第 5 阶段：纠纷、通知与后台-2

backend/internal/modules/auth/jwt.go

@@ -22,9 +22,10 @@ type JWTManager struct {
 }
 
 type Claims struct {
-	UserID    uint64 `json:"uid"`
-	Phone     string `json:"phone"`
-	TokenType string `json:"typ"`
+	UserID      uint64 `json:"uid"`
+	Phone       string `json:"phone"`
+	TokenType   string `json:"typ"`
+	SubjectType string `json:"sub_type"`
 	jwt.RegisteredClaims
 }
 
@@ -45,11 +46,15 @@ func NewJWTManager(secret string) *JWTManager {
 }
 
 func (m *JWTManager) GeneratePair(userID uint64, phone string) (TokenPair, error) {
-	accessToken, err := m.generate(userID, phone, tokenTypeAccess, m.accessTTL)
+	return m.GenerateSubjectPair(userID, phone, "user")
+}
+
+func (m *JWTManager) GenerateSubjectPair(userID uint64, subject string, subjectType string) (TokenPair, error) {
+	accessToken, err := m.generate(userID, subject, subjectType, tokenTypeAccess, m.accessTTL)
 	if err != nil {
 		return TokenPair{}, err
 	}
-	refreshToken, err := m.generate(userID, phone, tokenTypeRefresh, m.refreshTTL)
+	refreshToken, err := m.generate(userID, subject, subjectType, tokenTypeRefresh, m.refreshTTL)
 	if err != nil {
 		return TokenPair{}, err
 	}
@@ -62,6 +67,10 @@ func (m *JWTManager) GeneratePair(userID uint64, phone string) (TokenPair, error
 }
 
 func (m *JWTManager) Parse(tokenText, expectedType string) (*Claims, error) {
+	return m.ParseSubject(tokenText, expectedType, "")
+}
+
+func (m *JWTManager) ParseSubject(tokenText, expectedType string, expectedSubjectType string) (*Claims, error) {
 	claims := &Claims{}
 	token, err := jwt.ParseWithClaims(tokenText, claims, func(token *jwt.Token) (any, error) {
 		if token.Method != m.signingMethod {
@@ -75,17 +84,21 @@ func (m *JWTManager) Parse(tokenText, expectedType string) (*Claims, error) {
 	if claims.TokenType != expectedType {
 		return nil, ErrInvalidToken
 	}
+	if expectedSubjectType != "" && claims.SubjectType != expectedSubjectType {
+		return nil, ErrInvalidToken
+	}
 	return claims, nil
 }
 
-func (m *JWTManager) generate(userID uint64, phone string, tokenType string, ttl time.Duration) (string, error) {
+func (m *JWTManager) generate(userID uint64, subject string, subjectType string, tokenType string, ttl time.Duration) (string, error) {
 	now := time.Now()
 	claims := Claims{
-		UserID:    userID,
-		Phone:     phone,
-		TokenType: tokenType,
+		UserID:      userID,
+		Phone:       subject,
+		TokenType:   tokenType,
+		SubjectType: subjectType,
 		RegisteredClaims: jwt.RegisteredClaims{
-			Subject:   phone,
+			Subject:   subject,
 			IssuedAt:  jwt.NewNumericDate(now),
 			ExpiresAt: jwt.NewNumericDate(now.Add(ttl)),
 		},

backend/internal/modules/auth/service.go

@@ -109,7 +109,7 @@ func (s *Service) LoginWithSMS(ctx context.Context, phone string, code string) (
 }
 
 func (s *Service) RefreshToken(refreshToken string) (TokenPair, error) {
-	claims, err := s.jwt.Parse(refreshToken, tokenTypeRefresh)
+	claims, err := s.jwt.ParseSubject(refreshToken, tokenTypeRefresh, "user")
 	if err != nil {
 		return TokenPair{}, err
 	}