feat(auth,prompt-rule): add password change with session revocation and scope prompt rules by brand

Add self-service password change that re-hashes the credential and bumps a
per-user session version so all existing access/refresh tokens are rejected.
Session version is tracked in Redis with an in-memory fallback and enforced in
middleware and refresh.

Scope prompt rules and rule groups to a brand: new brand_id column (migrated to
a "未归属" fallback brand for existing rows), brand-filtered queries/indexes, and
brand-aware admin-web tabs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/admin-web/src/components/CustomArticleTab.vue

@@ -57,7 +57,8 @@ const publishModalOpen = ref(false)
 const selectedPublishArticleId = ref<number | null>(null)
 
 const rulesQuery = useQuery({
-  queryKey: ['promptRules', 'simple'],
+  queryKey: computed(() => ['promptRules', 'simple', companyStore.currentBrandId]),
+  enabled: computed(() => Boolean(companyStore.currentBrandId)),
   queryFn: () => promptRulesApi.listSimple(),
 })
 
@@ -246,6 +247,15 @@ watch(
   { immediate: true },
 )
 
+watch(
+  () => companyStore.currentBrandId,
+  () => {
+    draftFilters.prompt_rule_id = undefined
+    appliedFilters.prompt_rule_id = undefined
+    page.value = 1
+  },
+)
+
 onBeforeUnmount(() => {
   stopPolling()
 })

apps/admin-web/src/components/GenerateTaskDrawer.vue

@@ -59,9 +59,11 @@ const form = reactive({
 })
 
 const isSchedule = computed(() => props.mode === 'schedule')
+const currentBrandId = computed(() => companyStore.currentBrandId)
 
 const rulesQuery = useQuery({
-  queryKey: ['promptRules', 'simple'],
+  queryKey: computed(() => ['promptRules', 'simple', currentBrandId.value]),
+  enabled: computed(() => props.open && Boolean(currentBrandId.value)),
   queryFn: () => promptRulesApi.listSimple(),
 })
 
@@ -110,7 +112,6 @@ const selectedSchedulePublishPlatformIds = computed(() => {
 const scheduleCoverRequired = computed(() =>
   coverUploadRequired(selectedSchedulePublishPlatformIds.value),
 )
-const currentBrandId = computed(() => companyStore.currentBrandId)
 const effectiveScheduleCoverEnabled = computed(
   () => scheduleCoverRequired.value || form.coverEnabled,
 )
@@ -148,6 +149,10 @@ watch(
   },
 )
 
+watch(currentBrandId, () => {
+  form.promptRuleId = undefined
+})
+
 const createScheduleMutation = useMutation({
   mutationFn: () => schedulesApi.create(buildSchedulePayload()),
   onSuccess: async () => {

apps/admin-web/src/components/InstantTaskTab.vue

@@ -41,7 +41,8 @@ const appliedFilters = reactive<{
 })
 
 const rulesQuery = useQuery({
-  queryKey: ['promptRules', 'simple'],
+  queryKey: computed(() => ['promptRules', 'simple', companyStore.currentBrandId]),
+  enabled: computed(() => Boolean(companyStore.currentBrandId)),
   queryFn: () => promptRulesApi.listSimple(),
 })
 
@@ -175,6 +176,15 @@ watch(
   { immediate: true },
 )
 
+watch(
+  () => companyStore.currentBrandId,
+  () => {
+    draftFilters.prompt_rule_id = undefined
+    appliedFilters.prompt_rule_id = undefined
+    page.value = 1
+  },
+)
+
 onBeforeUnmount(() => {
   stopPolling()
 })

apps/admin-web/src/components/PromptRuleModal.vue

@@ -9,6 +9,7 @@ import { useI18n } from 'vue-i18n'
 import KnowledgeGroupSelect from '@/components/KnowledgeGroupSelect.vue'
 import { promptRulesApi } from '@/lib/api'
 import { formatError } from '@/lib/errors'
+import { useCompanyStore } from '@/stores/company'
 
