refresh Cookie HttpOnly · Secure · Scoped
CSRF DOUBLE SUBMIT
Refresh Rotation ENFORCED
明文 Token 存储 FORBIDDEN
SESSION NO SESSION
DEVICE NOT AVAILABLE
ACTIVE DEVICES 0
AUTH EVENTS APPEND ONLY
TRADING WRITE CLOSED
BROKER WRITE CLOSED
PAYMENT CLOSED
LIVE TRADING CLOSED
NO CLIENT-SIDE IDENTITY CLAIMS 前端不能声明 user_id、tier、License 或 Feature Gate;所有权限由服务端会话与权益快照决定。 RESEARCH ONLY · NO TRADING 身份认证和设备授权不改变交易、券商、支付、Webhook 与实盘关闭状态。