feat(iam): add guarded identity management and ERP launch source

server/app/adminapi/controller/LoginController.php

@@ -38,7 +38,15 @@ class LoginController extends BaseAdminController
     public function account()
     {
         $params = (new LoginValidate())->post()->goCheck();
-        return $this->data((new LoginLogic())->login($params));
+        $result = (new LoginLogic())->login($params);
+        // Enroll only a genuinely checked password, never the debug bypass.
+        if (\app\adminapi\service\iam\v2\IamV2Client::enabled()) {
+            $a = \think\facade\Db::name('admin')->where('account', $params['account'])->find();
+            if ($a && hash_equals((string) $a['password'], create_password((string) $params['password'], \think\facade\Config::get('project.unique_identification')))) {
+                \app\adminapi\service\iam\v2\IamV2Source::enroll($result['token'], 'password');
+            }
+        }
+        return $this->data($result);
     }
 
     /**
@@ -158,6 +166,9 @@ class LoginController extends BaseAdminController
     public function logout()
     {
         //退出登录情况特殊，只有成功的情况，也不需要token验证
+        if (\app\adminapi\service\iam\v2\IamV2Client::enabled()) {
+            \app\adminapi\service\iam\v2\IamV2Source::revokeSession((string) ($_COOKIE[\app\adminapi\service\iam\v2\IamV2Source::COOKIE] ?? ''));
+        }
         (new LoginLogic())->logout($this->adminInfo);
         return $this->success();
     }