feat(auth): implement session-based token management with revocation support

Add Session model, SessionService, and SessionRepository to track user login
sessions and enable token revocation on auth-critical events.

- Introduce explicit TokenType (access/refresh) in JWT claims to prevent
  refresh token misuse via access token endpoints
- Add SessionID field to JWT claims, enabling stateless JWT validation
  against revoked sessions
- Replace legacy Auth middleware with RequireAuth/OptionalAuth pipeline
  that validates token type, account status, and session validity
- Implement session revocation on password change, reset, user ban/inactive,
  and explicit logout
- Add Principal cache with active invalidation for banned/role-changed users
- Fix IDOR vulnerability: GetMessagesByCursor now validates currentUserID
  is conversation participant via GetParticipantStrict
- Add group member visibility checks: announcements, group info, member list
  now require group membership
- Simplify Casbin policy: remove g grouping, use r.sub == p.sub matcher
  with globMatch; user_roles table is single source of truth for roles
- Add migration logic to clean legacy casbin g rules and migrate old p rules
  from path-style to admin/<domain> resource naming

internal/service/message_service.go

@@ -2,14 +2,17 @@ package service
 
 import (
 	"context"
+	"errors"
 	"time"
 
 	"with_you/internal/cache"
+	apperrors "with_you/internal/errors"
 	"with_you/internal/model"
 	"with_you/internal/pkg/cursor"
 	"with_you/internal/repository"
 
 	"go.uber.org/zap"
+	"gorm.io/gorm"
 )
 
 // 缓存TTL常量
@@ -36,7 +39,9 @@ type MessageService interface {
 	GetMyParticipantsBatch(ctx context.Context, convIDs []string, userID string) (map[string]*model.ConversationParticipant, error)
 	InvalidateUserConversationCache(userID string)
 	InvalidateUserUnreadCache(userID, conversationID string)
-	GetMessagesByCursor(ctx context.Context, conversationID string, req *cursor.PageRequest) (*cursor.CursorPageResult[*model.Message], error)
+	// GetMessagesByCursor 游标分页获取会话消息。
+	// currentUserID 用于参与者校验：非会话参与者拒绝（防止 IDOR）。
+	GetMessagesByCursor(ctx context.Context, conversationID, currentUserID string, req *cursor.PageRequest) (*cursor.CursorPageResult[*model.Message], error)
 	GetConversationsByCursor(ctx context.Context, userID string, req *cursor.PageRequest) (*cursor.CursorPageResult[*model.Conversation], error)
 }
 
@@ -336,7 +341,22 @@ func (s *messageService) InvalidateUserUnreadCache(userID, conversationID string
 }
 
 // GetMessagesByCursor 游标分页获取会话消息
-func (s *messageService) GetMessagesByCursor(ctx context.Context, conversationID string, req *cursor.PageRequest) (*cursor.CursorPageResult[*model.Message], error) {
+//
+// 鉴权：currentUserID 必须是会话参与者，否则返回 ErrNotConversationMember。
+// 防止 IDOR：任意登录用户无法仅凭 conversationID 读取他人会话消息。
+func (s *messageService) GetMessagesByCursor(ctx context.Context, conversationID, currentUserID string, req *cursor.PageRequest) (*cursor.CursorPageResult[*model.Message], error) {
+	if currentUserID == "" {
+		return nil, apperrors.ErrUnauthorized
+	}
+	// 通过 messageRepo.GetParticipantStrict 校验参与者身份（纯查询，不创建记录）。
+	// 与 chatService 中 GetMessages 等方法保持一致的鉴权边界。
+	_, err := s.messageRepo.GetParticipantStrict(conversationID, currentUserID)
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, apperrors.ErrNotConversationMember
+		}
+		return nil, err
+	}
 	return s.messageRepo.GetMessagesByCursor(ctx, conversationID, req)
 }