feat(工作台): 优化入口布局与连接安全状态

backend/app/api/v1/auth.py

@@ -9,7 +9,7 @@ import uuid
 
 from app.core.config import settings
 from app.core.login_crypto import create_login_challenge, decrypt_login_payload, get_public_key_pem
-from app.core.request_context import resolve_ctms_client_type
+from app.core.request_context import resolve_client_ip, resolve_ctms_client_type
 from app.core.security import create_access_token, decode_token, decode_token_allow_expired, oauth2_scheme, verify_password
 from app.core.deps import get_current_user, get_db_session
 from app.crud import user as user_crud
@@ -379,6 +379,7 @@ async def heartbeat_login_session(
     return {
         "status": "online",
         "last_seen_at": session.last_seen_at.isoformat(),
+        "client_ip": resolve_client_ip(request),
     }
 
 

backend/tests/test_user_login_sessions.py

@@ -1,5 +1,6 @@
 from datetime import datetime, timedelta, timezone
 import uuid
+from pathlib import Path
 
 import pytest
 
@@ -20,6 +21,13 @@ def test_legacy_session_id_is_stable_without_storing_a_token():
     assert isinstance(first, uuid.UUID)
 
 
+def test_session_heartbeat_returns_server_observed_client_ip():
+    auth_source = (Path(__file__).resolve().parents[1] / "app" / "api" / "v1" / "auth.py").read_text()
+
+    assert "resolve_client_ip(request)" in auth_source
+    assert '"client_ip": resolve_client_ip(request)' in auth_source
+
+
 @pytest.mark.asyncio
 async def test_login_summary_marks_recent_unended_sessions_online(db_session, monkeypatch):
     now = datetime.now(timezone.utc)