feat(songs): 歌曲管理支持批量驳回、投稿留言自动审查与排期范围可见性过滤

- 新增 /api/admin/songs/batch-reject.post 批量驳回接口（事务清排期/投票/扣接纳数/黑名单去重/异步通知）
- requireSongAdmin 三角色校验 + createApiError 统一错误包装
- scheduleDaysBefore/After 四字段排期可见范围限制（开放 API 与公开排期接口三处缓存路径 + DB 条件过滤）
- submissionNoteAutoModeration 基于黑名单 KEYWORD/LANGUAGE/GENRE 自动判定留言 publicStatus，命中自动关闭 submissionNotePublic
- 更新 songs/request.post 与 songs/[id]/update.put 接入自动审查逻辑

server/api/auth/2fa/verify.post.ts

@@ -3,6 +3,7 @@ const { authenticator } = otplib
 import { db, userIdentities, eq, and, users } from '~/drizzle/db'
 import { twoFactorCodes } from '~~/server/utils/twoFactorStore'
 import { JWTEnhanced } from '~~/server/utils/jwt-enhanced'
+import { createAuthSession } from '~~/server/utils/create-auth-session'
 import { getClientIP } from '~~/server/utils/ip-utils'
 import { getBeijingTime } from '~/utils/timeUtils'
 
@@ -100,7 +101,12 @@ export default defineEventHandler(async (event) => {
     .catch((err) => console.error('Error updating user login info:', err))
 
   // 生成Token
-  const authToken = JWTEnhanced.generateToken(user.id, user.role)
+  const { token: authToken, jti } = JWTEnhanced.generateTokenWithJti(user.id, user.role)
+  await createAuthSession(event, {
+    userId: user.id,
+    jti,
+    loginMethod: type === 'totp' ? 'totp_2fa' : 'email_2fa'
+  })
   
   const isSecure =
       getRequestURL(event).protocol === 'https:' ||

server/api/auth/[provider]/callback.get.ts

@@ -2,6 +2,7 @@ import { parseState, getRedirectUri } from '~~/server/utils/oauth'
 import { generateBindingToken } from '~~/server/utils/oauth-token'
 import { db, eq, userIdentities } from '~/drizzle/db'
 import { JWTEnhanced } from '~~/server/utils/jwt-enhanced'
+import { createAuthSession } from '~~/server/utils/create-auth-session'
 import { getOAuthStrategy } from '~~/server/utils/oauth-strategies'
 import { isUserBlocked, getUserBlockRemainingTime } from '~~/server/services/securityService'
 
@@ -142,7 +143,13 @@ async function handleUserLoginOrBind(
     }
 
     // 登录
-    const token = JWTEnhanced.generateToken(existingIdentity.user.id, existingIdentity.user.role)
+    const { token, jti } = JWTEnhanced.generateTokenWithJti(existingIdentity.user.id, existingIdentity.user.role)
+    await createAuthSession(event, {
+      userId: existingIdentity.user.id,
+      jti,
+      loginMethod: 'oauth',
+      oauthProvider: provider
+    })
     setCookie(event, 'auth-token', token, {
       httpOnly: true,
       secure: process.env.NODE_ENV === 'production',

server/api/auth/bind.post.ts

@@ -1,6 +1,7 @@
 import bcrypt from 'bcryptjs'
 import { db, eq, users, userIdentities } from '~/drizzle/db'
 import { JWTEnhanced } from '~~/server/utils/jwt-enhanced'
+import { createAuthSession } from '~~/server/utils/create-auth-session'
 import { verifyBindingToken } from '~~/server/utils/oauth-token'
 import {
   isAccountLocked,
@@ -86,7 +87,13 @@ export default defineEventHandler(async (event) => {
   recordLoginSuccess(username, clientIp)
 
