完善生产查询与登录权限配置

backend/core/jwt/JwtToken.php

@@ -21,6 +21,7 @@ use Firebase\JWT\ExpiredException;
 use Firebase\JWT\JWT;
 use Firebase\JWT\Key;
 use Firebase\JWT\SignatureInvalidException;
+use app\model\system\Config;
 use UnexpectedValueException;
 
 class JwtToken
@@ -126,7 +127,7 @@ class JwtToken
         $jti = $this->generateJti();
 
         // 生成 Access Token
-        $accessTtl     = $this->config['ttl']['access'] ?? 7200;
+        $accessTtl     = $this->getConfiguredTtl('access', $clientType);
         $accessPayload = $this->buildPayload(
             id: $id,
             client: $clientType,
@@ -137,7 +138,7 @@ class JwtToken
         $accessToken   = $this->makeToken($accessPayload);
 
         // 生成 Refresh Token
-        $refreshTtl     = $this->config['ttl']['refresh'] ?? 604800;
+        $refreshTtl     = $this->getConfiguredTtl('refresh', $clientType);
         $refreshJti     = $this->generateJti();
         $refreshPayload = $this->buildPayload(
             id: $id,
@@ -156,7 +157,7 @@ class JwtToken
             'extra'       => $extraData,
             'login_mode'  => $loginMode,
             'created_at'  => time(),
-        ], $accessTtl);
+        ], max($accessTtl, $refreshTtl));
 
         // 创建 Token 对象
         $fullPayload = array_merge($accessPayload, ['id' => $id]);
@@ -217,7 +218,7 @@ class JwtToken
         $loginMode = $this->config['login_mode'] ?? $oldTokenInfo['login_mode'] ?? LoginMode::MULTI->value;
 
         // 将旧 access_token 和 refresh_token 加入黑名单
-        $blacklistTtl = $this->config['ttl']['refresh'] ?? 604800;
+        $blacklistTtl = $this->getConfiguredTtl('refresh', $clientType);
         if ($oldAccessJti !== '') {
             $this->blacklistStorage->add($oldAccessJti, $blacklistTtl);
             $this->tokenStorage->delete($oldAccessJti);
@@ -288,7 +289,7 @@ class JwtToken
             return null;
         }
 
-        $accessTtl          = $this->config['ttl']['access'] ?? 7200;
+        $accessTtl          = $this->getConfiguredTtl('access', $payload['client'] ?? '');
         $this->currentToken = Token::create($accessToken, '', $accessTtl, $payload);
 
         return $this->currentToken;
@@ -739,6 +740,33 @@ class JwtToken
     /**
      * 构建 Token 载荷
      */
+    protected function getConfiguredTtl(string $type, string $clientType): int
+    {
+        $defaults = $this->config['ttl'] ?? ['access' => 3600, 'refresh' => 604800];
+        $default = (int)($defaults[$type] ?? ($type === 'access' ? 3600 : 604800));
+        $content = Config::query()->where('code', 'auth_token_setting')->where('enabled', 1)->value('content');
+        if (is_string($content)) {
+            $decoded = json_decode($content, true);
+            $content = json_last_error() === JSON_ERROR_NONE ? $decoded : null;
+        }
+        if (!is_array($content)) {
+            return $default;
+        }
+
+        $client = strtolower($clientType);
+        $key = match ($client) {
+            'admin' => $type === 'refresh' ? 'admin_refresh_ttl' : 'admin_access_ttl',
+            'app', 'mobile' => $type === 'refresh' ? 'app_refresh_ttl' : 'app_access_ttl',
+            default => $type === 'refresh' ? 'web_refresh_ttl' : 'web_access_ttl',
+        };
+        if ($type === 'refresh' && !array_key_exists($key, $content)) {
+            $key = 'refresh_ttl';
+        }
+        $value = (int)($content[$key] ?? $default);
+        $minimum = $type === 'refresh' ? 300 : 60;
+        return $value >= $minimum ? $value : $default;
+    }
+
     protected function buildPayload(
         string    $id,
         string    $client,
@@ -749,8 +777,8 @@ class JwtToken
     {
         $now = time();
         $ttl = match ($type) {
-            TokenType::ACCESS => $this->config['ttl']['access'] ?? 7200,
-            TokenType::REFRESH => $this->config['ttl']['refresh'] ?? 604800,
+            TokenType::ACCESS => $this->getConfiguredTtl('access', $client),
+            TokenType::REFRESH => $this->getConfiguredTtl('refresh', $client),
         };
 
         $payload = [