fix: complete first version issue remediation

api/src/auth/session-validation.middleware.ts

@@ -0,0 +1,33 @@
+import { Injectable, NestMiddleware, UnauthorizedException } from '@nestjs/common';
+import { PrismaService } from '../prisma/prisma.service';
+
+export type SessionRequest = {
+  header(name: string): string | undefined;
+  sessionUserId?: string;
+};
+
+@Injectable()
+export class SessionValidationMiddleware implements NestMiddleware {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async use(request: SessionRequest, _: unknown, next: () => void) {
+    const authorization = request.header('authorization');
+    if (!authorization) {
+      next();
+      return;
+    }
+    const match = /^Bearer dev-token:([^:]+):(\d+)$/.exec(authorization.trim());
+    if (!match) {
+      throw new UnauthorizedException('登录会话无效，请重新登录');
+    }
+    const user = await this.prisma.user.findUnique({
+      where: { id: match[1] },
+      select: { id: true, status: true, deletedAt: true, sessionVersion: true },
+    });
+    if (!user || user.status !== 'active' || user.deletedAt || user.sessionVersion !== Number(match[2])) {
+      throw new UnauthorizedException('登录会话已失效，请重新登录');
+    }
+    request.sessionUserId = user.id;
+    next();
+  }
+}