@limecloud/cli 0.0.0-stage → 0.6.0

package/dist/identity.json

@@ -0,0 +1,1453 @@
+{
+  "openapi": "3.1.0",
+  "info": {
+    "title": "Lime Identity API",
+    "version": "0.6.0",
+    "description": "Implemented public OAuth 2.0 and OpenID Connect endpoints. Plain protocol responses; separate from authenticated management BFF APIs."
+  },
+  "servers": [
+    {
+      "url": "https://auth.limeai.run",
+      "description": "Production"
+    },
+    {
+      "url": "https://auth.limeai.local",
+      "description": "Local development"
+    }
+  ],
+  "paths": {
+    "/.well-known/openid-configuration": {
+      "get": {
+        "operationId": "identity_discovery",
+        "summary": "OpenID configuration",
+        "x-lime-summary-zh-CN": "OpenID 配置",
+        "description": "Read issuer metadata on the Auth host. Use an OIDC library to discover endpoints and supported algorithms.",
+        "x-lime-zh-CN": "在 Auth 域名读取 issuer 元数据，使用 OIDC 库发现端点与支持算法。",
+        "tags": [
+          "Identity"
+        ],
+        "security": [],
+        "responses": {
+          "200": {
+            "description": "Issuer metadata.",
+            "x-lime-zh-CN": "Issuer 元数据。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Discovery"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/oauth/authorize": {
+      "get": {
+        "operationId": "identity_authorize",
+        "summary": "Authorize a user",
+        "x-lime-summary-zh-CN": "用户授权",
+        "description": "Navigate the user's browser here. Register the client and exact redirect URI first. Production clients must be activated against a published version; installation authorization requires both installation_id and space_id. User consent remains separate from installation approval. The callback contains code+state or error+state; never accept it without checking the bound state.",
+        "x-lime-zh-CN": "将用户浏览器导航至此。先登记客户端和精确回调。生产客户端须基于已发布版本启用；安装授权须同时提供 installation_id 和 space_id。个人同意与安装批准分别判定。回调包含 code+state 或 error+state，必须校验绑定的 state 后再处理。",
+        "tags": [
+          "Identity"
+        ],
+        "security": [],
+        "parameters": [
+          {
+            "name": "response_type",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "const": "code"
+            }
+          },
+          {
+            "name": "client_id",
+            "in": "query",
+            "required": true,
+            "description": "Public or confidential user-client ID. Always send it in this query; never send a client secret to the authorization endpoint.",
+            "x-lime-zh-CN": "公共或机密用户客户端 ID。所有用户客户端均在此查询参数中提供 ID，不得向授权端点发送 Secret。",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "redirect_uri",
+            "in": "query",
+            "required": true,
+            "description": "Exact registered callback. Production requires HTTPS; sandbox accepts an explicitly registered HTTP loopback callback.",
+            "x-lime-zh-CN": "精确匹配已登记回调。生产要求 HTTPS；沙箱可使用显式登记的 HTTP 回环地址。",
+            "schema": {
+              "type": "string",
+              "format": "uri"
+            }
+          },
+          {
+            "name": "scope",
+            "in": "query",
+            "required": false,
+            "description": "Space-separated scopes registered on this client. openid is required for sign-in; profile, email and offline_access are optional.",
+            "x-lime-zh-CN": "客户端已登记的权限，以空格分隔。登录须含 openid，可选 profile、email、offline_access。",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "state",
+            "in": "query",
+            "required": true,
+            "description": "Unguessable transaction value, at least 16 characters. Compare it with the value bound to the initiating browser session before accepting any callback.",
+            "x-lime-zh-CN": "至少 16 字符的不可预测事务值。接收任何回调前，与发起浏览器会话绑定的原值比较。",
+            "schema": {
+              "type": "string",
+              "minLength": 16
+            }
+          },
+          {
+            "name": "nonce",
+            "in": "query",
+            "required": false,
+            "description": "Unguessable value, at least 16 characters, required when requesting openid. Verify it in the ID token.",
+            "x-lime-zh-CN": "请求 openid 时必填，至少 16 字符且不可预测，并在 ID Token 中校验。",
+            "schema": {
+              "type": "string",
+              "minLength": 16
+            }
+          },
+          {
+            "name": "code_challenge",
+            "in": "query",
+            "required": true,
+            "description": "Base64url(SHA256(code_verifier)), without padding.",
+            "x-lime-zh-CN": "对 code_verifier 计算 SHA-256 后进行无填充 Base64url 编码。",
+            "schema": {
+              "type": "string",
+              "minLength": 43,
+              "maxLength": 43
+            }
+          },
+          {
+            "name": "code_challenge_method",
+            "in": "query",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "const": "S256"
+            }
+          },
+          {
+            "name": "response_mode",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "enum": [
+                "query"
+              ]
+            }
+          },
+          {
+            "name": "prompt",
+            "in": "query",
+            "required": false,
+            "description": "Optional prompt. Silent consent reuse is not implemented; prompt=none can return login_required or consent_required.",
