fix: 完善刷新令牌与联合限流

2026-09-14 19:31:51 +08:00
parent 3e04197b02
commit c708205084
6 changed files with 393 additions and 112 deletions
@@ -0,0 +1,31 @@
+CREATE TYPE "RefreshTokenStatus" AS ENUM ('ACTIVE', 'USED');
+
+CREATE TABLE "refresh_tokens" (
+  "id" UUID NOT NULL,
+  "token_hash" VARCHAR(255) NOT NULL,
+  "session_id" UUID NOT NULL,
+  "generation" INTEGER NOT NULL,
+  "status" "RefreshTokenStatus" NOT NULL DEFAULT 'ACTIVE',
+  "used_at" TIMESTAMPTZ(3),
+  "replaced_by_hash" VARCHAR(255),
+  "created_at" TIMESTAMPTZ(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "expires_at" TIMESTAMPTZ(3) NOT NULL,
+  CONSTRAINT "refresh_tokens_pkey" PRIMARY KEY ("id"),
+  CONSTRAINT "refresh_tokens_generation_nonnegative" CHECK ("generation" >= 0),
+  CONSTRAINT "refresh_tokens_used_state_consistent" CHECK (
+    ("status" = 'ACTIVE' AND "used_at" IS NULL AND "replaced_by_hash" IS NULL)
+    OR ("status" = 'USED' AND "used_at" IS NOT NULL AND "replaced_by_hash" IS NOT NULL)
+  )
+);
+
+-- Legacy refresh values exposed the session id and cannot be upgraded client-side.
+-- Revoke those families; subsequent logins create opaque token history rows.
+UPDATE "sessions" SET "revoked_at" = COALESCE("revoked_at", CURRENT_TIMESTAMP);
+
+CREATE UNIQUE INDEX "refresh_tokens_token_hash_key" ON "refresh_tokens"("token_hash");
+CREATE UNIQUE INDEX "refresh_tokens_replaced_by_hash_key" ON "refresh_tokens"("replaced_by_hash");
+CREATE UNIQUE INDEX "refresh_tokens_session_id_generation_key" ON "refresh_tokens"("session_id", "generation");
+CREATE INDEX "refresh_tokens_session_id_status_idx" ON "refresh_tokens"("session_id", "status");
+CREATE INDEX "refresh_tokens_expires_at_idx" ON "refresh_tokens"("expires_at");
+ALTER TABLE "refresh_tokens" ADD CONSTRAINT "refresh_tokens_session_id_fkey"
+  FOREIGN KEY ("session_id") REFERENCES "sessions"("id") ON DELETE CASCADE ON UPDATE CASCADE;