修复冻结用户强制下线

backend/internal/middleware/auth.go

@@ -34,6 +34,8 @@ type AdminTokenContext struct {
 
 type AdminTokenValidatorFunc func(ctx context.Context, adminID uint64, tokenVersion int64) (AdminTokenContext, error)
 
+type UserTokenValidatorFunc func(ctx context.Context, userID uint64, tokenVersion int64) error
+
 func extractBearerToken(c *gin.Context) string {
 	header := c.GetHeader("Authorization")
 	tokenText := strings.TrimSpace(strings.TrimPrefix(header, "Bearer "))
@@ -50,7 +52,7 @@ func extractToken(c *gin.Context) string {
 	return c.Query("token")
 }
 
-func Auth(jwtManager *auth.JWTManager) gin.HandlerFunc {
+func Auth(jwtManager *auth.JWTManager, validate UserTokenValidatorFunc) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		tokenText := extractToken(c)
 		if tokenText == "" {
@@ -65,6 +67,17 @@ func Auth(jwtManager *auth.JWTManager) gin.HandlerFunc {
 			c.Abort()
 			return
 		}
+		if validate != nil {
+			if err := validate(c.Request.Context(), claims.UserID, claims.TokenVersion); err != nil {
+				if errors.Is(err, auth.ErrDependencyUnavailable) {
+					response.ServiceUnavailable(c, "用户认证服务暂时不可用")
+				} else {
+					response.Unauthorized(c, "登录状态已失效，请重新登录")
+				}
+				c.Abort()
+				return
+			}
+		}
 
 		c.Set(ContextUserID, claims.UserID)
 		c.Set(ContextPhone, claims.Phone)

backend/internal/middleware/auth_test.go

@@ -0,0 +1,36 @@
+package middleware
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"hfb_sys/backend/internal/modules/auth"
+
+	"github.com/gin-gonic/gin"
+)
+
+func TestAuthRejectsRevokedUserToken(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	manager := auth.NewJWTManager("test-secret")
+	pair, err := manager.GenerateSubjectPairWithVersion(7, "13900000007", "user", 0)
+	if err != nil {
+		t.Fatalf("生成令牌失败：%v", err)
+	}
+
+	engine := gin.New()
+	engine.GET("/protected", Auth(manager, func(_ context.Context, _ uint64, _ int64) error {
+		return auth.ErrTokenVersionMismatch
+	}), func(c *gin.Context) {
+		c.Status(http.StatusNoContent)
+	})
+	request := httptest.NewRequest(http.MethodGet, "/protected", nil)
+	request.Header.Set("Authorization", "Bearer "+pair.AccessToken)
+	response := httptest.NewRecorder()
+	engine.ServeHTTP(response, request)
+
+	if response.Code != http.StatusUnauthorized {
+		t.Fatalf("响应状态 = %d, want %d", response.Code, http.StatusUnauthorized)
+	}
+}