新功能(#48): 用户封禁链路接入 (#32)

Co-authored-by: multica-agent <github@multica.ai>

go.mod

@@ -82,6 +82,7 @@ require (
 	github.com/alibabacloud-go/tea-utils v1.4.5 // indirect
 	github.com/alibabacloud-go/tea-utils/v2 v2.0.7 // indirect
 	github.com/alibabacloud-go/tea-xml v1.1.3 // indirect
+	github.com/alicebob/miniredis/v2 v2.35.0 // indirect
 	github.com/aliyun/credentials-go v1.3.10 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23 // indirect
@@ -145,6 +146,7 @@ require (
 	github.com/tjfoc/gmsm v1.4.1 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.2.12 // indirect
+	github.com/yuin/gopher-lua v1.1.1 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.29.0 // indirect
 	go.opentelemetry.io/otel/metric v1.29.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.3.1 // indirect

go.sum

@@ -54,6 +54,8 @@ github.com/alibabacloud-go/tea-utils/v2 v2.0.7/go.mod h1:qxn986l+q33J5VkialKMqT/
 github.com/alibabacloud-go/tea-xml v1.1.2/go.mod h1:Rq08vgCcCAjHyRi/M7xlHKUykZCEtyBy9+DPF6GgEu8=
 github.com/alibabacloud-go/tea-xml v1.1.3 h1:7LYnm+JbOq2B+T/B0fHC4Ies4/FofC4zHzYtqw7dgt0=
 github.com/alibabacloud-go/tea-xml v1.1.3/go.mod h1:Rq08vgCcCAjHyRi/M7xlHKUykZCEtyBy9+DPF6GgEu8=
+github.com/alicebob/miniredis/v2 v2.35.0 h1:QwLphYqCEAo1eu1TqPRN2jgVMPBweeQcR21jeqDCONI=
+github.com/alicebob/miniredis/v2 v2.35.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
 github.com/aliyun/credentials-go v1.1.2/go.mod h1:ozcZaMR5kLM7pwtCMEpVmQ242suV6qTJya2bDq4X1Tw=
 github.com/aliyun/credentials-go v1.3.6/go.mod h1:1LxUuX7L5YrZUWzBrRyk0SwSdH4OmPrib8NVePL3fxM=
 github.com/aliyun/credentials-go v1.3.10 h1:45Xxrae/evfzQL9V10zL3xX31eqgLWEaIdCoPipOEQA=
@@ -395,6 +397,8 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.1.30/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=
+github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 h1:TT4fX+nBOA/+LUkobKGW1ydGcn+G3vRw9+g5HwCphpk=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0/go.mod h1:L7UH0GbB0p47T4Rri3uHjbpCFYrVrwc1I25QhNPiGK8=
 go.opentelemetry.io/otel v1.29.0 h1:PdomN/Al4q/lN6iBJEN3AwPvUiHPMlt93c8bqTG5Llw=

internal/config/cacheKey.go

@@ -70,3 +70,6 @@ const RegisterIpKeyPrefix = "register:ip:"
 
 // UserSessionsKeyPrefix per-user sessions zset key prefix
 const UserSessionsKeyPrefix = "auth:user_sessions:"
+
+// UserEnableKeyPrefix user enable state cache key prefix
+const UserEnableKeyPrefix = "user:enable:"

internal/logic/admin/user/kickOfflineByUserDeviceLogic.go

@@ -2,11 +2,7 @@ package user
 
 import (
 	"context"
-	"fmt"
-	"strconv"
-	"strings"
 
-	"github.com/perfect-panel/server/internal/config"
 	"github.com/perfect-panel/server/internal/svc"
 	"github.com/perfect-panel/server/internal/types"
 	"github.com/perfect-panel/server/pkg/logger"
@@ -50,84 +46,11 @@ func (l *KickOfflineByUserDeviceLogic) KickOfflineByUserDevice(req *types.KickOf
 
