登录子系统：OIDC 统一自签 token + 吊销即时生效 + 设备并入会话列表 + 应用内扫码 + 禁则修复

接续 90a3790（扫码 A0+A1+B + step-up 雏形）。蓝本见 AUTH.md。

OIDC 统一到 cdrop 自签 token
- /auth/exchange 先 JWKS 验 id_token 签名（自签 token 的唯一信任锚）再签 cdrop
  自签 HS256 access token（绑 sid），不再把 IdP RS256 下发浏览器；验签失败仅告警
  并回退 RS256（会话仍建、下次 refresh 自愈），登录不中断
- /auth/refresh oidc 路径仍打 IdP 轮换 refresh_token + 探测 IdP 侧吊销，但同样回
  自签 token；createWebSession 改返回行 id
- verify 链保留 RS256 分支仅供桌面端 loopback（其即时吊销留后续）

吊销即时生效 + 被吊销设备自知回退
- verifySelfToken 每请求按 sid 查 web_sessions 行，行删即拒 → 吊销在被吊销设备
  下一次请求即生效（不等 TTL），oidc / self / guest 一致
- 前端仅在「服务端以 401 确证会话失效」时 forceLogout 清登录态、回登录页；短期连接
  失败（5xx / 网络）一律保留登录态（refreshTokens 改三态 refreshed/invalid/transient，
  cookieRefresh 改 discriminated 结果）
- __root 反应式守卫：prod 下失登录态且非认证路由即跳登录页；新增 auth.sessionLost.* 三语

设备列表并入会话列表 + 孤儿自动清除
- GET /api/auth/sessions 统一 web_sessions 与原生客户端设备（桌面 / iOS，自 devices
  登记表呈现，native=true，离线也列）；同名不重复列出，排除 shortcut 与无会话 browser
- 吊销网页会话连带删其设备登记（无同名在用会话时）；原生「登出」走
  DELETE /api/devices/{name}（同要求 step-up）
- 新增 DeleteOrphanBrowserDevices（browser 型且无存活 web_session），接入设备清扫器（1h）

应用内扫码 + 聚珍崩溃 / CJK 禁则修复
- 登录页内置 getUserMedia + jsqr 扫码，不再外跳系统应用（避免开错浏览器）
- 修聚珍（cjk-autospace）MutationObserver 与 React 重渲染同子树冲突致的 insertBefore
  崩溃：扫码 / 显码 / 批准三状态机页整页跳过聚珍（data-jz-skip）
- 修流动正文未跑 CJK 禁则（jinze 为段落级、须 opt-in）：设置 / 快捷指令 / 桌面页一批
  hint 补 data-jz-level="paragraph" + justify，短标签 / 状态仍留文本级

step-up 完善
- auth_time 改可选（Casdoor 不下发，原强制致死循环）；stepped_up_at 按会话绑定、
  StepUpMaxAgeSeconds 窗口内不复要求；新增 POST /api/auth/stepup
- 批准页 persist 编进 step-up returnTo 防整页跳转丢失；scope 随档绑定（信任=full /
  仅此次=guest），默认偏安全的「仅此次」

文档与测试
- AUTH.md：折中架构、accounts 薄表、令牌架构、扫码流程、step-up、§4.4 统一会话列表
- 新增 Go 测试：OIDC 自签验证、verifySelfToken 吊销即拒、会话吊销连带删设备、
  统一会话列表（含原生 / 不含 shortcut / 不重复）、孤儿清扫、删设备需 step-up

internal/jwtauth/devices.go

@@ -11,10 +11,14 @@ import (
 // DeviceSweepInterval is how often the device sweeper wakes up.
 const DeviceSweepInterval = 1 * time.Hour
 
-// RunDeviceSweeper deletes devices whose last_seen is older than ttl.
-// Per user requirement: device registration must not outlive the longest
-// valid refresh_token (brief §2: 196h sliding window). Anything ≤ TTL is fine;
-// 0 disables the sweeper.
+// RunDeviceSweeper prunes the devices table on a timer so it stays aligned with
+// the session list (AUTH.md §4): it drops (1) devices whose last_seen is older
+// than ttl — registration must not outlive the longest valid refresh_token
+// (brief §2: 196h sliding window) — and (2) browser devices whose web_session is
+// gone (revoked or expired), which would otherwise linger until the stale cutoff
+// now that users can no longer remove devices by hand. Native and shortcut
+// devices keep no web_session and are pruned by the stale cutoff only. ttl ≤ 0
+// disables the sweeper.
 func RunDeviceSweeper(ctx context.Context, queries *db.Queries, ttl time.Duration) {
 	if ttl <= 0 {
 		slog.Info("device sweeper disabled (ttl <= 0)")
@@ -29,10 +33,14 @@ func RunDeviceSweeper(ctx context.Context, queries *db.Queries, ttl time.Duratio
 		case <-ctx.Done():
 			return
 		case <-t.C:
-			cutoff := time.Now().Add(-ttl).Unix()
+			now := time.Now()
+			cutoff := now.Add(-ttl).Unix()
 			if err := queries.DeleteStaleDevices(ctx, cutoff); err != nil {
 				slog.Error("device sweeper failed", "err", err)
 			}
+			if _, err := queries.DeleteOrphanBrowserDevices(ctx, now.Unix()); err != nil {
+				slog.Error("device sweeper: orphan browser cleanup failed", "err", err)
+			}
 		}
 	}
 }

