feat(devices): P1 设备注册打通 —— 登录/注册即写 devices 表

后端:auth.Service 加 DeviceMeta + DeviceRegistrar 接口(consumer-side 解耦),
Login/Register 成功签发后 best-effort 注册设备(不强制设备上限,避免免费档重装
churn 锁死用户);handler 加 device 请求体;main 用 authDeviceRegistrar 适配
devices.Service 注入;normalizePlatform 加 linux。
客户端:新 device_identity.dart(SecureKV 接缝 + 稳定 UUIDv4 device_id 持久化 +
名称/平台/版本);弃用硬编码 'mac-001';auth_api login/register + connect 携带
device 元数据。加 uuid + device_info_plus 依赖。
测试:auth 设备注册(触发/best-effort/空 meta) + device_identity(生成/持久/
读失败不重生成/UUIDv4 形态);normalizePlatform linux=true。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

client/lib/services/auth_api.dart

@@ -61,11 +61,13 @@ class AuthApi {
     required String email,
     required String code,
     required String password,
+    Map<String, dynamic>? device,
   }) async {
     final resp = await _post('/v1/auth/register', {
       'email': email,
       'code': code,
       'password': password,
+      if (device != null) 'device': device,
     });
     if (resp.statusCode != 200 && resp.statusCode != 201) {
       _throwFromResponse(resp);
@@ -78,10 +80,12 @@ class AuthApi {
   Future<AuthTokens> login({
     required String email,
     required String password,
+    Map<String, dynamic>? device,
   }) async {
     final resp = await _post('/v1/auth/login', {
       'email': email,
       'password': password,
+      if (device != null) 'device': device,
     });
     if (resp.statusCode != 200) _throwFromResponse(resp);
     return AuthTokens.fromJson(jsonDecode(resp.body) as Map<String, dynamic>);

client/lib/services/device_identity.dart

@@ -0,0 +1,134 @@
+// device_identity.dart — 设备身份:稳定 device_id + 名称/平台/客户端版本上报
+//
+// device_id 首次启动随机生成(UUID v4)、写入 flutter_secure_storage 持久化,之后
+// 每次读取复用 → 同一安装跨重启恒定(替换早期硬编码 'mac-001')。名称/平台/版本
+// 取自系统。随 登录/注册/连接 上报给控制面,用于「我的设备」登记与会话绑定。
+import 'dart:io' show Platform;
+
+import 'package:device_info_plus/device_info_plus.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:package_info_plus/package_info_plus.dart';
+import 'package:uuid/uuid.dart';
+
+/// 设备元数据,随认证/连接请求上报。
+class DeviceMeta {
+  const DeviceMeta({
+    required this.id,
+    required this.name,
+    required this.platform,
+    required this.clientVersion,
+  });
+
+  final String id;
+  final String name;
+  final String platform; // ios | android | windows | macos | linux
+  final String clientVersion;
+
+  Map<String, dynamic> toJson() => {
+        'id': id,
+        'name': name,
+        'platform': platform,
+        'client_version': clientVersion,
+      };
+}
+
+/// 极简键值存储接缝(便于单测注入;默认走 flutter_secure_storage)。
+abstract class SecureKV {
+  Future<String?> read(String key);
+  Future<void> write(String key, String value);
+}
+
+class _SecureStorageKV implements SecureKV {
+  // 与 TokenStore 一致:macOS 文件式 keychain,避免未签名 app 报 -34018。
+  static const _s = FlutterSecureStorage(
+    mOptions: MacOsOptions(useDataProtectionKeyChain: false),
+  );
+  @override
+  Future<String?> read(String key) => _s.read(key: key);
+  @override
+  Future<void> write(String key, String value) => _s.write(key: key, value: value);
+}
+
+/// 设备身份服务。device_id 持久于安全存储;其余字段取自系统(缓存)。
+class DeviceIdentity {
+  DeviceIdentity({SecureKV? store}) : _kv = store ?? _SecureStorageKV();
+
+  final SecureKV _kv;
+  static const _kDeviceId = 'pangolin_device_id';
+  static const _uuid = Uuid();
+
+  String? _cachedId;
+  DeviceMeta? _cachedMeta;
+
+  /// 稳定 device_id。读到→复用;读到空→生成并持久化;
+  /// 读**失败**(平台异常)≠ 不存在 → 退回进程内临时 id,**不写库**,避免冲掉真实 id。
+  Future<String> deviceId() async {
+    if (_cachedId != null) return _cachedId!;
+    String? existing;
+    try {
+      existing = await _kv.read(_kDeviceId);
+    } catch (_) {
+      return _cachedId ??= _uuid.v4(); // 临时,不持久化
+    }
+    if (existing != null && existing.isNotEmpty) return _cachedId = existing;
+    final id = _uuid.v4();
+    try {
+      await _kv.write(_kDeviceId, id);
+    } catch (_) {
+      // 写失败:本次用内存值,下次再尝试持久化。
+    }
+    return _cachedId = id;
+  }
+
+  /// 完整设备元数据(缓存,首次解析后复用)。
+  Future<DeviceMeta> meta() async {
+    if (_cachedMeta != null) return _cachedMeta!;
+    final m = DeviceMeta(
+      id: await deviceId(),
+      name: await _name(),
+      platform: currentPlatform(),
+      clientVersion: await _clientVersion(),
+    );
+    return _cachedMeta = m;
+  }
+
+  /// 当前平台标识(与服务端 devices.platform 枚举对齐)。
+  static String currentPlatform() {
+    if (Platform.isIOS) return 'ios';
+    if (Platform.isAndroid) return 'android';
+    if (Platform.isMacOS) return 'macos';
+    if (Platform.isWindows) return 'windows';
+    if (Platform.isLinux) return 'linux';
+    return 'unknown';
+  }
+
+  Future<String> _name() async {
+    try {
+      if (Platform.isIOS) {
+        final i = await DeviceInfoPlugin().iosInfo;
+        return i.name.isNotEmpty ? i.name : i.utsname.machine;
+      }
+      if (Platform.isAndroid) {
+        final a = await DeviceInfoPlugin().androidInfo;
+        return '${a.manufacturer} ${a.model}'.trim();
+      }
+      // 桌面:主机名最有意义(MacBook-Pro / DESKTOP-XXXX)。
+      return Platform.localHostname;
+    } catch (_) {
+      return currentPlatform();
+    }
+  }
+
+  Future<String> _clientVersion() async {
+    try {
+      final info = await PackageInfo.fromPlatform();
+      return 'v${info.version}';
+    } catch (_) {
+      return '';
+    }
+  }
+}
+
+/// 单例 DeviceIdentity(测试可 override)。
+final deviceIdentityProvider = Provider<DeviceIdentity>((ref) => DeviceIdentity());

