增加后台会话撤销并统一拼单业务状态

apps/backend/src/services/admin/admin-auth-service.ts

@@ -10,6 +10,12 @@ import {
   listAdminUsers,
   updateAdminUser,
 } from '../../repositories/admin-user-repo.js'
+import {
+  createAdminSession as createAdminSessionRecord,
+  getActiveAdminSession,
+  revokeAdminSession,
+  touchAdminSession,
+} from '../../repositories/admin-session-repo.js'
 import { addHours, nowIso } from '../../utils/time.js'
 import { createHttpError } from '../../utils/http.js'
 import { normalizePage, normalizePageSize } from './admin-query-utils.js'
@@ -113,6 +119,19 @@ export async function loginAdmin(
   }
 
   const session = createAdminSession(user)
+  const createdSession = await createAdminSessionRecord({
+    sessionId: String(session.sessionId || ''),
+    userId: Number(user.id),
+    issuedAt: String(session.issuedAt),
+    expiresAt: String(session.expiresAt),
+    now: nowIso(),
+  })
+  if (!createdSession) {
+    throw createHttpError('后台登录会话创建失败，请重试', {
+      statusCode: 503,
+      errorCode: 'admin_session_create_failed',
+    })
+  }
   await recordAdminLoginLog({
     userId: Number(user.id),
     username: String(user.username || normalizedUsername),
@@ -172,6 +191,21 @@ export async function verifyAdminSessionToken(token: unknown): Promise<AdminSess
   }
 
   const userId = Number(payload?.uid || 0)
+  const sessionId = String(payload?.sid || '').trim()
+  if (!sessionId) {
+    throw createHttpError('后台登录态无效', {
+      statusCode: 401,
+      errorCode: 'admin_auth_invalid',
+    })
+  }
+  const activeSession = await getActiveAdminSession(sessionId, nowIso())
+  if (!activeSession || Number(activeSession.user_id) !== userId) {
+    throw createHttpError('后台登录态已失效，请重新登录', {
+      statusCode: 401,
+      errorCode: 'admin_auth_revoked',
+    })
+  }
+  await touchAdminSession(sessionId, nowIso())
   const user = await getAdminUserById(userId)
   if (!user || user.status !== 'active') {
     throw createHttpError('后台账号已不可用，请重新登录', {
@@ -190,7 +224,7 @@ export async function verifyAdminSessionToken(token: unknown): Promise<AdminSess
   }
 
   return {
-    sessionId: String(payload?.sid || '').trim(),
+    sessionId,
     userId: Number(user.id),
     username: String(user.username || ''),
     role: normalizeAdminRole(user.role),
@@ -199,6 +233,12 @@ export async function verifyAdminSessionToken(token: unknown): Promise<AdminSess
   }
 }
 
+export async function logoutAdmin(token: unknown): Promise<{ success: boolean; revoked: boolean }> {
+  const session = await verifyAdminSessionToken(token)
+  const revoked = await revokeAdminSession(session.sessionId, nowIso())
+  return { success: true, revoked }
+}
+
 export async function getAdminSessionSummary(token: unknown): Promise<JsonObject> {
   const session = await verifyAdminSessionToken(token)
 
@@ -421,6 +461,8 @@ function createAdminSession(user: AdminUserRow): JsonObject {
   const signature = signPayload(encodedPayload)
 
   return {
+    sessionId: payload.sid,
+    issuedAt,
     token: `${encodedPayload}.${signature}`,
     expiresAt,
     user: {