更新用户在线时间设置

backend/utils/security.py

@@ -21,12 +21,21 @@ logger = logging.getLogger(__name__)
 security = HTTPBearer()
 
 def create_access_token(data: dict, expires_delta: timedelta = None):
-    """创建访问令牌"""
+    """创建访问令牌
+
+    业务要求：普通登录至少 7 天内不掉线。
+    因此在未显式传入 expires_delta 时，强制最小有效期为 7 天。
+    """
     to_encode = data.copy()
+
     if expires_delta:
         expire = datetime.utcnow() + expires_delta
     else:
-        expire = datetime.utcnow() + timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES)
+        min_expire_minutes = 60 * 24 * 7  # 7 days
+        configured_expire_minutes = int(getattr(settings, "ACCESS_TOKEN_EXPIRE_MINUTES", min_expire_minutes) or min_expire_minutes)
+        effective_expire_minutes = max(configured_expire_minutes, min_expire_minutes)
+        expire = datetime.utcnow() + timedelta(minutes=effective_expire_minutes)
+
     to_encode.update({"exp": expire})
     encoded_jwt = jwt.encode(to_encode, settings.JWT_SECRET_KEY, algorithm=settings.JWT_ALGORITHM)
     return encoded_jwt