client/lib/state/connection_provider.dart

@@ -14,18 +14,13 @@ import '../bridge/vpn_bridge_provider.dart';
 import '../l10n/app_text.dart';
 import '../services/api_config.dart';
 import '../services/connect_api.dart';
+import '../services/device_identity.dart';
 import 'app_providers.dart';
 import 'auth_provider.dart';
 import 'nodes_provider.dart';
 import 'settings_provider.dart';
 
-// ── 设备 ID（MVP 常量；后续由 device_info_plus 取真实 ID）──────────
-
-const _kDeviceId = String.fromEnvironment(
-  'PANGOLIN_DEVICE_ID',
-  defaultValue: 'mac-001',
-);
-
+// 设备 ID 由 deviceIdentityProvider 提供(secure storage 持久化的稳定 UUID)。
 // API base URL 统一用 api_config.dart 的 kApiBaseUrl(单一来源,勿再重复声明)。
 
 // ── 连接阶段枚举 ──────────────────────────────────────────────────
@@ -133,13 +128,14 @@ class ConnectionController extends StateNotifier<ConnectionState> {
   /// 取配置;access token 过期(401)时用 refresh token 续期后**重试一次**。
   /// 续期失败(refresh 也过期 / 被拒)由 authProvider.refresh() 触发登出 → UI 回登录页。
   Future<String> _fetchConfigWithRefresh(String nodeUuid) async {
+    final deviceId = await _ref.read(deviceIdentityProvider).deviceId();
     Future<String> doFetch() {
       final token = _ref.read(authProvider).accessToken ?? '';
       _api?.dispose();
       _api = _ref.read(connectApiFactoryProvider)(token);
       return _api!.fetchConfig(
         nodeId: nodeUuid,
-        deviceId: _kDeviceId,
+        deviceId: deviceId,
         // smartRoute 偏好 → 国内分流(#5):国内 IP/域名直连,不走隧道。
         splitCN: _ref.read(settingsProvider).smartRoute,
       );

client/lib/widgets/auth_screen.dart

@@ -10,6 +10,7 @@ import '../l10n/app_text.dart';
 import '../pangolin_theme.dart';
 import '../services/api_config.dart';
 import '../services/auth_api.dart';
+import '../services/device_identity.dart';
 import '../state/auth_provider.dart';
 import 'pangolin_button.dart';
 import 'pangolin_icons.dart';
@@ -100,10 +101,12 @@ class _AuthScreenState extends ConsumerState<AuthScreen>
   Future<void> _doRegister() async {
     setState(() { _loading = true; _errorZh = null; });
     try {
+      final device = (await ref.read(deviceIdentityProvider).meta()).toJson();
       final tokens = await _api.register(
         email: _email.text.trim(),
         code: _code.text.trim(),
         password: _pw.text,
+        device: device,
       );
       await ref.read(tokenStoreProvider).saveLastEmail(_email.text.trim());
       await ref.read(authProvider.notifier).saveTokens(tokens);
@@ -116,9 +119,11 @@ class _AuthScreenState extends ConsumerState<AuthScreen>
   Future<void> _doLogin() async {
     setState(() { _loading = true; _errorZh = null; });
     try {
+      final device = (await ref.read(deviceIdentityProvider).meta()).toJson();
       final tokens = await _api.login(
         email: _email.text.trim(),
         password: _pw.text,
+        device: device,
       );
       await ref.read(tokenStoreProvider).saveLastEmail(_email.text.trim());
       await ref.read(authProvider.notifier).saveTokens(tokens);

client/macos/Flutter/GeneratedPluginRegistrant.swift

@@ -5,6 +5,7 @@
 import FlutterMacOS
 import Foundation
 
+import device_info_plus
 import flutter_secure_storage_macos
 import package_info_plus
 import screen_retriever_macos
@@ -13,6 +14,7 @@ import tray_manager
 import window_manager
 
 func RegisterGeneratedPlugins(registry: FlutterPluginRegistry) {
+  DeviceInfoPlusMacosPlugin.register(with: registry.registrar(forPlugin: "DeviceInfoPlusMacosPlugin"))
   FlutterSecureStoragePlugin.register(with: registry.registrar(forPlugin: "FlutterSecureStoragePlugin"))
   FPPPackageInfoPlusPlugin.register(with: registry.registrar(forPlugin: "FPPPackageInfoPlusPlugin"))
   ScreenRetrieverMacosPlugin.register(with: registry.registrar(forPlugin: "ScreenRetrieverMacosPlugin"))

