pangolin

wangjia/pangolin

Fork 0

Commit Graph

Author	SHA1	Message	Date
wangjia	f0af3bcc94	fix(server): 强退设备立即离线 — online 须含活跃会话 + 撤销会话不刷 last_seen trick bug:强退后被踢设备的下一次会话轮询会先刷 last_seen 再发现 active=false,那一刷把它顶成「在线」直到 90s 窗口过期。修:① online = last_seen 新且有未撤销会话 (ActiveSessionDeviceIDs);被强退设备无活跃会话 → 立即离线。② SessionActive 仅在 active 时才 TouchLastSeen,撤销会话的轮询不再刷新。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-30 08:51:10 +08:00
wangjia	0b33f12400	feat: 近实时远程下线 — 客户端轮询会话有效性(~15s),服务端 GET /v1/me/session 控制面无推送通道,access token 是无状态 JWT(15min),强制退出后被踢设备要等 token 过期 (≤15min)才登出。改成客户端每 15s 轮询会话是否仍有效,被强制退出即登出 → 延迟压到 ~15s。 - 服务端:sessions.HasActiveSession(user,device) + devices.SessionActive(按 UUID,fail-open) + GET /v1/me/session?device_id= 返回 {active}(恒 200,判据在 body)。无新迁移。 - 客户端:account_api.sessionActive + main.dart _RootFlowState 15s 轮询,active=false 即 logout (网络/鉴权异常不据此登出,fail-safe)。 - 测试:TestSQLite_SessionHasActiveSession(建会话=活跃→RevokeByDevice→非活跃)。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-30 07:25:16 +08:00
wangjia	2f298f0a0a	feat(devices): P2 sessions 表 + 在线/最后登录/客户端版本 ci-pangolin / Lint — shellcheck (push) Successful in 8s Details ci-pangolin / OpenAPI Sync Check (push) Successful in 18s Details ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Successful in 6s Details ci-pangolin / Flutter — analyze + test (push) Successful in 24s Details ci-pangolin / Portable SQL — 可移植性 (mysql/sqlite) (push) Successful in 5s Details ci-pangolin / Codegen Drift — token 生成物未漂移 (push) Successful in 4s Details ci-pangolin / Go — build + test (push) Successful in 11s Details ci-pangolin / E2E Smoke — L4 进程级端到端 (push) Successful in 14s Details ci-pangolin / Go — integration (mysql/redis testcontainers) (push) Failing after 4m13s Details ci-pangolin / Golden — 视觉回归 (components + auth) (push) Successful in 14s Details migration 000016(mysql+sqlite,含 down):新增 sessions 表(绑 device+refresh JTI) + devices 加 client_version/totp_trusted_until。devices 唯一键改 + platform CHECK 加 linux(需 SQLite 表重建)拆出后续迁移,降风险。后端:新 internal/sessions Store(Create/Rotate/Revoke/RevokeByDevice/ LastLoginByDevice);TokenManager 外露 refresh JTI(IssueWithJTI/RefreshWithJTI/ ParseRefreshJTI);auth.Service 注入 SessionStore——登录建会话、刷新轮换、登出吊销; DeviceRegistrar 返回 deviceID;ReportUsage 心跳 touch devices.last_seen(在线判定); devices.ListDevices 经 LastLoginSource 注入返回 online(last_seen<3min)/client_version/ last_login;RegisterIfAbsent 存 client_version。客户端:Device model 加 online/clientVersion/lastLogin(fromJson 自动解析)。测试:sessions store 3 例 + ListDevices 在线/最后登录 + device model 2 例 + migration v16;全量 go test/flutter test 绿。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-29 00:50:24 +08:00

Author

SHA1

Message

Date

wangjia

f0af3bcc94

fix(server): 强退设备立即离线 — online 须含活跃会话 + 撤销会话不刷 last_seen

trick bug:强退后被踢设备的下一次会话轮询会先刷 last_seen 再发现 active=false,那一刷
把它顶成「在线」直到 90s 窗口过期。修:① online = last_seen 新 且 有未撤销会话
(ActiveSessionDeviceIDs);被强退设备无活跃会话 → 立即离线。② SessionActive 仅在 active
时才 TouchLastSeen,撤销会话的轮询不再刷新。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-30 08:51:10 +08:00

wangjia

0b33f12400

feat: 近实时远程下线 — 客户端轮询会话有效性(~15s),服务端 GET /v1/me/session

控制面无推送通道,access token 是无状态 JWT(15min),强制退出后被踢设备要等 token 过期
(≤15min)才登出。改成客户端每 15s 轮询会话是否仍有效,被强制退出即登出 → 延迟压到 ~15s。
- 服务端:sessions.HasActiveSession(user,device) + devices.SessionActive(按 UUID,fail-open)
  + GET /v1/me/session?device_id= 返回 {active}(恒 200,判据在 body)。无新迁移。
- 客户端:account_api.sessionActive + main.dart _RootFlowState 15s 轮询,active=false 即 logout
  (网络/鉴权异常不据此登出,fail-safe)。
- 测试:TestSQLite_SessionHasActiveSession(建会话=活跃→RevokeByDevice→非活跃)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-30 07:25:16 +08:00

wangjia

2f298f0a0a

feat(devices): P2 sessions 表 + 在线/最后登录/客户端版本

ci-pangolin / Lint — shellcheck (push) Successful in 8s

Details

ci-pangolin / OpenAPI Sync Check (push) Successful in 18s

Details

ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Successful in 6s

Details

ci-pangolin / Flutter — analyze + test (push) Successful in 24s

Details

ci-pangolin / Portable SQL — 可移植性 (mysql/sqlite) (push) Successful in 5s

Details

ci-pangolin / Codegen Drift — token 生成物未漂移 (push) Successful in 4s

Details

ci-pangolin / Go — build + test (push) Successful in 11s

Details

ci-pangolin / E2E Smoke — L4 进程级端到端 (push) Successful in 14s

Details

ci-pangolin / Go — integration (mysql/redis testcontainers) (push) Failing after 4m13s

Details

ci-pangolin / Golden — 视觉回归 (components + auth) (push) Successful in 14s

Details

migration 000016(mysql+sqlite,含 down):新增 sessions 表(绑 device+refresh JTI)
+ devices 加 client_version/totp_trusted_until。devices 唯一键改 + platform CHECK
加 linux(需 SQLite 表重建)拆出后续迁移,降风险。

后端:新 internal/sessions Store(Create/Rotate/Revoke/RevokeByDevice/
LastLoginByDevice);TokenManager 外露 refresh JTI(IssueWithJTI/RefreshWithJTI/
ParseRefreshJTI);auth.Service 注入 SessionStore——登录建会话、刷新轮换、登出吊销;
DeviceRegistrar 返回 deviceID;ReportUsage 心跳 touch devices.last_seen(在线判定);
devices.ListDevices 经 LastLoginSource 注入返回 online(last_seen<3min)/client_version/
last_login;RegisterIfAbsent 存 client_version。
客户端:Device model 加 online/clientVersion/lastLogin(fromJson 自动解析)。
测试:sessions store 3 例 + ListDevices 在线/最后登录 + device model 2 例 +
migration v16;全量 go test/flutter test 绿。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-29 00:50:24 +08:00

3 Commits