 // clearAllSessions 清除指定用户的所有会话（通过 SCAN 查找，不依赖 sorted set）
 func (l *KickOfflineByUserDeviceLogic) clearAllSessions(userId int64) {
-	sessionSet := make(map[string]struct{})
+	if err := clearAllSessions(l.ctx, l.svcCtx, userId); err != nil {
-
-	userIDText := strconv.FormatInt(userId, 10)
-	pattern := fmt.Sprintf("%s:*", config.SessionIdKey)
-	var cursor uint64
-	for {
-		keys, nextCursor, scanErr := l.svcCtx.Redis.Scan(l.ctx, cursor, pattern, 200).Result()
-		if scanErr != nil {
-			l.Errorw("扫描会话键失败", logger.Field("user_id", userId), logger.Field("error", scanErr.Error()))
-			break
-		}
-		for _, sessionKey := range keys {
-			value, getErr := l.svcCtx.Redis.Get(l.ctx, sessionKey).Result()
-			if getErr != nil || value != userIDText {
-				continue
-			}
-			sessionID := strings.TrimPrefix(sessionKey, config.SessionIdKey+":")
-			if sessionID == "" || strings.HasPrefix(sessionID, "detail:") {
-				continue
-			}
-			sessionSet[sessionID] = struct{}{}
-		}
-		cursor = nextCursor
-		if cursor == 0 {
-			break
-		}
-	}
-
-	deviceKeySet := make(map[string]struct{})
-	devicePattern := fmt.Sprintf("%s:*", config.DeviceCacheKeyKey)
-	cursor = 0
-	for {
-		keys, nextCursor, scanErr := l.svcCtx.Redis.Scan(l.ctx, cursor, devicePattern, 200).Result()
-		if scanErr != nil {
-			l.Errorw("扫描设备会话映射失败", logger.Field("user_id", userId), logger.Field("error", scanErr.Error()))
-			break
-		}
-		for _, deviceKey := range keys {
-			sessionID, getErr := l.svcCtx.Redis.Get(l.ctx, deviceKey).Result()
-			if getErr != nil {
-				continue
-			}
-			if _, exists := sessionSet[sessionID]; exists {
-				deviceKeySet[deviceKey] = struct{}{}
-			}
-		}
-		cursor = nextCursor
-		if cursor == 0 {
-			break
-		}
-	}
-
-	if len(sessionSet) == 0 {
-		return
-	}
-
-	sessionsKey := fmt.Sprintf("%s%v", config.UserSessionsKeyPrefix, userId)
-	pipe := l.svcCtx.Redis.TxPipeline()
-	for sessionID := range sessionSet {
-		pipe.Del(l.ctx, fmt.Sprintf("%v:%v", config.SessionIdKey, sessionID))
-		pipe.Del(l.ctx, fmt.Sprintf("%s:detail:%s", config.SessionIdKey, sessionID))
-		pipe.ZRem(l.ctx, sessionsKey, sessionID)
-	}
-	pipe.Del(l.ctx, sessionsKey)
-
-	for deviceKey := range deviceKeySet {
-		pipe.Del(l.ctx, deviceKey)
-	}
-
-	if _, err := pipe.Exec(l.ctx); err != nil {
 		l.Errorw("清理会话缓存失败",
 			logger.Field("user_id", userId),
 			logger.Field("error", err.Error()),
 		)
+		return
 	}
-
-	l.Infow("[KickOffline] 管理员踢设备-清除所有Session",
-		logger.Field("user_id", userId),
-		logger.Field("count", len(sessionSet)),
-	)
 }

internal/logic/admin/user/session.go

@@ -0,0 +1,81 @@
+package user
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/perfect-panel/server/internal/config"
+	"github.com/perfect-panel/server/internal/svc"
+)
+
+func clearAllSessions(ctx context.Context, svcCtx *svc.ServiceContext, userID int64) error {
+	userIDText := strconv.FormatInt(userID, 10)
+	sessionSet := make(map[string]struct{})
+
+	pattern := fmt.Sprintf("%s:*", config.SessionIdKey)
+	var cursor uint64
+	for {
+		keys, nextCursor, err := svcCtx.Redis.Scan(ctx, cursor, pattern, 200).Result()
+		if err != nil {
+			return err
+		}
+		for _, sessionKey := range keys {
+			value, err := svcCtx.Redis.Get(ctx, sessionKey).Result()
+			if err != nil || value != userIDText {
+				continue
+			}
+			sessionID := strings.TrimPrefix(sessionKey, config.SessionIdKey+":")
+			if sessionID == "" || strings.HasPrefix(sessionID, "detail:") {
+				continue
+			}
+			sessionSet[sessionID] = struct{}{}
+		}
+		cursor = nextCursor
+		if cursor == 0 {
+			break
+		}
+	}
+
+	if len(sessionSet) == 0 {
+		return nil
+	}
+
+	deviceKeySet := make(map[string]struct{})
+	devicePattern := fmt.Sprintf("%s:*", config.DeviceCacheKeyKey)
+	cursor = 0
+	for {
+		keys, nextCursor, err := svcCtx.Redis.Scan(ctx, cursor, devicePattern, 200).Result()
+		if err != nil {
+			return err
+		}
+		for _, deviceKey := range keys {
+			sessionID, err := svcCtx.Redis.Get(ctx, deviceKey).Result()
+			if err != nil {
+				continue
+			}
+			if _, exists := sessionSet[sessionID]; exists {
+				deviceKeySet[deviceKey] = struct{}{}
+			}
+		}
+		cursor = nextCursor
+		if cursor == 0 {
+			break
+		}
+	}
+
+	sessionsKey := fmt.Sprintf("%s%v", config.UserSessionsKeyPrefix, userID)
+	pipe := svcCtx.Redis.TxPipeline()
+	for sessionID := range sessionSet {
+		pipe.Del(ctx, fmt.Sprintf("%v:%v", config.SessionIdKey, sessionID))
+		pipe.Del(ctx, fmt.Sprintf("%s:detail:%s", config.SessionIdKey, sessionID))
+		pipe.ZRem(ctx, sessionsKey, sessionID)
+	}
+	pipe.Del(ctx, sessionsKey)
+	for deviceKey := range deviceKeySet {
+		pipe.Del(ctx, deviceKey)
+	}
+	_, err := pipe.Exec(ctx)
+	return err
+}

