feat: bind room tickets to member sessions and disconnect revoked sessions

db/migrations/00006_ticket_sessions.sql

@@ -0,0 +1,15 @@
+-- +goose Up
+-- 票据属于签发它的会话，会话删除时票据随之失效。bot 的 API Key 票据没有会话。
+ALTER TABLE room_tickets ADD COLUMN session_token_hash bytea REFERENCES member_sessions ON DELETE CASCADE;
+
+CREATE INDEX ON room_tickets (session_token_hash);
+
+-- 只有一个会话的成员，已有的票据只可能来自这个会话。对应不到唯一会话的成员票据直接删除，客户端会重新换取。
+UPDATE room_tickets t SET session_token_hash = s.token_hash
+FROM member_sessions s
+WHERE s.member_id = t.member_id
+    AND (SELECT count(*) FROM member_sessions o WHERE o.member_id = t.member_id) = 1;
+
+DELETE FROM room_tickets t
+WHERE t.session_token_hash IS NULL
+    AND NOT EXISTS (SELECT FROM rooms r WHERE r.id = t.room_id AND r.bot_member_id = t.member_id);

db/queries/members.sql

@@ -33,6 +33,7 @@ UPDATE members SET password_hash = @password_hash WHERE id = @id AND username IS
 -- name: DeleteSession :exec
 DELETE FROM member_sessions WHERE token_hash = @token_hash;
 
--- name: DeleteMemberSessions :exec
+-- name: DeleteMemberSessions :many
 -- keep 为 NULL 时删除这个成员的全部会话。
-DELETE FROM member_sessions WHERE member_id = @member_id AND token_hash IS DISTINCT FROM sqlc.narg(keep)::bytea;
+DELETE FROM member_sessions WHERE member_id = @member_id AND token_hash IS DISTINCT FROM sqlc.narg(keep)::bytea
+RETURNING token_hash;

db/queries/tickets.sql

@@ -3,10 +3,12 @@
 SELECT coalesce(password_hash, '')::text AS password_hash FROM rooms WHERE id = @id FOR SHARE;
 
 -- name: CreateTicket :exec
-INSERT INTO room_tickets (token_hash, room_id, member_id) VALUES (@token_hash, @room_id, @member_id);
+-- bot 的 API Key 没有会话，session_token_hash 为 NULL。
+INSERT INTO room_tickets (token_hash, room_id, member_id, session_token_hash)
+VALUES (@token_hash, @room_id, @member_id, sqlc.narg(session_token_hash));
 
 -- name: TicketHolder :one
-SELECT t.room_id, m.id, m.name, m.avatar_hash, r.bot_member_id IS NOT DISTINCT FROM m.id AS bot
+SELECT t.room_id, m.id, m.name, m.avatar_hash, r.bot_member_id IS NOT DISTINCT FROM m.id AS bot, t.session_token_hash
 FROM room_tickets t
 JOIN members m ON m.id = t.member_id
 JOIN rooms r ON r.id = t.room_id