+            "x-lime-zh-CN": "可选交互方式。当前未实现静默复用同意，prompt=none 可能返回 login_required 或 consent_required。",
+            "schema": {
+              "type": "string",
+              "enum": [
+                "login",
+                "consent",
+                "none"
+              ]
+            }
+          },
+          {
+            "name": "max_age",
+            "in": "query",
+            "required": false,
+            "description": "Maximum acceptable authentication age, in seconds.",
+            "x-lime-zh-CN": "可接受的认证最长经过秒数。",
+            "schema": {
+              "type": "integer",
+              "minimum": 0,
+              "maximum": 2147483647
+            }
+          },
+          {
+            "name": "ui_locales",
+            "in": "query",
+            "required": false,
+            "description": "Preferred sign-in UI languages, in order; supports en and zh-CN.",
+            "x-lime-zh-CN": "按优先级排列的认证界面语言，支持 en 和 zh-CN。",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "installation_id",
+            "in": "query",
+            "required": false,
+            "description": "Production installation ID. Supply together with space_id when authorizing an enterprise installation.",
+            "x-lime-zh-CN": "生产安装 ID。授权企业安装时须与 space_id 同时传入。",
+            "schema": {
+              "type": "string",
+              "maxLength": 40
+            }
+          },
+          {
+            "name": "space_id",
+            "in": "query",
+            "required": false,
+            "description": "Workspace containing the installation. This does not select a global current workspace.",
+            "x-lime-zh-CN": "安装所属的工作空间，不用于选择全局当前空间。",
+            "schema": {
+              "type": "string",
+              "maxLength": 40
+            }
+          }
+        ],
+        "responses": {
+          "302": {
+            "description": "Redirect to sign-in, consent or the validated callback. Callback codes are single-use and short-lived.",
+            "x-lime-zh-CN": "跳转登录、同意页或已验证的回调。回调授权码一次性且短期有效。",
+            "headers": {
+              "Location": {
+                "required": true,
+                "schema": {
+                  "type": "string",
+                  "format": "uri"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Invalid protocol request or grant. Device polling also uses this status for authorization_pending and slow_down.",
+            "x-lime-zh-CN": "协议请求或授权无效。设备轮询的 authorization_pending 和 slow_down 也使用此状态。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Client authentication failed.",
+            "x-lime-zh-CN": "客户端认证失败。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "Rate limit exceeded. Wait before retrying.",
+            "x-lime-zh-CN": "请求超过限流窗口，等待后重试。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "headers": {
+              "Retry-After": {
+                "schema": {
+                  "type": "integer"
+                },
+                "description": "Seconds before another attempt."
+              }
+            }
+          },
+          "503": {
+            "description": "A required dependency is unavailable.",
+            "x-lime-zh-CN": "必要依赖暂时不可用。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "Protocol processing failed.",
+            "x-lime-zh-CN": "协议处理失败。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/oauth/token": {
+      "post": {
+        "operationId": "identity_token",
+        "summary": "Exchange or refresh tokens",
+        "x-lime-summary-zh-CN": "兑换或刷新令牌",
+        "description": "Form-encoded request, not JSON. Public clients send client_id and no secret. Confidential and machine clients use client_secret_basic. Code+S256 is required for all authorization-code clients. Installation context is frozen before token exchange; installation_id, space_id, expected_generation and expected_release_id are rejected here. Responses are plain OAuth JSON, without a data envelope.",
+        "x-lime-zh-CN": "使用表单编码，不接收 JSON。公共客户端提交 client_id，不持有 Secret；机密与机器客户端使用 client_secret_basic。所有授权码客户端均要求 S256。安装上下文在兑换前冻结，此处拒绝 installation_id、space_id、expected_generation、expected_release_id。响应直接为 OAuth JSON，没有 data 包装。",
+        "tags": [
+          "Identity"
+        ],
+        "security": [
+          {
+            "ClientSecretBasic": []
+          },
+          {}
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/x-www-form-urlencoded": {
+              "schema": {
+                "$ref": "#/components/schemas/TokenRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Tokens for the accepted grant.",
+            "x-lime-zh-CN": "已接受授权对应的令牌。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TokenResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Invalid protocol request or grant. Device polling also uses this status for authorization_pending and slow_down.",
+            "x-lime-zh-CN": "协议请求或授权无效。设备轮询的 authorization_pending 和 slow_down 也使用此状态。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Client authentication failed.",
+            "x-lime-zh-CN": "客户端认证失败。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "Rate limit exceeded. Wait before retrying.",
+            "x-lime-zh-CN": "请求超过限流窗口，等待后重试。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "headers": {
+              "Retry-After": {
+                "schema": {
+                  "type": "integer"
+                },
+                "description": "Seconds before another attempt."
