fix: align admin behavior and Kratos integrations

internal/server/middleware/access.go

@@ -2,7 +2,10 @@ package middleware
 
 import (
 	"net/http"
+	"strings"
 
+	"kra/internal/biz"
+	"kra/internal/conf"
 	"kra/internal/server/httpx"
 	"kra/internal/service"
 	"kra/internal/service/dto"
@@ -10,7 +13,7 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
-func AccessControl(access *service.AccessService, audit *service.AuditService) gin.HandlerFunc {
+func AccessControl(runtime *conf.Runtime, access *service.AccessService, audit *service.AuditService) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		claims := Claims(c)
 		if claims == nil {
@@ -18,7 +21,14 @@ func AccessControl(access *service.AccessService, audit *service.AuditService) g
 			return
 		}
 		path := c.Request.URL.Path
-		allowed, err := access.Authorize(c.Request.Context(), claims.AuthorityID, path, c.Request.Method)
+		policyPath := path
+		if config := runtime.Admin(); config != nil && config.RouterPrefix != "" {
+			policyPath = strings.TrimPrefix(policyPath, strings.TrimSuffix(config.RouterPrefix, "/"))
+			if policyPath == "" {
+				policyPath = "/"
+			}
+		}
+		allowed, err := access.Authorize(c.Request.Context(), claims.AuthorityID, policyPath, c.Request.Method)
 		if err != nil || !allowed {
 			requestID, _ := c.Get("request_id")
 			requestIDText, _ := requestID.(string)
@@ -31,6 +41,7 @@ func AccessControl(access *service.AccessService, audit *service.AuditService) g
 			httpx.Fail(c, "数据权限加载失败")
 			return
 		}
+		requestContext = biz.NewActorContext(requestContext, biz.Actor{UserID: claims.ID, AuthorityID: claims.AuthorityID})
 		c.Request = c.Request.WithContext(requestContext)
 		c.Next()
 	}

internal/server/middleware/auth.go

@@ -16,13 +16,14 @@ import (
 
 const claimsKey = "admin_claims"
 
-func Auth(config *conf.AdminBackend, settings *service.SettingsService) gin.HandlerFunc {
+func Auth(runtime *conf.Runtime, settings *service.SettingsService) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		token := c.GetHeader("x-token")
 		if token == "" {
 			token, _ = c.Cookie("x-token")
 		}
 		secret := ""
+		config := runtime.Admin()
 		if config != nil && config.Jwt != nil {
 			secret = config.Jwt.SigningKey
 		}
@@ -35,9 +36,14 @@ func Auth(config *conf.AdminBackend, settings *service.SettingsService) gin.Hand
 			httpx.NoAuth(c, "登录状态已失效")
 			return
 		}
+		if active, checkErr := settings.ActiveTokenMatches(c.Request.Context(), claims.Username, token); checkErr != nil || !active {
+			httpx.NoAuth(c, "登录状态已失效")
+			return
+		}
 		if claims.ExpiresAt != nil && claims.BufferTime > 0 && time.Until(claims.ExpiresAt.Time) < time.Duration(claims.BufferTime)*time.Second {
 			expires, buffer := 7*24*time.Hour, time.Duration(claims.BufferTime)*time.Second
 			issuer := claims.Issuer
+			config = runtime.Admin()
 			if config != nil && config.Jwt != nil {
 				if config.Jwt.ExpiresTime != nil {
 					expires = config.Jwt.ExpiresTime.AsDuration()
@@ -50,10 +56,10 @@ func Auth(config *conf.AdminBackend, settings *service.SettingsService) gin.Hand
 				}
 			}
 			newToken, newClaims, refreshErr := adminauth.Generate(secret, issuer, expires, buffer, claims.ID, claims.AuthorityID, claims.UUID, claims.Username, claims.NickName, claims.MustChangePwd)
-			if refreshErr == nil {
+			if refreshErr == nil && settings.RotateActiveToken(c.Request.Context(), claims.Username, token, newToken, expires) == nil {
 				c.Header("new-token", newToken)
 				c.Header("new-expires-at", strconv.FormatInt(newClaims.ExpiresAt.Unix(), 10))
-				http.SetCookie(c.Writer, &http.Cookie{Name: "x-token", Value: newToken, Path: "/", MaxAge: int(expires.Seconds()), HttpOnly: true, SameSite: http.SameSiteStrictMode})
+				httpx.SetTokenCookie(c, newToken, int(expires.Seconds()))
 			}
 		}
 		c.Set(claimsKey, claims)

internal/server/middleware/rate_limit.go

@@ -1,8 +1,6 @@
 package middleware
 
 import (
-	"net/http"
-	"strconv"
 	"time"
 
 	"kra/internal/server/httpx"
@@ -26,11 +24,11 @@ func SecurityRateLimit(system *service.SystemService, settings *service.Settings
 		if window < 1 {
 			window = 60
 		}
-		bucket := time.Now().Unix() / int64(window)
-		key := "rate:" + c.ClientIP() + ":" + strconv.FormatInt(bucket, 10)
-		count, cacheErr := system.CacheIncrement(c.Request.Context(), key, time.Duration(window+1)*time.Second)
+		key := "KRA_SecLimit" + c.ClientIP() + c.FullPath()
+		count, cacheErr := system.CacheIncrement(c.Request.Context(), key, time.Duration(window)*time.Second)
 		if cacheErr == nil && int(count) > config.LimitCount {
-			c.AbortWithStatusJSON(http.StatusTooManyRequests, httpx.Response{Code: httpx.CodeError, Data: nil, Msg: "请求过于频繁"})
+			httpx.Fail(c, "请求太过频繁，请稍后再试")
+			c.Abort()
 			return
 		}
 		c.Next()