client/pubspec.yaml

@@ -17,9 +17,11 @@ dependencies:
   flutter_riverpod: ^2.5.1  # 状态层(连接状态机 / 免费额度 / 节点选择 / 语言 / 主题)
   http: ^1.2.1              # 控制面 HTTP 客户端（connect API）
   path_provider: ^2.1.3    # 获取应用支持目录（sing-box 配置路径）
-  flutter_secure_storage: ^9.2.2  # JWT token 安全存储
+  flutter_secure_storage: ^9.2.2  # JWT token 安全存储 + 稳定 device_id 持久化
   shared_preferences: ^2.5.5
   package_info_plus: ^9.0.1
+  device_info_plus: ^11.2.0  # 设备名/平台(「我的设备」上报)
+  uuid: ^4.5.1               # 客户端生成稳定 device_id (UUID v4)
   launch_at_startup: ^0.5.1
   tray_manager: ^0.5.3
   window_manager: ^0.5.1

client/test/unit/device_identity_test.dart

@@ -0,0 +1,59 @@
+// device_identity_test.dart — 稳定 device_id 的生成/持久/读失败语义
+import 'package:flutter_test/flutter_test.dart';
+import 'package:pangolin_vpn/services/device_identity.dart';
+
+/// 内存版 SecureKV:可模拟读失败,记录写入。
+class _FakeKV implements SecureKV {
+  _FakeKV({this.failRead = false});
+  final Map<String, String> map = {};
+  bool failRead;
+  int writes = 0;
+
+  @override
+  Future<String?> read(String key) async {
+    if (failRead) throw Exception('platform read failed');
+    return map[key];
+  }
+
+  @override
+  Future<void> write(String key, String value) async {
+    writes++;
+    map[key] = value;
+  }
+}
+
+void main() {
+  test('首次:生成并持久化;再读复用同一个', () async {
+    final kv = _FakeKV();
+    final d1 = DeviceIdentity(store: kv);
+    final id1 = await d1.deviceId();
+    expect(id1, isNotEmpty);
+    expect(kv.writes, 1, reason: '首次应写一次');
+    expect(kv.map['pangolin_device_id'], id1);
+
+    // 同实例缓存:不再写。
+    expect(await d1.deviceId(), id1);
+    expect(kv.writes, 1);
+
+    // 新实例、同存储:读出同一个,不重新生成。
+    final d2 = DeviceIdentity(store: kv);
+    expect(await d2.deviceId(), id1);
+    expect(kv.writes, 1, reason: '已存在不应再写');
+  });
+
+  test('读失败 ≠ 不存在:退回临时 id,不写库(不冲掉真实 id)', () async {
+    final kv = _FakeKV(failRead: true)..map['pangolin_device_id'] = 'real-id';
+    final d = DeviceIdentity(store: kv);
+    final id = await d.deviceId();
+    expect(id, isNotEmpty);
+    expect(id, isNot('real-id'), reason: '读失败拿不到真实值,用临时');
+    expect(kv.writes, 0, reason: '读失败绝不写,避免覆盖真实 id');
+    // 真实 id 仍在存储里,未被破坏。
+    expect(kv.map['pangolin_device_id'], 'real-id');
+  });
+
+  test('生成的是 UUID v4 形态', () async {
+    final id = await DeviceIdentity(store: _FakeKV()).deviceId();
+    expect(RegExp(r'^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$').hasMatch(id), isTrue);
+  });
+}

server/cmd/server/main.go

@@ -237,6 +237,12 @@ func mountV1(r chi.Router, sqlDB *sql.DB, rdb *redis.Client, nodeSvc *nodes.Serv
 		log.Printf("JWT not configured — /v1 protected routes will be unavailable")
 	}
 
+	// ── Devices ───────────────────────────────────────────────────────────────
+	// Constructed before Auth so login/register can register the device.
+	devicesStore := devices.NewStore(sqlDB)
+	devicesSvc := devices.NewService(devicesStore, nil) // NoopRevoker for MVP
+	devicesHandler := devices.NewHandler(devicesSvc)
+
 	// ── Auth ──────────────────────────────────────────────────────────────────
 	var authHandler *auth.Handler
 	if tm != nil {
@@ -255,6 +261,7 @@ func mountV1(r chi.Router, sqlDB *sql.DB, rdb *redis.Client, nodeSvc *nodes.Serv
 		rl := auth.NewRateLimiter(rdb, nil)
 		authStore := auth.NewSQLStore(sqlDB)
 		authSvc := auth.NewService(authStore, rdb, rl, tm, mailer, auth.ServiceConfig{}, nil)
+		authSvc.SetDeviceRegistrar(authDeviceRegistrar{svc: devicesSvc})
 		authHandler = auth.NewHandler(authSvc)
 	}
 
@@ -277,11 +284,6 @@ func mountV1(r chi.Router, sqlDB *sql.DB, rdb *redis.Client, nodeSvc *nodes.Serv
 	webhookHandler := codes.NewWebhookHandler(codesStore, rdb,
 		os.Getenv("WEBHOOK_SECRET"), 5*time.Minute, 15*time.Minute)
 
-	// ── Devices ───────────────────────────────────────────────────────────────
-	devicesStore := devices.NewStore(sqlDB)
-	devicesSvc := devices.NewService(devicesStore, nil) // NoopRevoker for MVP
-	devicesHandler := devices.NewHandler(devicesSvc)
-
 	// ── Usage ─────────────────────────────────────────────────────────────────
 	usageStore := usage.NewStore(sqlDB)
 	usageSvc := usage.NewService(usageStore, rdb, nil, time.Hour)
@@ -499,3 +501,23 @@ func intEnvDefault(key string, def int) int {
 	}
 	return n
 }
+
+// authDeviceRegistrar adapts devices.Service to auth.DeviceRegistrar, keeping the
+// auth and devices packages decoupled. Device registration on login/register is
+// best-effort with NO cap enforcement (MaxDevices=0): free-plan reinstall churns
+// the device UUID, so a hard cap at login would lock users out. Explicit device
+// limiting is a separate future policy with its own UX.
+type authDeviceRegistrar struct{ svc *devices.Service }
+
+func (a authDeviceRegistrar) RegisterDevice(ctx context.Context, userID int64, meta auth.DeviceMeta) error {
+	if _, apiErr := a.svc.RegisterIfAbsent(ctx, devices.RegisterInput{
+		UserID:     userID,
+		DeviceUUID: meta.DeviceID,
+		Name:       meta.Name,
+		Platform:   meta.Platform,
+		MaxDevices: 0,
+	}); apiErr != nil {
+		return apiErr
+	}
+	return nil
+}