+              }
+            }
+          },
+          "503": {
+            "description": "A required dependency is unavailable.",
+            "x-lime-zh-CN": "必要依赖暂时不可用。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "Protocol processing failed.",
+            "x-lime-zh-CN": "协议处理失败。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/oauth/device/authorization": {
+      "post": {
+        "operationId": "identity_device_authorization",
+        "summary": "Start device authorization",
+        "x-lime-summary-zh-CN": "发起设备授权",
+        "description": "Use for devices that cannot complete a browser callback. Supports public or confidential user clients, not machine clients. Send client_id for public clients, or use HTTP Basic for confidential clients. Do not send PKCE fields. Show the returned verification URI and user code, then poll /oauth/token using the returned interval. The device code expires after 600 seconds.",
+        "x-lime-zh-CN": "用于无法完成浏览器回调的设备。支持公共或机密用户客户端，不支持机器客户端。公共客户端提交 client_id，机密客户端使用 HTTP Basic。不得传入 PKCE 字段。展示返回的验证地址与用户码，再按 interval 轮询 /oauth/token。设备码 600 秒后到期。",
+        "tags": [
+          "Identity"
+        ],
+        "security": [
+          {
+            "ClientSecretBasic": []
+          },
+          {}
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/x-www-form-urlencoded": {
+              "schema": {
+                "$ref": "#/components/schemas/DeviceAuthorizationRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Device authorization transaction.",
+            "x-lime-zh-CN": "设备授权事务。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/DeviceAuthorizationResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Invalid protocol request or grant. Device polling also uses this status for authorization_pending and slow_down.",
+            "x-lime-zh-CN": "协议请求或授权无效。设备轮询的 authorization_pending 和 slow_down 也使用此状态。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Client authentication failed.",
+            "x-lime-zh-CN": "客户端认证失败。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "Rate limit exceeded. Wait before retrying.",
+            "x-lime-zh-CN": "请求超过限流窗口，等待后重试。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "headers": {
+              "Retry-After": {
+                "schema": {
+                  "type": "integer"
+                },
+                "description": "Seconds before another attempt."
+              }
+            }
+          },
+          "503": {
+            "description": "A required dependency is unavailable.",
+            "x-lime-zh-CN": "必要依赖暂时不可用。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "Protocol processing failed.",
+            "x-lime-zh-CN": "协议处理失败。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/oauth/userinfo": {
+      "get": {
+        "operationId": "identity_userinfo",
+        "summary": "Read user information",
+        "x-lime-summary-zh-CN": "读取用户资料",
+        "description": "Requires an active user access token with openid. Optional profile and email scopes control returned fields. ID tokens and machine tokens are not valid UserInfo credentials. Installation claims are present only for a current bound grant.",
+        "x-lime-zh-CN": "要求当前有效且具有 openid 的用户访问令牌。profile 和 email 控制返回字段。ID Token 和机器令牌不能用于 UserInfo。仅当前有效绑定授权返回安装声明。",
+        "tags": [
+          "Identity"
+        ],
+        "security": [
+          {
+            "Bearer": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Permitted user claims.",
+            "x-lime-zh-CN": "允许返回的用户声明。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/UserInfo"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Invalid or revoked token.",
+            "x-lime-zh-CN": "令牌无效或已撤销。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "A user grant with the required scope is missing.",
+            "x-lime-zh-CN": "缺少要求的用户授权。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "Rate limit exceeded. Wait before retrying.",
+            "x-lime-zh-CN": "请求超过限流窗口，等待后重试。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "headers": {
+              "Retry-After": {
+                "schema": {
+                  "type": "integer"
+                },
+                "description": "Seconds before another attempt."
