fix(auth): fail closed on token and validation checks

Made-with: Cursor

pro_v3.5.1/app/services/auth/AccessTokenService.php

@@ -32,10 +32,11 @@ class AccessTokenService
      *
      * @param callable $resolver 根据 token 内的 id 读取账号模型或数组
      * @param callable $authHashResolver 根据账号返回当前有效的 auth hash
+     * @param callable|null $accountValidator 根据账号判断当前 token 是否仍可用
      * @return mixed
      * @throws \Psr\SimpleCache\InvalidArgumentException
      */
-    public function parseToken(string $token, string $type, callable $resolver, callable $authHashResolver)
+    public function parseToken(string $token, string $type, callable $resolver, callable $authHashResolver, callable $accountValidator = null)
     {
         if (!$token || $token === 'undefined') {
             throw new AuthException(ApiErrorCode::ERR_LOGIN);
@@ -78,6 +79,11 @@ class AccessTokenService
             throw new AuthException(ApiErrorCode::ERR_LOGIN);
         }
 
+        if ($accountValidator && !$accountValidator($account)) {
+            $this->clearToken($md5Token, $type);
+            throw new AuthException(ApiErrorCode::ERR_LOGIN_INVALID);
+        }
+
         if ($auth !== $authHashResolver($account)) {
             throw new AuthException(ApiErrorCode::ERR_LOGIN_INVALID);
         }