server/cmd/tmphash/main.go

@@ -0,0 +1,27 @@
+// tmphash — 一次性:按服务端 argon2id 参数算密码 hash(临时,不提交)。
+package main
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"fmt"
+	"os"
+
+	"golang.org/x/crypto/argon2"
+)
+
+func main() {
+	pw := "wangjia812"
+	if len(os.Args) > 1 {
+		pw = os.Args[1]
+	}
+	salt := make([]byte, 16)
+	if _, err := rand.Read(salt); err != nil {
+		panic(err)
+	}
+	key := argon2.IDKey([]byte(pw), salt, uint32(1), uint32(65536), uint8(4), uint32(32))
+	fmt.Printf("$argon2id$v=%d$m=%d,t=%d,p=%d$%s$%s\n",
+		argon2.Version, 65536, 1, 4,
+		base64.RawStdEncoding.EncodeToString(salt),
+		base64.RawStdEncoding.EncodeToString(key))
+}

server/internal/auth/device_register_test.go

@@ -0,0 +1,89 @@
+package auth
+
+import (
+	"context"
+	"testing"
+)
+
+// fakeRegistrar records RegisterDevice calls for assertion.
+type fakeRegistrar struct {
+	calls []struct {
+		userID int64
+		meta   DeviceMeta
+	}
+	err error
+}
+
+func (f *fakeRegistrar) RegisterDevice(_ context.Context, userID int64, meta DeviceMeta) error {
+	f.calls = append(f.calls, struct {
+		userID int64
+		meta   DeviceMeta
+	}{userID, meta})
+	return f.err
+}
+
+// Register/Login with a device should trigger RegisterDevice with the meta.
+func TestService_RegisterDevice_OnRegisterAndLogin(t *testing.T) {
+	svc, _, _ := newService(t, ServiceConfig{})
+	reg := &fakeRegistrar{}
+	svc.SetDeviceRegistrar(reg)
+	ctx := context.Background()
+	const email = "dev@example.com"
+	const pw = "supersecret"
+	meta := DeviceMeta{DeviceID: "dev-uuid-1", Name: "MacBook Pro", Platform: "macos", ClientVersion: "v1.0.10"}
+
+	if _, err := svc.SendCode(ctx, email, "1.1.1.1"); err != nil {
+		t.Fatalf("SendCode: %v", err)
+	}
+	code := codeInRedis(t, svc, email)
+	if _, e := svc.Register(ctx, email, code, pw, meta); e != nil {
+		t.Fatalf("Register: %v", e)
+	}
+	if len(reg.calls) != 1 || reg.calls[0].meta.DeviceID != "dev-uuid-1" || reg.calls[0].meta.Platform != "macos" {
+		t.Fatalf("register did not register device: %+v", reg.calls)
+	}
+
+	if _, _, e := svc.Login(ctx, email, pw, "", meta); e != nil {
+		t.Fatalf("Login: %v", e)
+	}
+	if len(reg.calls) != 2 || reg.calls[1].meta.Name != "MacBook Pro" {
+		t.Fatalf("login did not register device: %+v", reg.calls)
+	}
+	if reg.calls[0].userID == 0 || reg.calls[0].userID != reg.calls[1].userID {
+		t.Fatalf("userID mismatch: %+v", reg.calls)
+	}
+}
+
+// A registrar error (e.g. device cap) must NOT fail login/register.
+func TestService_RegisterDevice_BestEffort(t *testing.T) {
+	svc, _, _ := newService(t, ServiceConfig{})
+	svc.SetDeviceRegistrar(&fakeRegistrar{err: context.DeadlineExceeded})
+	ctx := context.Background()
+	const email = "be@example.com"
+	if _, err := svc.SendCode(ctx, email, "1.1.1.1"); err != nil {
+		t.Fatalf("SendCode: %v", err)
+	}
+	code := codeInRedis(t, svc, email)
+	if _, e := svc.Register(ctx, email, code, "supersecret", DeviceMeta{DeviceID: "x", Platform: "windows"}); e != nil {
+		t.Fatalf("Register must succeed despite registrar error: %v", e)
+	}
+}
+
+// No device id / no registrar → no-op, login still works.
+func TestService_RegisterDevice_NoMeta(t *testing.T) {
+	svc, _, _ := newService(t, ServiceConfig{})
+	reg := &fakeRegistrar{}
+	svc.SetDeviceRegistrar(reg)
+	ctx := context.Background()
+	const email = "nm@example.com"
+	if _, err := svc.SendCode(ctx, email, "1.1.1.1"); err != nil {
+		t.Fatalf("SendCode: %v", err)
+	}
+	code := codeInRedis(t, svc, email)
+	if _, e := svc.Register(ctx, email, code, "supersecret", DeviceMeta{}); e != nil {
+		t.Fatalf("Register: %v", e)
+	}
+	if len(reg.calls) != 0 {
+		t.Fatalf("empty device id should not register: %+v", reg.calls)
+	}
+}

server/internal/auth/handler.go

@@ -46,15 +46,30 @@ type sendCodeRequest struct {
 	Email string `json:"email"`
 }
 