   // 登录
-  const token = JWTEnhanced.generateToken(user.id, user.role)
+  const { token, jti } = JWTEnhanced.generateTokenWithJti(user.id, user.role)
+  await createAuthSession(event, {
+    userId: user.id,
+    jti,
+    loginMethod: 'oauth',
+    oauthProvider: payload.provider
+  })
   setCookie(event, 'auth-token', token, {
     httpOnly: true,
     secure: process.env.NODE_ENV === 'production',

server/api/auth/login.post.ts

@@ -1,6 +1,7 @@
 import bcrypt from 'bcryptjs'
 import { db, eq, users, userIdentities, and } from '~/drizzle/db'
 import { JWTEnhanced } from '~~/server/utils/jwt-enhanced'
+import { createAuthSession } from '~~/server/utils/create-auth-session'
 import {
   getAccountLockRemainingTime,
   getIPBlockRemainingTime,
@@ -187,7 +188,8 @@ export default defineEventHandler(async (event) => {
       .catch((err) => console.error('Error updating user login info:', err))
 
     // 生成JWT
-    const token = JWTEnhanced.generateToken(user.id, user.role)
+    const { token, jti } = JWTEnhanced.generateTokenWithJti(user.id, user.role)
+    await createAuthSession(event, { userId: user.id, jti, loginMethod: 'password' })
 
     // 自动判断是否需要secure
     const isSecure =

server/api/auth/register.post.ts

@@ -1,6 +1,7 @@
 import bcrypt from 'bcryptjs'
 import { db, eq, users } from '~/drizzle/db'
 import { JWTEnhanced } from '~~/server/utils/jwt-enhanced'
+import { createAuthSession } from '~~/server/utils/create-auth-session'
 import { emailVerificationCodes } from '~~/server/api/user/email/send-code.post'
 
 export default defineEventHandler(async (event) => {
@@ -109,7 +110,8 @@ export default defineEventHandler(async (event) => {
   }
 
   // 签发 JWT Token
-  const token = JWTEnhanced.generateToken(newUser.id, newUser.role)
+  const { token, jti } = JWTEnhanced.generateTokenWithJti(newUser.id, newUser.role)
+  await createAuthSession(event, { userId: newUser.id, jti, loginMethod: 'password' })
 
   const isSecure =
     getRequestURL(event).protocol === 'https:' ||

server/api/auth/verify.get.ts

@@ -3,6 +3,7 @@ import { db } from '~/drizzle/db'
 import { users } from '~/drizzle/schema'
 import { executeRedisCommand, isRedisReady } from '../../utils/redis'
 import { eq } from 'drizzle-orm'
+import { isSessionRevokedByJti, touchAuthSession } from '~~/server/utils/create-auth-session'
 
 // 用户认证缓存（永久缓存，登出或权限变更时主动失效）
 
@@ -19,9 +20,17 @@ export default defineEventHandler(async (event) => {
     }
 
     // 验证JWT令牌
-    const decoded = jwt.verify(token, process.env.JWT_SECRET!) as { userId: number }
+    const decoded = jwt.verify(token, process.env.JWT_SECRET!) as { userId: number; jti?: string }
     const userId = decoded.userId
 
+    if (await isSessionRevokedByJti(decoded.jti)) {
+      throw createError({
+        statusCode: 401,
+        statusMessage: '会话已撤销，请重新登录'
+      })
+    }
+    touchAuthSession(decoded.jti).catch(() => undefined)
+
     // 优先从Redis缓存获取用户认证状态
     if (isRedisReady()) {
       const cachedUser = await executeRedisCommand(async () => {

server/api/auth/webauthn/login/verify.post.ts

@@ -4,6 +4,7 @@ import { getWebAuthnConfig } from '~~/server/utils/webauthn-config'
 import { db, eq, and, userIdentities } from '~/drizzle/db'
 import { createError, defineEventHandler, setCookie } from 'h3'
 import { JWTEnhanced } from '~~/server/utils/jwt-enhanced'
+import { createAuthSession } from '~~/server/utils/create-auth-session'
 
 export default defineEventHandler(async (event) => {
   const body = await readBody(event)
@@ -84,7 +85,8 @@ export default defineEventHandler(async (event) => {
         .where(eq(userIdentities.id, identity.id))
 
       // 签发登录 Token
-      const token = JWTEnhanced.generateToken(identity.user.id, identity.user.role)
+      const { token, jti } = JWTEnhanced.generateTokenWithJti(identity.user.id, identity.user.role)
+      await createAuthSession(event, { userId: identity.user.id, jti, loginMethod: 'webauthn' })
       setCookie(event, 'auth-token', token, {
         httpOnly: true,
         secure: process.env.NODE_ENV === 'production',