feat(auth): implement session-based token management with revocation support

Add Session model, SessionService, and SessionRepository to track user login
sessions and enable token revocation on auth-critical events.

- Introduce explicit TokenType (access/refresh) in JWT claims to prevent
  refresh token misuse via access token endpoints
- Add SessionID field to JWT claims, enabling stateless JWT validation
  against revoked sessions
- Replace legacy Auth middleware with RequireAuth/OptionalAuth pipeline
  that validates token type, account status, and session validity
- Implement session revocation on password change, reset, user ban/inactive,
  and explicit logout
- Add Principal cache with active invalidation for banned/role-changed users
- Fix IDOR vulnerability: GetMessagesByCursor now validates currentUserID
  is conversation participant via GetParticipantStrict
- Add group member visibility checks: announcements, group info, member list
  now require group membership
- Simplify Casbin policy: remove g grouping, use r.sub == p.sub matcher
  with globMatch; user_roles table is single source of truth for roles
- Add migration logic to clean legacy casbin g rules and migrate old p rules
  from path-style to admin/<domain> resource naming

internal/service/user_service.go

@@ -7,9 +7,12 @@ import (
 	"strings"
 	"time"
 
+	"go.uber.org/zap"
+
 	"with_you/internal/cache"
 	apperrors "with_you/internal/errors"
 	"with_you/internal/model"
+	"with_you/internal/pkg/auth"
 	"with_you/internal/pkg/utils"
 	"with_you/internal/repository"
 )
@@ -73,10 +76,15 @@ type UserService interface {
 }
 
 // userServiceImpl 用户服务实现
+//
+// sessionSvc 与 cache 用于改密/重置密码后撤销该用户全部登录会话并失效 Principal 缓存，
+// 让攻击者即使持有旧 access token 也无法用 refresh token 续期。
 type userServiceImpl struct {
 	userRepo             repository.UserRepository
 	systemMessageService SystemMessageService
 	emailCodeService     EmailCodeService
+	sessionSvc           SessionService
+	cache                cache.Cache
 	logService           *LogService
 }
 
@@ -87,11 +95,14 @@ func NewUserService(
 	emailService EmailService,
 	cacheBackend cache.Cache,
 	logService *LogService,
+	sessionSvc SessionService,
 ) UserService {
 	return &userServiceImpl{
 		userRepo:             userRepo,
 		systemMessageService: systemMessageService,
 		emailCodeService:     NewEmailCodeService(emailService, cacheBackend),
+		sessionSvc:           sessionSvc,
+		cache:                cacheBackend,
 		logService:           logService,
 	}
 }
@@ -687,6 +698,11 @@ func (s *userServiceImpl) ChangePassword(ctx context.Context, userID, oldPasswor
 		return err
 	}
 
+	// 改密成功后撤销该用户全部登录会话并失效 Principal 缓存。
+	// refresh token 立即失效；access token 在剩余 TTL 内仍可用（无状态 JWT 固有限制）。
+	// 失败仅告警不阻塞：密码已变更，缓存最终会自然过期。
+	s.invalidateSessionsAfterAuthChange(ctx, userID, "change_password")
+
 	// 记录数据变更日志
 	if s.logService != nil {
 		s.logService.DataChangeLog.RecordDataChange(&model.DataChangeLog{
@@ -728,7 +744,32 @@ func (s *userServiceImpl) ResetPasswordByEmail(ctx context.Context, email, verif
 		return err
 	}
 	user.PasswordHash = hashedPassword
-	return s.userRepo.Update(user)
+	if err := s.userRepo.Update(user); err != nil {
+		return err
+	}
+
+	// 重置密码成功后同样撤销该用户全部登录会话并失效 Principal 缓存。
+	s.invalidateSessionsAfterAuthChange(ctx, user.ID, "reset_password")
+
+	return nil
+}
+
+// invalidateSessionsAfterAuthChange 在密码变更/重置或同等敏感的认证态变更后，
+// 统一执行会话撤销与 Principal 缓存失效。
+//
+// 失败仅告警：密码已变更，refresh token 即便撤销失败也无法凭旧密码换发新令牌，
+// 风险窗口由 access TTL 收口；缓存最终会自然过期。
+func (s *userServiceImpl) invalidateSessionsAfterAuthChange(ctx context.Context, userID, reason string) {
+	if s.sessionSvc != nil {
+		if err := s.sessionSvc.RevokeAllByUser(ctx, userID); err != nil {
+			zap.L().Warn("failed to revoke sessions after auth change",
+				zap.String("user_id", userID),
+				zap.String("reason", reason),
+				zap.Error(err),
+			)
+		}
+	}
+	auth.InvalidatePrincipalCache(s.cache, userID)
 }
 
 // Search 搜索用户