+// deviceBody is the optional device identity sent on login/register so the
+// control plane can register the device (devices table) and bind a session.
+type deviceBody struct {
+	ID            string `json:"id"`
+	Name          string `json:"name"`
+	Platform      string `json:"platform"`
+	ClientVersion string `json:"client_version"`
+}
+
+func (d deviceBody) toMeta() DeviceMeta {
+	return DeviceMeta{DeviceID: d.ID, Name: d.Name, Platform: d.Platform, ClientVersion: d.ClientVersion}
+}
+
 type registerRequest struct {
-	Email    string `json:"email"`
-	Code     string `json:"code"`
-	Password string `json:"password"`
+	Email    string     `json:"email"`
+	Code     string     `json:"code"`
+	Password string     `json:"password"`
+	Device   deviceBody `json:"device"`
 }
 
 type loginRequest struct {
-	Email    string `json:"email"`
-	Password string `json:"password"`
+	Email    string     `json:"email"`
+	Password string     `json:"password"`
+	Device   deviceBody `json:"device"`
 }
 
 type refreshRequest struct {
@@ -87,7 +102,7 @@ func (h *Handler) Register(w http.ResponseWriter, r *http.Request) {
 	if !decodeJSON(w, r, &req) {
 		return
 	}
-	pair, apiErr := h.svc.Register(r.Context(), req.Email, req.Code, req.Password)
+	pair, apiErr := h.svc.Register(r.Context(), req.Email, req.Code, req.Password, req.Device.toMeta())
 	if apiErr != nil {
 		writeAPIErr(w, apiErr, 0)
 		return
@@ -101,7 +116,7 @@ func (h *Handler) Login(w http.ResponseWriter, r *http.Request) {
 	if !decodeJSON(w, r, &req) {
 		return
 	}
-	out, retryAfter, apiErr := h.svc.Login(r.Context(), req.Email, req.Password, clientIP(r))
+	out, retryAfter, apiErr := h.svc.Login(r.Context(), req.Email, req.Password, clientIP(r), req.Device.toMeta())
 	if apiErr != nil {
 		writeAPIErr(w, apiErr, retryAfter)
 		return

server/internal/auth/service.go

@@ -77,6 +77,22 @@ func (c *ServiceConfig) withDefaults() {
 	}
 }
 
+// DeviceMeta is the client-reported device identity carried on login/register so
+// the device can be registered (devices table) and, later, bound to a session.
+type DeviceMeta struct {
+	DeviceID      string // client-generated stable UUID (secure storage)
+	Name          string // host/model name
+	Platform      string // ios|android|windows|macos|linux
+	ClientVersion string // app version (stored from P2 onward)
+}
+
+// DeviceRegistrar registers the logging-in device. Defined consumer-side to
+// avoid an import cycle; devices.Service is adapted to it in main wiring.
+// Registration is best-effort and must never block login (see registerDevice).
+type DeviceRegistrar interface {
+	RegisterDevice(ctx context.Context, userID int64, meta DeviceMeta) error
+}
+
 // Service is the auth business layer: code issuance, registration, login, and
 // token refresh. It is safe for concurrent use.
 type Service struct {
@@ -87,6 +103,24 @@ type Service struct {
 	mailer Mailer
 	cfg    ServiceConfig
 	now    func() time.Time
+	devReg DeviceRegistrar // nil until wired; registration is best-effort
+}
+
+// SetDeviceRegistrar wires the device registrar after construction (main keeps
+// auth and devices decoupled). Safe to call once during startup.
+func (s *Service) SetDeviceRegistrar(r DeviceRegistrar) { s.devReg = r }
+
+// registerDevice records the logging-in device. Best-effort: a registrar error
+// (device cap, transient DB) is logged but never fails the login/registration —
+// the user must always be able to get in (notably: free-plan reinstall churns
+// the device UUID, so a hard cap here would lock users out).
+func (s *Service) registerDevice(ctx context.Context, userID int64, meta DeviceMeta) {
+	if s.devReg == nil || meta.DeviceID == "" {
+		return
+	}
+	if err := s.devReg.RegisterDevice(ctx, userID, meta); err != nil {
+		slog.Warn("auth: device register failed (login proceeds)", "uid", userID, "err", err)
+	}
 }
 
 // NewService wires the auth service. now may be nil (defaults to time.Now).
@@ -184,7 +218,7 @@ func (s *Service) SendCode(ctx context.Context, rawEmail, ip string) (retryAfter
 
 // Register verifies the code (one-time), creates the account plus a 7-day PRO
 // trial in a single transaction, and returns a fresh token pair.
-func (s *Service) Register(ctx context.Context, rawEmail, code, password string) (*TokenPair, *apierr.Error) {
+func (s *Service) Register(ctx context.Context, rawEmail, code, password string, device DeviceMeta) (*TokenPair, *apierr.Error) {
 	email := NormalizeEmail(rawEmail)
 	if !ValidEmail(email) || len(password) < 8 || len(code) != 6 {
 		return nil, ErrInvalidRequest
@@ -217,6 +251,7 @@ func (s *Service) Register(ctx context.Context, rawEmail, code, password string)
 	if err != nil {
 		return nil, ErrInternal
 	}
+	s.registerDevice(ctx, user.ID, device)
 	return pair, nil
 }
 
@@ -272,7 +307,7 @@ const (
 	totpPendingTTL    = 5 * time.Minute
 )
 
