fix: align admin behavior and Kratos integrations

internal/service/authentication.go

@@ -34,29 +34,39 @@ func (s *SystemService) Login(ctx context.Context, username, password string) (*
 		return nil, err
 	}
 	if u.Enable != 1 {
-		return nil, biz.ErrInvalidCredentials
+		return nil, biz.ErrUserDisabled
 	}
 	if security, securityErr := s.settings.CurrentSecurity(ctx); securityErr == nil && security.PwdExpireEnable && u.PasswordUpdatedAt != nil && time.Since(*u.PasswordUpdatedAt) > time.Duration(security.PwdExpireDays)*24*time.Hour {
 		u.MustChangePassword = true
 	}
-	return s.issueLogin(u, u.AuthorityID)
+	return s.issueLogin(ctx, u, u.AuthorityID)
 }
 
-func (s *SystemService) issueLogin(user *biz.User, authorityID uint) (*LoginResult, error) {
+func (s *SystemService) issueLogin(ctx context.Context, user *biz.User, authorityID uint) (*LoginResult, error) {
 	expires, buffer := 7*24*time.Hour, 24*time.Hour
 	secret, issuer := "", "kra"
-	if s.config != nil && s.config.Jwt != nil {
-		secret, issuer = s.config.Jwt.SigningKey, s.config.Jwt.Issuer
-		if s.config.Jwt.ExpiresTime != nil {
-			expires = s.config.Jwt.ExpiresTime.AsDuration()
+	config := s.runtime.Admin()
+	if config != nil && config.Jwt != nil {
+		secret, issuer = config.Jwt.SigningKey, config.Jwt.Issuer
+		if config.Jwt.ExpiresTime != nil {
+			expires = config.Jwt.ExpiresTime.AsDuration()
 		}
-		if s.config.Jwt.BufferTime != nil {
-			buffer = s.config.Jwt.BufferTime.AsDuration()
+		if config.Jwt.BufferTime != nil {
+			buffer = config.Jwt.BufferTime.AsDuration()
 		}
 	}
 	token, claims, err := adminauth.Generate(secret, issuer, expires, buffer, user.ID, authorityID, user.UUID, user.Username, user.NickName, user.MustChangePassword)
 	if err != nil {
 		return nil, err
 	}
+	if s.settings.UseMultipoint() {
+		oldToken, _, cacheErr := s.settings.cache.Get(ctx, activeTokenKey(user.Username))
+		if cacheErr != nil {
+			return nil, cacheErr
+		}
+		if cacheErr = s.settings.RotateActiveToken(ctx, user.Username, oldToken, token, expires); cacheErr != nil {
+			return nil, cacheErr
+		}
+	}
 	return &LoginResult{User: convertUser(user), Token: token, ExpiresAt: claims.ExpiresAt.UnixMilli(), NeedChangePassword: user.MustChangePassword}, nil
 }