1

common/auth.go

@@ -32,6 +32,22 @@ func SignToken(role, tokenFp string, expireSeconds int64) (string, error) {
 	return jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(jwtSecret))
 }
 
+// ---------- 访问令牌（内存持有，每次启动重新生成，不落库） ----------
+
+var accessToken string
+
+func SetAccessToken(token string) {
+	accessToken = token
+}
+
+func CheckAccessToken(token string) bool {
+	return accessToken != "" && token == accessToken
+}
+
+func AccessTokenFingerprint() string {
+	return TokenFingerprint(accessToken)
+}
+
 func ParseToken(tokenStr string) (*JwtClaims, error) {
 	token, err := jwt.ParseWithClaims(tokenStr, &JwtClaims{}, func(token *jwt.Token) (interface{}, error) {
 		return []byte(jwtSecret), nil

common/auth_middleware.go

@@ -1,7 +1,6 @@
 package common
 
 import (
-	"context"
 	"net/http"
 	"strings"
 
@@ -12,9 +11,6 @@ var publicPaths = []string{
 	"/system-config/login",
 }
 
-// CheckTokenFingerprint 由 kb/service 注入，避免 common → service 循环依赖
-var CheckTokenFingerprint func(ctx context.Context, fp string) bool
-
 func Auth(r *ghttp.Request) {
 	path := r.URL.Path
 
@@ -58,8 +54,8 @@ func Auth(r *ghttp.Request) {
 		return
 	}
 
-	// 指纹校验：访问令牌被重新生成后，旧会话立即失效
-	if CheckTokenFingerprint != nil && !CheckTokenFingerprint(r.Context(), claims.TokenFp) {
+	// 指纹校验：访问令牌变更（重启）后，旧会话立即失效
+	if claims.TokenFp != AccessTokenFingerprint() {
 		r.Response.WriteJson(ghttp.DefaultHandlerResponse{
 			Code:    http.StatusUnauthorized,
 			Message: "访问令牌已变更，请重新登录",