feat(sso): 授权页禁止被嵌进 iframe；认 HoloCard staging 的 client

- /:locale/sso/* 加 Content-Security-Policy: frame-ancestors 'none' 和 X-Frame-Options: DENY，
  防点击劫持骗已登录的访客点「继续」（实测只作用于授权页，其它页面响应头不变）
- client 表加 holocard-staging（后端 INV-010 里单独的 client，secret 和回跳地址都和线上分开）

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011CHv6oQ6cYWQvdBV6FFRhF

Author: longsizhuo

lib/sso.ts

@@ -1,4 +1,8 @@
-export const SSO_CLIENTS: Record<string, string> = { holocard: "HoloCard" };
+// 授权页上显示的站点名。和后端 sso.clients 表对应（后端还会再校验 client 和回跳地址）
+export const SSO_CLIENTS: Record<string, string> = {
+  holocard: "HoloCard",
+  "holocard-staging": "HoloCard（staging）",
+};
 
 export const SSO_PENDING_KEY = "ih:sso:pending";
 const PENDING_TTL_MS = 10 * 60 * 1000;

next.config.mjs

@@ -353,6 +353,19 @@ const config = {
       // / NEXT_LOCALE 协商（307，单跳到 /zh 或 /en）才是对的。
     ];
   },
+  async headers() {
+    return [
+      {
+        // IH 通行证授权页不许被别的网站嵌进 iframe：防点击劫持骗已登录的访客点「继续」，
+        // 替攻击者发起的登录签出授权码（见 lib/sso.ts、后端 SECURITY.md 的 INV-010）
+        source: "/:locale/sso/:path*",
+        headers: [
+          { key: "Content-Security-Policy", value: "frame-ancestors 'none'" },
+          { key: "X-Frame-Options", value: "DENY" },
+        ],
+      },
+    ];
+  },
   async rewrites() {
     const backendUrl = process.env.BACKEND_URL ?? "http://localhost:8080";
     return [

tests/sso.test.ts

@@ -35,6 +35,15 @@ describe("parseSsoRequest", () => {
     expect(parseSsoRequest({ ...VALID, extra: "x" })).toEqual(VALID);
   });
 
+  it("HoloCard 的 staging 是单独的 client，也认", () => {
+    const staging = {
+      ...VALID,
+      client_id: "holocard-staging",
+      redirect_uri: "https://holocard.staging.longsizhuo.com/auth/callback",
+    };
+    expect(parseSsoRequest(staging)).toEqual(staging);
+  });
+
   it.each(Object.keys(VALID))("缺 %s 或为空 → 拒绝", (key) => {
     expect(parseSsoRequest({ ...VALID, [key]: undefined })).toBeNull();
     expect(parseSsoRequest({ ...VALID, [key]: "" })).toBeNull();