CSCITech · Aug 30, 2026 · Aug 26, 2026 · Aug 26, 2026 · Aug 27, 2026 · Aug 27, 2026
diff --git a/constant/midjourney.go b/constant/midjourney.go
@@ -5,6 +5,8 @@ const (
 	MjRequestError = 4
 )
 
+const MjBillingSettlementPending = "billing_settlement_pending"
+
 const (
 	MjActionImagine       = "IMAGINE"
 	MjActionDescribe      = "DESCRIBE"

diff --git a/controller/midjourney_test.go b/controller/midjourney_test.go
@@ -175,6 +175,16 @@ func TestMidjourneyFailureRefundsWalletAndTokenThroughDurableSettlement(t *testi
 	require.NoError(t, err)
 	require.True(t, created)
 	require.False(t, refundDuplicate)
+	settlementInput := model.BillingSettlementInput{
+		OperationKey: "request:midjourney-refund-request:finalize", Source: model.BillingSettlementSourceWallet,
+		UserID: user.Id, TokenID: token.Id,
+	}
+	_, alreadyApplied, err := model.ApplyBillingSettlementOnce(settlementInput)
+	require.NoError(t, err)
+	require.False(t, alreadyApplied)
+	_, alreadyApplied, err = model.ApplyBillingSettlementOnce(settlementInput)
+	require.NoError(t, err)
+	require.True(t, alreadyApplied)
 
 	err = updateMidjourneyTaskFromResponse(context.Background(), mj, dto.MidjourneyDto{
 		MjId: mj.MjId, Status: "FAILURE", Progress: "100%", FailReason: "provider failed",
@@ -258,8 +268,18 @@ func TestApplyMidjourneyTaskResponsePreservesLateCompletionWithoutRefund(t *test
 			require.NoError(t, err)
 			require.True(t, created)
 			require.False(t, refundDuplicate)
+			settlementInput := model.BillingSettlementInput{
+				OperationKey: "request:midjourney-late-success-request-" + suffix + ":finalize", Source: model.BillingSettlementSourceWallet,
+				UserID: user.Id, TokenID: token.Id,
+			}
+			_, alreadyApplied, err := model.ApplyBillingSettlementOnce(settlementInput)
+			require.NoError(t, err)
+			require.False(t, alreadyApplied)
 			var settlementCountBefore int64
 			require.NoError(t, db.Model(&model.BillingSettlement{}).Count(&settlementCountBefore).Error)
+			_, alreadyApplied, err = model.ApplyBillingSettlementOnce(settlementInput)
+			require.NoError(t, err)
+			require.True(t, alreadyApplied)
 
 			err = applyMidjourneyTaskResponse(context.Background(), map[string]*model.Midjourney{mj.MjId: mj}, dto.MidjourneyDto{
 				MjId: mj.MjId, Status: tt.responseStatus, Progress: "100%", FinishTime: finishTime,

diff --git a/controller/misc.go b/controller/misc.go
@@ -408,9 +408,10 @@ func ResetPassword(c *gin.Context) {
 		return
 	}
 	c.JSON(http.StatusOK, gin.H{
-		"success": true,
-		"message": "",
-		"data":    password,
+		"success":            true,
+		"message":            common.TranslateMessage(c, i18n.MsgUserPasswordResetSuccessTokensRevoked),
+		"data":               password,
+		"api_tokens_revoked": true,
 	})
 	return
 }
diff --git a/controller/oauth.go b/controller/oauth.go
@@ -54,6 +54,13 @@ func providerParams(name string) map[string]any {
 	return map[string]any{"Provider": name}
 }
 
