feat(auth): implement session-based token management with revocation support

Add Session model, SessionService, and SessionRepository to track user login
sessions and enable token revocation on auth-critical events.

- Introduce explicit TokenType (access/refresh) in JWT claims to prevent
  refresh token misuse via access token endpoints
- Add SessionID field to JWT claims, enabling stateless JWT validation
  against revoked sessions
- Replace legacy Auth middleware with RequireAuth/OptionalAuth pipeline
  that validates token type, account status, and session validity
- Implement session revocation on password change, reset, user ban/inactive,
  and explicit logout
- Add Principal cache with active invalidation for banned/role-changed users
- Fix IDOR vulnerability: GetMessagesByCursor now validates currentUserID
  is conversation participant via GetParticipantStrict
- Add group member visibility checks: announcements, group info, member list
  now require group membership
- Simplify Casbin policy: remove g grouping, use r.sub == p.sub matcher
  with globMatch; user_roles table is single source of truth for roles
- Add migration logic to clean legacy casbin g rules and migrate old p rules
  from path-style to admin/<domain> resource naming

cmd/server/wire.go

@@ -4,13 +4,15 @@
 package main
 
 import (
+	"github.com/google/wire"
+
+	"with_you/internal/cache"
 	"with_you/internal/handler"
+	"with_you/internal/middleware"
 	"with_you/internal/repository"
 	"with_you/internal/router"
 	"with_you/internal/service"
 	appwire "with_you/internal/wire"
-
-	"github.com/google/wire"
 )
 
 // InitializeApp 初始化应用程序
@@ -33,6 +35,9 @@ func ProvideRouter(
 	notificationHandler *handler.NotificationHandler,
 	uploadHandler *handler.UploadHandler,
 	jwtService service.JWTService,
+	sessionService service.SessionService,
+	identityProvider middleware.IdentityProvider,
+	cache cache.Cache,
 	pushHandler *handler.PushHandler,
 	systemMessageHandler *handler.SystemMessageHandler,
 	groupHandler *handler.GroupHandler,
@@ -76,6 +81,9 @@ func ProvideRouter(
 		NotificationHandler:      notificationHandler,
 		UploadHandler:            uploadHandler,
 		JWTService:               jwtService,
+		SessionService:           sessionService,
+		IdentityProvider:         identityProvider,
+		Cache:                    cache,
 		PushHandler:              pushHandler,
 		SystemMessageHandler:     systemMessageHandler,
 		GroupHandler:             groupHandler,

