feat: 双Token认证(Access 2h/Refresh 7d) + 通知系统(转交/驳回自动推送)

backend/app/services/auth_service.py

@@ -1,11 +1,18 @@
-"""认证服务 — 对接 MOM 系统 sys_user 表 + Track 自有 JWT"""
+"""认证服务 — 对接 MOM 系统 sys_user 表 + Track 自有 JWT（双 Token 架构）"""
 from fastapi import HTTPException, status, Depends
 from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
 from jose import JWTError, jwt
 from werkzeug.security import check_password_hash
 
 from app.core.config import settings
-from app.core.security import create_access_token, ALGORITHM
+from app.core.security import (
+    create_access_token,
+    create_refresh_token,
+    decode_token,
+    ALGORITHM,
+    TOKEN_TYPE_ACCESS,
+    TOKEN_TYPE_REFRESH,
+)
 from app.core.mom_database import MomSessionLocal
 from app.schemas.user import LoginResponse, UserResponse
 
@@ -13,15 +20,15 @@ security = HTTPBearer()
 
 
 def login(username: str, password: str) -> LoginResponse:
-    """登录 — 查询 MOM 数据库 sys_user 表验证"""
+    """登录 — 签发双 Token（Access + Refresh）"""
     db = MomSessionLocal()
     try:
         # 1. 超级管理员硬编码（和 MOM 系统一致）
         if username == "IRIS" and password == "123321":
+            token_data = {"sub": "0", "role": "SUPER_ADMIN", "username": "IRIS", "display_name": "超级管理员"}
             return LoginResponse(
-                access_token=create_access_token(
-                    data={"sub": "0", "role": "SUPER_ADMIN"}
-                ),
+                access_token=create_access_token(data=token_data),
+                refresh_token=create_refresh_token(data=token_data),
                 user=UserResponse(
                     id="0",
                     username="IRIS",
@@ -60,17 +67,16 @@ def login(username: str, password: str) -> LoginResponse:
         # 4. 解析 display_name（"张三/zhangsan01" → "张三"）
         display_name = full_username.split("/")[0] if "/" in full_username else full_username
 
-        token = create_access_token(
-            data={
-                "sub": str(user_id),
-                "role": role or "operator",
-                "username": username,
-                "display_name": display_name,
-            }
-        )
+        token_data = {
+            "sub": str(user_id),
+            "role": role or "operator",
+            "username": username,
+            "display_name": display_name,
+        }
 
         return LoginResponse(
-            access_token=token,
+            access_token=create_access_token(data=token_data),
+            refresh_token=create_refresh_token(data=token_data),
             user=UserResponse(
                 id=str(user_id),
                 username=username,
@@ -83,16 +89,60 @@ def login(username: str, password: str) -> LoginResponse:
         db.close()
 
 
+def refresh_access_token(refresh_token: str) -> dict:
+    """
+    使用 Refresh Token 换取新的 Access Token。
+    校验：
+    1. Token 签名是否有效
+    2. Token type 是否为 "refresh"
+    3. Token 是否未过期
+    """
+    try:
+        payload = decode_token(refresh_token)
+    except JWTError:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Refresh Token 无效或已过期，请重新登录",
+        )
+
+    # 校验 token 类型
+    if payload.get("type") != TOKEN_TYPE_REFRESH:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="无效的 Token 类型，仅接受 Refresh Token",
+        )
+
+    # 提取用户信息，签发新的 Access Token
+    access_token = create_access_token(
+        data={
+            "sub": payload.get("sub"),
+            "role": payload.get("role", "operator"),
+            "username": payload.get("username", ""),
+            "display_name": payload.get("display_name", ""),
+        }
+    )
+
+    return {"access_token": access_token, "token_type": "bearer"}
+
+
 async def get_current_user(
     credentials: HTTPAuthorizationCredentials = Depends(security),
 ) -> dict:
-    """从 Bearer Token 解析当前用户（不查数据库，直接解 JWT）"""
+    """从 Bearer Token 解析当前用户（仅接受 Access Token）"""
     token = credentials.credentials
     try:
-        payload = jwt.decode(token, settings.SECRET_KEY, algorithms=[ALGORITHM])
+        payload = decode_token(token)
         user_id = payload.get("sub")
         if not user_id:
             raise HTTPException(status_code=401, detail="无效的 Token")
+
+        # 校验：仅接受 access token
+        if payload.get("type") == TOKEN_TYPE_REFRESH:
+            raise HTTPException(
+                status_code=401,
+                detail="请使用 Access Token 访问 API，Refresh Token 仅用于刷新",
+            )
+
         return payload
     except JWTError:
         raise HTTPException(status_code=401, detail="无效的 Token")