fix im p0 backend issues

server/session.go

@@ -1286,6 +1286,10 @@ func (s *Session) onLogin(msgID string, timestamp time.Time, rec *auth.Rec, miss
 
 		// Record deviceId used in this session
 		if s.deviceID != "" {
+			isNewDevice, deviceErr := isNewLoginDevice(s.tenantID, rec.Uid, s.deviceID)
+			if deviceErr != nil {
+				logs.Warn.Println("s.onLogin: failed to check known device", rec.Uid, deviceErr, s.sid)
+			}
 			if err := store.Devices.Update(s.tenantID, rec.Uid, "", &types.DeviceDef{
 				TenantID: s.tenantID,
 				DeviceId: s.deviceID,
@@ -1294,6 +1298,8 @@ func (s *Session) onLogin(msgID string, timestamp time.Time, rec *auth.Rec, miss
 				Lang:     s.lang,
 			}); err != nil {
 				logs.Warn.Println("failed to update device record", err)
+			} else if isNewDevice {
+				createLoginDeviceSecurityNotice(s.tenantID, rec.Uid, s.deviceID, s.platf, s.userAgent, timestamp)
 			}
 		}
 		if !s.uid.IsZero() {
@@ -1310,6 +1316,55 @@ func (s *Session) onLogin(msgID string, timestamp time.Time, rec *auth.Rec, miss
 	return reply
 }
 
+func isNewLoginDevice(tenantID types.TenantID, uid types.Uid, deviceID string) (bool, error) {
+	if store.Devices == nil || strings.TrimSpace(deviceID) == "" || uid.IsZero() {
+		return false, nil
+	}
+	devices, _, err := store.Devices.GetAll(tenantID, uid)
+	if err != nil {
+		return false, err
+	}
+	for _, device := range devices[uid] {
+		if device.DeviceId == deviceID {
+			return false, nil
+		}
+	}
+	return true, nil
+}
+
+func createLoginDeviceSecurityNotice(tenantID types.TenantID, uid types.Uid, deviceID, platform, userAgent string, at time.Time) {
+	if store.Security == nil || uid.IsZero() || strings.TrimSpace(deviceID) == "" {
+		return
+	}
+	eventID := stableIMEventID("security.login_device", uid.UserId(), deviceID)
+	if err := createIMSystemNotification(tenantID, uid, eventID, "security.login_device",
+		"新设备登录提醒", loginDeviceSecurityNoticeSummary(platform, userAgent),
+		map[string]any{
+			"scene":      "login_device",
+			"device_id":  deviceID,
+			"platform":   strings.TrimSpace(platform),
+			"user_agent": strings.TrimSpace(userAgent),
+			"login_at":   at.UTC().Format(time.RFC3339Nano),
+		}); err != nil {
+		logs.Warn.Println("s.onLogin: failed to create login device notification", uid, err)
+	}
+}
+
+func loginDeviceSecurityNoticeSummary(platform, userAgent string) string {
+	platform = strings.TrimSpace(platform)
+	if platform == "" {
+		platform = "未知设备"
+	}
+	userAgent = strings.TrimSpace(userAgent)
+	if userAgent == "" {
+		return platform + " 登录了你的账号"
+	}
+	if len([]rune(userAgent)) > 80 {
+		userAgent = string([]rune(userAgent)[:80])
+	}
+	return platform + " 登录了你的账号：" + userAgent
+}
+
 func currentNodeID() string {
 	if globals.cluster != nil && globals.cluster.thisNodeName != "" {
 		return globals.cluster.thisNodeName