新增空闲锁屏、修复401等问题，新增文件版本管理、共享库等占位符

backend/app/api/v1/auth.py

@@ -1,3 +1,4 @@
+from datetime import datetime, timedelta, timezone
 from fastapi import APIRouter, Depends, HTTPException, status
 from fastapi import File, UploadFile
 from pydantic import BaseModel, EmailStr, Field
@@ -5,7 +6,8 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from pathlib import Path
 import uuid
 
-from app.core.security import create_access_token, verify_password
+from app.core.config import settings
+from app.core.security import create_access_token, decode_token_allow_expired, oauth2_scheme, verify_password
 from app.core.deps import get_current_user, get_db_session
 from app.crud import user as user_crud
 from app.models.user import UserRole, UserStatus
@@ -18,6 +20,21 @@ class LoginRequest(BaseModel):
     password: str = Field(min_length=1)
 
 
+class ExtendResponse(BaseModel):
+    accessToken: str
+    expiresAt: datetime
+
+
+class UnlockRequest(BaseModel):
+    email: EmailStr
+    password: str = Field(min_length=1)
+
+
+class UnlockResponse(BaseModel):
+    accessToken: str
+    expiresAt: datetime
+
+
 router = APIRouter()
 AVATAR_ROOT = Path(__file__).resolve().parent.parent.parent / "uploads" / "avatars"
 AVATAR_ROOT.mkdir(parents=True, exist_ok=True)
@@ -58,10 +75,12 @@ async def login_for_access_token(
             detail="账号未审核或不可用",
         )
 
+    session_start = datetime.now(timezone.utc)
     access_token = create_access_token(
         user_id=str(db_user.id),
         role=db_user.role.value if hasattr(db_user.role, "value") else db_user.role,
         expires_minutes=None,
+        session_start=session_start,
     )
     return Token(access_token=access_token, token_type="bearer")
 
@@ -71,6 +90,67 @@ async def read_me(current_user=Depends(get_current_user)) -> UserRead:
     return current_user
 
 
+@router.post("/extend", response_model=ExtendResponse)
+async def extend_access_token(
+    token: str = Depends(oauth2_scheme),
+    db: AsyncSession = Depends(get_db_session),
+) -> ExtendResponse:
+    payload = decode_token_allow_expired(token)
+    exp = payload.get("exp")
+    if not exp:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="登录已过期")
+    now_ts = int(datetime.now(timezone.utc).timestamp())
+    if now_ts > int(exp) + settings.JWT_EXTEND_GRACE_SECONDS:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="登录已过期")
+    user_id = payload.get("sub")
+    if not user_id:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="无法验证登录凭据")
+    db_user = await user_crud.get_by_id(db, uuid.UUID(str(user_id)))
+    if not db_user:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="账号不存在或已停用")
+    if db_user.status != UserStatus.ACTIVE:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="账号已停用")
+    session_start_ts = payload.get("orig_iat") or payload.get("iat")
+    if session_start_ts:
+        max_seconds = settings.ABSOLUTE_SESSION_MAX_HOURS * 3600
+        if now_ts - int(session_start_ts) > max_seconds:
+            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="会话已到期，请重新登录")
+        session_start = datetime.fromtimestamp(int(session_start_ts), tz=timezone.utc)
+    else:
+        session_start = datetime.now(timezone.utc)
+    new_token = create_access_token(
+        user_id=str(db_user.id),
+        role=db_user.role.value if hasattr(db_user.role, "value") else db_user.role,
+        expires_minutes=None,
+        session_start=session_start,
+    )
+    expires_at = datetime.now(timezone.utc) + timedelta(minutes=settings.JWT_EXPIRE_MINUTES)
+    return ExtendResponse(accessToken=new_token, expiresAt=expires_at)
+
+
+@router.post("/unlock", response_model=UnlockResponse)
+async def unlock_session(
+    payload: UnlockRequest,
+    db: AsyncSession = Depends(get_db_session),
+) -> UnlockResponse:
+    db_user = await user_crud.get_by_email(db, payload.email)
+    if not db_user:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="账号不存在")
+    if not verify_password(payload.password, db_user.password_hash):
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="密码错误")
+    if db_user.status != UserStatus.ACTIVE:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="账号已停用")
+    session_start = datetime.now(timezone.utc)
+    access_token = create_access_token(
+        user_id=str(db_user.id),
+        role=db_user.role.value if hasattr(db_user.role, "value") else db_user.role,
+        expires_minutes=None,
+        session_start=session_start,
+    )
+    expires_at = session_start + timedelta(minutes=settings.JWT_EXPIRE_MINUTES)
+    return UnlockResponse(accessToken=access_token, expiresAt=expires_at)
+
+
 @router.patch("/me", response_model=UserRead)
 async def update_me(
     payload: UserSelfUpdate,