feat(msgcrypto): 新增 safechat 消息加解密与 vendorAuthCode 客户端

internal/msgcrypto/goproxy_authcode.go

@@ -0,0 +1,54 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package msgcrypto
+
+import "context"
+
+// mintAuthCodeForProxy is the goProxy-only mint path. domain is compared
+// locally and never forwarded. A successful mint invalidates any unconsumed
+// cache so a one-shot code cannot be reused.
+func mintAuthCodeForProxy(codes AuthCodeProvider, allowedHost, corpID, domain string) (string, error) {
+	if err := matchRedirectHost(domain, allowedHost); err != nil {
+		return "", err
+	}
+	if codes == nil {
+		return "", ErrNoAuthCodeProvider
+	}
+
+	var (
+		code string
+		err  error
+	)
+	if provider, ok := codes.(CorpAuthCodeProvider); ok {
+		code, err = provider.AuthCodeForCorp(context.Background(), corpID)
+	} else {
+		code, err = codes.AuthCode(context.Background())
+	}
+	if err != nil {
+		invalidateAuthCode(codes)
+		return "", err
+	}
+	if code == "" {
+		invalidateAuthCode(codes)
+		return "", ErrNoAuthCode
+	}
+	invalidateAuthCode(codes)
+	return code, nil
+}
+
+func invalidateAuthCode(codes AuthCodeProvider) {
+	if invalidator, ok := codes.(interface{ Invalidate() }); ok {
+		invalidator.Invalidate()
+	}
+}