internal/jwtauth/middleware.go

@@ -19,13 +19,16 @@ import (
 	"commilitia.net/cdrop/internal/db"
 )
 
-// Store is the subset of *db.Queries the auth middleware uses: device upserts
-// plus the shortcut-token lookups needed to honour revocation. Declared as an
-// interface so tests can swap in a fake.
+// Store is the subset of *db.Queries the auth middleware uses: device upserts,
+// the shortcut-token lookups needed to honour revocation, and the web_session
+// lookup that makes a self-signed session token's revocation take effect at once
+// (a deleted row → the token is rejected on its next request, not after TTL).
+// Declared as an interface so tests can swap in a fake.
 type Store interface {
 	UpsertDevice(ctx context.Context, arg db.UpsertDeviceParams) error
 	GetShortcutToken(ctx context.Context, jti string) (db.ShortcutToken, error)
 	TouchShortcutTokenUsed(ctx context.Context, arg db.TouchShortcutTokenUsedParams) error
+	GetWebSession(ctx context.Context, id string) (db.WebSession, error)
 }
 
 type Authenticator struct {
@@ -108,7 +111,7 @@ func (a *Authenticator) verify(ctx context.Context, token string, r *http.Reques
 	// cdrop self-signed session tokens first: distinct key + typ=session, so a
 	// shortcut token (different key, requires jti) never validates here and a
 	// session token never falls through to the shortcut path's DB lookup.
-	if c, err := a.verifySelfToken(token); err == nil {
+	if c, err := a.verifySelfToken(ctx, token); err == nil {
 		return c, nil
 	}
 	if c, err := a.verifyHS256(ctx, token); err == nil {
@@ -119,9 +122,13 @@ func (a *Authenticator) verify(ctx context.Context, token string, r *http.Reques
 
 // verifySelfToken validates a cdrop self-signed session access token (AUTH.md
 // §3.1): HS256 over DeriveSessionTokenKey, carrying typ=session and a full/guest
-// scope. Stateless by design — no DB lookup, so it stays cheap on every request;
-// revocation rides the short TTL (the session row is re-checked at /auth/refresh).
-func (a *Authenticator) verifySelfToken(token string) (*Claims, error) {
+// scope. This is the unified browser token — scan-login (self/guest) AND OIDC web
+// logins both ride it now, so the browser holds one token type. After the cheap
+// signature/exp/scope checks it does ONE indexed lookup of the token's sid against
+// web_sessions: a deleted row means the session was revoked, and the token is
+// rejected on its very next request (immediate "log out this device"). The IdP
+// RS256 path (verifyRS256) remains only for the desktop client's loopback tokens.
+func (a *Authenticator) verifySelfToken(ctx context.Context, token string) (*Claims, error) {
 	if len(a.sessionTokenKey) == 0 {
 		return nil, errors.New("session token key not configured")
 	}
@@ -147,6 +154,16 @@ func (a *Authenticator) verifySelfToken(token string) (*Claims, error) {
 	if scope != "full" && scope != "guest" {
 		return nil, errors.New("session token invalid scope")
 	}
+	// Bind the token to its live web_session row (sid): once that row is revoked
+	// (deleted), the token is rejected on its very next request — "log out this
+	// device" takes effect immediately rather than after the access token's TTL.
+	sid, _ := custom["sid"].(string)
+	if sid == "" {
+		return nil, errors.New("session token missing sid")
+	}
+	if _, err := a.store.GetWebSession(ctx, sid); err != nil {
+		return nil, errors.New("session revoked")
+	}
 	return &Claims{UserID: std.Subject, SessionScope: scope}, nil
 }
 
@@ -265,8 +282,9 @@ func (a *Authenticator) verifyRS256(ctx context.Context, token string) (*Claims,
 
