feat: 会话管理 - 支持按设备粒度踢下线

- 新增 sessions 表，每次登录创建会话记录（记录 IP/UA）
- AuthMiddleware 改为基于 session 校验，可精确踢掉单个设备
- 自己改密码后踢掉其他设备，管理员改密码后踢掉该用户全部设备
- 新增 GET /api/me/sessions 查看活跃会话列表
- 新增 DELETE /api/me/sessions/:sessionId 踢掉指定会话
- 新增 DELETE /api/admin/users/:id/sessions 管理员强制下线某用户
- 兼容无 session_id 的旧 token，回退到 TokenInvalidBefore 校验

internal/db/db.go

@@ -36,7 +36,7 @@ func Init(cfg *config.DatabaseConfig) error {
 		return fmt.Errorf("数据库连接失败: %w", err)
 	}
 
-	if err := DB.AutoMigrate(&model.User{}); err != nil {
+	if err := DB.AutoMigrate(&model.User{}, &model.Session{}); err != nil {
 		return fmt.Errorf("数据库迁移失败: %w", err)
 	}
 

internal/handler/auth.go

@@ -2,12 +2,14 @@ package handler
 
 import (
 	"net/http"
+	"time"
 
 	"lmvpn/internal/db"
 	"lmvpn/internal/middleware"
 	"lmvpn/internal/model"
 
 	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
 	"golang.org/x/crypto/bcrypt"
 )
 
@@ -50,12 +52,25 @@ func Login(c *gin.Context) {
 		return
 	}
 
-	token, err := middleware.GenerateToken(user.ID, user.Username, user.Role)
+	sessionID := uuid.New().String()
+	token, err := middleware.GenerateToken(sessionID, user.ID, user.Username, user.Role)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "生成令牌失败"})
 		return
 	}
 
+	session := model.Session{
+		SessionID: sessionID,
+		UserID:    user.ID,
+		IP:        c.ClientIP(),
+		UserAgent: c.GetHeader("User-Agent"),
+		ExpiresAt: time.Now().Add(24 * time.Hour),
+	}
+	if err := db.DB.Create(&session).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "创建会话失败"})
+		return
+	}
+
 	c.JSON(http.StatusOK, loginResponse{
 		Token: token,
 		User: userInfo{
@@ -102,11 +117,18 @@ func ChangePassword(c *gin.Context) {
 		return
 	}
 
-	if err := db.DB.Model(&user).Update("password", string(hash)).Error; err != nil {
+	now := time.Now()
+	if err := db.DB.Model(&user).Updates(map[string]interface{}{
+		"password":             string(hash),
+		"token_invalid_before": now,
+	}).Error; err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "密码修改失败"})
 		return
 	}
 
+	sessionID, _ := c.Get("session_id")
+	db.DB.Model(&model.Session{}).Where("user_id = ? AND session_id != ?", userID, sessionID).Update("invalid", true)
+
 	c.JSON(http.StatusOK, gin.H{"message": "密码修改成功"})
 }
 

