From b06a5fc058649db5a3207015dc92ceb76e599d8a Mon Sep 17 00:00:00 2001 From: API Changelog Bot Date: Thu, 14 May 2026 18:18:23 +0800 Subject: [PATCH] =?UTF-8?q?docs(auth):=20=E8=A1=A5=20switchRole=20?= =?UTF-8?q?=E5=89=8D=E7=AB=AF=E6=8F=90=E9=86=92=20+=20=E5=8F=8D=E5=90=91?= =?UTF-8?q?=20cleanup=20=E5=9C=BA=E6=99=AF=E8=A1=A8=20+=20#2294?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../14_feat_admin_auth_refresh_token.md | 21 ++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/changelogs/2026-05/14_feat_admin_auth_refresh_token.md b/changelogs/2026-05/14_feat_admin_auth_refresh_token.md index 7f8412f..2d588bf 100644 --- a/changelogs/2026-05/14_feat_admin_auth_refresh_token.md +++ b/changelogs/2026-05/14_feat_admin_auth_refresh_token.md @@ -179,7 +179,26 @@ STEP 9: POST /admin/auth/refresh {篡改 refresh} -> 401 --- +## switchRole 提醒(@mmg 重要) + +切换角色 `POST /admin/auth/switch-role` 响应也包含新的 refreshToken/accessTokenExpiresIn/refreshTokenExpiresIn 字段。前端必须同时更新本地存储的 **accessToken 和 refreshToken**(背后 jti 已轮换,旧 refresh 立即失效)。不要只取 token 字段。 + +## 已审视的反向 cleanup 场景 + +| 场景 | 是否清 token | 说明 | +|---|---|---| +| logout | 清 access + refresh | 主动登出 | +| changePassword | 清 access + refresh | 改密强制重登 | +| deleteAdmin | 清 access + refresh (#2294 补) | 删 admin 防绕过 | +| resetPassword | 清 access + refresh (#2294 补) | 超管重置他人密码 | +| login 账号锁定 (失败 5 次) | 清 access + refresh (#2294 补 + 修旧 bug) | 可疑账号防已签发 token 继续生效 | +| switchRole | 不主动清 (jti 轮转自动覆盖) | issueAdminTokens 写新 jti 覆盖旧 | +| login 成功 | 不主动清 (同 switchRole) | — | +| unlockAdmin | 不清 | 登录态本就无效 | + ## 相关文档 - Issue: [wx/HL#2283](https://git.1814.love:8443/wx/HL/issues/2283) -- PR: [wx/HL#2285](https://git.1814.love:8443/wx/HL/pulls/2285) + hotfix [wx/HL#2287](https://git.1814.love:8443/wx/HL/pulls/2287) (补 user-service TokenInterceptor 白名单) +- PR 主体: [wx/HL#2285](https://git.1814.love:8443/wx/HL/pulls/2285) +- Hotfix #2287: 补 user-service TokenInterceptor 白名单 +- Hotfix #2294: 补 deleteAdmin/resetPassword/账号锁定 3 处 refresh cleanup + 锁定旧 bug