 const props = defineProps<{
   open: boolean
@@ -22,6 +23,7 @@ const emit = defineEmits<{
 
 const queryClient = useQueryClient()
 const { t } = useI18n()
+const companyStore = useCompanyStore()
 
 const form = reactive({
   name: '',
@@ -34,7 +36,8 @@ const form = reactive({
 })
 
 const groupsQuery = useQuery({
-  queryKey: ['promptRules', 'groups'],
+  queryKey: computed(() => ['promptRules', 'groups', companyStore.currentBrandId]),
+  enabled: computed(() => props.open && Boolean(companyStore.currentBrandId)),
   queryFn: () => promptRulesApi.listGroups(),
 })
 
@@ -56,6 +59,15 @@ watch(
   },
 )
 
+watch(
+  () => companyStore.currentBrandId,
+  () => {
+    if (props.open) {
+      emit('update:open', false)
+    }
+  },
+)
+
 const createMutation = useMutation({
   mutationFn: () =>
     promptRulesApi.create({

apps/admin-web/src/components/PromptRuleTab.vue

@@ -16,9 +16,11 @@ import PromptRuleModal from '@/components/PromptRuleModal.vue'
 import { promptRulesApi } from '@/lib/api'
 import { formatDateTime } from '@/lib/display'
 import { formatError } from '@/lib/errors'
+import { useCompanyStore } from '@/stores/company'
 
 const queryClient = useQueryClient()
 const { t } = useI18n()
+const companyStore = useCompanyStore()
 
 const selectedGroupId = ref<number | 'all' | 'ungrouped'>('all')
 const ruleModalOpen = ref(false)
@@ -30,7 +32,8 @@ const page = ref(1)
 const pageSize = ref(20)
 
 const groupsQuery = useQuery({
-  queryKey: ['promptRules', 'groups'],
+  queryKey: computed(() => ['promptRules', 'groups', companyStore.currentBrandId]),
+  enabled: computed(() => Boolean(companyStore.currentBrandId)),
   queryFn: () => promptRulesApi.listGroups(),
 })
 
@@ -48,7 +51,8 @@ const ruleListParams = computed(() => {
 })
 
 const rulesQuery = useQuery({
-  queryKey: computed(() => ['promptRules', 'list', ruleListParams.value]),
+  queryKey: computed(() => ['promptRules', 'list', companyStore.currentBrandId, ruleListParams.value]),
+  enabled: computed(() => Boolean(companyStore.currentBrandId)),
   queryFn: () => promptRulesApi.list(ruleListParams.value),
 })
 
@@ -169,6 +173,17 @@ function handleTableChange(nextPage: number, nextPageSize: number): void {
 watch(selectedGroupId, () => {
   page.value = 1
 })
+
+watch(
+  () => companyStore.currentBrandId,
+  () => {
+    selectedGroupId.value = 'all'
+    editingRule.value = null
+    ruleModalOpen.value = false
+    groupModalOpen.value = false
+    page.value = 1
+  },
+)
 </script>
 
 <template>

apps/admin-web/src/components/ScheduleTaskTab.vue

@@ -53,7 +53,8 @@ const appliedFilters = reactive<{
 })
 
 const rulesQuery = useQuery({
-  queryKey: ['promptRules', 'simple'],
+  queryKey: computed(() => ['promptRules', 'simple', companyStore.currentBrandId]),
+  enabled: computed(() => Boolean(companyStore.currentBrandId)),
   queryFn: () => promptRulesApi.listSimple(),
 })
 
@@ -214,6 +215,17 @@ watch(
   { immediate: true },
 )
 
+watch(
+  () => companyStore.currentBrandId,
+  () => {
+    draftFilters.prompt_rule_id = undefined
+    appliedFilters.prompt_rule_id = undefined
+    editingTask.value = null
+    modalOpen.value = false
+    page.value = 1
+  },
+)
+
 onBeforeUnmount(() => {
   stopPolling()
 })