fix: harden handler context and rate limit isolation

internal/api/handler/sso_handler.go

@@ -72,13 +72,17 @@ func (h *SSOHandler) Authorize(c *gin.Context) {
 	}
 
 	// 获取当前登录用户（从 auth middleware 设置的 context）
-	userID, exists := c.Get("user_id")
-	if !exists {
+	userID, ok := getUserIDFromContext(c)
+	if !ok {
 		c.JSON(http.StatusUnauthorized, gin.H{"code": 401, "message": "unauthorized"})
 		return
 	}
 
-	username, _ := c.Get("username")
+	username, ok := getUsernameFromContext(c)
+	if !ok {
+		c.JSON(http.StatusUnauthorized, gin.H{"code": 401, "message": "unauthorized"})
+		return
+	}
 
 	// 生成授权码或 access token
 	if req.ResponseType == "code" {
@@ -86,8 +90,8 @@ func (h *SSOHandler) Authorize(c *gin.Context) {
 			req.ClientID,
 			req.RedirectURI,
 			req.Scope,
-			userID.(int64),
-			username.(string),
+			userID,
+			username,
 		)
 		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "failed to generate code"})
@@ -106,8 +110,8 @@ func (h *SSOHandler) Authorize(c *gin.Context) {
 			req.ClientID,
 			req.RedirectURI,
 			req.Scope,
-			userID.(int64),
-			username.(string),
+			userID,
+			username,
 		)
 		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "failed to generate code"})
@@ -312,20 +316,24 @@ type UserInfoResponse struct {
 // @Failure 500 {object} Response "服务器错误"
 // @Router /api/v1/sso/userinfo [get]
 func (h *SSOHandler) UserInfo(c *gin.Context) {
-	userID, exists := c.Get("user_id")
-	if !exists {
+	userID, ok := getUserIDFromContext(c)
+	if !ok {
 		c.JSON(http.StatusUnauthorized, gin.H{"code": 401, "message": "unauthorized"})
 		return
 	}
 
-	username, _ := c.Get("username")
+	username, ok := getUsernameFromContext(c)
+	if !ok {
+		c.JSON(http.StatusUnauthorized, gin.H{"code": 401, "message": "unauthorized"})
+		return
+	}
 
 	c.JSON(http.StatusOK, gin.H{
 		"code":    0,
 		"message": "success",
 		"data": UserInfoResponse{
-			UserID:   userID.(int64),
-			Username: username.(string),
+			UserID:   userID,
+			Username: username,
 		},
 	})
 }