feat(auth): implement session-based token management with revocation support

Add Session model, SessionService, and SessionRepository to track user login
sessions and enable token revocation on auth-critical events.

- Introduce explicit TokenType (access/refresh) in JWT claims to prevent
  refresh token misuse via access token endpoints
- Add SessionID field to JWT claims, enabling stateless JWT validation
  against revoked sessions
- Replace legacy Auth middleware with RequireAuth/OptionalAuth pipeline
  that validates token type, account status, and session validity
- Implement session revocation on password change, reset, user ban/inactive,
  and explicit logout
- Add Principal cache with active invalidation for banned/role-changed users
- Fix IDOR vulnerability: GetMessagesByCursor now validates currentUserID
  is conversation participant via GetParticipantStrict
- Add group member visibility checks: announcements, group info, member list
  now require group membership
- Simplify Casbin policy: remove g grouping, use r.sub == p.sub matcher
  with globMatch; user_roles table is single source of truth for roles
- Add migration logic to clean legacy casbin g rules and migrate old p rules
  from path-style to admin/<domain> resource naming

internal/handler/group_handler.go

@@ -838,6 +838,8 @@ func (h *GroupHandler) HandleCreateAnnouncement(c *gin.Context) {
 
 // HandleGetAnnouncements 获取群公告列表
 // GET /api/v1/groups/:id/announcements
+//
+// 可见性策略：仅群成员可见。非成员返回 403 NOT_GROUP_MEMBER。
 func (h *GroupHandler) HandleGetAnnouncements(c *gin.Context) {
 	userID := parseUserID(c)
 	if userID == "" {
@@ -851,6 +853,12 @@ func (h *GroupHandler) HandleGetAnnouncements(c *gin.Context) {
 		return
 	}
 
+	// 成员校验：公告仅群成员可见。
+	if !h.groupService.IsGroupMember(userID, groupID) {
+		response.Forbidden(c, "不是群成员")
+		return
+	}
+
 	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
 	pageSize, _ := strconv.Atoi(c.DefaultQuery("page_size", "20"))
 
@@ -1387,7 +1395,9 @@ func (h *GroupHandler) GetMembersByCursor(c *gin.Context) {
 }
 
 // GetAnnouncementsByCursor 游标分页获取群公告列表
-// GET /api/groups/:id/announcements/cursor
+// GET /api/v1/groups/:id/announcements/cursor
+//
+// 可见性策略：仅群成员可见。非成员返回 403 NOT_GROUP_MEMBER。
 func (h *GroupHandler) GetAnnouncementsByCursor(c *gin.Context) {
 	userID := parseUserID(c)
 	if userID == "" {
@@ -1401,6 +1411,12 @@ func (h *GroupHandler) GetAnnouncementsByCursor(c *gin.Context) {
 		return
 	}
 
+	// 成员校验
+	if !h.groupService.IsGroupMember(userID, groupID) {
+		response.Forbidden(c, "不是群成员")
+		return
+	}
+
 	// 解析游标分页请求
 	req := h.parseCursorRequest(c)
 
@@ -1937,6 +1953,8 @@ func (h *GroupHandler) HandleRespondInvite(c *gin.Context) {
 
 // HandleGetGroupInfo 获取群信息
 // GET /api/v1/groups/:id
+//
+// 可见性策略：成员返回完整详情；非成员仅返回公开字段（name/avatar/description/member_count）。
 func (h *GroupHandler) HandleGetGroupInfo(c *gin.Context) {
 	userID := parseUserID(c)
 	if userID == "" {
@@ -1967,11 +1985,26 @@ func (h *GroupHandler) HandleGetGroupInfo(c *gin.Context) {
 	resp := dto.GroupToResponse(group)
 	resp.MemberCount = memberCount
 
+	// 非成员仅返回公开字段：与成员分支同构（仍是 GroupResponse），但清空敏感字段。
+	// 与成员分支共用 GroupResponse 结构，依赖完整字段的客户端解析不会因字段缺失出错。
+	if !h.groupService.IsGroupMember(userID, groupID) {
+		resp.OwnerID = ""
+		resp.MaxMembers = 0
+		resp.JoinType = 0
+		resp.MuteAll = false
+		resp.IsMember = false
+		response.Success(c, resp)
+		return
+	}
+
+	resp.IsMember = true
 	response.Success(c, resp)
 }
 
 // HandleGetGroupMemberList 获取群成员列表
 // GET /api/v1/groups/:id/members
+//
+// 可见性策略：仅群成员可见。非成员返回 403 NOT_GROUP_MEMBER。
 func (h *GroupHandler) HandleGetGroupMemberList(c *gin.Context) {
 	userID := parseUserID(c)
 	if userID == "" {
@@ -1988,8 +2021,13 @@ func (h *GroupHandler) HandleGetGroupMemberList(c *gin.Context) {
 	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
 	pageSize, _ := strconv.Atoi(c.DefaultQuery("page_size", "50"))
 