-func (s *Service) Login(ctx context.Context, rawEmail, password, ip string) (*LoginOutcome, time.Duration, *apierr.Error) {
+func (s *Service) Login(ctx context.Context, rawEmail, password, ip string, device DeviceMeta) (*LoginOutcome, time.Duration, *apierr.Error) {
 	_ = ip // IP reserved for future per-IP login throttling; not logged.
 	email := NormalizeEmail(rawEmail)
 	if email == "" || password == "" {
@@ -329,6 +364,7 @@ func (s *Service) Login(ctx context.Context, rawEmail, password, ip string) (*Lo
 	if err != nil {
 		return nil, 0, ErrInternal
 	}
+	s.registerDevice(ctx, user.ID, device)
 	return &LoginOutcome{Tokens: pair}, 0, nil
 }
 

server/internal/auth/service_test.go

@@ -40,7 +40,7 @@ func TestService_RegisterFullFlow(t *testing.T) {
 	}
 	code := codeInRedis(t, svc, email)
 
-	pair, apiErr := svc.Register(ctx, email, code, "supersecret")
+	pair, apiErr := svc.Register(ctx, email, code, "supersecret", DeviceMeta{})
 	if apiErr != nil {
 		t.Fatalf("Register: %v", apiErr)
 	}
@@ -84,7 +84,7 @@ func TestService_DuplicateEmailConflict(t *testing.T) {
 
 	// First registration.
 	_, _ = svc.SendCode(ctx, email, "")
-	if _, e := svc.Register(ctx, email, codeInRedis(t, svc, email), "password1"); e != nil {
+	if _, e := svc.Register(ctx, email, codeInRedis(t, svc, email), "password1", DeviceMeta{}); e != nil {
 		t.Fatalf("first register: %v", e)
 	}
 
@@ -103,7 +103,7 @@ func TestService_DuplicateEmailConflict(t *testing.T) {
 	if err := svc.rdb.Set(ctx, codeKey(email), "654321", 10*time.Minute).Err(); err != nil {
 		t.Fatalf("force code: %v", err)
 	}
-	_, apiErr := svc.Register(ctx, email, "654321", "password2")
+	_, apiErr := svc.Register(ctx, email, "654321", "password2", DeviceMeta{})
 	if apiErr == nil || apiErr.Code != ErrCodeInvalid.Code {
 		t.Fatalf("want code_invalid (anti-enumeration), got %v", apiErr)
 	}
@@ -115,7 +115,7 @@ func TestService_CodeWrong(t *testing.T) {
 	const email = "wrong@example.com"
 	_, _ = svc.SendCode(ctx, email, "")
 
-	_, apiErr := svc.Register(ctx, email, "000000", "password1")
+	_, apiErr := svc.Register(ctx, email, "000000", "password1", DeviceMeta{})
 	if apiErr == nil || apiErr.Code != ErrCodeInvalid.Code {
 		t.Fatalf("want code_invalid, got %v", apiErr)
 	}
@@ -131,7 +131,7 @@ func TestService_CodeExpired(t *testing.T) {
 	// Expire the code key.
 	svc.rdb.Del(ctx, codeKey(email))
 
-	_, apiErr := svc.Register(ctx, email, code, "password1")
+	_, apiErr := svc.Register(ctx, email, code, "password1", DeviceMeta{})
 	if apiErr == nil || apiErr.Code != ErrCodeInvalid.Code {
 		t.Fatalf("want code_invalid after expiry, got %v", apiErr)
 	}
@@ -144,11 +144,11 @@ func TestService_CodeReuseRejected(t *testing.T) {
 	_, _ = svc.SendCode(ctx, email, "")
 	code := codeInRedis(t, svc, email)
 
-	if _, e := svc.Register(ctx, email, code, "password1"); e != nil {
+	if _, e := svc.Register(ctx, email, code, "password1", DeviceMeta{}); e != nil {
 		t.Fatalf("first register: %v", e)
 	}
 	// Re-using the consumed code must fail.
-	_, apiErr := svc.Register(ctx, "other@example.com", code, "password1")
+	_, apiErr := svc.Register(ctx, "other@example.com", code, "password1", DeviceMeta{})
 	if apiErr == nil || apiErr.Code != ErrCodeInvalid.Code {
 		t.Fatalf("want code_invalid on reuse, got %v", apiErr)
 	}
@@ -163,12 +163,12 @@ func TestService_CodeBruteForceBurned(t *testing.T) {
 
 	// 3 wrong attempts burn the code.
 	for i := 0; i < 3; i++ {
-		if _, e := svc.Register(ctx, email, "999999", "password1"); e == nil {
+		if _, e := svc.Register(ctx, email, "999999", "password1", DeviceMeta{}); e == nil {
 			t.Fatal("wrong code should fail")
 		}
 	}
 	// Even the correct code no longer works.
-	if _, e := svc.Register(ctx, email, good, "password1"); e == nil || e.Code != ErrCodeInvalid.Code {
+	if _, e := svc.Register(ctx, email, good, "password1", DeviceMeta{}); e == nil || e.Code != ErrCodeInvalid.Code {
 		t.Fatalf("burned code should reject correct value, got %v", e)
 	}
 }
@@ -205,25 +205,25 @@ func TestService_LoginAndLockout(t *testing.T) {
 	const pw = "rightpassword"
 
 	_, _ = svc.SendCode(ctx, email, "")
-	if _, e := svc.Register(ctx, email, codeInRedis(t, svc, email), pw); e != nil {
+	if _, e := svc.Register(ctx, email, codeInRedis(t, svc, email), pw, DeviceMeta{}); e != nil {
 		t.Fatalf("register: %v", e)
 	}
 
 	// Correct login works.
-	pair, _, apiErr := svc.Login(ctx, email, pw, "")
+	pair, _, apiErr := svc.Login(ctx, email, pw, "", DeviceMeta{})
 	if apiErr != nil || pair == nil {
 		t.Fatalf("login should succeed: %v", apiErr)
 	}
 
