fix: align admin behavior and Kratos integrations

internal/service/settings.go

@@ -1,7 +1,9 @@
 package service
 
 import (
+	"context"
 	"sync"
+	"time"
 
 	"kra/internal/biz"
 	"kra/internal/conf"
@@ -9,12 +11,39 @@ import (
 
 type SettingsService struct {
 	uc            *biz.SettingsUsecase
-	config        *conf.AdminBackend
+	runtime       *conf.Runtime
 	securityMu    sync.RWMutex
 	securityCache *biz.SecurityConfig
+	cache         biz.Cache
 }
 
-func NewSettingsService(uc *biz.SettingsUsecase, config *conf.AdminBackend) *SettingsService {
-	return &SettingsService{uc: uc, config: config}
+func NewSettingsService(uc *biz.SettingsUsecase, runtime *conf.Runtime, cache biz.Cache) *SettingsService {
+	return &SettingsService{uc: uc, runtime: runtime, cache: cache}
+}
+
+func (s *SettingsService) UseMultipoint() bool {
+	config := s.runtime.Admin()
+	return config != nil && config.System != nil && config.System.UseMultipoint
+}
+
+func activeTokenKey(username string) string { return "jwt:active:" + username }
+
+func (s *SettingsService) ActiveTokenMatches(ctx context.Context, username, token string) (bool, error) {
+	if !s.UseMultipoint() {
+		return true, nil
+	}
+	active, ok, err := s.cache.Get(ctx, activeTokenKey(username))
+	return ok && active == token, err
+}
+
+func (s *SettingsService) RotateActiveToken(ctx context.Context, username, oldToken, newToken string, expiration time.Duration) error {
+	if !s.UseMultipoint() {
+		return nil
+	}
+	if oldToken != "" && oldToken != newToken {
+		if err := s.BlacklistToken(ctx, oldToken); err != nil {
+			return err
+		}
+	}
+	return s.cache.Set(ctx, activeTokenKey(username), newToken, expiration)
 }
-func (s *SettingsService) Repo() biz.SettingsRepo { return s.uc.Repo() }