fix(api): 修复 API Token 过期校验与更新校验

- 将数据库中的 expires_at 设为必填，并在认证时仅允许未过期的令牌通过
- 增加空过期时间的更新校验，避免写入非法时间值
- 补充过期令牌与空过期时间更新的测试覆盖
- 调整前端日期输入与提交逻辑，避免创建 API Token 时表单异常中断

apps/api/internal/app/api_token_handlers.go

@@ -124,6 +124,10 @@ func (a *App) handleUpdateAPIToken(w http.ResponseWriter, r *http.Request) {
 		expiresValue = current.ExpiresAt.UTC().Format(time.RFC3339Nano)
 	}
 	if req.ExpiresAt != nil {
+		if strings.TrimSpace(*req.ExpiresAt) == "" {
+			badRequest(w, errors.New("expiresAt must be an RFC3339 timestamp"))
+			return
+		}
 		expiresAt, err := parseOptionalFutureTime(*req.ExpiresAt, a.now().UTC())
 		if err != nil {
 			badRequest(w, err)

apps/api/internal/app/app.go

@@ -169,7 +169,7 @@ func (a *App) migrate(ctx context.Context) error {
 			name TEXT NOT NULL,
 			token_hash TEXT NOT NULL UNIQUE,
 			last_used_at TEXT,
-			expires_at TEXT,
+			expires_at TEXT NOT NULL,
 			disabled INTEGER NOT NULL DEFAULT 0,
 			created_at TEXT NOT NULL,
 			updated_at TEXT NOT NULL

apps/api/internal/app/app_test.go

@@ -1705,6 +1705,15 @@ func TestAPITokenManagementStoresHashAndRevokes(t *testing.T) {
 	if code := openAdmin.do("GET", "/api/open/domains", nil, &domains); code != http.StatusOK {
 		t.Fatalf("open api with bearer token code=%d", code)
 	}
+	if _, err := a.db.Exec(`UPDATE api_tokens SET expires_at=? WHERE id=?`, a.now().UTC().Add(-time.Minute).Format(time.RFC3339Nano), created.Item.ID); err != nil {
+		t.Fatal(err)
+	}
+	if code := openAdmin.do("GET", "/api/open/domains", nil, &map[string]any{}); code != http.StatusUnauthorized {
+		t.Fatalf("expired bearer token code=%d", code)
+	}
+	if _, err := a.db.Exec(`UPDATE api_tokens SET expires_at=? WHERE id=?`, created.Item.ExpiresAt.UTC().Format(time.RFC3339Nano), created.Item.ID); err != nil {
+		t.Fatal(err)
+	}
 	var listed struct {
 		Items []APIToken `json:"items"`
 	}
@@ -1715,6 +1724,10 @@ func TestAPITokenManagementStoresHashAndRevokes(t *testing.T) {
 		t.Fatalf("listed tokens=%+v", listed.Items)
 	}
 
+	if code := admin.do("POST", "/api/me/api-tokens/"+created.Item.ID, map[string]any{"expiresAt": ""}, &map[string]any{}); code != http.StatusBadRequest {
+		t.Fatalf("empty api token expiry update code=%d", code)
+	}
+
 	disabled := true
 	var updated APIToken
 	if code := admin.do("POST", "/api/me/api-tokens/"+created.Item.ID, map[string]any{"disabled": disabled}, &updated); code != http.StatusOK {

apps/api/internal/app/router_auth.go

@@ -258,7 +258,7 @@ func (a *App) authenticateAPIToken(r *http.Request) (*User, error) {
 	now := a.now().UTC().Format(time.RFC3339Nano)
 	row := a.db.QueryRowContext(r.Context(), `SELECT at.id,u.id,u.email,u.display_name,u.role,u.disabled,u.two_factor_enabled,u.created_at
 		FROM api_tokens at JOIN users u ON u.id=at.user_id
-		WHERE at.token_hash=? AND at.disabled=0 AND (at.expires_at IS NULL OR at.expires_at > ?)`, hashToken(token), now)
+		WHERE at.token_hash=? AND at.disabled=0 AND at.expires_at > ?`, hashToken(token), now)
 	var tokenID string
 	var u User
 	var disabled, twoFactorEnabled int