cmd/server/wire_gen.go

@@ -7,7 +7,9 @@
 package main
 
 import (
+	"with_you/internal/cache"
 	"with_you/internal/handler"
+	"with_you/internal/middleware"
 	"with_you/internal/repository"
 	"with_you/internal/router"
 	"with_you/internal/service"
@@ -49,7 +51,10 @@ func InitializeApp() (*App, error) {
 	loginLogService := wire.ProvideLoginLogService(asyncLogManager, loginLogRepository)
 	dataChangeLogService := wire.ProvideDataChangeLogService(asyncLogManager, dataChangeLogRepository)
 	logService := wire.ProvideLogService(operationLogService, loginLogService, dataChangeLogService)
-	userService := wire.ProvideUserService(userRepository, systemMessageService, emailService, cache, logService)
+	sessionRepository := repository.NewSessionRepository(db)
+	jwtService := wire.ProvideJWTService(config)
+	sessionService := wire.ProvideSessionService(sessionRepository, jwtService)
+	userService := wire.ProvideUserService(userRepository, systemMessageService, emailService, cache, logService, sessionService)
 	userActivityRepository := wire.ProvideUserActivityRepository(db, cache)
 	userActivityService := wire.ProvideUserActivityService(userActivityRepository)
 	userProfileAuditRepository := repository.NewUserProfileAuditRepository(db)
@@ -82,17 +87,20 @@ func InitializeApp() (*App, error) {
 	seqBufferManager := wire.ProvideSeqBufferManager(config, client, cache)
 	pushWorker := wire.ProvidePushWorker(config, client, messagePublisher, pushService, messageRepository, userRepository)
 	conversationVersionLogRepository := repository.NewConversationVersionLogRepository(db)
-	chatService := wire.ProvideChatService(messageRepository, userRepository, messagePublisher, cache, uploadService, pushService, seqBufferManager, pushWorker, client, conversationVersionLogRepository, config)
-	messageService := wire.ProvideMessageService(messageRepository, cache, uploadService)
 	groupRepository := repository.NewGroupRepository(db)
 	groupJoinRequestRepository := repository.NewGroupJoinRequestRepository(db)
 	groupService := wire.ProvideGroupService(groupRepository, userRepository, messageRepository, groupJoinRequestRepository, systemNotificationRepository, messagePublisher, cache)
+	chatService := wire.ProvideChatService(messageRepository, userRepository, messagePublisher, cache, uploadService, pushService, seqBufferManager, pushWorker, client, conversationVersionLogRepository, config, groupService)
+	messageService := wire.ProvideMessageService(messageRepository, cache, uploadService)
 	messageHandler := wire.ProvideMessageHandler(chatService, messageService, userService, groupService, uploadService, messagePublisher)
 	notificationRepository := repository.NewNotificationRepository(db)
 	notificationService := wire.ProvideNotificationService(notificationRepository, cache)
 	notificationHandler := handler.NewNotificationHandler(notificationService)
 	uploadHandler := handler.NewUploadHandler(uploadService)
-	jwtService := wire.ProvideJWTService(config)
+	enforcer := wire.ProvideCasbinEnforcer(config, db)
+	roleRepository := wire.ProvideRoleRepository(db)
+	casbinService := wire.ProvideCasbinService(enforcer, cache, roleRepository, config)
+	identityProvider := wire.ProvideIdentityProvider(userService, casbinService, sessionRepository)
 	pushHandler := handler.NewPushHandler(pushService)
 	systemMessageHandler := wire.ProvideSystemMessageHandler(systemMessageService)
 	groupHandler := wire.ProvideGroupHandler(groupService, userService)
@@ -118,12 +126,9 @@ func InitializeApp() (*App, error) {
 	emptyClassroomRepository := repository.NewEmptyClassroomRepository(db)
 	emptyClassroomSyncService := wire.ProvideEmptyClassroomSyncService(taskManager, emptyClassroomRepository, logger)
 	emptyClassroomHandler := handler.NewEmptyClassroomHandler(emptyClassroomSyncService)
-	roleRepository := wire.ProvideRoleRepository(db)
-	enforcer := wire.ProvideCasbinEnforcer(config, db)
-	casbinService := wire.ProvideCasbinService(enforcer, cache, roleRepository, config)
 	roleService := wire.ProvideRoleService(roleRepository, casbinService)
 	roleHandler := handler.NewRoleHandler(roleService)
-	adminUserService := wire.ProvideAdminUserService(userRepository)
+	adminUserService := wire.ProvideAdminUserService(userRepository, sessionService, cache)
 	adminUserHandler := handler.NewAdminUserHandler(adminUserService, pushService)
 	adminPostService := wire.ProvideAdminPostService(postRepository, cache, logService)
 	adminPostHandler := handler.NewAdminPostHandler(adminPostService)
@@ -162,7 +167,7 @@ func InitializeApp() (*App, error) {
 	wsHandler := wire.ProvideWSHandler(messagePublisher, chatService, groupService, jwtService, callService, userService)
 	liveKitService := wire.ProvideLiveKitService(config, logger)
 	liveKitHandler := wire.ProvideLiveKitHandler(liveKitService, callService, config, logger)
-	router := ProvideRouter(userRepository, userHandler, postHandler, commentHandler, messageHandler, notificationHandler, uploadHandler, jwtService, pushHandler, systemMessageHandler, groupHandler, stickerHandler, voteHandler, channelHandler, scheduleHandler, gradeHandler, examHandler, emptyClassroomHandler, roleHandler, adminUserHandler, adminPostHandler, adminCommentHandler, adminGroupHandler, adminDashboardHandler, adminLogHandler, qrCodeHandler, materialHandler, callHandler, reportHandler, adminReportHandler, verificationHandler, adminVerificationHandler, adminProfileAuditHandler, setupHandler, tradeHandler, logService, userActivityService, casbinService, userService, wsHandler, liveKitHandler)
+	router := ProvideRouter(userRepository, userHandler, postHandler, commentHandler, messageHandler, notificationHandler, uploadHandler, jwtService, sessionService, identityProvider, cache, pushHandler, systemMessageHandler, groupHandler, stickerHandler, voteHandler, channelHandler, scheduleHandler, gradeHandler, examHandler, emptyClassroomHandler, roleHandler, adminUserHandler, adminPostHandler, adminCommentHandler, adminGroupHandler, adminDashboardHandler, adminLogHandler, qrCodeHandler, materialHandler, callHandler, reportHandler, adminReportHandler, verificationHandler, adminVerificationHandler, adminProfileAuditHandler, setupHandler, tradeHandler, logService, userActivityService, casbinService, userService, wsHandler, liveKitHandler)
 	hotRankWorker := wire.ProvideHotRankWorker(config, postRepository, channelRepository, cache, client)
 	fileCleanupWorker := wire.ProvideFileCleanupWorker(config, uploadedFileRepository, s3Client, client)
 	deviceCleanupWorker := wire.ProvideDeviceCleanupWorker(config, deviceTokenRepository, client)
@@ -185,6 +190,9 @@ func ProvideRouter(
 	notificationHandler *handler.NotificationHandler,
 	uploadHandler *handler.UploadHandler,
 	jwtService service.JWTService,
+	sessionService service.SessionService,
+	identityProvider middleware.IdentityProvider, cache2 cache.Cache,
+
 	pushHandler *handler.PushHandler,
 	systemMessageHandler *handler.SystemMessageHandler,
 	groupHandler *handler.GroupHandler,
@@ -228,6 +236,9 @@ func ProvideRouter(
 		NotificationHandler:      notificationHandler,
 		UploadHandler:            uploadHandler,
 		JWTService:               jwtService,
+		SessionService:           sessionService,
+		IdentityProvider:         identityProvider,
+		Cache:                    cache2,
 		PushHandler:              pushHandler,
 		SystemMessageHandler:     systemMessageHandler,
 		GroupHandler:             groupHandler,