前台登陆逻辑修改，请帮我实现“单设备登录（同端互斥）”功能

video-gen-api/alembic/versions/20260813_增加用户token_version字段.py

@@ -0,0 +1,22 @@
+"""增加用户token_version字段 — 单设备登录
+
+Revision ID: 20260813_token_version
+Revises:b7e2c4d91a63
+Create Date: 2026-08-13 10:00:00.000000
+"""
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers, used by Alembic.
+revision = '20260813_token_version'
+down_revision = 'b7e2c4d91a63'  # 设置为上一个迁移的 revision
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.add_column('users', sa.Column('token_version', sa.Integer(), nullable=False, server_default='0'))
+
+
+def downgrade():
+    op.drop_column('users', 'token_version')

video-gen-api/app/api/v1/auth.py

@@ -58,7 +58,9 @@ def _validate_captcha_if_needed(captcha_token: str | None) -> None:
 
 def _token_response(user: User, remember_me: bool = False) -> dict:
     user.credits = round(user.credits, 2)
-    token = create_access_token(user.id, remember_me)
+    # 递增 token_version — 单设备登录（全局互斥），使旧 token 全部失效
+    user.token_version = (user.token_version or 0) + 1
+    token = create_access_token(user.id, remember_me, user.token_version)
     return {
         "access_token": token,
         "token_type": "bearer",
@@ -237,7 +239,9 @@ async def register(req: RegisterRequest, db: AsyncSession = Depends(get_db)):
     await _assign_default_frontend_menus(db, user)
 
     user.credits = round(user.credits, 2)
-    token = create_access_token(user.id)
+    # 递增 token_version — 单设备登录
+    user.token_version = (user.token_version or 0) + 1
+    token = create_access_token(user.id, False, user.token_version)
     return {
         "access_token": token,
         "token_type": "bearer",
@@ -247,7 +251,13 @@ async def register(req: RegisterRequest, db: AsyncSession = Depends(get_db)):
 
 
 @router.post("/logout")
-async def logout(current_user: User = Depends(get_current_user_allow_password_pending)):
+async def logout(
+    current_user: User = Depends(get_current_user_allow_password_pending),
+    db: AsyncSession = Depends(get_db),
+):
+    # 递增 token_version — 使当前 token 失效，实现主动退出后不可再用
+    current_user.token_version = (current_user.token_version or 0) + 1
+    await db.flush()
     return {"message": "ok"}
 
 

video-gen-api/app/dependencies.py

@@ -32,15 +32,18 @@ async def get_current_user_allow_password_pending(
             detail="未登录",
         )
 
-    user_id = decode_access_token(credentials.credentials)
-    if not user_id:
+    payload = decode_access_token(credentials.credentials)
+    if not payload:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="登录已过期",
         )
 
+    user_id = payload.get("sub")
+    token_version = payload.get("ver", 0)
+
     # Skip captcha tokens
-    if user_id.startswith("captcha:"):
+    if user_id and user_id.startswith("captcha:"):
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="无效的凭证",
@@ -53,6 +56,14 @@ async def get_current_user_allow_password_pending(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="账号不存在或已禁用",
         )
+
+    # 单设备登录校验 — token 版本号不匹配说明已被踢出
+    if token_version != user.token_version:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="账号已在其他设备登录，请重新登录",
+        )
+
     return user
 
 

video-gen-api/app/models/user.py

@@ -44,6 +44,11 @@ class User(Base, TimestampMixin):
         Integer, default=50, server_default="50", nullable=False
     )
 
+    # Token 版本号 — 每次登录/退出时递增，用于实现单设备登录（全局互斥）
+    token_version: Mapped[int] = mapped_column(
+        Integer, default=0, server_default="0", nullable=False
+    )
+
     @property
     def must_set_password(self) -> bool:
         return self.user_type == "frontend" and not self.hashed_password

video-gen-api/app/services/auth.py

@@ -22,20 +22,20 @@ def verify_password(plain: str, hashed: str | None) -> bool:
         return False
 
 
-def create_access_token(user_id: str, remember_me: bool = False) -> str:
+def create_access_token(user_id: str, remember_me: bool = False, token_version: int = 0) -> str:
     minutes = settings.JWT_EXPIRE_REMEMBER_MINUTES if remember_me else settings.JWT_EXPIRE_MINUTES
     expire = datetime.now(timezone.utc) + timedelta(minutes=minutes)
-    payload = {"sub": user_id, "exp": expire}
+    payload = {"sub": user_id, "exp": expire, "ver": token_version}
     return jwt.encode(payload, settings.SECRET_KEY, algorithm=settings.JWT_ALGORITHM)
 
 
-def decode_access_token(token: str) -> str | None:
-    """Decode JWT and return user_id, or None if invalid."""
+def decode_access_token(token: str) -> dict | None:
+    """Decode JWT and return full payload, or None if invalid."""
     try:
         payload = jwt.decode(
             token, settings.SECRET_KEY, algorithms=[settings.JWT_ALGORITHM]
         )
-        return payload.get("sub")
+        return payload
     except jwt.PyJWTError:
         return None