+              }
+            }
+          },
+          "503": {
+            "description": "A required dependency is unavailable.",
+            "x-lime-zh-CN": "必要依赖暂时不可用。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "Protocol processing failed.",
+            "x-lime-zh-CN": "协议处理失败。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          }
+        }
+      },
+      "post": {
+        "operationId": "identity_userinfo_post",
+        "summary": "Read user information",
+        "x-lime-summary-zh-CN": "读取用户资料",
+        "description": "Requires an active user access token with openid. Optional profile and email scopes control returned fields. ID tokens and machine tokens are not valid UserInfo credentials. Installation claims are present only for a current bound grant.",
+        "x-lime-zh-CN": "要求当前有效且具有 openid 的用户访问令牌。profile 和 email 控制返回字段。ID Token 和机器令牌不能用于 UserInfo。仅当前有效绑定授权返回安装声明。",
+        "tags": [
+          "Identity"
+        ],
+        "security": [
+          {
+            "Bearer": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Permitted user claims.",
+            "x-lime-zh-CN": "允许返回的用户声明。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/UserInfo"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Invalid or revoked token.",
+            "x-lime-zh-CN": "令牌无效或已撤销。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "A user grant with the required scope is missing.",
+            "x-lime-zh-CN": "缺少要求的用户授权。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "Rate limit exceeded. Wait before retrying.",
+            "x-lime-zh-CN": "请求超过限流窗口，等待后重试。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "headers": {
+              "Retry-After": {
+                "schema": {
+                  "type": "integer"
+                },
+                "description": "Seconds before another attempt."
+              }
+            }
+          },
+          "503": {
+            "description": "A required dependency is unavailable.",
+            "x-lime-zh-CN": "必要依赖暂时不可用。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "Protocol processing failed.",
+            "x-lime-zh-CN": "协议处理失败。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/oauth/jwks": {
+      "get": {
+        "operationId": "identity_jwks",
+        "summary": "Signing keys",
+        "x-lime-summary-zh-CN": "签名公钥",
+        "description": "Public RSA keys for verifying RS256 ID tokens. Match kid and refresh keys when an unknown kid appears. Fetch through an OIDC library; do not use access tokens as JWTs.",
+        "x-lime-zh-CN": "用于验证 RS256 ID Token 的公开 RSA 密钥。按 kid 匹配，未知 kid 时刷新。通过 OIDC 库获取；不得将访问令牌作为 JWT 解析。",
+        "tags": [
+          "Identity"
+        ],
+        "security": [],
+        "responses": {
+          "200": {
+            "description": "Public signing keys.",
+            "x-lime-zh-CN": "公开签名密钥。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/JWKSet"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/oauth/revoke": {
+      "post": {
+        "operationId": "identity_revoke",
+        "summary": "Revoke a token",
+        "x-lime-summary-zh-CN": "撤销令牌",
+        "description": "Authenticate as the issuing client. Public clients send client_id; confidential clients use HTTP Basic. A successful or already invalid token returns HTTP 200 with an empty body. This revokes an authorization token; it does not perform browser-wide central sign-out.",
+        "x-lime-zh-CN": "使用签发客户端身份认证。公共客户端提交 client_id，机密客户端使用 HTTP Basic。成功或令牌已无效均返回 HTTP 200 空正文。此操作撤销授权令牌，不执行浏览器中央退出。",
+        "tags": [
+          "Identity"
+        ],
+        "security": [
+          {
+            "ClientSecretBasic": []
+          },
+          {}
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/x-www-form-urlencoded": {
+              "schema": {
+                "$ref": "#/components/schemas/TokenLookupRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Empty body; the request was accepted without revealing token existence.",
+            "x-lime-zh-CN": "空正文，接受请求且不泄露令牌是否存在。"
+          },
+          "400": {
+            "description": "Invalid protocol request or grant. Device polling also uses this status for authorization_pending and slow_down.",
+            "x-lime-zh-CN": "协议请求或授权无效。设备轮询的 authorization_pending 和 slow_down 也使用此状态。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Client authentication failed.",
+            "x-lime-zh-CN": "客户端认证失败。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "Rate limit exceeded. Wait before retrying.",
+            "x-lime-zh-CN": "请求超过限流窗口，等待后重试。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "headers": {
+              "Retry-After": {
+                "schema": {
+                  "type": "integer"
+                },
+                "description": "Seconds before another attempt."
