AskaEth 026b27b310 feat(auth): refresh token 续期(B2) — 不透明哈希+单次旋转+/auth/refresh+/auth/logout ...

- auth/refresh.go: RefreshStore(Issue/Rotate/Revoke/RevokeAll/RevokeByUser), SHA-256哈希256-bit随机串, 单次旋转事务(并发重放fail-closed)
- 迁移0008_refresh_tokens(id/user_id/role/token_hash UNIQUE/expires_at/revoked_at + 索引)
- gateway: POST /v1/auth/refresh(旋转/续期) + /v1/auth/logout(单/全设备); login响应增refreshToken
- config: AUTH_REFRESH_TTL(720h)/AUTH_REFRESH_ROTATE_DISABLED; decode.go 支持time.Duration
- rotate-jwt成功后RevokeAll(响应refreshTokensRevoked), revoke-keys不动refresh
- 14测试+真实二进制e2e, build/vet/test绿+交叉编译
- Docs/api-client v0.25 + api-reference §2.3/2.4 同步

2026-09-08 21:45:00 +08:00

..

apikey_test.go

feat: JWT过期自动重置 + 用户端登录页 + 系统设置前三个真实实现

2026-09-07 13:57:36 +08:00

apikey.go

feat: JWT过期自动重置 + 用户端登录页 + 系统设置前三个真实实现

2026-09-07 13:57:36 +08:00

auth.go

feat(auth): refresh token 续期(B2) — 不透明哈希+单次旋转+/auth/refresh+/auth/logout

2026-09-08 21:45:00 +08:00

jwt_test.go

feat: JWT过期自动重置 + 用户端登录页 + 系统设置前三个真实实现

2026-09-07 13:57:36 +08:00

jwt.go

feat: JWT过期自动重置 + 用户端登录页 + 系统设置前三个真实实现

2026-09-07 13:57:36 +08:00

password_test.go

feat(auth): JWT(HS256 stdlib) + RBAC(owner/admin/viewer) + API key + 密码 hash；config 校验

2026-09-06 07:19:28 +08:00

password.go

feat(auth): JWT(HS256 stdlib) + RBAC(owner/admin/viewer) + API key + 密码 hash；config 校验

2026-09-06 07:19:28 +08:00

rbac_test.go

feat(auth): JWT(HS256 stdlib) + RBAC(owner/admin/viewer) + API key + 密码 hash；config 校验

2026-09-06 07:19:28 +08:00

rbac.go

feat(auth): JWT(HS256 stdlib) + RBAC(owner/admin/viewer) + API key + 密码 hash；config 校验

2026-09-06 07:19:28 +08:00

refresh_test.go

feat(auth): refresh token 续期(B2) — 不透明哈希+单次旋转+/auth/refresh+/auth/logout

2026-09-08 21:45:00 +08:00

refresh.go

feat(auth): refresh token 续期(B2) — 不透明哈希+单次旋转+/auth/refresh+/auth/logout

2026-09-08 21:45:00 +08:00

role_test.go

feat(auth): JWT(HS256 stdlib) + RBAC(owner/admin/viewer) + API key + 密码 hash；config 校验

2026-09-06 07:19:28 +08:00