internal/logic/admin/user/session_test.go

@@ -0,0 +1,74 @@
+package user
+
+import (
+	"context"
+	"testing"
+
+	"github.com/alicebob/miniredis/v2"
+	"github.com/perfect-panel/server/internal/config"
+	"github.com/perfect-panel/server/internal/svc"
+	"github.com/redis/go-redis/v9"
+)
+
+func TestClearAllSessions(t *testing.T) {
+	redisServer, err := miniredis.Run()
+	if err != nil {
+		t.Fatalf("miniredis.Run() error = %v", err)
+	}
+	defer redisServer.Close()
+
+	rdb := redis.NewClient(&redis.Options{Addr: redisServer.Addr()})
+	defer rdb.Close()
+
+	svcCtx := &svc.ServiceContext{Redis: rdb}
+	ctx := context.Background()
+
+	userID := int64(42)
+	sessionID := "session-a"
+	otherSessionID := "session-b"
+	userSessionKey := config.SessionIdKey + ":" + sessionID
+	userDetailKey := config.SessionIdKey + ":detail:" + sessionID
+	otherSessionKey := config.SessionIdKey + ":" + otherSessionID
+	userSessionsZSet := config.UserSessionsKeyPrefix + "42"
+	deviceKey := config.DeviceCacheKeyKey + ":device-1"
+	unrelatedDeviceKey := config.DeviceCacheKeyKey + ":device-2"
+
+	setString(t, redisServer, userSessionKey, "42")
+	setString(t, redisServer, userDetailKey, "detail")
+	setString(t, redisServer, otherSessionKey, "99")
+	setString(t, redisServer, deviceKey, sessionID)
+	setString(t, redisServer, unrelatedDeviceKey, otherSessionID)
+	if _, err := redisServer.ZAdd(userSessionsZSet, 1, sessionID); err != nil {
+		t.Fatalf("seed session zset: %v", err)
+	}
+
+	if err := clearAllSessions(ctx, svcCtx, userID); err != nil {
+		t.Fatalf("clearAllSessions() error = %v", err)
+	}
+
+	assertMissing(t, redisServer, userSessionKey)
+	assertMissing(t, redisServer, userDetailKey)
+	assertMissing(t, redisServer, deviceKey)
+	assertMissing(t, redisServer, userSessionsZSet)
+
+	if !redisServer.Exists(otherSessionKey) {
+		t.Fatalf("unrelated session %q should remain", otherSessionKey)
+	}
+	if !redisServer.Exists(unrelatedDeviceKey) {
+		t.Fatalf("unrelated device mapping %q should remain", unrelatedDeviceKey)
+	}
+}
+
+func setString(t *testing.T, server *miniredis.Miniredis, key, value string) {
+	t.Helper()
+	if err := server.Set(key, value); err != nil {
+		t.Fatalf("set %q: %v", key, err)
+	}
+}
+
+func assertMissing(t *testing.T, server *miniredis.Miniredis, key string) {
+	t.Helper()
+	if server.Exists(key) {
+		t.Fatalf("expected key %q to be removed", key)
+	}
+}

internal/logic/admin/user/updateUserBasicInfoLogic.go

@@ -44,6 +44,14 @@ func (l *UpdateUserBasicInfoLogic) UpdateUserBasicInfo(req *types.UpdateUserBasi
 	if req.Avatar != "" && !tool.IsValidImageSize(req.Avatar, 1024) {
 		return errors.Wrapf(xerr.NewErrCode(xerr.ERROR), "Invalid Image Size")
 	}
+	if req.Enable != nil && !*req.Enable {
+		if userInfo.IsAdmin != nil && *userInfo.IsAdmin {
+			return errors.Wrapf(xerr.NewErrCode(xerr.InvalidAccess), "admin user cannot be disabled")
+		}
+		if userInfo.Id == 2 {
+			return errors.Wrapf(xerr.NewErrCode(xerr.InvalidAccess), "demo user cannot be disabled")
+		}
+	}
 
 	err = l.svcCtx.UserModel.Transaction(l.ctx, func(tx *gorm.DB) error {
 		if req.Balance != nil && userInfo.Balance != *req.Balance {
@@ -176,6 +184,19 @@ func (l *UpdateUserBasicInfoLogic) UpdateUserBasicInfo(req *types.UpdateUserBasi
 		}
 		return errors.Wrapf(xerr.NewErrCode(xerr.DatabaseUpdateError), "Update User Error")
 	}
+	if req.Enable != nil {
+		if cacheErr := logicCommon.InvalidateUserEnableCache(l.ctx, l.svcCtx, userInfo.Id); cacheErr != nil {
+			l.Errorw("[UpdateUserBasicInfoLogic] clear enable cache failed", logger.Field("err", cacheErr.Error()), logger.Field("userId", req.UserId))
+		}
+		if !*req.Enable {
+			if sessionErr := clearAllSessions(l.ctx, l.svcCtx, userInfo.Id); sessionErr != nil {
+				l.Errorw("[UpdateUserBasicInfoLogic] clear sessions failed", logger.Field("err", sessionErr.Error()), logger.Field("userId", req.UserId))
+			}
+			for _, device := range userInfo.UserDevices {
+				l.svcCtx.DeviceManager.KickDevice(userInfo.Id, device.Identifier)
+			}
+		}
+	}
 