+              }
+            }
+          },
+          "503": {
+            "description": "A required dependency is unavailable.",
+            "x-lime-zh-CN": "必要依赖暂时不可用。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "Protocol processing failed.",
+            "x-lime-zh-CN": "协议处理失败。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/oauth/introspect": {
+      "post": {
+        "operationId": "identity_introspect",
+        "summary": "Inspect a token",
+        "x-lime-summary-zh-CN": "检查令牌",
+        "description": "Server-side only; requires HTTP Basic with this client's secret. Only tokens issued to the same client can be active. Invalid, expired, revoked or other-client tokens return active=false. Public clients cannot use this endpoint.",
+        "x-lime-zh-CN": "仅供服务端使用，要求通过 HTTP Basic 认证当前客户端 Secret。仅同一客户端签发的令牌可返回有效。无效、过期、撤销或其他客户端令牌返回 active=false。公共客户端不能调用。",
+        "tags": [
+          "Identity"
+        ],
+        "security": [
+          {
+            "ClientSecretBasic": []
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/x-www-form-urlencoded": {
+              "schema": {
+                "$ref": "#/components/schemas/TokenLookupRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Token activity and permitted metadata.",
+            "x-lime-zh-CN": "令牌有效性与允许的元数据。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Introspection"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Invalid protocol request or grant. Device polling also uses this status for authorization_pending and slow_down.",
+            "x-lime-zh-CN": "协议请求或授权无效。设备轮询的 authorization_pending 和 slow_down 也使用此状态。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Client authentication failed.",
+            "x-lime-zh-CN": "客户端认证失败。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "Rate limit exceeded. Wait before retrying.",
+            "x-lime-zh-CN": "请求超过限流窗口，等待后重试。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "headers": {
+              "Retry-After": {
+                "schema": {
+                  "type": "integer"
+                },
+                "description": "Seconds before another attempt."
+              }
+            }
+          },
+          "503": {
+            "description": "A required dependency is unavailable.",
+            "x-lime-zh-CN": "必要依赖暂时不可用。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "Protocol processing failed.",
+            "x-lime-zh-CN": "协议处理失败。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  },
+  "components": {
+    "securitySchemes": {
+      "ClientSecretBasic": {
+        "type": "http",
+        "scheme": "basic",
+        "description": "client_secret_basic; form-encode the client ID and secret before constructing HTTP Basic."
+      },
+      "Bearer": {
+        "type": "http",
+        "scheme": "bearer",
+        "description": "Opaque user access token with openid."
+      }
+    },
+    "schemas": {
+      "OAuthError": {
+        "type": "object",
+        "properties": {
+          "error": {
+            "type": "string",
+            "description": "Stable OAuth error code. Device flow also returns authorization_pending, slow_down, access_denied and expired_token.",
+            "x-lime-zh-CN": "稳定 OAuth 错误码。设备流程还会返回 authorization_pending、slow_down、access_denied、expired_token。"
+          },
+          "error_description": {
+            "type": "string",
+            "description": "Optional human-readable detail. Use error for program logic.",
+            "x-lime-zh-CN": "可选的人类可读说明，程序判断应使用 error。"
+          },
+          "error_hint": {
+            "type": "string",
+            "description": "Optional recovery hint.",
+            "x-lime-zh-CN": "可选恢复提示。"
+          },
+          "error_uri": {
+            "type": "string",
+            "format": "uri"
+          }
+        },
+        "required": [
+          "error"
+        ]
+      },
+      "AuthorizationCodeTokenRequest": {
+        "type": "object",
+        "properties": {
+          "grant_type": {
+            "type": "string",
+            "const": "authorization_code"
+          },
+          "client_id": {
+            "type": "string",
+            "description": "Client ID from Sign-in clients. Public clients send it in the form; confidential and machine clients authenticate with HTTP Basic.",
+            "x-lime-zh-CN": "来自登录客户端页面的 Client ID。公共客户端通过表单传入，机密与机器客户端使用 HTTP Basic。"
+          },
+          "code": {
+            "type": "string",
+            "description": "Single-use authorization code received at the registered redirect URI.",
+            "x-lime-zh-CN": "登记回调收到的一次性授权码。"
+          },
+          "redirect_uri": {
+            "type": "string",
+            "description": "Exactly the redirect_uri sent in the authorization request.",
