修复冻结用户强制下线

backend/internal/modules/auth/service.go

@@ -33,6 +33,7 @@ var (
 	ErrPasswordTooWeak       = errors.New("password too weak")
 	ErrLoginLocked           = errors.New("login locked")
 	ErrUserAlreadyExists     = errors.New("user already exists")
+	ErrTokenVersionMismatch  = errors.New("user token version mismatch")
 )
 
 const (
@@ -180,7 +181,7 @@ func (s *Service) LoginWithSMS(ctx context.Context, phone string, code string) (
 		return LoginResult{}, ErrUserDisabled
 	}
 
-	tokens, err := s.jwt.GeneratePair(user.ID, user.Phone)
+	tokens, err := s.generateUserTokenPair(user)
 	if err != nil {
 		return LoginResult{}, err
 	}
@@ -189,12 +190,26 @@ func (s *Service) LoginWithSMS(ctx context.Context, phone string, code string) (
 	return LoginResult{User: user, Tokens: tokens}, nil
 }
 
-func (s *Service) RefreshToken(refreshToken string) (TokenPair, error) {
+func (s *Service) RefreshToken(ctx context.Context, refreshToken string) (TokenPair, error) {
+	if s.jwt == nil || s.users == nil {
+		return TokenPair{}, ErrDependencyUnavailable
+	}
 	claims, err := s.jwt.ParseSubject(refreshToken, tokenTypeRefresh, "user")
 	if err != nil {
 		return TokenPair{}, err
 	}
-	return s.jwt.GeneratePair(claims.UserID, claims.Phone)
+	user, err := s.users.FindActiveForToken(ctx, claims.UserID, claims.TokenVersion)
+	if err != nil {
+		return TokenPair{}, err
+	}
+	return s.generateUserTokenPair(user)
+}
+
+func (s *Service) generateUserTokenPair(user *model.User) (TokenPair, error) {
+	if s.jwt == nil {
+		return TokenPair{}, ErrDependencyUnavailable
+	}
+	return s.jwt.GenerateSubjectPairWithVersion(user.ID, user.Phone, "user", user.TokenVersion)
 }
 
 func codeKey(phone string) string {
@@ -264,7 +279,7 @@ func (s *Service) LoginWithPassword(ctx context.Context, phone, password, client
 
 	_ = clearLoginFailure(ctx, s.redis, phone, clientIP)
 
-	tokens, err := s.jwt.GeneratePair(user.ID, user.Phone)
+	tokens, err := s.generateUserTokenPair(user)
 	if err != nil {
 		return LoginResult{}, err
 	}
@@ -369,7 +384,7 @@ func (s *Service) RegisterWithPassword(ctx context.Context, phone, code, passwor
 		return LoginResult{}, ErrUserDisabled
 	}
 
-	tokens, err := s.jwt.GeneratePair(user.ID, user.Phone)
+	tokens, err := s.generateUserTokenPair(user)
 	if err != nil {
 		return LoginResult{}, err
 	}