feat(devices): P3 强制退出 + 清除增强(per-device 凭证吊销)

后端:新端点 POST /v1/me/devices/{uuid}/logout(ForceLogout:吊销该设备会话+ 丢 Redis JTI,设备留列表)。DeleteDevice 增强:先吊销会话再删设备(FK ON DELETE CASCADE 清理会话行)+ 按 dp_uuid 吊销数据面凭证。CredentialRevoker 接口改 per-device RevokeDevice(dpUUID),由 nodes.Service 实现(查 connect_credentials 持有节点→推 CommandTypeRevoke + 删凭证行),main 注入替 NoopRevoker;devices 注入 SessionPort/JTIRevoker。修 SQLite 跨连接死锁(会话吊销移到 delete tx 之前)。 migration 000016 sessions FK 加 ON DELETE CASCADE。客户端:account_api.forceLogout + devicesProvider.forceLogout(UI 留 P6)。测试:ForceLogout(吊销会话+JTI+设备保留+403/404)+ DeleteDevice(级联+按 dp_uuid 吊销);NoopRevoker 改 dp_uuid;全量 server/flutter 测试绿。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-29 06:01:41 +08:00
parent 2f298f0a0a
commit bcc114088c
16 changed files with 325 additions and 74 deletions
@@ -244,10 +244,18 @@ func mountV1(r chi.Router, sqlDB *sql.DB, rdb *redis.Client, nodeSvc *nodes.Serv
 	devicesSvc := devices.NewService(devicesStore, nil) // NoopRevoker for MVP
 	devicesHandler := devices.NewHandler(devicesSvc)

-	// Sessions: login sessions bound to (device, refresh JTI) — P2. Shared by
-	// auth (create/rotate/revoke) and devices (last-login display).
+	// Sessions: login sessions bound to (device, refresh JTI) — P2/P3. Shared by
+	// auth (create/rotate/revoke) and devices (last-login display + force-logout).
 	sessionStore := sessions.NewStore(sqlDB)
-	devicesSvc.SetLastLoginSource(sessionStore)
+	devicesSvc.SetSessionPort(sessionStore)
+	if tm != nil {
+		devicesSvc.SetJTIRevoker(tm) // force-logout drops refresh JTIs from Redis
+	}
+	// Per-device credential revoke on clear-login: nodes.Service pushes Revoke to
+	// the holding node(s). Wired when a DB-backed nodeSvc exists.
+	if nodeSvc != nil {
+		devicesSvc.SetCredentialRevoker(nodeSvc)
+	}

 	// ── Auth ──────────────────────────────────────────────────────────────────
 	var authHandler *auth.Handler