 	// 3 wrong attempts.
 	for i := 0; i < 3; i++ {
-		_, _, e := svc.Login(ctx, email, "wrong", "")
+		_, _, e := svc.Login(ctx, email, "wrong", "", DeviceMeta{})
 		if e == nil || e.Code != ErrInvalidCredentials.Code {
 			t.Fatalf("attempt %d want invalid_credentials, got %v", i, e)
 		}
 	}
 	// Now locked, even with the correct password.
-	_, ra, e := svc.Login(ctx, email, pw, "")
+	_, ra, e := svc.Login(ctx, email, pw, "", DeviceMeta{})
 	if e == nil || e.Code != ErrAccountLocked.Code {
 		t.Fatalf("want account_locked, got %v", e)
 	}
@@ -234,7 +234,7 @@ func TestService_LoginAndLockout(t *testing.T) {
 
 func TestService_LoginUnknownUser(t *testing.T) {
 	svc, _, _ := newService(t, ServiceConfig{})
-	_, _, apiErr := svc.Login(context.Background(), "ghost@example.com", "whatever", "")
+	_, _, apiErr := svc.Login(context.Background(), "ghost@example.com", "whatever", "", DeviceMeta{})
 	if apiErr == nil || apiErr.Code != ErrInvalidCredentials.Code {
 		t.Fatalf("want invalid_credentials for unknown user, got %v", apiErr)
 	}
@@ -247,12 +247,12 @@ func TestService_BannedUserRejected(t *testing.T) {
 	const pw = "password1"
 
 	_, _ = svc.SendCode(ctx, email, "")
-	if _, e := svc.Register(ctx, email, codeInRedis(t, svc, email), pw); e != nil {
+	if _, e := svc.Register(ctx, email, codeInRedis(t, svc, email), pw, DeviceMeta{}); e != nil {
 		t.Fatalf("register: %v", e)
 	}
 	store.setStatus(email, "banned")
 
-	_, _, apiErr := svc.Login(ctx, email, pw, "")
+	_, _, apiErr := svc.Login(ctx, email, pw, "", DeviceMeta{})
 	if apiErr == nil || apiErr.Code != ErrAccountBanned.Code {
 		t.Fatalf("want account_banned, got %v", apiErr)
 	}
@@ -264,7 +264,7 @@ func TestService_RefreshRotation(t *testing.T) {
 	const email = "refresh@example.com"
 
 	_, _ = svc.SendCode(ctx, email, "")
-	pair, e := svc.Register(ctx, email, codeInRedis(t, svc, email), "password1")
+	pair, e := svc.Register(ctx, email, codeInRedis(t, svc, email), "password1", DeviceMeta{})
 	if e != nil {
 		t.Fatalf("register: %v", e)
 	}

server/internal/auth/zz_tmpverify_test.go

@@ -0,0 +1,10 @@
+package auth
+import "testing"
+import "os"
+func TestTmpVerify(t *testing.T){
+  h,_ := os.ReadFile("/Users/wangjia/.claude/jobs/f76e813b/tmp/newhash.txt")
+  enc := string(h); enc = enc[:len(enc)-1] // strip newline
+  ok,err := VerifyPassword(enc, "wangjia812")
+  if err!=nil || !ok { t.Fatalf("verify failed ok=%v err=%v", ok, err) }
+  t.Log("verify OK")
+}

server/internal/devices/service.go

@@ -351,6 +351,8 @@ func normalizePlatform(s string) (string, bool) {
 		return "windows", true
 	case "macos":
 		return "macos", true
+	case "linux":
+		return "linux", true
 	}
 	return "", false
 }

server/internal/devices/service_test.go

@@ -208,8 +208,8 @@ func TestRequirePaidTier(t *testing.T) {
 
 func TestNormalizePlatform(t *testing.T) {
 	cases := map[string]bool{
-		"ios": true, "iOS": true, "ANDROID": true, "windows": true, "macos": true,
-		"linux": false, "": false, "blackberry": false,
+		"ios": true, "iOS": true, "ANDROID": true, "windows": true, "macos": true, "linux": true,
+		"": false, "blackberry": false,
 	}
 	for in, wantOK := range cases {
 		_, ok := normalizePlatform(in)

todo/todo.html

@@ -257,8 +257,8 @@ ul.todo-list { list-style: none; margin: 0; padding: 0; }
       <div class="stat-pill"><strong>12</strong>全部</div>
       <div class="stat-pill"><strong>9</strong>待开始</div>
       <div class="stat-pill"><strong>0</strong>开发中</div>
-      <div class="stat-pill"><strong>3</strong>待验收</div>
-      <div class="stat-pill"><strong>0</strong>已验收</div>
+      <div class="stat-pill"><strong>1</strong>待验收</div>
+      <div class="stat-pill"><strong>2</strong>已验收</div>
       