-	members, total, err := h.groupService.GetMembers(groupID, page, pageSize)
+	// 成员校验在 service 层完成。
+	members, total, err := h.groupService.GetMembersForUser(userID, groupID, page, pageSize)
 	if err != nil {
+		if errors.Is(err, service.ErrNotGroupMember) {
+			response.Forbidden(c, "不是群成员")
+			return
+		}
 		if errors.Is(err, service.ErrGroupNotFound) {
 			response.NotFound(c, "群组不存在")
 			return

internal/handler/message_handler.go

@@ -1108,10 +1108,10 @@ func (h *MessageHandler) GetMessagesByCursor(c *gin.Context) {
 	// 解析游标分页参数
 	pageReq := parseCursorPageRequest(c)
 
-	// 调用服务层
-	result, err := h.messageService.GetMessagesByCursor(c.Request.Context(), conversationID, pageReq)
+	// 调用服务层（内部会校验 currentUserID 是否是会话参与者，否则拒绝）
+	result, err := h.messageService.GetMessagesByCursor(c.Request.Context(), conversationID, userID, pageReq)
 	if err != nil {
-		response.InternalServerError(c, "failed to get messages")
+		response.HandleError(c, err, "failed to get messages")
 		return
 	}
 

internal/handler/user_handler.go

@@ -6,12 +6,17 @@ import (
 	"crypto/sha256"
 	"fmt"
 	"strconv"
+	"time"
 
 	"github.com/gin-gonic/gin"
+	"go.uber.org/zap"
 
+	"with_you/internal/cache"
 	"with_you/internal/dto"
 	"with_you/internal/middleware"
 	"with_you/internal/model"
+	apperrors "with_you/internal/errors"
+	"with_you/internal/pkg/auth"
 	"with_you/internal/pkg/response"
 	"with_you/internal/service"
 )
@@ -37,6 +42,8 @@ type UserHandler struct {
 	activityService     service.UserActivityService
 	profileAuditService service.UserProfileAuditService
 	jwtService          service.JWTService
+	sessionService      service.SessionService
+	cache               cache.Cache
 	logService          *service.LogService
 }
 
@@ -62,6 +69,16 @@ func (h *UserHandler) SetActivityService(activityService service.UserActivitySer
 	h.activityService = activityService
 }
 
+// SetSessionService 设置会话服务（用于登出与令牌轮换）。
+func (h *UserHandler) SetSessionService(sessionService service.SessionService) {
+	h.sessionService = sessionService
+}
+
+// SetCache 注入缓存实例（用于登出时失效 Principal/Session 缓存）。
+func (h *UserHandler) SetCache(c cache.Cache) {
+	h.cache = c
+}
+
 // generateTokenID 生成Token ID
 func generateTokenID(token string) string {
 	h := sha256.New()
@@ -92,12 +109,16 @@ func (h *UserHandler) Register(c *gin.Context) {
 		return
 	}
 
-	// 生成Token
-	accessToken, _ := h.jwtService.GenerateAccessToken(user.ID, user.Username)
-	refreshToken, _ := h.jwtService.GenerateRefreshToken(user.ID, user.Username)
-
+	// 签发带会话的令牌对：sid 写入 JWT，支持登出/封禁后撤销。
 	ip := c.ClientIP()
 	userAgent := c.GetHeader("User-Agent")
+	refreshExpire := time.Duration(7*24) * time.Hour
+	_, accessToken, refreshToken, err := h.sessionService.Issue(c.Request.Context(), user.ID, user.Username, userAgent, ip, refreshExpire)
+	if err != nil {
+		// 会话签发失败视为登录不可用，避免签发无 sid 的旧式令牌。
+		response.InternalServerError(c, "failed to issue session")
+		return
+	}
 
 	// 记录用户活跃
 	if h.activityService != nil {
@@ -161,12 +182,15 @@ func (h *UserHandler) Login(c *gin.Context) {
 
 	middleware.ResetLoginFailures(c.ClientIP())
 
-	// 生成Token
-	accessToken, _ := h.jwtService.GenerateAccessToken(user.ID, user.Username)
-	refreshToken, _ := h.jwtService.GenerateRefreshToken(user.ID, user.Username)
-
+	// 签发带会话的令牌对。
 	ip := c.ClientIP()
 	userAgent := c.GetHeader("User-Agent")
+	refreshExpire := time.Duration(7*24) * time.Hour
+	_, accessToken, refreshToken, err := h.sessionService.Issue(c.Request.Context(), user.ID, user.Username, userAgent, ip, refreshExpire)
+	if err != nil {
+		response.InternalServerError(c, "failed to issue session")
+		return
+	}
 
 	// 记录用户活跃
 	if h.activityService != nil {
@@ -179,8 +203,6 @@ func (h *UserHandler) Login(c *gin.Context) {
 
 	// 更新登录日志（补充IP和UserAgent）
 	if h.logService != nil {
-		ip := c.ClientIP()
-		userAgent := c.GetHeader("User-Agent")
 		go func() {
 			h.logService.LoginLog.RecordLogin(&model.LoginLog{
 				UserID:    user.ID,
@@ -463,6 +485,11 @@ func (h *UserHandler) VerifyEmail(c *gin.Context) {
 }
 
