fix: 停用删除重置密码发 fatal 并注入 Downlink 发 revoked

internal/admin/handler.go

@@ -41,6 +41,12 @@ type Deps struct {
 	SecureCookies bool
 	// KickEndpoint 踢下线钩子（只断开连接）；nil 时踢线为 no-op。
 	KickEndpoint EndpointKickFunc
+	// PasswordResetKick 重置登录密码后踢线（应发 fatal）；nil 时回退 KickEndpoint。
+	PasswordResetKick EndpointKickFunc
+	// DisableKick 停用后踢线（应发 fatal(disabled)）；nil 且已注入 Identity 时不再 Kick。
+	DisableKick EndpointKickFunc
+	// DeleteKick 删除后踢线（应发 fatal(deleted)）；nil 且已注入 Identity 时不再 Kick。
+	DeleteKick EndpointKickFunc
 	// Identity 端停用/启用/删除级联（I5）；nil 时回退为仅改 enabled/删行。
 	Identity identity.Service
 
@@ -54,20 +60,23 @@ type Deps struct {
 
 // Handler 是可挂载的管理接口（路由前缀 /api/admin/）。
 type Handler struct {
-	db        *store.DB
-	hash      auth.HashPool
-	tokens    auth.APITokens
-	locks     auth.LoginLocks
-	log       *slog.Logger
-	trusted   []*net.IPNet
-	ttl       time.Duration
-	forceSec  bool
-	kick      EndpointKickFunc
-	identity  identity.Service
-	groups    group.Service
-	cfg       config.Config
-	version   string
-	startedAt time.Time
+	db          *store.DB
+	hash        auth.HashPool
+	tokens      auth.APITokens
+	locks       auth.LoginLocks
+	log         *slog.Logger
+	trusted     []*net.IPNet
+	ttl         time.Duration
+	forceSec    bool
+	kick        EndpointKickFunc
+	resetKick   EndpointKickFunc
+	disableKick EndpointKickFunc
+	deleteKick  EndpointKickFunc
+	identity    identity.Service
+	groups      group.Service
+	cfg         config.Config
+	version     string
+	startedAt   time.Time
 
 	mux *http.ServeMux
 
@@ -96,22 +105,25 @@ func New(d Deps) *Handler {
 		ver = "dev"
 	}
 	h := &Handler{
-		db:        d.DB,
-		hash:      d.Hash,
-		tokens:    d.Tokens,
-		locks:     d.Locks,
-		log:       d.Logger,
-		trusted:   d.TrustedProxies,
-		ttl:       ttl,
-		forceSec:  d.SecureCookies,
-		kick:      d.KickEndpoint,
-		identity:  d.Identity,
-		groups:    d.Groups,
-		cfg:       cfg,
-		version:   ver,
-		startedAt: time.Now(),
-		mux:       http.NewServeMux(),
-		lastUsed:  make(map[string]time.Time),
+		db:          d.DB,
+		hash:        d.Hash,
+		tokens:      d.Tokens,
+		locks:       d.Locks,
+		log:         d.Logger,
+		trusted:     d.TrustedProxies,
+		ttl:         ttl,
+		forceSec:    d.SecureCookies,
+		kick:        d.KickEndpoint,
+		resetKick:   d.PasswordResetKick,
+		disableKick: d.DisableKick,
+		deleteKick:  d.DeleteKick,
+		identity:    d.Identity,
+		groups:      d.Groups,
+		cfg:         cfg,
+		version:     ver,
+		startedAt:   time.Now(),
+		mux:         http.NewServeMux(),
+		lastUsed:    make(map[string]time.Time),
 	}
 	h.routes()
 	return h