冲突解决

video-gen-api/alembic/versions/20260813_增加用户token_version字段.py

@@ -0,0 +1,22 @@
+"""增加用户token_version字段 — 单设备登录
+
+Revision ID: 20260813_token_version
+Revises:b7e2c4d91a63
+Create Date: 2026-08-13 10:00:00.000000
+"""
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers, used by Alembic.
+revision = '20260813_token_version'
+down_revision = 'b7e2c4d91a63'  # 设置为上一个迁移的 revision
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.add_column('users', sa.Column('token_version', sa.Integer(), nullable=False, server_default='0'))
+
+
+def downgrade():
+    op.drop_column('users', 'token_version')

video-gen-api/app/api/v1/auth.py

@@ -61,7 +61,9 @@ def _validate_captcha_if_needed(captcha_token: str | None) -> None:
 
 def _token_response(user: User, remember_me: bool = False) -> dict:
     user.credits = round(user.credits, 2)
-    token = create_access_token(user.id, remember_me)
+    # 递增 token_version — 单设备登录（全局互斥），使旧 token 全部失效
+    user.token_version = (user.token_version or 0) + 1
+    token = create_access_token(user.id, remember_me, user.token_version)
     return {
         "access_token": token,
         "token_type": "bearer",
@@ -246,7 +248,9 @@ async def register(req: RegisterRequest, db: AsyncSession = Depends(get_db)):
     await _assign_default_frontend_menus(db, user)
 
     user.credits = round(user.credits, 2)
-    token = create_access_token(user.id)
+    # 递增 token_version — 单设备登录
+    user.token_version = (user.token_version or 0) + 1
+    token = create_access_token(user.id, False, user.token_version)
     return {
         "access_token": token,
         "token_type": "bearer",
@@ -256,7 +260,13 @@ async def register(req: RegisterRequest, db: AsyncSession = Depends(get_db)):
 
 
 @router.post("/logout")
-async def logout(current_user: User = Depends(get_current_user_allow_password_pending)):
+async def logout(
+    current_user: User = Depends(get_current_user_allow_password_pending),
+    db: AsyncSession = Depends(get_db),
+):
+    # 递增 token_version — 使当前 token 失效，实现主动退出后不可再用
+    current_user.token_version = (current_user.token_version or 0) + 1
+    await db.flush()
     return {"message": "ok"}
 
 

video-gen-api/app/dependencies.py

@@ -33,15 +33,18 @@ async def get_current_user_allow_password_pending(
             detail="未登录",
         )
 
-    user_id = decode_access_token(credentials.credentials)
+    payload = decode_access_token(credentials.credentials)
-    if not user_id:
+    if not payload:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="登录已过期",
         )
 
+    user_id = payload.get("sub")
+    token_version = payload.get("ver", 0)
+
     # Skip captcha tokens
-    if user_id.startswith("captcha:"):
+    if user_id and user_id.startswith("captcha:"):
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="无效的凭证",
@@ -54,6 +57,14 @@ async def get_current_user_allow_password_pending(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="账号不存在或已禁用",
         )
+
+    # 单设备登录校验 — token 版本号不匹配说明已被踢出
+    if token_version != user.token_version:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="账号已在其他设备登录，请重新登录",
+        )
+
     attach_credit_snapshot(user, await get_available_credits(db, user.id))
     return user
 

video-gen-api/app/models/user.py

@@ -38,6 +38,11 @@ class User(Base, TimestampMixin):
         Integer, default=50, server_default="50", nullable=False
     )
 
+    # Token 版本号 — 每次登录/退出时递增，用于实现单设备登录（全局互斥）
+    token_version: Mapped[int] = mapped_column(
+        Integer, default=0, server_default="0", nullable=False
+    )
+
     @property
     def credits(self) -> float:
         return float(getattr(self, "_credits_snapshot", 0.0) or 0.0)

video-gen-api/app/services/auth.py

@@ -22,20 +22,20 @@ def verify_password(plain: str, hashed: str | None) -> bool:
         return False
 
 
-def create_access_token(user_id: str, remember_me: bool = False) -> str:
+def create_access_token(user_id: str, remember_me: bool = False, token_version: int = 0) -> str:
     minutes = settings.JWT_EXPIRE_REMEMBER_MINUTES if remember_me else settings.JWT_EXPIRE_MINUTES
     expire = datetime.now(timezone.utc) + timedelta(minutes=minutes)
-    payload = {"sub": user_id, "exp": expire}
+    payload = {"sub": user_id, "exp": expire, "ver": token_version}
     return jwt.encode(payload, settings.SECRET_KEY, algorithm=settings.JWT_ALGORITHM)
 
