重构认证授权逻辑，集中到 auth 包中

web/handlers/auth.go

@@ -110,7 +110,7 @@ func Token(c *fiber.Ctx) error {
 		scope := strings.Split(req.Scope, ",")
 		token, err := s.Auth.OauthRefreshToken(c.Context(), client, req.RefreshToken, scope)
 		if err != nil {
-			if errors.Is(err, s.ErrInvalidToken) {
+			if errors.Is(err, auth2.ErrInvalidRefreshToken) {
 				return sendError(c, s.ErrOauthInvalidGrant)
 			}
 			return sendError(c, err)
@@ -226,7 +226,7 @@ func protect(c *fiber.Ctx, grant auth2.GrantType, clientId, clientSecret string)
 }
 
 // 发送成功响应
-func sendSuccess(c *fiber.Ctx, details *s.TokenDetails) error {
+func sendSuccess(c *fiber.Ctx, details *auth2.TokenDetails) error {
 	return c.JSON(TokenResp{
 		AccessToken:  details.AccessToken,
 		TokenType:    "Bearer",
@@ -292,7 +292,7 @@ func Revoke(c *fiber.Ctx) error {
 	}
 
 	// 删除会话
-	err = s.Session.Remove(c.Context(), req.AccessToken, req.RefreshToken)
+	err = auth2.RemoveSession(c.Context(), req.AccessToken, req.RefreshToken)
 	if err != nil {
 		return err
 	}