+func supportsOAuthState(provider string, intent string) bool {
+	if provider == "telegram" {
+		return common.TelegramOAuthEnabled && intent == model.AuthFlowIntentLogin
+	}
+	return oauth.GetProvider(provider) != nil
+}
+
 func oauthProviderUserUpdateField(provider oauth.Provider) (model.UserUpdateField, bool) {
 	switch provider.(type) {
 	case *oauth.GitHubProvider:
@@ -120,7 +127,7 @@ func GenerateOAuthCode(c *gin.Context) {
 	request.Provider = strings.ToLower(strings.TrimSpace(request.Provider))
 	request.Intent = strings.TrimSpace(request.Intent)
 	request.Aff = strings.TrimSpace(request.Aff)
-	if oauth.GetProvider(request.Provider) == nil ||
+	if !supportsOAuthState(request.Provider, request.Intent) ||
 		(request.Intent != model.AuthFlowIntentLogin && request.Intent != model.AuthFlowIntentBind) ||
 		len(request.Aff) > 32 ||
 		(request.Intent == model.AuthFlowIntentBind && request.Aff != "") {

diff --git a/controller/oauth_test.go b/controller/oauth_test.go
@@ -3,6 +3,7 @@ package controller
 import (
 	"context"
 	"errors"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -31,18 +32,77 @@ func (*deletedUserOAuthProvider) ExchangeToken(context.Context, string, *gin.Con
 func setupControllerAuthFlowDB(t *testing.T) {
 	t.Helper()
 	originalDB := model.DB
-	db, err := gorm.Open(sqlite.Open("file:controller_auth_flow?mode=memory&cache=shared"), &gorm.Config{})
+	originalLogDB := model.LOG_DB
+	dsn := fmt.Sprintf("file:%s?mode=memory&cache=shared", strings.ReplaceAll(t.Name(), "/", "_"))
+	db, err := gorm.Open(sqlite.Open(dsn), &gorm.Config{})
 	require.NoError(t, err)
-	require.NoError(t, db.AutoMigrate(&model.AuthFlow{}))
+	require.NoError(t, db.AutoMigrate(&model.AuthFlow{}, &model.User{}, &model.Log{}))
 	model.DB = db
+	model.LOG_DB = db
 	t.Cleanup(func() {
 		model.DB = originalDB
+		model.LOG_DB = originalLogDB
 		if sqlDB, dbErr := db.DB(); dbErr == nil {
 			_ = sqlDB.Close()
 		}
 	})
 }
 
+func TestGenerateOAuthCodeCreatesTelegramLoginState(t *testing.T) {
+	setupControllerAuthFlowDB(t)
+	originalEnabled := common.TelegramOAuthEnabled
+	common.TelegramOAuthEnabled = true
+	t.Cleanup(func() { common.TelegramOAuthEnabled = originalEnabled })
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Use(sessions.Sessions("session", cookie.NewStore([]byte("telegram-state-create-test"))))
+	router.POST("/api/oauth/state", GenerateOAuthCode)
+
+	recorder := httptest.NewRecorder()
+	request := httptest.NewRequest(http.MethodPost, "/api/oauth/state", strings.NewReader(`{"provider":"telegram","intent":"login"}`))
+	request.Header.Set("Content-Type", "application/json")
+	router.ServeHTTP(recorder, request)
+
+	var response struct {
+		Success bool   `json:"success"`
+		Data    string `json:"data"`
+	}
+	require.NoError(t, common.Unmarshal(recorder.Body.Bytes(), &response))
+	require.True(t, response.Success)
+	require.NotEmpty(t, response.Data)
+	_, err := model.GetAuthFlow(response.Data, model.AuthFlowMatch{
+		Purpose: model.AuthFlowPurposeOAuth, Provider: "telegram", Intent: model.AuthFlowIntentLogin,
+	})
+	require.NoError(t, err)
+}
+
+func TestGenerateOAuthCodeRejectsTelegramLoginStateWhenDisabled(t *testing.T) {
+	setupControllerAuthFlowDB(t)
+	require.NoError(t, appi18n.Init())
+	originalEnabled := common.TelegramOAuthEnabled
+	common.TelegramOAuthEnabled = false
+	t.Cleanup(func() { common.TelegramOAuthEnabled = originalEnabled })
+
+	router := gin.New()
+	router.Use(sessions.Sessions("session", cookie.NewStore([]byte("telegram-state-disabled-test"))))
+	router.POST("/api/oauth/state", GenerateOAuthCode)
+
+	recorder := httptest.NewRecorder()
+	request := httptest.NewRequest(http.MethodPost, "/api/oauth/state", strings.NewReader(`{"provider":"telegram","intent":"login"}`))
+	request.Header.Set("Content-Type", "application/json")
+	router.ServeHTTP(recorder, request)
+
+	require.Equal(t, http.StatusOK, recorder.Code)
+	var response struct {
+		Success bool `json:"success"`
+	}
+	require.NoError(t, common.Unmarshal(recorder.Body.Bytes(), &response))
+	require.False(t, response.Success)
+	var count int64
+	require.NoError(t, model.DB.Model(&model.AuthFlow{}).Count(&count).Error)
+	require.Zero(t, count)
+}
+
 func TestGenerateOAuthCodeCreatesProviderBoundOpaqueState(t *testing.T) {
 	setupControllerAuthFlowDB(t)
 	gin.SetMode(gin.TestMode)
@@ -135,6 +195,32 @@ func TestGenerateOAuthCodeRejectsAnonymousBind(t *testing.T) {
 	require.Equal(t, "Unauthorized", response.Message)
 }
 
