批量更新

go/services/auth/login.go

@@ -6,6 +6,7 @@ import (
 	"time"
 
 	"server/models"
+	"server/pkg/jwtutil"
 	"server/pkg/passwordutil"
 )
 
@@ -127,9 +128,9 @@ func PasswordLogin(account, password, clientID, ip, userAgent string) (*LoginRes
 		ClientID:   clientID,
 		Sid:        sess.Sid,
 		Username:   profile.Nickname,
-		UserType:   "tenant",
 		Amr:        AmrPwd,
 		AccessTTL:  accessTTL,
+		// 不指定 UserType：由 IssueTokens 按应用编码给出 backend / app
 	})
 	if err != nil {
 		return nil, err
@@ -184,7 +185,6 @@ func ChooseTenant(sid string, tid uint64, clientID string) (*TokenPair, *Identit
 		ClientID:   clientID,
 		Sid:        sid,
 		Username:   profile.Nickname,
-		UserType:   "tenant",
 	})
 	if err != nil {
 		return nil, nil, err
@@ -262,7 +262,32 @@ func writeLoginLog(tid uint64, identityID uint64, account, userName, clientID, l
 	return err
 }
 
-// Logout 登出：吊销刷新令牌、会话与访问令牌
+// Logout 登出：吊销刷新令牌、会话与访问令牌，并通知其他应用（单点登出）
 func Logout(accessToken, refreshToken string) error {
-	return RevokeTokenPair(refreshToken, accessToken, models.RevokeReasonLogout)
+	err := RevokeTokenPair(refreshToken, accessToken, models.RevokeReasonLogout)
+
+	// 单点登出：通知该用户在其他应用的会话（如后台登出后 APP 同步下线）
+	identityID := uint64(0)
+	if claims, e := jwtutil.ParseTokenRaw(accessToken); e == nil && claims.UserID > 0 {
+		identityID = uint64(claims.UserID)
+	}
+	if identityID == 0 && refreshToken != "" {
+		if rt, e := findRefreshToken(refreshToken); e == nil {
+			identityID = rt.IdentityID
+		}
+	}
+	if identityID > 0 {
+		NotifyBackchannelLogout(identityID)
+	}
+	return err
+}
+
+// findRefreshToken 按明文查找刷新令牌记录
+func findRefreshToken(plain string) (*models.AuthRefreshToken, error) {
+	var rt models.AuthRefreshToken
+	if err := models.Orm.QueryTable(new(models.AuthRefreshToken)).
+		Filter("token_hash", hashToken(plain)).One(&rt); err != nil {
+		return nil, err
+	}
+	return &rt, nil
 }