 	return nil
 }

internal/logic/auth/admin/adminLoginLogic.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/perfect-panel/server/internal/config"
 	"github.com/perfect-panel/server/internal/logic/auth"
+	logiccommon "github.com/perfect-panel/server/internal/logic/common"
 	"github.com/perfect-panel/server/internal/model/log"
 	"github.com/perfect-panel/server/internal/model/user"
 	"github.com/perfect-panel/server/internal/svc"
@@ -19,6 +20,7 @@ import (
 	"github.com/perfect-panel/server/pkg/uuidx"
 	"github.com/perfect-panel/server/pkg/xerr"
 	"github.com/pkg/errors"
+	"github.com/redis/go-redis/v9"
 	"gorm.io/gorm"
 )
 
@@ -94,6 +96,9 @@ func (l *AdminLoginLogic) AdminLogin(req *types.UserLoginRequest) (resp *types.L
 	if !tool.MultiPasswordVerify(userInfo.Algo, userInfo.Salt, req.Password, userInfo.Password) {
 		return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserPasswordError), "user password")
 	}
+	if logiccommon.IsUserDisabled(userInfo) {
+		return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserDisabled), "User disabled")
+	}
 
 	// Bind device to user if identifier is provided
 	if req.Identifier != "" {
@@ -130,6 +135,7 @@ func (l *AdminLoginLogic) AdminLogin(req *types.UserLoginRequest) (resp *types.L
 	if err = l.svcCtx.Redis.Set(l.ctx, sessionIdCacheKey, userInfo.Id, time.Duration(l.svcCtx.Config.JwtAuth.AccessExpire)*time.Second).Err(); err != nil {
 		return nil, errors.Wrapf(xerr.NewErrCode(xerr.ERROR), "set session id error: %v", err.Error())
 	}
+	l.svcCtx.Redis.ZAdd(l.ctx, fmt.Sprintf("%s%d", config.UserSessionsKeyPrefix, userInfo.Id), redis.Z{Score: float64(time.Now().Unix()), Member: sessionId})
 	loginStatus = true
 	return &types.LoginResponse{
 		Token: token,

internal/logic/auth/emailLoginLogic.go

@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"github.com/perfect-panel/server/internal/config"
+	logicCommon "github.com/perfect-panel/server/internal/logic/common"
 	"github.com/perfect-panel/server/internal/model/log"
 	"github.com/perfect-panel/server/internal/model/user"
 	"github.com/perfect-panel/server/internal/svc"
@@ -18,6 +19,7 @@ import (
 	"github.com/perfect-panel/server/pkg/uuidx"
 	"github.com/perfect-panel/server/pkg/xerr"
 	"github.com/pkg/errors"
+	"github.com/redis/go-redis/v9"
 	"gorm.io/gorm"
 )
 
@@ -114,6 +116,9 @@ func (l *EmailLoginLogic) EmailLogin(req *types.EmailLoginRequest) (resp *types.
 			return nil, errors.Wrapf(xerr.NewErrCode(xerr.DatabaseUpdateError), "register failed: %v", err.Error())
 		}
 	}
+	if logicCommon.IsUserDisabled(userInfo) {
+		return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserDisabled), "User disabled")
+	}
 
 	// Record login status
 	defer func() {
@@ -188,6 +193,7 @@ func (l *EmailLoginLogic) EmailLogin(req *types.EmailLoginRequest) (resp *types.
 	if err = l.svcCtx.Redis.Set(l.ctx, sessionIdCacheKey, userInfo.Id, time.Duration(l.svcCtx.Config.JwtAuth.AccessExpire)*time.Second).Err(); err != nil {
 		return nil, errors.Wrapf(xerr.NewErrCode(xerr.ERROR), "set session id error: %v", err.Error())
 	}
+	l.svcCtx.Redis.ZAdd(l.ctx, fmt.Sprintf("%s%d", config.UserSessionsKeyPrefix, userInfo.Id), redis.Z{Score: float64(time.Now().Unix()), Member: sessionId})
 
 	loginStatus = true
 	return &types.LoginResponse{

internal/logic/auth/oauth/oAuthLoginGetTokenLogic.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/perfect-panel/server/internal/config"
 	authlogic "github.com/perfect-panel/server/internal/logic/auth"
+	logiccommon "github.com/perfect-panel/server/internal/logic/common"
 	"github.com/perfect-panel/server/internal/model/auth"
 	"github.com/perfect-panel/server/internal/model/log"
 	"github.com/perfect-panel/server/internal/model/user"
@@ -23,6 +24,7 @@ import (
 	"github.com/perfect-panel/server/pkg/uuidx"
 	"github.com/perfect-panel/server/pkg/xerr"
 	"github.com/pkg/errors"
+	"github.com/redis/go-redis/v9"
 	"gorm.io/gorm"
 )
 
