feat(auth): implement session-based token management with revocation support

Add Session model, SessionService, and SessionRepository to track user login
sessions and enable token revocation on auth-critical events.

- Introduce explicit TokenType (access/refresh) in JWT claims to prevent
  refresh token misuse via access token endpoints
- Add SessionID field to JWT claims, enabling stateless JWT validation
  against revoked sessions
- Replace legacy Auth middleware with RequireAuth/OptionalAuth pipeline
  that validates token type, account status, and session validity
- Implement session revocation on password change, reset, user ban/inactive,
  and explicit logout
- Add Principal cache with active invalidation for banned/role-changed users
- Fix IDOR vulnerability: GetMessagesByCursor now validates currentUserID
  is conversation participant via GetParticipantStrict
- Add group member visibility checks: announcements, group info, member list
  now require group membership
- Simplify Casbin policy: remove g grouping, use r.sub == p.sub matcher
  with globMatch; user_roles table is single source of truth for roles
- Add migration logic to clean legacy casbin g rules and migrate old p rules
  from path-style to admin/<domain> resource naming

internal/handler/user_handler.go

@@ -6,12 +6,17 @@ import (
 	"crypto/sha256"
 	"fmt"
 	"strconv"
+	"time"
 
 	"github.com/gin-gonic/gin"
+	"go.uber.org/zap"
 
+	"with_you/internal/cache"
 	"with_you/internal/dto"
 	"with_you/internal/middleware"
 	"with_you/internal/model"
+	apperrors "with_you/internal/errors"
+	"with_you/internal/pkg/auth"
 	"with_you/internal/pkg/response"
 	"with_you/internal/service"
 )
@@ -37,6 +42,8 @@ type UserHandler struct {
 	activityService     service.UserActivityService
 	profileAuditService service.UserProfileAuditService
 	jwtService          service.JWTService
+	sessionService      service.SessionService
+	cache               cache.Cache
 	logService          *service.LogService
 }
 
@@ -62,6 +69,16 @@ func (h *UserHandler) SetActivityService(activityService service.UserActivitySer
 	h.activityService = activityService
 }
 
+// SetSessionService 设置会话服务（用于登出与令牌轮换）。
+func (h *UserHandler) SetSessionService(sessionService service.SessionService) {
+	h.sessionService = sessionService
+}
+
+// SetCache 注入缓存实例（用于登出时失效 Principal/Session 缓存）。
+func (h *UserHandler) SetCache(c cache.Cache) {
+	h.cache = c
+}
+
 // generateTokenID 生成Token ID
 func generateTokenID(token string) string {
 	h := sha256.New()
@@ -92,12 +109,16 @@ func (h *UserHandler) Register(c *gin.Context) {
 		return
 	}
 
-	// 生成Token
-	accessToken, _ := h.jwtService.GenerateAccessToken(user.ID, user.Username)
-	refreshToken, _ := h.jwtService.GenerateRefreshToken(user.ID, user.Username)
-
+	// 签发带会话的令牌对：sid 写入 JWT，支持登出/封禁后撤销。
 	ip := c.ClientIP()
 	userAgent := c.GetHeader("User-Agent")
+	refreshExpire := time.Duration(7*24) * time.Hour
+	_, accessToken, refreshToken, err := h.sessionService.Issue(c.Request.Context(), user.ID, user.Username, userAgent, ip, refreshExpire)
+	if err != nil {
+		// 会话签发失败视为登录不可用，避免签发无 sid 的旧式令牌。
+		response.InternalServerError(c, "failed to issue session")
+		return
+	}
 
 	// 记录用户活跃
 	if h.activityService != nil {
@@ -161,12 +182,15 @@ func (h *UserHandler) Login(c *gin.Context) {
 
 	middleware.ResetLoginFailures(c.ClientIP())
 
-	// 生成Token
-	accessToken, _ := h.jwtService.GenerateAccessToken(user.ID, user.Username)
-	refreshToken, _ := h.jwtService.GenerateRefreshToken(user.ID, user.Username)
-
+	// 签发带会话的令牌对。
 	ip := c.ClientIP()
 	userAgent := c.GetHeader("User-Agent")
+	refreshExpire := time.Duration(7*24) * time.Hour
+	_, accessToken, refreshToken, err := h.sessionService.Issue(c.Request.Context(), user.ID, user.Username, userAgent, ip, refreshExpire)
+	if err != nil {
+		response.InternalServerError(c, "failed to issue session")
+		return
+	}
 
 	// 记录用户活跃
 	if h.activityService != nil {
@@ -179,8 +203,6 @@ func (h *UserHandler) Login(c *gin.Context) {
 
