release(main): 同步 dev 最新候选改动

backend/app/api/v1/auth.py

@@ -1,5 +1,6 @@
 from datetime import datetime, timedelta, timezone
-from fastapi import APIRouter, Depends, HTTPException, Query, Response, status
+from dataclasses import dataclass
+from fastapi import APIRouter, Depends, HTTPException, Query, Request, Response, status
 from fastapi import File, UploadFile
 from pydantic import BaseModel, EmailStr, Field
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -8,7 +9,8 @@ import uuid
 
 from app.core.config import settings
 from app.core.login_crypto import create_login_challenge, decrypt_login_payload, get_public_key_pem
-from app.core.security import create_access_token, decode_token_allow_expired, oauth2_scheme, verify_password
+from app.core.request_context import resolve_client_ip, resolve_ctms_client_type
+from app.core.security import create_access_token, decode_token, decode_token_allow_expired, oauth2_scheme, verify_password
 from app.core.deps import get_current_user, get_db_session
 from app.crud import user as user_crud
 from app.models.user import UserStatus
@@ -25,6 +27,12 @@ from app.schemas.email_settings import (
 )
 from app.schemas.user import Token, UserRead, UserRegisterRequest, UserSelfUpdate, UserUpdate
 from app.services import email_service
+from app.services.user_login_sessions import (
+    create_login_session,
+    end_login_session,
+    session_id_from_payload,
+    touch_login_session,
+)
 from fastapi.responses import FileResponse
 
 
@@ -70,12 +78,59 @@ AVATAR_ALLOWED_CONTENT_TYPES = {
 }
 
 
-def issue_user_token(db_user) -> Token:
+@dataclass(frozen=True)
+class SessionPolicy:
+    access_minutes: int
+    absolute_max_seconds: int
+
+
+def normalize_session_client_type(value: str | None) -> str:
+    return "desktop" if (value or "").strip().lower() == "desktop" else "web"
+
+
+def get_session_policy_for_client_type(client_type: str) -> SessionPolicy:
+    if client_type == "desktop":
+        max_seconds = settings.DESKTOP_SESSION_MAX_DAYS * 24 * 3600
+        return SessionPolicy(
+            access_minutes=settings.DESKTOP_SESSION_MAX_DAYS * 24 * 60,
+            absolute_max_seconds=max_seconds,
+        )
+    return SessionPolicy(
+        access_minutes=settings.JWT_EXPIRE_MINUTES,
+        absolute_max_seconds=settings.ABSOLUTE_SESSION_MAX_HOURS * 3600,
+    )
+
+
+def get_request_session_client_type(request: Request) -> str:
+    return normalize_session_client_type(resolve_ctms_client_type(request.headers))
+
+
+def policy_expires_at(issued_at: datetime, session_start: datetime, policy: SessionPolicy) -> datetime:
+    access_expires_at = issued_at + timedelta(minutes=policy.access_minutes)
+    session_expires_at = session_start + timedelta(seconds=policy.absolute_max_seconds)
+    return min(access_expires_at, session_expires_at)
+
+
+async def issue_user_token(db_user, request: Request, db: AsyncSession) -> Token:
     session_start = datetime.now(timezone.utc)
+    session_id = uuid.uuid4()
+    client_type = get_request_session_client_type(request)
+    policy = get_session_policy_for_client_type(client_type)
     access_token = create_access_token(
         user_id=str(db_user.id),
-        expires_minutes=None,
+        expires_minutes=policy.access_minutes,
         session_start=session_start,
+        max_age_seconds=policy.absolute_max_seconds,
+        issued_at=session_start,
+        client_type=client_type,
+        session_id=str(session_id),
+    )
+    await create_login_session(
+        db,
+        session_id=session_id,
+        user_id=db_user.id,
+        request=request,
+        login_at=session_start,
     )
     return Token(access_token=access_token, token_type="bearer")
 
@@ -240,23 +295,23 @@ async def get_login_key() -> LoginKeyResponse:
 
 @router.post("/login", response_model=Token)
 async def login_for_access_token(
-    payload: LoginRequest, db: AsyncSession = Depends(get_db_session)
+    payload: LoginRequest, request: Request, db: AsyncSession = Depends(get_db_session)
 ) -> Token:
     db_user = await authenticate_encrypted_password(payload, db)
     ensure_user_active(db_user)
 
-    return issue_user_token(db_user)
+    return await issue_user_token(db_user, request, db)
 
 
 @router.post("/dev-login", response_model=Token)
 async def dev_login_for_access_token(
-    payload: DevLoginRequest, db: AsyncSession = Depends(get_db_session)
+    payload: DevLoginRequest, request: Request, db: AsyncSession = Depends(get_db_session)
 ) -> Token:
     if settings.ENV != "development":
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Not found")
     db_user = await authenticate_plain_password(payload, db)
     ensure_user_active(db_user)
-    return issue_user_token(db_user)
+    return await issue_user_token(db_user, request, db)
 
 
 @router.get("/me", response_model=UserRead)
@@ -285,22 +340,63 @@ async def extend_access_token(
     if db_user.status != UserStatus.ACTIVE:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="账号已停用")
     session_start_ts = payload.get("orig_iat") or payload.get("iat")
+    policy = get_session_policy_for_client_type(normalize_session_client_type(payload.get("client_type")))
     if session_start_ts:
-        max_seconds = settings.ABSOLUTE_SESSION_MAX_HOURS * 3600
-        if now_ts - int(session_start_ts) > max_seconds:
+        if now_ts - int(session_start_ts) > policy.absolute_max_seconds:
             raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="会话已到期，请重新登录")
         session_start = datetime.fromtimestamp(int(session_start_ts), tz=timezone.utc)
     else:
         session_start = datetime.now(timezone.utc)
+    issued_at = datetime.now(timezone.utc)
     new_token = create_access_token(
         user_id=str(db_user.id),
-        expires_minutes=None,
+        expires_minutes=policy.access_minutes,
         session_start=session_start,
+        max_age_seconds=policy.absolute_max_seconds,
+        issued_at=issued_at,
+        client_type=normalize_session_client_type(payload.get("client_type")),
+        session_id=str(session_id_from_payload(payload)),
     )
-    expires_at = datetime.now(timezone.utc) + timedelta(minutes=settings.JWT_EXPIRE_MINUTES)
+    expires_at = policy_expires_at(issued_at, session_start, policy)
     return ExtendResponse(accessToken=new_token, expiresAt=expires_at)
 
 
+@router.post("/session/heartbeat")
+async def heartbeat_login_session(
+    request: Request,
+    token: str = Depends(oauth2_scheme),
+    current_user=Depends(get_current_user),
+    db: AsyncSession = Depends(get_db_session),
+) -> dict:
+    session = await touch_login_session(
+        db,
+        user_id=current_user.id,
+        payload=decode_token(token),
+        request=request,
+    )
+    if session is None:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="登录会话已结束")
+    return {
+        "status": "online",
+        "last_seen_at": session.last_seen_at.isoformat(),
+        "client_ip": resolve_client_ip(request),
+    }
+
+
+@router.post("/session/logout", status_code=status.HTTP_204_NO_CONTENT)
+async def logout_login_session(
+    token: str = Depends(oauth2_scheme),
+    current_user=Depends(get_current_user),
+    db: AsyncSession = Depends(get_db_session),
+) -> Response:
+    await end_login_session(
+        db,
+        user_id=current_user.id,
+        payload=decode_token(token),
+    )
+    return Response(status_code=status.HTTP_204_NO_CONTENT)
+
+
 @router.patch("/me", response_model=UserRead)
 async def update_me(
     payload: UserSelfUpdate,