 // RefreshToken 刷新Token
+//
+// 安全语义：
+//   - 仅接受 refresh token（jwt.ParseRefreshToken 严格校验 typ=refresh）。
+//   - 通过 SessionService 校验会话未撤销未过期，并轮换会话（旧 refresh token 失效）。
+//   - 不接受 access token，access token 不能在刷新端点换取新令牌。
 func (h *UserHandler) RefreshToken(c *gin.Context) {
 	type RefreshRequest struct {
 		RefreshToken string `json:"refresh_token" binding:"required"`
@@ -474,26 +501,34 @@ func (h *UserHandler) RefreshToken(c *gin.Context) {
 		return
 	}
 
-	// 解析 refresh token
-	claims, err := h.jwtService.ParseToken(req.RefreshToken)
+	// 获取用户信息用于填充新令牌的 username 声明。
+	// 先解析 refresh 拿 userID，再查 DB；不直接信任 JWT 中的 username。
+	claims, err := h.jwtService.ParseRefreshToken(req.RefreshToken)
 	if err != nil {
-		response.Unauthorized(c, "invalid refresh token")
+		response.HandleError(c, apperrors.ErrInvalidToken, "invalid refresh token")
 		return
 	}
 
-	// 获取用户信息
 	user, err := h.userService.GetUserByID(c.Request.Context(), claims.UserID)
 	if err != nil {
-		response.InternalServerError(c, "user not found")
+		response.HandleError(c, apperrors.ErrUserNotFound, "user not found")
 		return
 	}
 
-	// 生成新 token
-	accessToken, _ := h.jwtService.GenerateAccessToken(user.ID, user.Username)
-	refreshToken, _ := h.jwtService.GenerateRefreshToken(user.ID, user.Username)
+	if user.Status != model.UserStatusActive && user.Status != model.UserStatusPendingDeletion {
+		response.HandleError(c, apperrors.ErrUserBanned, "user banned")
+		return
+	}
 
 	ip := c.ClientIP()
 	userAgent := c.GetHeader("User-Agent")
+	refreshExpire := time.Duration(7*24) * time.Hour
+
+	_, accessToken, refreshToken, err := h.sessionService.Rotate(c.Request.Context(), req.RefreshToken, user.Username, userAgent, ip, refreshExpire)
+	if err != nil {
+		response.HandleError(c, err, "failed to refresh token")
+		return
+	}
 
 	// 记录用户活跃
 	if h.activityService != nil {
@@ -801,9 +836,14 @@ func (h *UserHandler) SendChangePasswordCode(c *gin.Context) {
 }
 
 // Logout 用户登出
+//
+// 安全语义：撤销当前会话，使 refresh token 立即失效。
+// access token 在剩余 TTL 内仍可用（无状态 JWT 的固有限制），但 refresh token 已撤销，
+// 攻击者无法用 refresh token 续期，access token 也会在短 TTL 内自然过期。
+// 如需 access token 即时失效，可后续引入 jti 黑名单。
 func (h *UserHandler) Logout(c *gin.Context) {
-	currentUserID := c.GetString("user_id")
-	if currentUserID == "" {
+	principal, ok := auth.GetPrincipal(c)
+	if !ok || principal == nil {
 		response.Unauthorized(c, "not logged in")
 		return
 	}
@@ -811,8 +851,23 @@ func (h *UserHandler) Logout(c *gin.Context) {
 	ip := c.ClientIP()
 	userAgent := c.GetHeader("User-Agent")
 
+	// 撤销当前会话。
+	if h.sessionService != nil && principal.SessionID != "" {
+		if err := h.sessionService.Revoke(c.Request.Context(), principal.SessionID); err != nil {
+			// 撤销失败不阻塞登出流程，但记日志便于排查。
+			zap.L().Warn("failed to revoke session on logout",
+				zap.String("session_id", principal.SessionID),
+				zap.Error(err),
+			)
+		}
+	}
+
+	// 失效 Principal/Session 缓存，避免登出后短时间内旧 token 仍命中缓存。
+	auth.InvalidatePrincipalCache(h.cache, principal.UserID)
+	auth.InvalidateSessionCache(h.cache, principal.SessionID)
+
 	// 获取用户信息
-	user, err := h.userService.GetUserByID(c.Request.Context(), currentUserID)
+	user, err := h.userService.GetUserByID(c.Request.Context(), principal.UserID)
 	if err != nil {
 		response.InternalServerError(c, "user not found")
 		return

internal/handler/ws_handler.go

@@ -125,7 +125,8 @@ func (h *WSHandler) HandleWebSocket(c *gin.Context) {
 		return
 	}
 
-	claims, err := h.jwtService.ParseToken(token)
+	// 仅接受 access token，防止 refresh token 通过 WebSocket 入口绕过限制。
+	claims, err := h.jwtService.ParseAccessToken(token)
 	if err != nil {
 		response.Unauthorized(c, "invalid token")
 		return