@@ -74,6 +76,9 @@ func (l *OAuthLoginGetTokenLogic) OAuthLoginGetToken(req *types.OAuthLoginGetTok
 	if err != nil {
 		return nil, err
 	}
+	if logiccommon.IsUserDisabled(userInfo) {
+		return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserDisabled), "User disabled")
+	}
 
 	token, err := l.generateToken(userInfo, requestID)
 	if err != nil {
@@ -628,6 +633,7 @@ func (l *OAuthLoginGetTokenLogic) generateToken(userInfo *user.User, requestID s
 		)
 		return "", errors.Wrapf(xerr.NewErrCode(xerr.ERROR), "set session id error: %v", err)
 	}
+	l.svcCtx.Redis.ZAdd(l.ctx, fmt.Sprintf("%s%d", config.UserSessionsKeyPrefix, userInfo.Id), redis.Z{Score: float64(time.Now().Unix()), Member: sessionId})
 
 	l.Infow("jwt token generated successfully",
 		logger.Field("request_id", requestID),

internal/logic/auth/telephoneLoginLogic.go

@@ -21,6 +21,7 @@ import (
 	"github.com/perfect-panel/server/pkg/uuidx"
 	"github.com/perfect-panel/server/pkg/xerr"
 	"github.com/pkg/errors"
+	"github.com/redis/go-redis/v9"
 	"gorm.io/gorm"
 )
 
@@ -64,6 +65,9 @@ func (l *TelephoneLoginLogic) TelephoneLogin(req *types.TelephoneLoginRequest, r
 		}
 		return nil, errors.Wrapf(xerr.NewErrCode(xerr.DatabaseQueryError), "query user info failed: %v", err.Error())
 	}
+	if common.IsUserDisabled(userInfo) {
+		return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserDisabled), "User disabled")
+	}
 	// Record login status
 	defer func(svcCtx *svc.ServiceContext) {
 		if userInfo.Id != 0 {
@@ -165,6 +169,7 @@ func (l *TelephoneLoginLogic) TelephoneLogin(req *types.TelephoneLoginRequest, r
 	if err = l.svcCtx.Redis.Set(l.ctx, sessionIdCacheKey, userInfo.Id, time.Duration(l.svcCtx.Config.JwtAuth.AccessExpire)*time.Second).Err(); err != nil {
 		return nil, errors.Wrapf(xerr.NewErrCode(xerr.ERROR), "set session id error: %v", err.Error())
 	}
+	l.svcCtx.Redis.ZAdd(l.ctx, fmt.Sprintf("%s%d", config.UserSessionsKeyPrefix, userInfo.Id), redis.Z{Score: float64(time.Now().Unix()), Member: sessionId})
 	loginStatus = true
 	return &types.LoginResponse{
 		Token: token,

internal/logic/auth/userLoginLogic.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"time"
 
+	logicCommon "github.com/perfect-panel/server/internal/logic/common"
 	"github.com/perfect-panel/server/internal/model/log"
 	"github.com/perfect-panel/server/pkg/captcha"
 	"github.com/perfect-panel/server/pkg/constant"
@@ -17,6 +18,7 @@ import (
 	"github.com/perfect-panel/server/pkg/uuidx"
 	"github.com/perfect-panel/server/pkg/xerr"
 	"github.com/pkg/errors"
+	"github.com/redis/go-redis/v9"
 	"gorm.io/gorm"
 
 	"github.com/perfect-panel/server/internal/svc"
@@ -89,6 +91,9 @@ func (l *UserLoginLogic) UserLogin(req *types.UserLoginRequest) (resp *types.Log
 	if !tool.MultiPasswordVerify(userInfo.Algo, userInfo.Salt, req.Password, userInfo.Password) {
 		return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserPasswordError), "user password")
 	}
+	if logicCommon.IsUserDisabled(userInfo) {
+		return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserDisabled), "User disabled")
+	}
 
 	// Update last login time
 	now := time.Now()
@@ -135,6 +140,7 @@ func (l *UserLoginLogic) UserLogin(req *types.UserLoginRequest) (resp *types.Log
 	if err = l.svcCtx.Redis.Set(l.ctx, sessionIdCacheKey, userInfo.Id, time.Duration(l.svcCtx.Config.JwtAuth.AccessExpire)*time.Second).Err(); err != nil {
 		return nil, errors.Wrapf(xerr.NewErrCode(xerr.ERROR), "set session id error: %v", err.Error())
 	}
+	l.svcCtx.Redis.ZAdd(l.ctx, fmt.Sprintf("%s%d", config.UserSessionsKeyPrefix, userInfo.Id), redis.Z{Score: float64(time.Now().Unix()), Member: sessionId})
 	loginStatus = true
 	return &types.LoginResponse{
 		Token: token,