+            "x-lime-zh-CN": "须与授权请求中的 redirect_uri 完全一致。",
+            "format": "uri"
+          },
+          "code_verifier": {
+            "type": "string",
+            "description": "Original random PKCE verifier. Never send the verifier to the authorization endpoint.",
+            "x-lime-zh-CN": "原始随机 PKCE verifier，不得将其发往授权端点。",
+            "minLength": 43,
+            "maxLength": 128
+          }
+        },
+        "required": [
+          "grant_type",
+          "code",
+          "redirect_uri",
+          "code_verifier"
+        ]
+      },
+      "RefreshTokenRequest": {
+        "type": "object",
+        "properties": {
+          "grant_type": {
+            "type": "string",
+            "const": "refresh_token"
+          },
+          "client_id": {
+            "type": "string",
+            "description": "Client ID from Sign-in clients. Public clients send it in the form; confidential and machine clients authenticate with HTTP Basic.",
+            "x-lime-zh-CN": "来自登录客户端页面的 Client ID。公共客户端通过表单传入，机密与机器客户端使用 HTTP Basic。"
+          },
+          "refresh_token": {
+            "type": "string",
+            "description": "Latest refresh token. Serialize refreshes and atomically replace the stored token after success; do not reuse an old token after an uncertain result.",
+            "x-lime-zh-CN": "最新刷新令牌。串行刷新并在成功后原子替换保存值；结果不明时不得重用旧令牌。"
+          },
+          "scope": {
+            "type": "string",
+            "description": "Optional subset of the original grant; cannot add scopes.",
+            "x-lime-zh-CN": "可选的原授权权限子集，不得扩权。"
+          }
+        },
+        "required": [
+          "grant_type",
+          "refresh_token"
+        ]
+      },
+      "DeviceTokenRequest": {
+        "type": "object",
+        "properties": {
+          "grant_type": {
+            "type": "string",
+            "const": "urn:ietf:params:oauth:grant-type:device_code"
+          },
+          "client_id": {
+            "type": "string",
+            "description": "Client ID from Sign-in clients. Public clients send it in the form; confidential and machine clients authenticate with HTTP Basic.",
+            "x-lime-zh-CN": "来自登录客户端页面的 Client ID。公共客户端通过表单传入，机密与机器客户端使用 HTTP Basic。"
+          },
+          "device_code": {
+            "type": "string",
+            "description": "Device code from device authorization. Poll at interval; add 5 seconds after each slow_down. Stop on success, denial or expiry.",
+            "x-lime-zh-CN": "设备授权返回的 device_code。按 interval 轮询；每次 slow_down 增加 5 秒。成功、拒绝或到期后停止。",
+            "minLength": 43,
+            "maxLength": 43
+          }
+        },
+        "required": [
+          "grant_type",
+          "device_code"
+        ]
+      },
+      "MachineTokenRequest": {
+        "type": "object",
+        "properties": {
+          "grant_type": {
+            "type": "string",
+            "const": "client_credentials"
+          },
+          "audience": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Optional registered audiences. Repeat the form field for multiple audiences; unregistered values are rejected.",
+            "x-lime-zh-CN": "可选的已登记 Audience。多个值须重复表单字段，未登记值会被拒绝。"
+          }
+        },
+        "required": [
+          "grant_type"
+        ],
+        "description": "Machine clients only. No user scopes, user identity or generic business API access is granted.",
+        "x-lime-zh-CN": "仅限机器客户端，不授予用户权限、用户身份或通用业务 API 访问权。"
+      },
+      "TokenResponse": {
+        "type": "object",
+        "properties": {
+          "access_token": {
+            "type": "string",
+            "description": "Opaque bearer token. Do not parse it as an ID token or send it in a URL.",
+            "x-lime-zh-CN": "不透明 Bearer 令牌，不作为 ID Token 解析，也不得放入 URL。"
+          },
+          "token_type": {
+            "type": "string"
+          },
+          "expires_in": {
+            "type": "integer",
+            "description": "Access token lifetime in seconds. Use the response value.",
+            "x-lime-zh-CN": "访问令牌有效秒数，以响应为准。",
+            "minimum": 0
+          },
+          "scope": {
+            "type": "string",
+            "description": "Granted scopes, separated by spaces.",
+            "x-lime-zh-CN": "实际授予的权限，以空格分隔。"
+          },
+          "refresh_token": {
+            "type": "string",
+            "description": "Rotating token, returned only for an eligible user grant with offline_access.",
+            "x-lime-zh-CN": "轮换刷新令牌，仅符合条件且具有 offline_access 的用户授权返回。"
+          },
+          "id_token": {
+            "type": "string",
+            "description": "RS256-signed ID token for an OpenID Connect user grant. Validate issuer, audience, signature, expiry and nonce with an OIDC library.",