 
-def decode_access_token(token: str) -> str | None:
+def decode_access_token(token: str) -> dict | None:
-    """Decode JWT and return user_id, or None if invalid."""
+    """Decode JWT and return full payload, or None if invalid."""
     try:
         payload = jwt.decode(
             token, settings.SECRET_KEY, algorithms=[settings.JWT_ALGORITHM]
         )
-        return payload.get("sub")
+        return payload
     except jwt.PyJWTError:
         return None
 

video-gen-app/dist/index.html

@@ -27,7 +27,7 @@
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=Outfit:wght@300;400;500;600;700&display=swap" rel="stylesheet" />
     <title>民众智创</title>
-    <script type="module" crossorigin src="/assets/index-xGZWod_P.js"></script>
+    <script type="module" crossorigin src="/assets/index-CGl8RZCw.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-DSYnuUvx.css">
   </head>
   <body>

video-gen-app/src/api/client.ts

@@ -114,6 +114,10 @@ if (!res.ok) {
     if (typeof parsed?.detail === 'string') {
       msg = parsed.detail;
     }
+    // 检测"被踢出"错误 — 单设备登录互斥
+    if (res.status === 401 && typeof parsed?.detail === 'string' && parsed.detail.includes('其他设备登录')) {
+      window.dispatchEvent(new CustomEvent('kicked-out', { detail: { message: parsed.detail } }));
+    }
     if (res.status === 401 && !options.skipAuthRedirect) {
       clearToken();
       window.location.href = '/login';

video-gen-app/src/components/KickedOutModal.tsx

@@ -0,0 +1,43 @@
+import React from 'react';
+import { Modal, Typography, Button } from 'antd';
+import { ExclamationCircleOutlined } from '@ant-design/icons';
+import { clearToken } from '../api/client';
+
+interface KickedOutModalProps {
+  visible: boolean;
+}
+
+const KickedOutModal: React.FC<KickedOutModalProps> = ({ visible }) => {
+  const handleOk = () => {
+    clearToken();
+    window.location.href = '/login';
+  };
+
+  return (
+    <Modal
+      open={visible}
+      closable={false}
+      maskClosable={false}
+      footer={null}
+      centered
+      width={400}
+      style={{ textAlign: 'center' }}
+      wrapClassName="kicked-out-modal"
+    >
+      <div style={{ padding: '24px 0 16px' }}>
+        <ExclamationCircleOutlined style={{ fontSize: 48, color: '#f59e0b', marginBottom: 16 }} />
+        <Typography.Title level={4} style={{ marginBottom: 12, color: '#1e293b' }}>
+          登录提示
+        </Typography.Title>
+        <Typography.Paragraph style={{ color: '#64748b', fontSize: 14, marginBottom: 24 }}>
+          您的账号已在其他设备登录，请重新登录
+        </Typography.Paragraph>
+        <Button type="primary" size="large" block onClick={handleOk} style={{ borderRadius: 8 }}>
+          确定
+        </Button>
+      </div>
+    </Modal>
+  );
+};
+
+export default KickedOutModal;

video-gen-app/src/components/Layout/AppLayout.tsx

@@ -64,6 +64,7 @@ import { getMenuConfigs, getCreditProductCatalog, getPaymentMethods, createRecha
 import type { CreditProduct, CreditProductCatalog } from '../../types';
 import NotificationPopup from '../NotificationPopup';
 import ActivityBanner from './ActivityBanner';
+import KickedOutModal from '../KickedOutModal';
 import './AppLayout.css';
 
 
@@ -498,6 +499,11 @@ const AppLayout: React.FC = () => {
     }
     return logo;
   });
+  const [siteInfoLoading, setSiteInfoLoading] = useState(!localStorage.getItem('siteInfo'));
+  const [bannerVisible, setBannerVisible] = useState(false);
+  const [kickedOutVisible, setKickedOutVisible] = useState(false);
+
+  // 资源存储容量（从 getUser().resource_capacity 获取）
   const [resourceCapacity, setResourceCapacity] = useState<{
     enabled: boolean;
     usedBytes: number;
@@ -511,6 +517,13 @@ const AppLayout: React.FC = () => {
   const [isMobile, setIsMobile] = useState(false);
   const [operationManualUrl, setOperationManualUrl] = useState('');
 
+  // 监听"被踢出"事件 — 单设备登录互斥
+  useEffect(() => {
+    const handler = () => setKickedOutVisible(true);
+    window.addEventListener('kicked-out', handler);
+    return () => window.removeEventListener('kicked-out', handler);
+  }, []);
+
   useEffect(() => {
     getSiteInfo().then(info => {
       const name = info.siteName || '智创';
@@ -1024,7 +1037,8 @@ const AppLayout: React.FC = () => {
       flexDirection: 'column',
       overflow: 'hidden',
     }}>
-      <ActivityBanner onVisibilityChange={() => {}} />
+      <ActivityBanner onVisibilityChange={(v) => setBannerVisible(v)} />
+      <KickedOutModal visible={kickedOutVisible} />
       <div style={{ display: 'flex', position: 'relative', padding: 4, gap: 12, flex: 1, minHeight: 0, overflow: 'hidden' }}>
         <div className="desktop-sidebar" style={{
           width: sidebarW, position: 'sticky', top: 4, alignSelf: 'flex-start', zIndex: 100,