internal/logic/auth/userRegisterLogic.go

@@ -101,7 +101,7 @@ func (l *UserRegisterLogic) UserRegister(req *types.UserRegisterRequest) (resp *
 	} else if err == nil && !u.DeletedAt.Valid {
 		return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserExist), "user email exist: %v", req.Email)
 	} else if err == nil && u.DeletedAt.Valid {
-		return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserDisabled), "user email deleted: %v", req.Email)
+		return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserNotExist), "user email deleted: %v", req.Email)
 	}
 
 	if !registerIpLimit(l.svcCtx, l.ctx, req.IP, "email", req.Email) {

internal/logic/common/user_enable.go

@@ -0,0 +1,89 @@
+package common
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+	"time"
+
+	"github.com/perfect-panel/server/internal/config"
+	modeluser "github.com/perfect-panel/server/internal/model/user"
+	"github.com/perfect-panel/server/internal/svc"
+	"github.com/perfect-panel/server/pkg/logger"
+	"github.com/perfect-panel/server/pkg/xerr"
+	"github.com/pkg/errors"
+	"github.com/redis/go-redis/v9"
+)
+
+const userEnableCacheTTL = 30 * time.Second
+
+func UserEnableCacheKey(userID int64) string {
+	return fmt.Sprintf("%s%d", config.UserEnableKeyPrefix, userID)
+}
+
+func IsUserDisabled(userInfo *modeluser.User) bool {
+	return userInfo != nil && userInfo.Enable != nil && !*userInfo.Enable
+}
+
+func ResolveEnabledUser(ctx context.Context, svcCtx *svc.ServiceContext, userID int64) (*modeluser.User, error) {
+	if userID <= 0 {
+		return nil, errors.Wrapf(xerr.NewErrCode(xerr.InvalidAccess), "invalid user id: %d", userID)
+	}
+
+	cacheKey := UserEnableCacheKey(userID)
+	cached, err := svcCtx.Redis.Get(ctx, cacheKey).Result()
+	if err == nil {
+		if cached == strconv.FormatBool(false) {
+			return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserDisabled), "User disabled")
+		}
+		return svcCtx.UserModel.FindOne(ctx, userID)
+	}
+	if err != nil && err != redis.Nil {
+		logger.WithContext(ctx).Errorw("get user enable cache failed, fallback to db",
+			logger.Field("user_id", userID),
+			logger.Field("error", err.Error()),
+		)
+		return loadEnabledUserFromDB(ctx, svcCtx, userID)
+	}
+
+	userInfo, err := svcCtx.UserModel.FindOne(ctx, userID)
+	if err != nil {
+		return nil, err
+	}
+
+	if cacheErr := CacheUserEnabled(ctx, svcCtx, userID, !IsUserDisabled(userInfo)); cacheErr != nil {
+		logger.WithContext(ctx).Errorw("cache user enable state failed",
+			logger.Field("user_id", userID),
+			logger.Field("error", cacheErr.Error()),
+		)
+	}
+	if IsUserDisabled(userInfo) {
+		return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserDisabled), "User disabled")
+	}
+	return userInfo, nil
+}
+
+func CacheUserEnabled(ctx context.Context, svcCtx *svc.ServiceContext, userID int64, enabled bool) error {
+	return svcCtx.Redis.Set(ctx, UserEnableCacheKey(userID), strconv.FormatBool(enabled), userEnableCacheTTL).Err()
+}
+
+func InvalidateUserEnableCache(ctx context.Context, svcCtx *svc.ServiceContext, userID int64) error {
+	return svcCtx.Redis.Del(ctx, UserEnableCacheKey(userID)).Err()
+}
+
+func loadEnabledUserFromDB(ctx context.Context, svcCtx *svc.ServiceContext, userID int64) (*modeluser.User, error) {
+	var userInfo modeluser.User
+	if err := svcCtx.DB.WithContext(ctx).
+		Model(&modeluser.User{}).
+		Unscoped().
+		Where("`id` = ?", userID).
+		Preload("UserDevices").
+		Preload("AuthMethods").
+		First(&userInfo).Error; err != nil {
+		return nil, err
+	}
+	if IsUserDisabled(&userInfo) {
+		return nil, errors.Wrapf(xerr.NewErrCode(xerr.UserDisabled), "User disabled")
+	}
+	return &userInfo, nil
+}