+            "x-lime-zh-CN": "OIDC 用户授权的 RS256 签名 ID Token。使用 OIDC 库校验 issuer、audience、签名、有效期和 nonce。"
+          }
+        },
+        "required": [
+          "access_token",
+          "token_type",
+          "expires_in"
+        ]
+      },
+      "DeviceAuthorizationRequest": {
+        "type": "object",
+        "properties": {
+          "client_id": {
+            "type": "string",
+            "description": "Client ID from Sign-in clients. Public clients send it in the form; confidential and machine clients authenticate with HTTP Basic.",
+            "x-lime-zh-CN": "来自登录客户端页面的 Client ID。公共客户端通过表单传入，机密与机器客户端使用 HTTP Basic。"
+          },
+          "scope": {
+            "type": "string",
+            "description": "Space-separated scopes registered on this client. openid is required for sign-in; profile, email and offline_access are optional.",
+            "x-lime-zh-CN": "客户端已登记的权限，以空格分隔。登录须含 openid，可选 profile、email、offline_access。"
+          },
+          "installation_id": {
+            "type": "string",
+            "description": "Production installation ID. Supply together with space_id when authorizing an enterprise installation.",
+            "x-lime-zh-CN": "生产安装 ID。授权企业安装时须与 space_id 同时传入。",
+            "maxLength": 40
+          },
+          "space_id": {
+            "type": "string",
+            "description": "Workspace containing the installation. This does not select a global current workspace.",
+            "x-lime-zh-CN": "安装所属的工作空间，不用于选择全局当前空间。",
+            "maxLength": 40
+          }
+        },
+        "required": []
+      },
+      "DeviceAuthorizationResponse": {
+        "type": "object",
+        "properties": {
+          "device_code": {
+            "type": "string",
+            "description": "Secret device code. Keep on the requesting device.",
+            "x-lime-zh-CN": "保密设备码，仅留在发起请求的设备。"
+          },
+          "user_code": {
+            "type": "string",
+            "description": "Code shown to the user for entry on the verification page.",
+            "x-lime-zh-CN": "供用户在验证页输入的短码。"
+          },
+          "verification_uri": {
+            "type": "string",
+            "format": "uri"
+          },
+          "verification_uri_complete": {
+            "type": "string",
+            "format": "uri"
+          },
+          "expires_in": {
+            "type": "integer",
+            "description": "Device code lifetime in seconds.",
+            "x-lime-zh-CN": "设备码有效秒数。"
+          },
+          "interval": {
+            "type": "integer",
+            "description": "Minimum polling interval in seconds.",
+            "x-lime-zh-CN": "最小轮询间隔秒数。"
+          }
+        },
+        "required": [
+          "device_code",
+          "user_code",
+          "verification_uri",
+          "verification_uri_complete",
+          "expires_in",
+          "interval"
+        ]
+      },
+      "TokenLookupRequest": {
+        "type": "object",
+        "properties": {
+          "client_id": {
+            "type": "string",
+            "description": "Client ID from Sign-in clients. Public clients send it in the form; confidential and machine clients authenticate with HTTP Basic.",
+            "x-lime-zh-CN": "来自登录客户端页面的 Client ID。公共客户端通过表单传入，机密与机器客户端使用 HTTP Basic。"
+          },
+          "token": {
+            "type": "string",
+            "description": "Token to revoke or inspect. Never include it in a URL.",
+            "x-lime-zh-CN": "待撤销或检查的令牌，不得包含在 URL 中。"
+          },
+          "token_type_hint": {
+            "type": "string",
+            "enum": [
+              "access_token",
+              "refresh_token"
+            ]
+          }
+        },
+        "required": [
+          "token"
+        ]
+      },
+      "UserInfo": {
+        "type": "object",
+        "properties": {
+          "sub": {
+            "type": "string",
+            "description": "Pairwise subject for this client sector; not a platform-wide user ID.",
+            "x-lime-zh-CN": "客户端 sector 范围内的成对主体标识，不是平台全局用户 ID。"
+          },
+          "name": {
+            "type": "string",
+            "description": "Present only when profile was granted.",
+            "x-lime-zh-CN": "仅授予 profile 时返回。"
+          },
+          "email": {
+            "type": "string",
+            "description": "Present only when email was granted.",
+            "x-lime-zh-CN": "仅授予 email 时返回。",
+            "format": "email"
+          },
+          "email_verified": {
+            "type": "boolean"
+          },
+          "lime_installation_id": {
+            "type": "string",
+            "description": "Present only for a current installation-bound grant.",
+            "x-lime-zh-CN": "仅当前有效的安装绑定授权返回。"
+          },
+          "lime_space_id": {
+            "type": "string"
+          },
+          "lime_release_id": {