+func TestGenerateOAuthCodeRejectsTelegramBindIntent(t *testing.T) {
+	setupControllerAuthFlowDB(t)
+	require.NoError(t, appi18n.Init())
+	originalEnabled := common.TelegramOAuthEnabled
+	common.TelegramOAuthEnabled = true
+	t.Cleanup(func() { common.TelegramOAuthEnabled = originalEnabled })
+
+	recorder := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(recorder)
+	c.Request = httptest.NewRequest(http.MethodPost, "/api/oauth/state", strings.NewReader(`{"provider":"telegram","intent":"bind"}`))
+	c.Request.Header.Set("Content-Type", "application/json")
+	c.Set("id", 123)
+
+	GenerateOAuthCode(c)
+
+	require.Equal(t, http.StatusOK, recorder.Code)
+	var response struct {
+		Success bool `json:"success"`
+	}
+	require.NoError(t, common.Unmarshal(recorder.Body.Bytes(), &response))
+	require.False(t, response.Success)
+	var count int64
+	require.NoError(t, model.DB.Model(&model.AuthFlow{}).Count(&count).Error)
+	require.Zero(t, count)
+}
+
 func TestHandleOAuthRejectsConsumedStateBeforeProviderExchange(t *testing.T) {
 	setupControllerAuthFlowDB(t)
 	require.NoError(t, appi18n.Init())

diff --git a/controller/passkey.go b/controller/passkey.go
@@ -36,10 +36,6 @@ func PasskeyRegisterBegin(c *gin.Context) {
 		return
 	}
 
-	if !requirePasskeyRegistrationVerification(c, user.Id) {
-		return
-	}
-
 	credential, err := model.GetPasskeyByUserID(user.Id)
 	if err != nil && !errors.Is(err, model.ErrPasskeyNotFound) {
 		common.ApiError(c, err)
@@ -100,10 +96,6 @@ func PasskeyRegisterFinish(c *gin.Context) {
 		return
 	}
 
-	if !requirePasskeyRegistrationVerification(c, user.Id) {
-		return
-	}
-
 	wa, err := passkeysvc.BuildWebAuthn(c.Request)
 	if err != nil {
 		common.ApiError(c, err)
@@ -138,10 +130,12 @@ func PasskeyRegisterFinish(c *gin.Context) {
 		return
 	}
 
-	if err := model.UpsertPasskeyCredential(passkeyCredential); err != nil {
+	generation, err := model.ReplacePasskeyCredentialAndBumpSessionGeneration(passkeyCredential)
+	if err != nil {
 		common.ApiError(c, err)
 		return
 	}
+	preserveCurrentSessionAfterCommittedSecurityChange(c, user.Id, generation, "registering a passkey")
 
 	recordUserSecurityAudit(c, user.Id, "user.passkey_register", nil)
 	c.JSON(http.StatusOK, gin.H{
@@ -164,10 +158,12 @@ func PasskeyDelete(c *gin.Context) {
 		return
 	}
 