 	// 更新登录日志（补充IP和UserAgent）
 	if h.logService != nil {
-		ip := c.ClientIP()
-		userAgent := c.GetHeader("User-Agent")
 		go func() {
 			h.logService.LoginLog.RecordLogin(&model.LoginLog{
 				UserID:    user.ID,
@@ -463,6 +485,11 @@ func (h *UserHandler) VerifyEmail(c *gin.Context) {
 }
 
 // RefreshToken 刷新Token
+//
+// 安全语义：
+//   - 仅接受 refresh token（jwt.ParseRefreshToken 严格校验 typ=refresh）。
+//   - 通过 SessionService 校验会话未撤销未过期，并轮换会话（旧 refresh token 失效）。
+//   - 不接受 access token，access token 不能在刷新端点换取新令牌。
 func (h *UserHandler) RefreshToken(c *gin.Context) {
 	type RefreshRequest struct {
 		RefreshToken string `json:"refresh_token" binding:"required"`
@@ -474,26 +501,34 @@ func (h *UserHandler) RefreshToken(c *gin.Context) {
 		return
 	}
 
-	// 解析 refresh token
-	claims, err := h.jwtService.ParseToken(req.RefreshToken)
+	// 获取用户信息用于填充新令牌的 username 声明。
+	// 先解析 refresh 拿 userID，再查 DB；不直接信任 JWT 中的 username。
+	claims, err := h.jwtService.ParseRefreshToken(req.RefreshToken)
 	if err != nil {
-		response.Unauthorized(c, "invalid refresh token")
+		response.HandleError(c, apperrors.ErrInvalidToken, "invalid refresh token")
 		return
 	}
 
-	// 获取用户信息
 	user, err := h.userService.GetUserByID(c.Request.Context(), claims.UserID)
 	if err != nil {
-		response.InternalServerError(c, "user not found")
+		response.HandleError(c, apperrors.ErrUserNotFound, "user not found")
 		return
 	}
 
-	// 生成新 token
-	accessToken, _ := h.jwtService.GenerateAccessToken(user.ID, user.Username)
-	refreshToken, _ := h.jwtService.GenerateRefreshToken(user.ID, user.Username)
+	if user.Status != model.UserStatusActive && user.Status != model.UserStatusPendingDeletion {
+		response.HandleError(c, apperrors.ErrUserBanned, "user banned")
+		return
+	}
 
 	ip := c.ClientIP()
 	userAgent := c.GetHeader("User-Agent")
+	refreshExpire := time.Duration(7*24) * time.Hour
+
+	_, accessToken, refreshToken, err := h.sessionService.Rotate(c.Request.Context(), req.RefreshToken, user.Username, userAgent, ip, refreshExpire)
+	if err != nil {
+		response.HandleError(c, err, "failed to refresh token")
+		return
+	}
 
 	// 记录用户活跃
 	if h.activityService != nil {
@@ -801,9 +836,14 @@ func (h *UserHandler) SendChangePasswordCode(c *gin.Context) {
 }
 
 // Logout 用户登出
+//
+// 安全语义：撤销当前会话，使 refresh token 立即失效。
+// access token 在剩余 TTL 内仍可用（无状态 JWT 的固有限制），但 refresh token 已撤销，
+// 攻击者无法用 refresh token 续期，access token 也会在短 TTL 内自然过期。
+// 如需 access token 即时失效，可后续引入 jti 黑名单。
 func (h *UserHandler) Logout(c *gin.Context) {
-	currentUserID := c.GetString("user_id")
-	if currentUserID == "" {
+	principal, ok := auth.GetPrincipal(c)
+	if !ok || principal == nil {
 		response.Unauthorized(c, "not logged in")
 		return
 	}
@@ -811,8 +851,23 @@ func (h *UserHandler) Logout(c *gin.Context) {
 	ip := c.ClientIP()
 	userAgent := c.GetHeader("User-Agent")
 
+	// 撤销当前会话。
+	if h.sessionService != nil && principal.SessionID != "" {
+		if err := h.sessionService.Revoke(c.Request.Context(), principal.SessionID); err != nil {
+			// 撤销失败不阻塞登出流程，但记日志便于排查。
+			zap.L().Warn("failed to revoke session on logout",
+				zap.String("session_id", principal.SessionID),
+				zap.Error(err),
+			)
+		}
+	}
+
+	// 失效 Principal/Session 缓存，避免登出后短时间内旧 token 仍命中缓存。
+	auth.InvalidatePrincipalCache(h.cache, principal.UserID)
+	auth.InvalidateSessionCache(h.cache, principal.SessionID)
+
 	// 获取用户信息
-	user, err := h.userService.GetUserByID(c.Request.Context(), currentUserID)
+	user, err := h.userService.GetUserByID(c.Request.Context(), principal.UserID)
 	if err != nil {
 		response.InternalServerError(c, "user not found")
 		return