feat: add im auth verification flows

server/auth/token/auth_token.go

@@ -23,10 +23,10 @@ type authenticator struct {
 	serialNumber int
 }
 
-const tokenVersion = uint8(2)
+const tokenVersion = uint8(3)
 
-// tokenLayout defines positioning of various bytes in token v2.
-// [1:version][8:tenant][8:UID][4:expires][2:authLevel][2:serial][2:features][32:signature] = 59 bytes.
+// tokenLayout defines positioning of various bytes in token v3.
+// [1:version][8:tenant][8:UID][4:expires][2:authLevel][2:serial][2:features][4:authVersion][32:signature] = 63 bytes.
 type tokenLayout struct {
 	// Token format version.
 	Version uint8
@@ -42,6 +42,8 @@ type tokenLayout struct {
 	SerialNumber uint16
 	// Bitmap with feature bits.
 	Features uint16
+	// User-scoped auth version.
+	AuthVersion uint32
 }
 
 // Init initializes the authenticator: parses the config and sets salt, serial number and lifetime.
@@ -143,13 +145,29 @@ func (ta *authenticator) Authenticate(ctx auth.AuthContext, token []byte) (*auth
 		return nil, nil, types.ErrExpired
 	}
 
+	features := auth.Feature(tl.Features)
+	if features&auth.FeatureNoLogin == 0 {
+		if store.Security == nil {
+			return nil, nil, types.ErrInternal
+		}
+		currentVersion, err := store.Security.GetAuthVersion(types.TenantID(tl.TenantID), types.Uid(tl.Uid))
+		if err != nil {
+			return nil, nil, err
+		}
+		if int(tl.AuthVersion) != currentVersion {
+			return nil, nil, types.ErrFailed
+		}
+	}
+
 	return &auth.Rec{
-		TenantID:  types.TenantID(tl.TenantID),
-		Uid:       types.Uid(tl.Uid),
-		AuthLevel: auth.Level(tl.AuthLevel),
-		Lifetime:  auth.Duration(time.Until(expires)),
-		Features:  auth.Feature(tl.Features),
-		State:     types.StateUndefined}, nil, nil
+		TenantID:    types.TenantID(tl.TenantID),
+		Uid:         types.Uid(tl.Uid),
+		AuthLevel:   auth.Level(tl.AuthLevel),
+		Lifetime:    auth.Duration(time.Until(expires)),
+		Features:    features,
+		State:       types.StateUndefined,
+		AuthVersion: int(tl.AuthVersion),
+	}, nil, nil
 }
 
 // GenSecret generates a new token.
@@ -173,6 +191,7 @@ func (ta *authenticator) GenSecret(rec *auth.Rec) ([]byte, time.Time, error) {
 		AuthLevel:    uint16(rec.AuthLevel),
 		SerialNumber: uint16(ta.serialNumber),
 		Features:     uint16(rec.Features),
+		AuthVersion:  uint32(rec.AuthVersion),
 	}
 	buf := new(bytes.Buffer)
 	binary.Write(buf, binary.LittleEndian, &tl)