完善掉线诊断并优化二维码加载

backend/internal/modules/adminauth/repository.go

@@ -8,7 +8,9 @@ import (
 	"strings"
 	"time"
 
+	"hfb_sys/backend/internal/auditlog"
 	"hfb_sys/backend/internal/captcha"
+	"hfb_sys/backend/internal/logging"
 	"hfb_sys/backend/internal/model"
 	"hfb_sys/backend/internal/modules/auth"
 
@@ -92,21 +94,45 @@ func (r *Repository) Login(ctx context.Context, username string, password string
 func (r *Repository) FindActiveForToken(ctx context.Context, id uint64, tokenVersion int64) (*model.AdminUser, error) {
 	var admin model.AdminUser
 	if err := r.db.WithContext(ctx).First(&admin, id).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, newTokenValidationError("admin_not_found", ErrAdminNotFound)
+		}
 		return nil, err
 	}
 	if admin.Status != "active" {
-		return nil, ErrAdminDisabled
+		return nil, newTokenValidationError("admin_disabled", ErrAdminDisabled)
 	}
 	if admin.TokenVersion <= 0 || admin.TokenVersion != tokenVersion {
-		return nil, ErrInvalidRefreshToken
+		return nil, newTokenVersionMismatchError(tokenVersion, admin.TokenVersion)
 	}
 	return &admin, nil
 }
 
 func (r *Repository) RevokeTokens(ctx context.Context, adminID uint64) error {
-	return r.db.WithContext(ctx).Model(&model.AdminUser{}).
-		Where("id = ?", adminID).
-		UpdateColumn("token_version", gorm.Expr("token_version + 1")).Error
+	return r.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		if err := tx.Model(&model.AdminUser{}).
+			Where("id = ?", adminID).
+			UpdateColumn("token_version", gorm.Expr("token_version + 1")).Error; err != nil {
+			return err
+		}
+		return appendTokenVersionAudit(tx, ctx, adminID, "logout")
+	})
+}
+
+func appendTokenVersionAudit(tx *gorm.DB, ctx context.Context, adminID uint64, reason string) error {
+	bizID := adminID
+	return auditlog.Append(tx, auditlog.Entry{
+		ActorType: "admin",
+		ActorID:   logging.AdminIDFromContext(ctx),
+		Action:    "auth.token_version.bump",
+		BizType:   "admin_user",
+		BizID:     &bizID,
+		Meta:      auditlog.Meta{RequestID: logging.RequestIDFromContext(ctx)},
+		Detail: map[string]any{
+			"target_admin_id": adminID,
+			"reason":          reason,
+		},
+	})
 }
 
 func (r *Repository) verifyCaptcha(ctx context.Context, captchaID string, captchaCode string) error {