修复数据库波动导致后台掉线

backend/internal/modules/adminauth/handler.go

@@ -138,7 +138,7 @@ func (h *Handler) Refresh(c *gin.Context) {
 	tokens, err := h.service.Refresh(c.Request.Context(), refreshToken)
 	if err != nil {
 		reason, tokenVersion, currentVersion := middleware.AdminValidationFailure(err)
-		middleware.RecordAdminAuthFailure(c, reason, refreshTokenSource, tokenVersion, currentVersion)
+		middleware.RecordAdminAuthFailure(c, reason, refreshTokenSource, tokenVersion, currentVersion, middleware.AdminValidationFailureDetail(err))
 		writeAdminAuthError(c, err)
 		return
 	}

backend/internal/modules/adminauth/repository.go

@@ -92,12 +92,15 @@ func (r *Repository) Login(ctx context.Context, username string, password string
 }
 
 func (r *Repository) FindActiveForToken(ctx context.Context, id uint64, tokenVersion int64) (*model.AdminUser, error) {
+	if r.db == nil {
+		return nil, newTokenDependencyError(ErrDependencyUnavailable)
+	}
 	var admin model.AdminUser
 	if err := r.db.WithContext(ctx).First(&admin, id).Error; err != nil {
 		if errors.Is(err, gorm.ErrRecordNotFound) {
 			return nil, newTokenValidationError("admin_not_found", ErrAdminNotFound)
 		}
-		return nil, err
+		return nil, newTokenDependencyError(err)
 	}
 	if admin.Status != "active" {
 		return nil, newTokenValidationError("admin_disabled", ErrAdminDisabled)
@@ -160,10 +163,15 @@ func (r *Repository) FindByID(ctx context.Context, id uint64) (*AdminDTO, error)
 }
 
 func (r *Repository) FindActiveForPasswordGate(ctx context.Context, id uint64, tokenVersion int64) (*AdminDTO, error) {
-	if _, err := r.FindActiveForToken(ctx, id, tokenVersion); err != nil {
+	admin, err := r.FindActiveForToken(ctx, id, tokenVersion)
+	if err != nil {
 		return nil, err
 	}
-	return r.FindByID(ctx, id)
+	// 认证只需要用户名和强制改密标识；复用已校验的查询结果，避免每个后台请求再查询一次数据库。
+	return &AdminDTO{
+		Username:           admin.Username,
+		PasswordMustChange: admin.PasswordMustChange,
+	}, nil
 }
 
 func (r *Repository) UpdateSupportStatus(ctx context.Context, adminID uint64, status string) error {

backend/internal/modules/adminauth/service.go

@@ -3,6 +3,7 @@ package adminauth
 import (
 	"context"
 	"errors"
+	"strings"
 
 	"hfb_sys/backend/internal/modules/auth"
 )
@@ -23,6 +24,8 @@ type TokenValidationError struct {
 	Reason         string
 	TokenVersion   int64
 	CurrentVersion int64
+	Detail         string
+	Unavailable    bool
 	err            error
 }
 
@@ -44,10 +47,33 @@ func (e *TokenValidationError) AuthFailureVersions() (int64, int64) {
 	return e.TokenVersion, e.CurrentVersion
 }
 
+// AuthFailureDetail 返回仅供服务端日志使用的依赖错误摘要，不包含令牌内容。
+func (e *TokenValidationError) AuthFailureDetail() string {
+	return e.Detail
+}
+
+// AuthFailureUnavailable 标识当前失败是否由临时依赖故障引起。
+func (e *TokenValidationError) AuthFailureUnavailable() bool {
+	return e.Unavailable
+}
+
 func newTokenValidationError(reason string, err error) error {
 	return &TokenValidationError{Reason: reason, err: err}
 }
 
+func newTokenDependencyError(err error) error {
+	detail := strings.Join(strings.Fields(err.Error()), " ")
+	if len(detail) > 240 {
+		detail = detail[:240]
+	}
+	return &TokenValidationError{
+		Reason:      "admin_db_query_failed",
+		Detail:      detail,
+		Unavailable: true,
+		err:         errors.Join(ErrDependencyUnavailable, err),
+	}
+}
+
 func newTokenVersionMismatchError(tokenVersion, currentVersion int64) error {
 	return &TokenValidationError{
 		Reason:         "token_version_mismatch",
@@ -79,6 +105,9 @@ func (s *Service) Refresh(ctx context.Context, refreshToken string) (*auth.Token
 	}
 	admin, err := s.repo.FindActiveForToken(ctx, claims.UserID, claims.TokenVersion)
 	if err != nil {
+		if errors.Is(err, ErrDependencyUnavailable) {
+			return nil, err
+		}
 		if errors.Is(err, ErrAdminDisabled) {
 			return nil, ErrAdminDisabled
 		}