internal/logic/common/user_enable_test.go

@@ -0,0 +1,266 @@
+package common
+
+import (
+	"context"
+	"errors"
+	"regexp"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/alicebob/miniredis/v2"
+	"github.com/perfect-panel/server/internal/model/user"
+	"github.com/perfect-panel/server/internal/svc"
+	"github.com/perfect-panel/server/pkg/xerr"
+	"github.com/redis/go-redis/v9"
+	"gorm.io/driver/mysql"
+	"gorm.io/gorm"
+	"gorm.io/gorm/schema"
+)
+
+func TestIsUserDisabled(t *testing.T) {
+	trueValue := true
+	falseValue := false
+
+	testCases := []struct {
+		name string
+		user *user.User
+		want bool
+	}{
+		{
+			name: "nil user treated as enabled",
+			user: nil,
+			want: false,
+		},
+		{
+			name: "nil enable treated as enabled",
+			user: &user.User{Id: 1},
+			want: false,
+		},
+		{
+			name: "enabled user",
+			user: &user.User{Id: 2, Enable: &trueValue},
+			want: false,
+		},
+		{
+			name: "disabled user",
+			user: &user.User{Id: 3, Enable: &falseValue},
+			want: true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := IsUserDisabled(tc.user); got != tc.want {
+				t.Fatalf("IsUserDisabled() = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestResolveEnabledUser(t *testing.T) {
+	t.Run("cache hit false returns disabled error without db query", func(t *testing.T) {
+		svcCtx, mock, redisServer := newEnableTestServiceContext(t)
+		defer redisServer.Close()
+
+		ctx := context.Background()
+		if err := svcCtx.Redis.Set(ctx, UserEnableCacheKey(9), "false", 0).Err(); err != nil {
+			t.Fatalf("seed redis: %v", err)
+		}
+
+		_, err := ResolveEnabledUser(ctx, svcCtx, 9)
+		assertCodeError(t, err, xerr.UserDisabled)
+		if err := mock.ExpectationsWereMet(); err != nil {
+			t.Fatalf("unexpected db query: %v", err)
+		}
+	})
+
+	t.Run("cache miss loads enabled user and backfills cache", func(t *testing.T) {
+		svcCtx, mock, redisServer := newEnableTestServiceContext(t)
+		defer redisServer.Close()
+
+		expectFindOne(mock, 11, true)
+
+		ctx := context.Background()
+		userInfo, err := ResolveEnabledUser(ctx, svcCtx, 11)
+		if err != nil {
+			t.Fatalf("ResolveEnabledUser() error = %v", err)
+		}
+		if userInfo.Id != 11 {
+			t.Fatalf("ResolveEnabledUser() user id = %d, want 11", userInfo.Id)
+		}
+
+		cached, err := svcCtx.Redis.Get(ctx, UserEnableCacheKey(11)).Result()
+		if err != nil {
+			t.Fatalf("read backfilled cache: %v", err)
+		}
+		if cached != "true" {
+			t.Fatalf("backfilled cache = %q, want %q", cached, "true")
+		}
+
+		if err := mock.ExpectationsWereMet(); err != nil {
+			t.Fatalf("db expectations: %v", err)
+		}
+	})
+
+	t.Run("cache miss loads disabled user and caches false", func(t *testing.T) {
+		svcCtx, mock, redisServer := newEnableTestServiceContext(t)
+		defer redisServer.Close()
+
+		expectFindOne(mock, 13, false)
+
+		ctx := context.Background()
+		_, err := ResolveEnabledUser(ctx, svcCtx, 13)
+		assertCodeError(t, err, xerr.UserDisabled)
+
+		cached, cacheErr := svcCtx.Redis.Get(ctx, UserEnableCacheKey(13)).Result()
+		if cacheErr != nil {
+			t.Fatalf("read disabled cache: %v", cacheErr)
+		}
+		if cached != "false" {
+			t.Fatalf("disabled cache = %q, want %q", cached, "false")
+		}
+
+		if err := mock.ExpectationsWereMet(); err != nil {
+			t.Fatalf("db expectations: %v", err)
+		}
+	})
+
+	t.Run("redis failure falls back to db", func(t *testing.T) {
+		svcCtx, mock, redisServer := newEnableTestServiceContext(t)
+		expectFindOne(mock, 17, true)
+		redisServer.Close()
+
+		userInfo, err := ResolveEnabledUser(context.Background(), svcCtx, 17)
+		if err != nil {
+			t.Fatalf("ResolveEnabledUser() error = %v", err)
+		}
+		if userInfo.Id != 17 {
+			t.Fatalf("ResolveEnabledUser() user id = %d, want 17", userInfo.Id)
+		}
+
+		if err := mock.ExpectationsWereMet(); err != nil {
+			t.Fatalf("db expectations: %v", err)
+		}
+	})
+}
+
+func newEnableTestServiceContext(t *testing.T) (*svc.ServiceContext, sqlmock.Sqlmock, *miniredis.Miniredis) {
+	t.Helper()
+
+	sqlDB, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("sqlmock.New() error = %v", err)
+	}
+	mock.MatchExpectationsInOrder(false)
+	t.Cleanup(func() {
+		_ = sqlDB.Close()
+	})
+
+	gdb, err := gorm.Open(mysql.New(mysql.Config{
+		Conn:                      sqlDB,
+		SkipInitializeWithVersion: true,
+	}), &gorm.Config{
+		NamingStrategy: schema.NamingStrategy{SingularTable: true},
+	})
+	if err != nil {
+		t.Fatalf("gorm.Open() error = %v", err)
+	}
+
+	redisServer, err := miniredis.Run()
+	if err != nil {
+		t.Fatalf("miniredis.Run() error = %v", err)
+	}
+
+	rdb := redis.NewClient(&redis.Options{Addr: redisServer.Addr()})
+	t.Cleanup(func() {
+		_ = rdb.Close()
+	})
+
+	return &svc.ServiceContext{
+		DB:        gdb,
+		Redis:     rdb,
+		UserModel: user.NewModel(gdb, rdb),
+	}, mock, redisServer
+}
+
+func expectFindOne(mock sqlmock.Sqlmock, userID int64, enabled bool) {
+	rows := sqlmock.NewRows([]string{
+		"id",
+		"password",
+		"algo",
+		"salt",
+		"avatar",
+		"balance",
+		"refer_code",
+		"referer_id",
+		"commission",
+		"referral_percentage",
+		"only_first_purchase",
+		"gift_amount",
+		"enable",
+		"is_admin",
+		"enable_balance_notify",
+		"enable_login_notify",
+		"enable_subscribe_notify",
+		"enable_trade_notify",
+		"rules",
+		"member_status",
+		"remark",
+		"last_login_time",
+		"created_at",
+		"updated_at",
+		"deleted_at",
+	}).AddRow(
+		userID,
+		"pwd",
+		"default",
+		"",
+		"",
+		int64(0),
+		"",
+		int64(0),
+		int64(0),
+		uint8(0),
+		true,
+		int64(0),
+		enabled,
+		false,
+		false,
+		false,
+		false,
+		false,
+		"",
+		"",
+		"",
+		nil,
+		nil,
+		nil,
+		nil,
+	)
+
+	mock.ExpectQuery(regexp.QuoteMeta("SELECT * FROM `user` WHERE `id` = ? ORDER BY `user`.`id` LIMIT ?")).
+		WithArgs(userID, 1).
+		WillReturnRows(rows)
+	mock.ExpectQuery(regexp.QuoteMeta("SELECT * FROM `user_device` WHERE `user_device`.`user_id` = ?")).
+		WithArgs(userID).
+		WillReturnRows(sqlmock.NewRows([]string{"id", "user_id", "identifier"}))
+	mock.ExpectQuery(regexp.QuoteMeta("SELECT * FROM `user_auth_methods` WHERE `user_auth_methods`.`user_id` = ?")).
+		WithArgs(userID).
+		WillReturnRows(sqlmock.NewRows([]string{"id", "user_id", "auth_type", "auth_identifier", "verified"}))
+}
+
+func assertCodeError(t *testing.T, err error, wantCode uint32) {
+	t.Helper()
+
+	if err == nil {
+		t.Fatal("expected error, got nil")
+	}
+
+	var codeErr *xerr.CodeError
+	if !errors.As(err, &codeErr) {
+		t.Fatalf("error %T does not contain xerr.CodeError: %v", err, err)
+	}
+	if codeErr.GetErrCode() != wantCode {
+		t.Fatalf("error code = %d, want %d", codeErr.GetErrCode(), wantCode)
+	}
+}

