fix: 完善刷新令牌与联合限流

2026-09-14 19:31:51 +08:00
parent 3e04197b02
commit c708205084
6 changed files with 393 additions and 112 deletions
@@ -19,6 +19,11 @@ enum AuthProvider {
  WECHAT
 }

+enum RefreshTokenStatus {
+  ACTIVE
+  USED
+}
+
 enum ReviewStatus {
  DRAFT
  REVIEWING
@@ -148,25 +153,44 @@ model AuthIdentity {
 }

 model Session {
-  id                String    @id @default(uuid()) @db.Uuid
-  accountId         String    @map("account_id") @db.Uuid
-  refreshTokenHash  String    @unique @map("refresh_token_hash") @db.VarChar(255)
-  deviceId          String?   @map("device_id") @db.VarChar(255)
-  expiresAt         DateTime  @map("expires_at") @db.Timestamptz(3)
-  revokedAt         DateTime? @map("revoked_at") @db.Timestamptz(3)
-  tokenFamily       String    @map("token_family") @db.Uuid
-  generation        Int       @default(0)
-  previousTokenHash String?   @unique @map("previous_token_hash") @db.VarChar(255)
-  rotatedAt         DateTime? @map("rotated_at") @db.Timestamptz(3)
-  createdAt         DateTime  @default(now()) @map("created_at") @db.Timestamptz(3)
-  updatedAt         DateTime  @updatedAt @map("updated_at") @db.Timestamptz(3)
-  account           Account   @relation(fields: [accountId], references: [id], onDelete: Cascade)
+  id                String         @id @default(uuid()) @db.Uuid
+  accountId         String         @map("account_id") @db.Uuid
+  refreshTokenHash  String         @unique @map("refresh_token_hash") @db.VarChar(255)
+  deviceId          String?        @map("device_id") @db.VarChar(255)
+  expiresAt         DateTime       @map("expires_at") @db.Timestamptz(3)
+  revokedAt         DateTime?      @map("revoked_at") @db.Timestamptz(3)
+  tokenFamily       String         @map("token_family") @db.Uuid
+  generation        Int            @default(0)
+  previousTokenHash String?        @unique @map("previous_token_hash") @db.VarChar(255)
+  rotatedAt         DateTime?      @map("rotated_at") @db.Timestamptz(3)
+  createdAt         DateTime       @default(now()) @map("created_at") @db.Timestamptz(3)
+  updatedAt         DateTime       @updatedAt @map("updated_at") @db.Timestamptz(3)
+  account           Account        @relation(fields: [accountId], references: [id], onDelete: Cascade)
+  refreshTokens     RefreshToken[]

  @@index([accountId, expiresAt])
  @@index([tokenFamily])
  @@map("sessions")
 }

+model RefreshToken {
+  id             String             @id @default(uuid()) @db.Uuid
+  tokenHash      String             @unique @map("token_hash") @db.VarChar(255)
+  sessionId      String             @map("session_id") @db.Uuid
+  generation     Int
+  status         RefreshTokenStatus @default(ACTIVE)
+  usedAt         DateTime?          @map("used_at") @db.Timestamptz(3)
+  replacedByHash String?            @unique @map("replaced_by_hash") @db.VarChar(255)
+  createdAt      DateTime           @default(now()) @map("created_at") @db.Timestamptz(3)
+  expiresAt      DateTime           @map("expires_at") @db.Timestamptz(3)
+  session        Session            @relation(fields: [sessionId], references: [id], onDelete: Cascade)
+
+  @@unique([sessionId, generation])
+  @@index([sessionId, status])
+  @@index([expiresAt])
+  @@map("refresh_tokens")
+}
+
 model Bottle {
  id           String              @id @default(uuid()) @db.Uuid
  authorId     String              @map("author_id") @db.Uuid