feat(auth): add refresh token module

Assisted-by: Codex

Author: luoqiz

continew-auth-refresh/pom.xml

@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <parent>
+        <groupId>top.continew.admin</groupId>
+        <artifactId>continew-admin</artifactId>
+        <version>${revision}</version>
+    </parent>
+
+    <artifactId>continew-auth-refresh</artifactId>
+    <packaging>jar</packaging>
+
+    <name>${project.artifactId}</name>
+    <description>认证会话模块（Refresh Token、会话轮换和 Access Token 绑定）</description>
+
+    <dependencies>
+        <dependency>
+            <groupId>${project.groupId}</groupId>
+            <artifactId>continew-common</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-aop</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-test</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+</project>

continew-auth-refresh/src/main/java/top/continew/admin/auth/api/AccessSessionValidator.java

@@ -0,0 +1,23 @@
+/*
+ * Copyright (c) 2022-present Charles7c Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package top.continew.admin.auth.api;
+
+/** 校验 Access Token 是否仍绑定有效认证会话。 */
+public interface AccessSessionValidator {
+
+    boolean isInvalid(String accessToken);
+}

continew-auth-refresh/src/main/java/top/continew/admin/auth/api/AuthPolicyLockTarget.java

@@ -0,0 +1,43 @@
+/*
+ * Copyright (c) 2022-present Charles7c Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package top.continew.admin.auth.api;
+
+/**
+ * 认证会话安全策略锁的目标。
+ *
+ * @author luoqiz
+ */
+public record AuthPolicyLockTarget(Type type, String key) {
+
+    public static AuthPolicyLockTarget client(String clientId) {
+        return new AuthPolicyLockTarget(Type.CLIENT, clientId);
+    }
+
+    public static AuthPolicyLockTarget tenant(Long tenantId) {
+        return new AuthPolicyLockTarget(Type.TENANT, String.valueOf(tenantId));
+    }
+
+    public static AuthPolicyLockTarget user(Long userId) {
+        return new AuthPolicyLockTarget(Type.USER, String.valueOf(userId));
+    }
+
+    public enum Type {
+        USER,
+        TENANT,
+        CLIENT
+    }
+}

continew-auth-refresh/src/main/java/top/continew/admin/auth/api/AuthPolicyLockTargetResolver.java

@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2022-present Charles7c Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package top.continew.admin.auth.api;
+
+import java.util.Collection;
+
+/**
+ * 将业务方法参数解析为认证会话策略锁目标。
+ *
+ * <p>实现由 system 或 tenant 插件提供，认证会话模块不引用任何业务 Mapper。</p>
+ *
+ * @author luoqiz
+ */
+public interface AuthPolicyLockTargetResolver {
+
+    Collection<AuthPolicyLockTarget> resolve(Object[] args);
+}

continew-auth-refresh/src/main/java/top/continew/admin/auth/api/AuthPolicyWriteLocked.java

@@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2022-present Charles7c Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package top.continew.admin.auth.api;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+/**
+ * 在数据库事务开始前获取认证策略写锁。
+ *
+ * <p>标记会改变登录资格或会话策略的项目业务方法，统一约束分布式锁与数据库事务的
+ * 顺序，避免登录/刷新路径的“Redis 锁→数据库”与管理路径的“数据库→Redis 锁”互锁。</p>
+ *
+ * @author luoqiz
+ */
+@Target(ElementType.METHOD)
+@Retention(RetentionPolicy.RUNTIME)
+public @interface AuthPolicyWriteLocked {
+
+    /** 由业务模块实现的锁目标解析器。 */
+    Class<? extends AuthPolicyLockTargetResolver> value();
+}

continew-auth-refresh/src/main/java/top/continew/admin/auth/api/AuthSessionConstants.java

@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2022-present Charles7c Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package top.continew.admin.auth.api;
+
+/**
+ * 认证会话常量。
+ *
+ * @author luoqiz
+ */
+public final class AuthSessionConstants {
+
+    /** Access Token 中绑定 Refresh Session ID 的声明名称。 */
+    public static final String SESSION_ID_CLAIM = "sid";
+
+    private AuthSessionConstants() {
+    }
+}

continew-auth-refresh/src/main/java/top/continew/admin/auth/api/AuthSessionRevocationNotifier.java

@@ -0,0 +1,32 @@
+/*
+ * Copyright (c) 2022-present Charles7c Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package top.continew.admin.auth.api;
+
+/**
+ * 认证会话撤销通知器。
+ *
+ * @author luoqiz
+ */
+public interface AuthSessionRevocationNotifier {
+
+    /**
+     * 通知所有实时连接撤销指定登录会话。
+     *
+     * @param sessionId Refresh Session ID
+     */
+    void notifyRevoked(String sessionId);
+}