-	if err := model.DeletePasskeyByUserID(user.Id); err != nil {
+	generation, err := model.DeletePasskeyAndBumpSessionGeneration(user.Id)
+	if err != nil {
 		common.ApiError(c, err)
 		return
 	}
+	preserveCurrentSessionAfterCommittedSecurityChange(c, user.Id, generation, "deleting a passkey")
 
 	recordUserSecurityAudit(c, user.Id, "user.passkey_delete", nil)
 	c.JSON(http.StatusOK, gin.H{
@@ -331,7 +327,7 @@ func PasskeyLoginFinish(c *gin.Context) {
 	}
 	now := time.Now()
 	updatedCredential.LastUsedAt = &now
-	if err := model.UpsertPasskeyCredential(updatedCredential); err != nil {
+	if err := model.UpdatePasskeyCredentialAfterAuthentication(updatedCredential); err != nil {
 		common.ApiError(c, err)
 		return
 	}
@@ -370,7 +366,7 @@ func AdminResetPasskey(c *gin.Context) {
 		return
 	}
 
-	if err := model.DeletePasskeyByUserID(user.Id); err != nil {
+	if _, err := model.DeletePasskeyAndBumpSessionGeneration(user.Id); err != nil {
 		common.ApiError(c, err)
 		return
 	}
@@ -479,16 +475,21 @@ func PasskeyVerifyFinish(c *gin.Context) {
 	}
 
 	waUser := passkeysvc.NewWebAuthnUser(user, credential)
-	_, err = wa.FinishLogin(waUser, *sessionData, c.Request)
+	validatedCredential, err := wa.FinishLogin(waUser, *sessionData, c.Request)
 	if err != nil {
 		common.ApiError(c, err)
 		return
 	}
+	if validatedCredential == nil {
+		common.ApiErrorMsg(c, "Passkey 凭证更新失败")
+		return
+	}
 
 	// 更新凭证的最后使用时间
+	credential.ApplyValidatedCredential(validatedCredential)
 	now := time.Now()
 	credential.LastUsedAt = &now
-	if err := model.UpsertPasskeyCredential(credential); err != nil {
+	if err := model.UpdatePasskeyCredentialAfterAuthentication(credential); err != nil {
 		common.ApiError(c, err)
 		return
 	}
@@ -531,26 +532,14 @@ func getSessionUser(c *gin.Context) (*model.User, error) {
 	return user, nil
 }
 
-func requirePasskeyRegistrationVerification(c *gin.Context, userID int) bool {
-	twoFA, err := model.GetTwoFAByUserId(userID)
-	if err != nil {
-		common.ApiError(c, err)
-		return false
-	}
-	if twoFA == nil || !twoFA.IsEnabled {
-		return true
-	}
-	return requireSecureVerificationMethod(c, secureVerificationMethod2FA)
-}
-
 func requirePasskeyDeleteVerification(c *gin.Context, userID int) bool {
 	twoFA, err := model.GetTwoFAByUserId(userID)
 	if err != nil {
 		common.ApiError(c, err)
 		return false
 	}
 	if twoFA != nil && twoFA.IsEnabled {
-		return requireSecureVerificationMethod(c, secureVerificationMethod2FA)
+		return requireSecureVerificationMethod(c, model.SecureVerificationMethod2FA)
 	}
 
 	_, err = model.GetPasskeyByUserID(userID)
@@ -566,7 +555,7 @@ func requirePasskeyDeleteVerification(c *gin.Context, userID int) bool {
 		return false
 	}
 
-	return requireSecureVerificationMethod(c, secureVerificationMethodPasskey)
+	return requireSecureVerificationMethod(c, model.SecureVerificationMethodPasskey)
 }
 
 func requireSecureVerificationMethod(c *gin.Context, method string) bool {