优化

internal/biz/authentication.go

@@ -142,17 +142,14 @@ func (uc *AuthenticationUsecase) SwitchAuthority(ctx context.Context, claims *Au
 	if err := uc.users.SetUserAuthority(ctx, claims.ID, authorityID); err != nil {
 		return nil, err
 	}
-	user, err := uc.users.User(ctx, claims.ID)
-	if err != nil {
-		return nil, err
-	}
-	// IssueToken receives the remaining lifetime rather than zero so the new
-	// token expires at the same instant as the token it replaced.
-	remaining := time.Until(claims.ExpiresAt)
-	issued, err := uc.issuer.IssueToken(user, authorityID, claims.MustChangePwd, remaining)
+	// Role switching signs the current claims again after replacing only the
+	// authority ID. It must not reload mutable profile fields or reset JWT
+	// timing/buffer claims as if this were a fresh login.
+	issued, err := uc.issuer.ReissueToken(claims, authorityID)
 	if err != nil {
 		return nil, err
 	}
+	user := &User{ID: claims.ID, UUID: claims.UUID, Username: claims.Username, NickName: claims.NickName, AuthorityID: authorityID, MustChangePassword: claims.MustChangePwd}
 	return &AuthenticationResult{User: user, Token: issued.Value, ExpiresAt: issued.ExpiresAt, NeedChangePassword: claims.MustChangePwd}, nil
 }