feat(auth): implement session-based token management with revocation support

Add Session model, SessionService, and SessionRepository to track user login
sessions and enable token revocation on auth-critical events.

- Introduce explicit TokenType (access/refresh) in JWT claims to prevent
  refresh token misuse via access token endpoints
- Add SessionID field to JWT claims, enabling stateless JWT validation
  against revoked sessions
- Replace legacy Auth middleware with RequireAuth/OptionalAuth pipeline
  that validates token type, account status, and session validity
- Implement session revocation on password change, reset, user ban/inactive,
  and explicit logout
- Add Principal cache with active invalidation for banned/role-changed users
- Fix IDOR vulnerability: GetMessagesByCursor now validates currentUserID
  is conversation participant via GetParticipantStrict
- Add group member visibility checks: announcements, group info, member list
  now require group membership
- Simplify Casbin policy: remove g grouping, use r.sub == p.sub matcher
  with globMatch; user_roles table is single source of truth for roles
- Add migration logic to clean legacy casbin g rules and migrate old p rules
  from path-style to admin/<domain> resource naming

internal/wire/identity_provider.go

@@ -0,0 +1,54 @@
+package wire
+
+import (
+	"context"
+
+	"with_you/internal/middleware"
+	"with_you/internal/model"
+	"with_you/internal/repository"
+	"with_you/internal/service"
+)
+
+// ProvideIdentityProvider 提供认证管道依赖的 IdentityProvider 实现。
+//
+// 把 UserService + CasbinService + SessionRepository 组合为中间件所需的查询接口，
+// 避免中间件直接依赖具体 service 三个包，便于测试以 fake 注入。
+func ProvideIdentityProvider(
+	userService service.UserService,
+	casbinService service.CasbinService,
+	sessionRepo repository.SessionRepository,
+) middleware.IdentityProvider {
+	return &identityProviderImpl{
+		userService:   userService,
+		casbinService: casbinService,
+		sessionRepo:   sessionRepo,
+	}
+}
+
+type identityProviderImpl struct {
+	userService   service.UserService
+	casbinService service.CasbinService
+	sessionRepo   repository.SessionRepository
+}
+
+func (i *identityProviderImpl) GetUserByID(ctx context.Context, userID string) (*model.User, error) {
+	return i.userService.GetUserByID(ctx, userID)
+}
+
+func (i *identityProviderImpl) GetRolesForUser(ctx context.Context, userID string) ([]string, error) {
+	roles, err := i.casbinService.GetRolesForUser(ctx, userID)
+	if err != nil {
+		return nil, err
+	}
+	if roles == nil {
+		roles = []string{}
+	}
+	return roles, nil
+}
+
+func (i *identityProviderImpl) GetSessionByID(ctx context.Context, sessionID string) (*model.Session, error) {
+	if sessionID == "" {
+		return nil, nil
+	}
+	return i.sessionRepo.GetByID(ctx, sessionID)
+}

internal/wire/provider_set.go

@@ -10,4 +10,7 @@ var AllSet = wire.NewSet(
 	ServiceSet,
 	HandlerSet,
 	GRPCSet,
+
+	// 认证管道依赖的身份提供者
+	ProvideIdentityProvider,
 )

internal/wire/repository.go

@@ -58,6 +58,9 @@ var RepositorySet = wire.NewSet(
 
 	// 文件上传记录（聊天文件 TTL 过期清理）
 	repository.NewUploadedFileRepository,
+
+	// 会话（令牌撤销支持）
+	repository.NewSessionRepository,
 )
 
 // ProvideUserActivityRepository 提供用户活跃数据仓储

internal/wire/service.go

@@ -28,6 +28,9 @@ var ServiceSet = wire.NewSet(
 	// JWT 服务（需要配置参数）
 	ProvideJWTService,
 
+	// 会话服务（令牌撤销支持）
+	ProvideSessionService,
+
 	// 基础服务
 	ProvideEmailService,
 	ProvidePostAIService,
@@ -97,6 +100,14 @@ func ProvideJWTService(cfg *config.Config) service.JWTService {
 	)
 }
 
+// ProvideSessionService 提供会话服务（用于令牌撤销）。
+func ProvideSessionService(
+	sessionRepo repository.SessionRepository,
+	jwtService service.JWTService,
+) service.SessionService {
+	return service.NewSessionService(sessionRepo, jwtService)
+}
+
 // ProvideEmailService 提供邮件服务
 func ProvideEmailService(client email.Client) service.EmailService {
 	return service.NewEmailService(client)
@@ -180,8 +191,9 @@ func ProvideUserService(
 	emailService service.EmailService,
 	cacheBackend cache.Cache,
 	logService *service.LogService,
+	sessionService service.SessionService,
 ) service.UserService {
-	return service.NewUserService(userRepo, systemMessageService, emailService, cacheBackend, logService)
+	return service.NewUserService(userRepo, systemMessageService, emailService, cacheBackend, logService, sessionService)
 }
 
 // ProvideStickerService 提供表情服务
@@ -222,6 +234,7 @@ func ProvideChatService(
 	redisClient *redis.Client,
 	versionLogRepo repository.ConversationVersionLogRepository,
 	cfg *config.Config,
+	groupService service.GroupService,
 ) service.ChatService {
 	var vlogOpt []repository.ConversationVersionLogRepository
 	if cfg.VersionLog.Enabled {
@@ -231,7 +244,9 @@ func ProvideChatService(
 	if redisClient != nil {
 		rdb = redisClient.GetClient()
 	}
-	return service.NewChatService(messageRepo, userRepo, nil, publisher, cacheBackend, uploadService, pushService, seqBufferMgr, pushWorker, rdb, vlogOpt...)
+	// 注入 GroupAbility：群消息发送前校验成员/禁言。
+	groupAbility := service.NewGroupAbility(groupService)
+	return service.NewChatService(messageRepo, userRepo, nil, publisher, cacheBackend, uploadService, pushService, seqBufferMgr, pushWorker, rdb, groupAbility, vlogOpt...)
 }
 
 // ProvideScheduleService 提供日程服务
@@ -340,8 +355,14 @@ func ProvideRoleService(
 }
 
 // ProvideAdminUserService 提供管理端用户服务
-func ProvideAdminUserService(userRepo repository.UserRepository) service.AdminUserService {
-	return service.NewAdminUserService(userRepo)
+//
+// 注入 SessionService 与 cache：封禁/停用用户时撤销其全部登录会话并失效 Principal 缓存。
+func ProvideAdminUserService(
+	userRepo repository.UserRepository,
+	sessionService service.SessionService,
+	cacheBackend cache.Cache,
+) service.AdminUserService {
+	return service.NewAdminUserService(userRepo, sessionService, cacheBackend)
 }
 
 // ProvideAdminPostService 提供管理端帖子服务