+            "type": "string"
+          },
+          "lime_installation_generation": {
+            "type": "integer"
+          }
+        },
+        "required": [
+          "sub"
+        ]
+      },
+      "Introspection": {
+        "type": "object",
+        "properties": {
+          "active": {
+            "type": "boolean"
+          },
+          "client_id": {
+            "type": "string"
+          },
+          "sub": {
+            "type": "string"
+          },
+          "scope": {
+            "type": "string"
+          },
+          "exp": {
+            "type": "integer"
+          },
+          "iat": {
+            "type": "integer"
+          },
+          "aud": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "lime_installation_id": {
+            "type": "string"
+          },
+          "lime_space_id": {
+            "type": "string"
+          },
+          "lime_release_id": {
+            "type": "string"
+          },
+          "lime_installation_generation": {
+            "type": "integer"
+          }
+        },
+        "required": [
+          "active"
+        ]
+      },
+      "JWK": {
+        "type": "object",
+        "properties": {
+          "kty": {
+            "type": "string",
+            "const": "RSA"
+          },
+          "use": {
+            "type": "string",
+            "const": "sig"
+          },
+          "alg": {
+            "type": "string",
+            "const": "RS256"
+          },
+          "kid": {
+            "type": "string"
+          },
+          "n": {
+            "type": "string"
+          },
+          "e": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "kty",
+          "kid",
+          "n",
+          "e"
+        ]
+      },
+      "JWKSet": {
+        "type": "object",
+        "properties": {
+          "keys": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/JWK"
+            }
+          }
+        },
+        "required": [
+          "keys"
+        ]
+      },
+      "Discovery": {
+        "type": "object",
+        "properties": {
+          "issuer": {
+            "type": "string",
+            "format": "uri"
+          },
+          "authorization_endpoint": {
+            "type": "string",
+            "format": "uri"
+          },
+          "token_endpoint": {
+            "type": "string",
+            "format": "uri"
+          },
+          "userinfo_endpoint": {
+            "type": "string",
+            "format": "uri"
+          },
+          "jwks_uri": {
+            "type": "string",
+            "format": "uri"
+          },
+          "revocation_endpoint": {
+            "type": "string",
+            "format": "uri"
+          },
+          "introspection_endpoint": {
+            "type": "string",
+            "format": "uri"
+          },
+          "device_authorization_endpoint": {
+            "type": "string",
+            "format": "uri"
+          },
+          "response_types_supported": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "response_modes_supported": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "grant_types_supported": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "subject_types_supported": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "id_token_signing_alg_values_supported": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "token_endpoint_auth_methods_supported": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "code_challenge_methods_supported": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "scopes_supported": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "claims_supported": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        },
+        "required": [
+          "issuer",
+          "authorization_endpoint",
+          "token_endpoint",
+          "userinfo_endpoint",
+          "jwks_uri"
+        ]
+      },
+      "TokenRequest": {
+        "oneOf": [
+          {
+            "$ref": "#/components/schemas/AuthorizationCodeTokenRequest"
+          },
+          {
+            "$ref": "#/components/schemas/RefreshTokenRequest"
+          },
+          {
+            "$ref": "#/components/schemas/DeviceTokenRequest"
+          },
+          {
+            "$ref": "#/components/schemas/MachineTokenRequest"
+          }
+        ],
+        "discriminator": {
+          "propertyName": "grant_type",
+          "mapping": {
+            "authorization_code": "#/components/schemas/AuthorizationCodeTokenRequest",
+            "refresh_token": "#/components/schemas/RefreshTokenRequest",
+            "urn:ietf:params:oauth:grant-type:device_code": "#/components/schemas/DeviceTokenRequest",
+            "client_credentials": "#/components/schemas/MachineTokenRequest"
+          }
+        }
+      }
+    }
+  }
+}