internal/handler/session.go

@@ -0,0 +1,88 @@
+package handler
+
+import (
+	"net/http"
+	"strconv"
+	"time"
+
+	"lmvpn/internal/db"
+	"lmvpn/internal/model"
+
+	"github.com/gin-gonic/gin"
+)
+
+type sessionResponse struct {
+	SessionID string `json:"session_id"`
+	IP        string `json:"ip"`
+	UserAgent string `json:"user_agent"`
+	Current   bool   `json:"current"`
+	CreatedAt string `json:"created_at"`
+	ExpiresAt string `json:"expires_at"`
+}
+
+func ListMySessions(c *gin.Context) {
+	userID, _ := c.Get("user_id")
+	currentSessionID, _ := c.Get("session_id")
+
+	var sessions []model.Session
+	db.DB.Where("user_id = ? AND invalid = ? AND expires_at > ?", userID, false, time.Now()).
+		Order("created_at desc").
+		Find(&sessions)
+
+	result := make([]sessionResponse, len(sessions))
+	for i, s := range sessions {
+		result[i] = sessionResponse{
+			SessionID: s.SessionID,
+			IP:        s.IP,
+			UserAgent: s.UserAgent,
+			Current:   s.SessionID == currentSessionID,
+			CreatedAt: s.CreatedAt.Format("2006-01-02 15:04:05"),
+			ExpiresAt: s.ExpiresAt.Format("2006-01-02 15:04:05"),
+		}
+	}
+
+	c.JSON(http.StatusOK, gin.H{"sessions": result})
+}
+
+func RevokeMySession(c *gin.Context) {
+	sessionID := c.Param("sessionId")
+	if sessionID == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "参数错误"})
+		return
+	}
+
+	userID, _ := c.Get("user_id")
+	currentSessionID, _ := c.Get("session_id")
+
+	if sessionID == currentSessionID {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "不能撤销当前会话"})
+		return
+	}
+
+	var session model.Session
+	if err := db.DB.Where("session_id = ? AND user_id = ?", sessionID, userID).First(&session).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "会话不存在"})
+		return
+	}
+
+	db.DB.Model(&session).Update("invalid", true)
+	c.JSON(http.StatusOK, gin.H{"message": "已撤销会话"})
+}
+
+func AdminRevokeUserSessions(c *gin.Context) {
+	idStr := c.Param("id")
+	id, err := strconv.ParseUint(idStr, 10, 64)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "参数错误"})
+		return
+	}
+
+	var user model.User
+	if err := db.DB.First(&user, id).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "用户不存在"})
+		return
+	}
+
+	db.DB.Model(&model.Session{}).Where("user_id = ?", id).Update("invalid", true)
+	c.JSON(http.StatusOK, gin.H{"message": "已强制下线该用户"})
+}

internal/handler/user.go

@@ -3,6 +3,7 @@ package handler
 import (
 	"net/http"
 	"strconv"
+	"time"
 
 	"lmvpn/internal/db"
 	"lmvpn/internal/model"
@@ -153,6 +154,7 @@ func UpdateUser(c *gin.Context) {
 			return
 		}
 		updates["password"] = string(hash)
+		updates["token_invalid_before"] = time.Now()
 	}
 
 	if len(updates) == 0 {
@@ -165,6 +167,10 @@ func UpdateUser(c *gin.Context) {
 		return
 	}
 
+	if req.Password != "" {
+		db.DB.Model(&model.Session{}).Where("user_id = ?", id).Update("invalid", true)
+	}
+
 	db.DB.First(&user, id)
 	c.JSON(http.StatusOK, formatUser(&user))
 }

internal/middleware/auth.go

@@ -5,6 +5,9 @@ import (
 	"strings"
 	"time"
 
+	"lmvpn/internal/db"
+	"lmvpn/internal/model"
+
 	"github.com/gin-gonic/gin"
 	"github.com/golang-jwt/jwt/v5"
 )
@@ -15,17 +18,19 @@ const (
 )
 
 type Claims struct {
-	UserID   uint   `json:"user_id"`
+	SessionID string `json:"session_id,omitempty"`
-	Username string `json:"username"`
+	UserID    uint   `json:"user_id"`
-	Role     string `json:"role"`
+	Username  string `json:"username"`
+	Role      string `json:"role"`
 	jwt.RegisteredClaims
 }
 
-func GenerateToken(userID uint, username, role string) (string, error) {
+func GenerateToken(sessionID string, userID uint, username, role string) (string, error) {
 	claims := Claims{
-		UserID:   userID,
+		SessionID: sessionID,
-		Username: username,
+		UserID:    userID,
-		Role:     role,
+		Username:  username,
+		Role:      role,
 		RegisteredClaims: jwt.RegisteredClaims{
 			ExpiresAt: jwt.NewNumericDate(time.Now().Add(tokenExpire)),
 			IssuedAt:  jwt.NewNumericDate(time.Now()),
@@ -86,9 +91,48 @@ func AuthMiddleware() gin.HandlerFunc {
 			return
 		}
 
