admin/verify
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: require instance_id when device_id is provided on logout

Browse Source 
- Only device_id without instance_id returns error
- Three valid combinations:
  - device_id + instance_id: clear specific instance
  - only instance_id: clear instance across devices
  - no params: clear all instances

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
admin
2026-05-28 18:20:33 +08:00
parent ab3f188c04
commit 008e66f84e
1 changed files with 20 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/internal/router/app/user.go
+9 -15
View File
@@ -51,6 +51,12 @@ func handleAppLogout(c *gin.Context) {
return
}
// 只有 device_id 没有 instance_id 时提示错误
if req.DeviceID != "" && req.InstanceID == "" {
response.Error(c, 400, "缺少 instance_id 参数")
return
}
// 获取用户在该应用下的所有设备
var devices []model.UserDevice
if err := database.DB.Where("user_id = ? AND application_id = ?", userID, app.ID).Find(&devices).Error; err != nil {
@@ -64,16 +70,14 @@ func handleAppLogout(c *gin.Context) {
}
deviceIDs := make([]uint, len(devices))
deviceMap := make(map[uint]string)
for i, d := range devices {
deviceIDs[i] = d.ID
deviceMap[d.ID] = d.DeviceID
}
var deletedCount int64
if req.DeviceID != "" {
// 找到指定的设备
if req.InstanceID != "" && req.DeviceID != "" {
// 清除指定设备的指定实例
var targetDeviceID uint
for _, d := range devices {
if d.DeviceID == req.DeviceID {
@@ -87,19 +91,10 @@ func handleAppLogout(c *gin.Context) {
return
}
if req.InstanceID != "" {
// 清除指定实例
result := database.DB.Where("device_id = ? AND instance_id = ?", targetDeviceID, req.InstanceID).Delete(&model.DeviceSession{})
deletedCount = result.RowsAffected
log.Printf("[INFO] Logout: deleted session for device %s, instance %s, count %d", req.DeviceID, req.InstanceID, deletedCount)
} else {
// 清除该设备所有实例
result := database.DB.Where("device_id = ?", targetDeviceID).Delete(&model.DeviceSession{})
deletedCount = result.RowsAffected
log.Printf("[INFO] Logout: deleted all sessions for device %s, count %d", req.DeviceID, deletedCount)
}
} else {
if req.InstanceID != "" {
} else if req.InstanceID != "" {
// 清除指定实例（跨设备）
result := database.DB.Where("device_id IN ? AND instance_id = ?", deviceIDs, req.InstanceID).Delete(&model.DeviceSession{})
deletedCount = result.RowsAffected
@@ -110,7 +105,6 @@ func handleAppLogout(c *gin.Context) {
deletedCount = result.RowsAffected
log.Printf("[INFO] Logout: deleted all sessions for user %d, count %d", userID, deletedCount)
}
}
service.LogVerification(c, &app.ID, uintPtr(userID.(uint)), "logout", fmt.Sprintf("用户登出，清除 %d 个实例", deletedCount), req.DeviceID, nil)