feat(admin): 增加玩家密码管理与角色边界

app/Services/PlayerTokenResolver.php

@@ -8,10 +8,10 @@ use App\Models\Player;
 use App\Lottery\ErrorCode;
 use Illuminate\Http\Request;
 use App\Support\PlayerAuthSource;
-use App\Support\PlayerAutoRegistrationDefaults;
 use App\Support\PlayerFundingMode;
 use App\Support\PlayerTokenAesUnwrap;
 use Illuminate\Database\QueryException;
+use App\Support\PlayerAutoRegistrationDefaults;
 use App\Exceptions\PlayerAuthenticationException;
 use App\Services\Integration\PartnerSiteConfigResolver;
 
@@ -192,6 +192,11 @@ final class PlayerTokenResolver
             throw new PlayerAuthenticationException('玩家不存在', ErrorCode::PlayerNotRegistered->value);
         }
 
+        $tokenVersion = (int) data_get($claims, 'token_version', 0);
+        if ($tokenVersion !== (int) ($player->native_token_version ?? 0)) {
+            throw new PlayerAuthenticationException('Token 已因密码变更失效', ErrorCode::PlayerTokenInvalid->value);
+        }
+
         $player->forceFill(['last_login_at' => now()])->save();
 
         return $player->refresh();
@@ -288,9 +293,6 @@ final class PlayerTokenResolver
         return is_string($decoded) ? $decoded : '';
     }
 
-    /**
-     * @param  object  $claims
-     */
     private function assertNativeJwtTemporalPolicy(object $claims): void
     {
         if (! isset($claims->exp) || ! is_numeric($claims->exp)) {