jkjoy/plp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 完善刷新令牌与联合限流

Browse Source
This commit is contained in:
root
2026-09-14 19:31:51 +08:00
parent 3e04197b02
commit c708205084
6 changed files with 393 additions and 112 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prisma/migrations/0003_refresh_token_history/migration.sql
+31
View File
@@ -0,0 +1,31 @@
CREATE TYPE "RefreshTokenStatus" AS ENUM ('ACTIVE', 'USED');
CREATE TABLE "refresh_tokens" (
"id" UUID NOT NULL,
"token_hash" VARCHAR(255) NOT NULL,
"session_id" UUID NOT NULL,
"generation" INTEGER NOT NULL,
"status" "RefreshTokenStatus" NOT NULL DEFAULT 'ACTIVE',
"used_at" TIMESTAMPTZ(3),
"replaced_by_hash" VARCHAR(255),
"created_at" TIMESTAMPTZ(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
"expires_at" TIMESTAMPTZ(3) NOT NULL,
CONSTRAINT "refresh_tokens_pkey" PRIMARY KEY ("id"),
CONSTRAINT "refresh_tokens_generation_nonnegative" CHECK ("generation" >= 0),
CONSTRAINT "refresh_tokens_used_state_consistent" CHECK (
("status" = 'ACTIVE' AND "used_at" IS NULL AND "replaced_by_hash" IS NULL)
OR ("status" = 'USED' AND "used_at" IS NOT NULL AND "replaced_by_hash" IS NOT NULL)
)
);
-- Legacy refresh values exposed the session id and cannot be upgraded client-side.
-- Revoke those families; subsequent logins create opaque token history rows.
UPDATE "sessions" SET "revoked_at" = COALESCE("revoked_at", CURRENT_TIMESTAMP);
CREATE UNIQUE INDEX "refresh_tokens_token_hash_key" ON "refresh_tokens"("token_hash");
CREATE UNIQUE INDEX "refresh_tokens_replaced_by_hash_key" ON "refresh_tokens"("replaced_by_hash");
CREATE UNIQUE INDEX "refresh_tokens_session_id_generation_key" ON "refresh_tokens"("session_id", "generation");
CREATE INDEX "refresh_tokens_session_id_status_idx" ON "refresh_tokens"("session_id", "status");
CREATE INDEX "refresh_tokens_expires_at_idx" ON "refresh_tokens"("expires_at");
ALTER TABLE "refresh_tokens" ADD CONSTRAINT "refresh_tokens_session_id_fkey"
FOREIGN KEY ("session_id") REFERENCES "sessions"("id") ON DELETE CASCADE ON UPDATE CASCADE;
prisma/schema.prisma
+37 -13
View File
@@ -19,6 +19,11 @@ enum AuthProvider {
WECHAT
}
enum RefreshTokenStatus {
ACTIVE
USED
}
enum ReviewStatus {
DRAFT
REVIEWING
@@ -148,25 +153,44 @@ model AuthIdentity {
}
model Session {
id String @id @default(uuid()) @db.Uuid
accountId String @map("account_id") @db.Uuid
refreshTokenHash String @unique @map("refresh_token_hash") @db.VarChar(255)
deviceId String? @map("device_id") @db.VarChar(255)
expiresAt DateTime @map("expires_at") @db.Timestamptz(3)
revokedAt DateTime? @map("revoked_at") @db.Timestamptz(3)
tokenFamily String @map("token_family") @db.Uuid
generation Int @default(0)
previousTokenHash String? @unique @map("previous_token_hash") @db.VarChar(255)
rotatedAt DateTime? @map("rotated_at") @db.Timestamptz(3)
createdAt DateTime @default(now()) @map("created_at") @db.Timestamptz(3)
updatedAt DateTime @updatedAt @map("updated_at") @db.Timestamptz(3)
account Account @relation(fields: [accountId], references: [id], onDelete: Cascade)
id String @id @default(uuid()) @db.Uuid
accountId String @map("account_id") @db.Uuid
refreshTokenHash String @unique @map("refresh_token_hash") @db.VarChar(255)
deviceId String? @map("device_id") @db.VarChar(255)
expiresAt DateTime @map("expires_at") @db.Timestamptz(3)
revokedAt DateTime? @map("revoked_at") @db.Timestamptz(3)
tokenFamily String @map("token_family") @db.Uuid
generation Int @default(0)
previousTokenHash String? @unique @map("previous_token_hash") @db.VarChar(255)
rotatedAt DateTime? @map("rotated_at") @db.Timestamptz(3)
createdAt DateTime @default(now()) @map("created_at") @db.Timestamptz(3)
updatedAt DateTime @updatedAt @map("updated_at") @db.Timestamptz(3)
account Account @relation(fields: [accountId], references: [id], onDelete: Cascade)
refreshTokens RefreshToken[]
@@index([accountId, expiresAt])
@@index([tokenFamily])
@@map("sessions")
}
model RefreshToken {
id String @id @default(uuid()) @db.Uuid
tokenHash String @unique @map("token_hash") @db.VarChar(255)
sessionId String @map("session_id") @db.Uuid
generation Int
status RefreshTokenStatus @default(ACTIVE)
usedAt DateTime? @map("used_at") @db.Timestamptz(3)
replacedByHash String? @unique @map("replaced_by_hash") @db.VarChar(255)
createdAt DateTime @default(now()) @map("created_at") @db.Timestamptz(3)
expiresAt DateTime @map("expires_at") @db.Timestamptz(3)
session Session @relation(fields: [sessionId], references: [id], onDelete: Cascade)
@@unique([sessionId, generation])
@@index([sessionId, status])
@@index([expiresAt])
@@map("refresh_tokens")
}
model Bottle {
id String @id @default(uuid()) @db.Uuid
authorId String @map("author_id") @db.Uuid