1d7ade9d90
feat: 学校端接口租户隔离修复与Response规范化
...
## 租户隔离修复
- 修复 SchoolCourseController 硬编码 tenantId=1L 的严重 bug
- 为 SchoolClassController 8个接口添加租户验证
- 为 SchoolTeacherController 4个接口添加租户验证
- 为 SchoolStudentController 3个接口添加租户验证
- 为 SchoolParentController 6个接口添加租户验证
- 为 SchoolTaskController 3个接口添加租户验证
- 为 SchoolGrowthController 3个接口添加租户验证
## Map 返回类型改 Response
- SchoolTaskTemplateController: Map → TaskTemplateResponse
- SchoolScheduleController: Map → SchedulePlanResponse
- SchoolPackageController: Map → PackageInfoResponse/PackageUsageResponse
- SchoolSettingsController: Map → SchoolSettingsResponse 等
- SchoolReportController: Map → ReportOverviewResponse 等
## 新增 Response DTO
- PackageInfoResponse, PackageUsageResponse
- SchoolSettingsResponse, BasicSettingsResponse
- NotificationSettingsResponse, SecuritySettingsResponse
- ReportOverviewResponse, TeacherReportResponse
- CourseReportResponse, StudentReportResponse
## 新增 Request DTO
- RenewRequest, SchoolSettingsUpdateRequest
- BasicSettingsUpdateRequest, NotificationSettingsUpdateRequest
- SecuritySettingsUpdateRequest
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-18 00:02:05 +08:00
dfbf89e8fe
feat: 实现多地点登录支持
...
主要变更:
- 修改 JwtTokenRedisService.validateToken() 方法,移除 token 一致性检查
- 在 JwtAuthenticationFilter 中新增 isAccountActive() 方法,每次请求验证账户状态
- 所有状态判断改为忽略大小写 (equalsIgnoreCase)
- 保留黑名单机制用于主动踢人、登出等场景
功能特性:
- 同一账号可以在多个设备/浏览器同时登录
- 各个登录状态的 token 都有效,不会互踢下线
- 支持所有角色:admin, school, teacher, parent
- JWT token 过期时间(默认 24 小时)保证安全性
修改文件:
- JwtTokenRedisService.java
- JwtAuthenticationFilter.java
- AuthServiceImpl.java
文档更新:
- docs/CHANGELOG.md
- docs/dev-logs/2026-03-17.md
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-17 12:13:21 +08:00