feat(desktop): 支持桌面端三十天免登录

backend/app/core/config.py

@@ -19,6 +19,7 @@ class Settings(BaseSettings):
     JWT_EXPIRE_MINUTES: int = 60
     JWT_EXTEND_GRACE_SECONDS: int = 120
     ABSOLUTE_SESSION_MAX_HOURS: int = 8
+    DESKTOP_SESSION_MAX_DAYS: int = 30
     LOGIN_RSA_PRIVATE_KEY: Optional[str] = None
     LOGIN_RSA_PUBLIC_KEY: Optional[str] = None
     LOGIN_RSA_KEY_ID: str = "default"

backend/app/core/security.py

@@ -19,16 +19,29 @@ def create_access_token(
     user_id: str,
     expires_minutes: Optional[int] = None,
     session_start: Optional[datetime] = None,
+    max_age_seconds: Optional[int] = None,
+    issued_at: Optional[datetime] = None,
+    client_type: Optional[str] = None,
 ) -> str:
-    now = datetime.now(timezone.utc)
+    now = issued_at or datetime.now(timezone.utc)
+    if now.tzinfo is None:
+        now = now.replace(tzinfo=timezone.utc)
     expire = now + timedelta(minutes=expires_minutes or settings.JWT_EXPIRE_MINUTES)
     session_start_time = session_start or now
+    if session_start_time.tzinfo is None:
+        session_start_time = session_start_time.replace(tzinfo=timezone.utc)
+    if max_age_seconds is not None:
+        session_expire = session_start_time + timedelta(seconds=max_age_seconds)
+        if expire > session_expire:
+            expire = session_expire
     to_encode: Dict[str, Any] = {
         "sub": user_id,
         "exp": expire,
         "iat": int(now.timestamp()),
         "orig_iat": int(session_start_time.timestamp()),
     }
+    if client_type:
+        to_encode["client_type"] = client_type
     return jwt.encode(to_encode, settings.JWT_SECRET_KEY, algorithm=ALGORITHM)