滑动续期与自动刷新：

Web：访问令牌 10 分钟；活跃时自动轮换刷新令牌；连续无操作 30 分钟后清除登录并跳转登录页。
App：会话窗口 3 天；打开 App、恢复前台或请求接口时自动刷新并重新顺延 3 天。
普通登录和 SSO 使用同一策略。
刷新令牌只以 SHA-256 摘要入库，每次刷新都会轮换，旧令牌无法再次使用；退出登录会吊销刷新令牌。
网络临时故障不会误清登录状态，多标签页同时刷新也做了竞争处理。

src/Jiaowu.Api/Controllers/SsoController.cs

@@ -20,7 +20,7 @@ namespace Jiaowu.Api.Controllers;
 [Route("api/auth/sso")]
 public sealed class SsoController(
     UserManager<ApplicationUser> userManager,
-    ITokenService tokenService,
+    IAuthSessionService authSessionService,
     IDistributedCache cache,
     IOptions<SsoOptions> options) : ControllerBase
 {
@@ -162,15 +162,14 @@ public sealed class SsoController(
                 StatusCodes.Status401Unauthorized);
 
         var roles = await userManager.GetRolesAsync(user);
-        return new LoginResponse(
-            tokenService.Create(user, roles),
-            new CurrentUserResponse(
-                user.Id,
-                user.UserName!,
-                user.DisplayName,
-                roles,
-                user.CollegeId,
-                EffectiveDataScopeResolver.Resolve(roles).ToString()));
+        var session = await authSessionService.CreateAsync(
+            user,
+            roles,
+            request.IsNativeApp
+                ? AuthenticationClientType.App
+                : AuthenticationClientType.Web,
+            cancellationToken);
+        return AuthController.CreateLoginResponse(session);
     }
 
     [EnableRateLimiting("public-auth")]
@@ -254,15 +253,14 @@ public sealed class SsoController(
 
         await cache.RemoveAsync(BindingCacheKey(request.Code), cancellationToken);
         var roles = await userManager.GetRolesAsync(user);
-        return new LoginResponse(
-            tokenService.Create(user, roles),
-            new CurrentUserResponse(
-                user.Id,
-                user.UserName!,
-                user.DisplayName,
-                roles,
-                user.CollegeId,
-                EffectiveDataScopeResolver.Resolve(roles).ToString()));
+        var session = await authSessionService.CreateAsync(
+            user,
+            roles,
+            request.IsNativeApp
+                ? AuthenticationClientType.App
+                : AuthenticationClientType.Web,
+            cancellationToken);
+        return AuthController.CreateLoginResponse(session);
     }
 
     internal static string NormalizeReturnUrl(string? returnUrl) =>
@@ -325,7 +323,8 @@ public sealed class SsoController(
 public sealed record SsoSettingsResponse(bool Enabled, string DisplayName);
 
 public sealed record SsoExchangeRequest(
-    [Required, MinLength(20), MaxLength(200)] string Code);
+    [Required, MinLength(20), MaxLength(200)] string Code,
+    bool IsNativeApp = false);
 
 public sealed record SsoBindingInfoResponse(
     string ProviderDisplayName,
@@ -334,6 +333,7 @@ public sealed record SsoBindingInfoResponse(
 public sealed record SsoBindRequest(
     [Required, MinLength(20), MaxLength(200)] string Code,
     [Required, MaxLength(100)] string UserName,
-    [Required, MaxLength(100)] string Password);
+    [Required, MaxLength(100)] string Password,
+    bool IsNativeApp = false);
 
 internal sealed record SsoBindingTicket(string Subject, string ExternalUserName);