internal/logic/subscribe/subscribeLogic.go

@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"github.com/perfect-panel/server/adapter"
+	logiccommon "github.com/perfect-panel/server/internal/logic/common"
 	"github.com/perfect-panel/server/internal/model/client"
 	"github.com/perfect-panel/server/internal/model/group"
 	"github.com/perfect-panel/server/internal/model/log"
@@ -79,6 +80,10 @@ func (l *SubscribeLogic) Handler(req *types.SubscribeRequest) (resp *types.Subsc
 		l.Errorw("[SubscribeLogic] Get user subscribe failed", logger.Field("error", err.Error()), logger.Field("token", req.Token))
 		return nil, err
 	}
+	if _, err := logiccommon.ResolveEnabledUser(l.ctx.Request.Context(), l.svc, userSubscribe.UserId); err != nil {
+		l.Errorw("[SubscribeLogic] User disabled", logger.Field("error", err.Error()), logger.Field("userId", userSubscribe.UserId))
+		return nil, err
+	}
 
 	var subscribeStatus = false
 	defer func() {

internal/middleware/authMiddleware.go

@@ -6,6 +6,7 @@ import (
 	"strings"
 	"time"
 
+	logiccommon "github.com/perfect-panel/server/internal/logic/common"
 	"github.com/perfect-panel/server/pkg/constant"
 
 	"github.com/perfect-panel/server/pkg/logger"
@@ -87,10 +88,10 @@ func authenticateRequest(c *gin.Context, svc *svc.ServiceContext, token string,
 
 	svc.Redis.Expire(c, sessionIdCacheKey, time.Duration(svc.Config.JwtAuth.AccessExpire)*time.Second)
 
-	userInfo, err := svc.UserModel.FindOne(c, userId)
+	userInfo, err := logiccommon.ResolveEnabledUser(c, svc, userId)
 	if err != nil {
-		logger.WithContext(c.Request.Context()).Debug("[AuthMiddleware] UserModel FindOne", logger.Field("error", err.Error()), logger.Field("userId", userId))
+		logger.WithContext(c.Request.Context()).Debug("[AuthMiddleware] ResolveEnabledUser", logger.Field("error", err.Error()), logger.Field("userId", userId))
-		result.HttpResult(c, nil, errors.Wrapf(xerr.NewErrCode(xerr.DatabaseQueryError), "Database Query Error"))
+		result.HttpResult(c, nil, err)
 		c.Abort()
 		return false
 	}