 // VerifyIDToken validates an OIDC id_token (RS256 via JWKS, issuer + audience)
 // from a fresh prompt=login exchange and returns its subject and auth_time (the
-// epoch second of the actual end-user authentication). Used for step-up re-auth
-// (AUTH.md §6): the caller checks sub matches and auth_time is recent enough.
+// epoch second of the actual end-user authentication, or 0 when the IdP omits the
+// claim — Casdoor does). Used for step-up re-auth (AUTH.md §6): the caller checks
+// sub matches and, only when auth_time is present, that it is recent enough.
 func (a *Authenticator) VerifyIDToken(ctx context.Context, token string) (subject string, authTime int64, err error) {
 	if a.jwks == nil {
 		return "", 0, errors.New("JWKS not configured")
@@ -300,10 +318,10 @@ func (a *Authenticator) VerifyIDToken(ctx context.Context, token string) (subjec
 	if std.Subject == "" {
 		return "", 0, errors.New("missing subject claim")
 	}
-	at, ok := numericClaim(custom["auth_time"])
-	if !ok {
-		return "", 0, errors.New("missing auth_time claim")
-	}
+	// auth_time is OPTIONAL: required by OIDC only when the IdP chooses to honour
+	// max_age, and Casdoor omits it entirely. Absent → 0; the caller treats the
+	// fresh single-use prompt=login code as the freshness bound instead.
+	at, _ := numericClaim(custom["auth_time"])
 	return std.Subject, at, nil
 }
 

internal/jwtauth/middleware_test.go

@@ -22,9 +22,10 @@ import (
 // shortcut-token lookups from an in-memory map (empty → "not found", so plain
 // device-only tests are unaffected).
 type fakeDeviceUpserter struct {
-	calls  []db.UpsertDeviceParams
-	err    error
-	tokens map[string]db.ShortcutToken
+	calls       []db.UpsertDeviceParams
+	err         error
+	tokens      map[string]db.ShortcutToken
+	revokedSIDs map[string]bool
 }
 
 func (f *fakeDeviceUpserter) UpsertDevice(_ context.Context, arg db.UpsertDeviceParams) error {
@@ -45,6 +46,15 @@ func (f *fakeDeviceUpserter) TouchShortcutTokenUsed(_ context.Context, _ db.Touc
 	return nil
 }
 
+// GetWebSession backs the self-token revocation check. revokedSIDs lets a test
+// simulate a revoked session (deleted row); any other sid resolves to a live row.
+func (f *fakeDeviceUpserter) GetWebSession(_ context.Context, id string) (db.WebSession, error) {
+	if f.revokedSIDs[id] {
+		return db.WebSession{}, sql.ErrNoRows
+	}
+	return db.WebSession{ID: id, UserID: "user-x"}, nil
+}
+
 // echo handler that responds with the claims+device discovered in context.
 func echoMe(w http.ResponseWriter, r *http.Request) {
 	claims, _ := ClaimsFromContext(r.Context())
@@ -489,6 +499,26 @@ func TestSanitizeDeviceName(t *testing.T) {
 	}
 }
 
+// A self-signed session token is bound to its web_session row: once the row is
+// revoked (deleted), the token is rejected on its next request even though it is
+// still cryptographically valid and unexpired — "log out this device" is immediate
+// (AUTH.md §1/§3.1).
+func TestSelfToken_RejectedAfterSessionRevoked(t *testing.T) {
+	secret := "test-session-secret-at-least-32-bytes-long"
+	exp := time.Now().Add(time.Hour)
+
+	live := New(&config.Config{AuthMode: "prod", SessionSecret: secret}, &fakeDeviceUpserter{})
+	if c, _ := serveBearer(live, signSelfToken(t, secret, "user-x", "session", "full", exp)); c != http.StatusOK {
+		t.Fatalf("token with a live session: got %d, want 200", c)
+	}
+
+	revoked := New(&config.Config{AuthMode: "prod", SessionSecret: secret},
+		&fakeDeviceUpserter{revokedSIDs: map[string]bool{"test-sid": true}})
+	if c, _ := serveBearer(revoked, signSelfToken(t, secret, "user-x", "session", "full", exp)); c != http.StatusUnauthorized {
+		t.Errorf("token whose session was revoked must be rejected, got %d", c)
+	}
+}
+
 // signSelfToken mints a cdrop self-signed session token the way httpapi.mintSessionToken
 // does: HS256 over DeriveSessionTokenKey, with typ + scope custom claims and no jti.
 func signSelfToken(t *testing.T, secret, sub, typ, scope string, exp time.Time) string {
@@ -505,7 +535,7 @@ func signSelfToken(t *testing.T, secret, sub, typ, scope string, exp time.Time)
 		IssuedAt: jwt.NewNumericDate(time.Now()),
 		Expiry:   jwt.NewNumericDate(exp),
 	}
-	tok, err := jwt.Signed(sig).Claims(std).Claims(map[string]any{"typ": typ, "scope": scope}).Serialize()
+	tok, err := jwt.Signed(sig).Claims(std).Claims(map[string]any{"typ": typ, "scope": scope, "sid": "test-sid"}).Serialize()
 	if err != nil {
 		t.Fatalf("serialize: %v", err)
 	}