发布 0.1.0:通知渠道、告警规则、令牌版本与安全加固

internal/service/oauth.go

@@ -197,7 +197,12 @@ func (o *OAuthService) HandleCallback(ctx context.Context, provider, state, code
 		return "", "", p.mode, err
 	}
 	if p.mode == "bind" {
-		return "", ident.Display, p.mode, o.bind(ctx, p.username, provider, ident)
+		if err := o.bind(ctx, p.username, provider, ident); err != nil {
+			return "", ident.Display, p.mode, err
+		}
+		// 绑定属敏感变更:版本递增使旧令牌失效,同时为操作者签新令牌随回跳带回
+		token, _, err := o.auth.RevokeSessions(ctx, p.username)
+		return token, ident.Display, p.mode, err
 	}
 	token, display, err = o.loginByIdentity(ctx, provider, ident)
 	return token, display, p.mode, err
@@ -305,7 +310,7 @@ func (o *OAuthService) loginByIdentity(ctx context.Context, provider string, ide
 	if err := o.db.WithContext(ctx).First(&user, row.UserID).Error; err != nil {
 		return "", "", fmt.Errorf("find bound user: %w", err)
 	}
-	token, _, err := o.auth.signToken(user.Username)
+	token, _, err := o.auth.signToken(user.Username, user.TokenVersion)
 	return token, ident.Display, err
 }
 
@@ -345,5 +350,6 @@ func (o *OAuthService) Unbind(ctx context.Context, username string, id uint) err
 	if res.RowsAffected == 0 {
 		return gorm.ErrRecordNotFound
 	}
-	return nil
+	// 解绑属敏感变更:递增令牌版本,已签发会话全部失效
+	return o.auth.bumpTokenVersion(ctx, username)
 }