internal/middleware/auth.go

// Package middleware 提供路由层中间件。
//
// 注意：旧的 Auth/OptionalAuth 函数已被 auth_pipeline.go 中的
// RequireAuth / OptionalAuth 替代，新版本内置令牌类型校验、账户状态校验与会话校验。
// 路由层应使用 RequireAuth(jwt, idp, cache) 与 OptionalAuth(jwt, idp, cache)。
package middleware
feat(auth): implement session-based token management with revocation support Add Session model, SessionService, and SessionRepository to track user login sessions and enable token revocation on auth-critical events. - Introduce explicit TokenType (access/refresh) in JWT claims to prevent refresh token misuse via access token endpoints - Add SessionID field to JWT claims, enabling stateless JWT validation against revoked sessions - Replace legacy Auth middleware with RequireAuth/OptionalAuth pipeline that validates token type, account status, and session validity - Implement session revocation on password change, reset, user ban/inactive, and explicit logout - Add Principal cache with active invalidation for banned/role-changed users - Fix IDOR vulnerability: GetMessagesByCursor now validates currentUserID is conversation participant via GetParticipantStrict - Add group member visibility checks: announcements, group info, member list now require group membership - Simplify Casbin policy: remove g grouping, use r.sub == p.sub matcher with globMatch; user_roles table is single source of truth for roles - Add migration logic to clean legacy casbin g rules and migrate old p rules from path-style to admin/<domain> resource naming 2026-07-05 18:28:08 +08:00			`// Package middleware 提供路由层中间件。`
			`//`
			`// 注意：旧的 Auth/OptionalAuth 函数已被 auth_pipeline.go 中的`
			`// RequireAuth / OptionalAuth 替代，新版本内置令牌类型校验、账户状态校验与会话校验。`
			`// 路由层应使用 RequireAuth(jwt, idp, cache) 与 OptionalAuth(jwt, idp, cache)。`
			`package middleware`