+		var user model.User
+		if err := db.DB.First(&user, claims.UserID).Error; err != nil {
+			c.JSON(http.StatusUnauthorized, gin.H{"error": "用户不存在"})
+			c.Abort()
+			return
+		}
+
+		if user.Status != 1 {
+			c.JSON(http.StatusForbidden, gin.H{"error": "账号已被禁用"})
+			c.Abort()
+			return
+		}
+
+		if claims.SessionID != "" {
+			var session model.Session
+			if err := db.DB.Where("session_id = ?", claims.SessionID).First(&session).Error; err != nil {
+				c.JSON(http.StatusUnauthorized, gin.H{"error": "会话不存在"})
+				c.Abort()
+				return
+			}
+			if session.Invalid {
+				c.JSON(http.StatusUnauthorized, gin.H{"error": "会话已失效，请重新登录"})
+				c.Abort()
+				return
+			}
+			if time.Now().After(session.ExpiresAt) {
+				c.JSON(http.StatusUnauthorized, gin.H{"error": "会话已过期，请重新登录"})
+				c.Abort()
+				return
+			}
+		} else if user.TokenInvalidBefore != nil && claims.IssuedAt != nil {
+			if claims.IssuedAt.Time.Before(*user.TokenInvalidBefore) {
+				c.JSON(http.StatusUnauthorized, gin.H{"error": "令牌已失效，请重新登录"})
+				c.Abort()
+				return
+			}
+		}
+
 		c.Set("user_id", claims.UserID)
 		c.Set("username", claims.Username)
 		c.Set("role", claims.Role)
+		c.Set("session_id", claims.SessionID)
 		c.Next()
 	}
 }

internal/model/session.go

@@ -0,0 +1,18 @@
+package model
+
+import "time"
+
+type Session struct {
+	ID        uint      `gorm:"primaryKey;autoIncrement"`
+	SessionID string    `gorm:"uniqueIndex;size:36;not null"`
+	UserID    uint      `gorm:"index;not null"`
+	IP        string    `gorm:"size:64"`
+	UserAgent string    `gorm:"size:512"`
+	Invalid   bool      `gorm:"default:false"`
+	CreatedAt time.Time `gorm:"autoCreateTime"`
+	ExpiresAt time.Time `gorm:"not null"`
+}
+
+func (Session) TableName() string {
+	return "sessions"
+}

internal/model/user.go

@@ -3,13 +3,14 @@ package model
 import "time"
 
 type User struct {
-	ID        uint      `gorm:"primaryKey;autoIncrement"`
+	ID                  uint       `gorm:"primaryKey;autoIncrement"`
-	Username  string    `gorm:"uniqueIndex;size:64;not null"`
+	Username            string     `gorm:"uniqueIndex;size:64;not null"`
-	Password  string    `gorm:"size:128;not null"`
+	Password            string     `gorm:"size:128;not null"`
-	Role      string    `gorm:"size:16;default:user"`
+	Role                string     `gorm:"size:16;default:user"`
-	Status    int       `gorm:"default:1"`
+	Status              int        `gorm:"default:1"`
-	CreatedAt time.Time `gorm:"autoCreateTime"`
+	TokenInvalidBefore  *time.Time `gorm:"default:null"`
-	UpdatedAt time.Time `gorm:"autoUpdateTime"`
+	CreatedAt           time.Time  `gorm:"autoCreateTime"`
+	UpdatedAt           time.Time  `gorm:"autoUpdateTime"`
 }
 
 func (User) TableName() string {

internal/router/router.go

@@ -22,6 +22,8 @@ func Setup(r *gin.Engine) {
 	{
 		auth.GET("/me", handler.Me)
 		auth.PUT("/me/password", handler.ChangePassword)
+		auth.GET("/me/sessions", handler.ListMySessions)
+		auth.DELETE("/me/sessions/:sessionId", handler.RevokeMySession)
 	}
 
 	admin := r.Group("/api/admin")
@@ -32,6 +34,7 @@ func Setup(r *gin.Engine) {
 		admin.POST("/users", handler.CreateUser)
 		admin.PUT("/users/:id", handler.UpdateUser)
 		admin.DELETE("/users/:id", handler.DeleteUser)
+		admin.DELETE("/users/:id/sessions", handler.AdminRevokeUserSessions)
 	}
 
 	fs := http.FileServer(http.Dir("./dist"))