fix: align admin behavior and Kratos integrations

internal/server/middleware/auth.go

@@ -16,13 +16,14 @@ import (
 
 const claimsKey = "admin_claims"
 
-func Auth(config *conf.AdminBackend, settings *service.SettingsService) gin.HandlerFunc {
+func Auth(runtime *conf.Runtime, settings *service.SettingsService) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		token := c.GetHeader("x-token")
 		if token == "" {
 			token, _ = c.Cookie("x-token")
 		}
 		secret := ""
+		config := runtime.Admin()
 		if config != nil && config.Jwt != nil {
 			secret = config.Jwt.SigningKey
 		}
@@ -35,9 +36,14 @@ func Auth(config *conf.AdminBackend, settings *service.SettingsService) gin.Hand
 			httpx.NoAuth(c, "登录状态已失效")
 			return
 		}
+		if active, checkErr := settings.ActiveTokenMatches(c.Request.Context(), claims.Username, token); checkErr != nil || !active {
+			httpx.NoAuth(c, "登录状态已失效")
+			return
+		}
 		if claims.ExpiresAt != nil && claims.BufferTime > 0 && time.Until(claims.ExpiresAt.Time) < time.Duration(claims.BufferTime)*time.Second {
 			expires, buffer := 7*24*time.Hour, time.Duration(claims.BufferTime)*time.Second
 			issuer := claims.Issuer
+			config = runtime.Admin()
 			if config != nil && config.Jwt != nil {
 				if config.Jwt.ExpiresTime != nil {
 					expires = config.Jwt.ExpiresTime.AsDuration()
@@ -50,10 +56,10 @@ func Auth(config *conf.AdminBackend, settings *service.SettingsService) gin.Hand
 				}
 			}
 			newToken, newClaims, refreshErr := adminauth.Generate(secret, issuer, expires, buffer, claims.ID, claims.AuthorityID, claims.UUID, claims.Username, claims.NickName, claims.MustChangePwd)
-			if refreshErr == nil {
+			if refreshErr == nil && settings.RotateActiveToken(c.Request.Context(), claims.Username, token, newToken, expires) == nil {
 				c.Header("new-token", newToken)
 				c.Header("new-expires-at", strconv.FormatInt(newClaims.ExpiresAt.Unix(), 10))
-				http.SetCookie(c.Writer, &http.Cookie{Name: "x-token", Value: newToken, Path: "/", MaxAge: int(expires.Seconds()), HttpOnly: true, SameSite: http.SameSiteStrictMode})
+				httpx.SetTokenCookie(c, newToken, int(expires.Seconds()))
 			}
 		}
 		c.Set(claimsKey, claims)