     </div>
   </div>
@@ -583,7 +583,7 @@ ul.todo-list { list-style: none; margin: 0; padding: 0; }
   </div>
   <div class="section-block" id="section-done">
     <div class="section-title st-done" data-toggle="done">
-      🔍 待验收 <span class="s-count">3</span>
+      🔍 待验收 <span class="s-count">1</span>
       <span class="s-arrow">▴ 收起</span>
     </div>
     <div class="section-list-wrap " id="list-wrap-done">
@@ -617,50 +617,31 @@ ul.todo-list { list-style: none; margin: 0; padding: 0; }
     </div>
       </div>
     </li>
-
-    <li class="todo-card s-done"
-        data-id="5"
-        data-level="mid"
-        data-status="done"
-        data-tier="3"
-        data-tags="后端">
-      <div class="card-header">
-        <span class="item-title">SendCode 发信失败记日志 + 测试</span>
-        <div class="card-badges">
-          <span class="tag status-badge s-done">待验收</span>
-          <span class="tag t-high">重要</span>
-          <span class="tag tier-3">三级</span>
-          
-          <button class="reject-btn" data-id="5" data-title="SendCode 发信失败记日志 + 测试">拒绝验收</button>
-        </div>
-      </div>
-      
-      <div class="item-desc">auth/service.go 异步发信把错误静默吞了（:157 SendCode 的 _=s.mailer.SendCode(...)，:133 SendAlreadyRegistered 同样），导致 SMTP 故障日志无痕、本次 587 被封难排查。改为发信失败时记日志（slog.Error，脱敏：只记 send failed:&lt;err&gt;，绝不记验证码，邮箱可打码，守 no-secret-in-logs）。并加测试：注入会失败的 mock Mailer，断言发送失败时确实记了一条错误日志（可用 LogMailer 思路/捕获 slog handler 验证）。</div>
-      
-      
-      <div class="card-footer">
-        <div class="tag-row"><span class="tag t-tag" data-tag="后端">后端</span></div>
-        <div class="item-meta">
-      <span class="meta-date">🕐 2026-06-28</span>
-      
+      </ul>
     </div>
-      </div>
-    </li>
-
-    <li class="todo-card s-done"
+  </div>
+  <div class="section-block" id="section-accepted">
+    <div class="section-title st-accepted" data-toggle="accepted">
+      ✅ 已验收 <span class="s-count">2</span>
+      <span class="s-arrow">▾ 展开</span>
+    </div>
+    <div class="section-list-wrap collapsed" id="list-wrap-accepted">
+      <ul class="todo-list" id="list-accepted">
+        
+    <li class="todo-card s-accepted"
         data-id="6"
         data-level="mid"
-        data-status="done"
+        data-status="accepted"
         data-tier="2"
         data-tags="前端,后端">
       <div class="card-header">
         <span class="item-title">节点列表：正式名(地区·国家) + 国旗图标</span>
         <div class="card-badges">
-          <span class="tag status-badge s-done">待验收</span>
+          <span class="tag status-badge s-accepted">已验收</span>
           <span class="tag t-high">重要</span>
           <span class="tag tier-2">二级</span>
           
-          <button class="reject-btn" data-id="6" data-title="节点列表：正式名(地区·国家) + 国旗图标">拒绝验收</button>
+          
         </div>
       </div>
       
@@ -671,21 +652,39 @@ ul.todo-list { list-style: none; margin: 0; padding: 0; }
         <div class="tag-row"><span class="tag t-tag" data-tag="前端">前端</span> <span class="tag t-tag" data-tag="后端">后端</span></div>
         <div class="item-meta">
       <span class="meta-date">🕐 2026-06-28</span>
-      
+      <span class="meta-date">✅ 验收 2026-06-28</span>
     </div>
       </div>
     </li>
-      </ul>
+
+    <li class="todo-card s-accepted"
+        data-id="5"
+        data-level="mid"
+        data-status="accepted"
+        data-tier="3"
+        data-tags="后端">
+      <div class="card-header">
+        <span class="item-title">SendCode 发信失败记日志 + 测试</span>
+        <div class="card-badges">
+          <span class="tag status-badge s-accepted">已验收</span>
+          <span class="tag t-high">重要</span>
+          <span class="tag tier-3">三级</span>
+          
+          
+        </div>
+      </div>
+      
+      <div class="item-desc">auth/service.go 异步发信把错误静默吞了（:157 SendCode 的 _=s.mailer.SendCode(...)，:133 SendAlreadyRegistered 同样），导致 SMTP 故障日志无痕、本次 587 被封难排查。改为发信失败时记日志（slog.Error，脱敏：只记 send failed:&lt;err&gt;，绝不记验证码，邮箱可打码，守 no-secret-in-logs）。并加测试：注入会失败的 mock Mailer，断言发送失败时确实记了一条错误日志（可用 LogMailer 思路/捕获 slog handler 验证）。</div>
+      
+      
+      <div class="card-footer">
+        <div class="tag-row"><span class="tag t-tag" data-tag="后端">后端</span></div>
+        <div class="item-meta">
+      <span class="meta-date">🕐 2026-06-28</span>
+      <span class="meta-date">✅ 验收 2026-06-28</span>
     </div>
-  </div>
-  <div class="section-block" id="section-accepted">
-    <div class="section-title st-accepted" data-toggle="accepted">
-      ✅ 已验收 <span class="s-count">0</span>
-      <span class="s-arrow">▾ 展开</span>
-    </div>
-    <div class="section-list-wrap collapsed" id="list-wrap-accepted">
-      <ul class="todo-list" id="list-accepted">
-        <p class="empty-tip">暂无条目</p>
+      </div>
+    </li>
       </ul>
     </div>
   </div>

todo/todo.json

@@ -1,7 +1,7 @@
 {
   "meta": {
     "title": "feature+windows — 项目 TODO",
-    "updated_at": "2026-06-28T11:27:56.709Z"
+    "updated_at": "2026-06-28T13:19:24.300Z"
   },
   "seq": 12,
   "items": [
@@ -75,10 +75,10 @@
       "tags": [
         "后端"
       ],
-      "status": "done",
+      "status": "accepted",
       "created_at": "2026-06-27T23:37:24.980Z",
-      "done": false,
-      "completed_at": null,
+      "done": true,
+      "completed_at": "2026-06-28T13:19:24.207Z",
       "version": null
     },
     {
@@ -91,10 +91,10 @@
         "前端",
         "后端"
       ],
-      "status": "done",
+      "status": "accepted",
       "created_at": "2026-06-28T00:21:30.990Z",
-      "done": false,
-      "completed_at": null,
+      "done": true,
+      "completed_at": "2026-06-28T13:19:24.299Z",
       "version": null
     },
     {