登录/注册/OAuth 回调统一走 SetLoginSession，保存前清空 Redis 会话 ID，堵住未授权会话固定。metric 持平 8。

Result: {"status":"keep","total_issues":8,"golint_canonicalheader":0,"golint_errname":0,"golint_errorlint":1,"golint_forcetypeassert":0,"golint_gosec":0,"golint_intrange":0,"golint_modernize":3,"golint_nilnil":3,"golint_perfsprint":0,"golint_prealloc":0,"golint_recvcheck":1,"golint_usestdlibvars":0,"golint_wastedassign":0,"golint_total":8,"eslint_problems":0,"eslint_errors":0,"eslint_warnings":0,"tsc_errors":0,"measure_s":90,"golint_test_testifylint":0,"golint_test_thelper":0,"golint_test_usetesting":0,"golint_test_total":0,"golint_exhaustive":0,"golint_vetx_total":0,"vitest_failed":0,"vitest_total":126}

internal/apps/oauth/handler_callback.go

@@ -176,7 +176,7 @@ func handleCallbackLogin(ctx context.Context, c *gin.Context, source *model.Auth
 
 	user.LastLoginAt = time.Now()
 	_ = repository.UpdateUserLastLoginAt(ctx, user.ID, user.LastLoginAt)
-	if err := setLoginSession(ctx, c, &user); err != nil {
+	if err := SetLoginSession(ctx, c, &user); err != nil {
 		response.AbortInternal(c, err.Error())
 		return
 	}

internal/apps/oauth/session_context.go

@@ -14,6 +14,7 @@ import (
 	"github.com/gin-contrib/sessions"
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
+	gsessions "github.com/gorilla/sessions"
 )
 
 // GetUserIDFromSession 从 Session 中提取用户 ID
@@ -47,13 +48,29 @@ func hashSessionToken(token string) string {
 	return hex.EncodeToString(h.Sum(nil))
 }
 
-func setLoginSession(ctx context.Context, c *gin.Context, user *model.User) error {
+func rotateSessionID(s sessions.Session) {
+	if inner, ok := s.(interface{ Session() *gsessions.Session }); ok {
+		if sess := inner.Session(); sess != nil {
+			sess.ID = ""
+		}
+	}
+}
+
+// SetLoginSession writes the authenticated user into a freshly rotated session.
+func SetLoginSession(ctx context.Context, c *gin.Context, user *model.User, extras ...map[string]any) error {
 	session := sessions.Default(c)
+	session.Clear()
+	rotateSessionID(session)
+
 	session.Set(UserIDKey, user.ID)
 	session.Set(UserNameKey, user.Username)
 	session.Set(PasswordHashKey, user.Password)
+	if len(extras) > 0 {
+		for key, value := range extras[0] {
+			session.Set(key, value)
+		}
+	}
 
-	// 根据系统配置动态设置 Session 过期时间
 	maxAge := config.Config.App.SessionAge
 	isSessionCookie := false
 
@@ -61,7 +78,6 @@ func setLoginSession(ctx context.Context, c *gin.Context, user *model.User) erro
 	if err == nil {
 		switch {
 		case ttlHours == -1:
-			// 永不过期，设置为 10 年
 			maxAge = 10 * 365 * 24 * 3600
 		case ttlHours > 0:
 			maxAge = ttlHours * 3600

internal/apps/user/routers.go

@@ -4,17 +4,14 @@
 package user
 
 import (
-	"context"
 	"net/http"
 	"strings"
 	"time"
 
 	"github.com/Rain-kl/Wavelet/internal/apps/oauth"
-	"github.com/Rain-kl/Wavelet/internal/infra/config"
 	"github.com/Rain-kl/Wavelet/internal/infra/persistence/idgen"
 	"github.com/Rain-kl/Wavelet/internal/listener"
 	"github.com/Rain-kl/Wavelet/internal/model"
-	"github.com/Rain-kl/Wavelet/internal/repository"
 	pkgu "github.com/Rain-kl/Wavelet/pkg/util"
 	"github.com/Rain-kl/Wavelet/internal/shared/response"
 	"github.com/Rain-kl/Wavelet/pkg/logger"
@@ -53,40 +50,6 @@ type updateProfileRequest struct {
 	Location  string `json:"location"`
 }
 
-func setLoginSession(ctx context.Context, c *gin.Context, user *model.User) error {
-	session := sessions.Default(c)
-	session.Set(oauth.UserIDKey, user.ID)
-	session.Set(oauth.UserNameKey, user.Username)
-	session.Set(oauth.PasswordHashKey, user.Password)
-
-	// 根据系统配置动态设置 Session 过期时间
-	maxAge := config.Config.App.SessionAge
-	isSessionCookie := false
-
-	ttlHours, err := repository.GetIntByKey(ctx, model.ConfigKeyLoginSessionTTLHours)
-	if err == nil {
-		switch {
-		case ttlHours == -1:
-			// 永不过期，设置为 10 年
-			maxAge = 10 * 365 * 24 * 3600
-		case ttlHours > 0:
-			maxAge = ttlHours * 3600
-		case ttlHours == 0:
-			isSessionCookie = true
-		}
-	}
-	session.Options(oauth.GetSessionOptions(maxAge))
-
-	if err := session.Save(); err != nil {
-		return err
-	}
-
-	if isSessionCookie {
-		oauth.StripCookieMaxAgeAndExpires(c.Writer.Header(), config.Config.App.SessionCookieName)
-	}
-
-	return nil
-}
 
 // Login 用户密码登录
 // @Summary 用户密码登录
@@ -150,21 +113,18 @@ func Login(c *gin.Context) {
 		}
 	}
 
-	session := sessions.Default(c)
 	needChangePassword := isPlaintext
 
-	if isPlaintext {
-		session.Set("need_change_password", true)
-	} else {
-		session.Delete("need_change_password")
-	}
-
 	user.LastLoginAt = time.Now()
 	if err := updateLastLogin(ctx, user); err != nil {
 		response.AbortBadRequest(c, "更新登录时间失败，请稍后再试")
 		return
 	}
-	if err := setLoginSession(ctx, c, user); err != nil {
+	extras := map[string]any{}
+	if isPlaintext {
+		extras["need_change_password"] = true
+	}
+	if err := oauth.SetLoginSession(ctx, c, user, extras); err != nil {
 		response.AbortBadRequest(c, errSaveSessionFailed)
 		return
 	}
@@ -254,7 +214,7 @@ func Register(c *gin.Context) {
 		return
 	}
 
-	if err := setLoginSession(ctx, c, &user); err != nil {
+	if err := oauth.SetLoginSession(ctx, c, &user); err != nil {
 		response.AbortBadRequest(c, errSaveSessionFailed)
 		return
 	}