feat(api)!: fold devices into users and report member presence

Contract 7.0.0 (breaking). Devices become an attribute of the account;
members are managed per user, and only unauthenticated guests keep a
per-terminal registration.

- rename seats -> max_members, seats_used -> members_used,
  seats_full -> members_full, SeatJoined -> JoinResult, the `seats`
  stream control message -> `members`, and POST /channels/{id}/seats ->
  POST /channels/{id}/join (stored channel settings are migrated on start)
- drop per-terminal encrypted device labels and the seat list/release
  endpoints; add GET/DELETE /channels/{id}/guests for guest terminals
- authenticate account members by account session only: the terminal key
  is optional for logged-in accounts, no seat row is written for them,
  and gated-download grants are counted per user (per terminal for guests)
- GET /channels/{id}/members now returns online, devices and
  online_devices per account; presence is tracked in memory from active
  WebSocket/SSE subscriptions and is not pushed over the stream
- owner invitation list no longer returns accounts that already joined

server/src/WebDrop.Api/ApiContract.cs

@@ -2,7 +2,8 @@ namespace WebDrop.Api;
 
 public static class ApiContract
 {
-    // v5 changes channel capacity from per-endpoint devices to account members.
+    // v5: 频道容量按账号成员计;v7: seats 改名 max_members/members_used/members_full,
+    // 去掉设备名与设备清单接口,访客改走 /guests。设备只是账号的属性。
     // Keep this aligned with contracts/api-contract.json and docs/openapi.yaml.
-    public const string Version = "6.0.0";
+    public const string Version = "7.0.0";
 }

server/src/WebDrop.Api/ApiJson.cs

@@ -33,7 +33,7 @@ public sealed class DefaultsBody
 }
 public sealed class SettingChoicesBody
 {
-    [JsonPropertyName("seats")] public required int[] Seats { get; init; }
+    [JsonPropertyName("max_members")] public required int[] MaxMembers { get; init; }
     [JsonPropertyName("ttl_seconds")] public required int[] TtlSeconds { get; init; }
     [JsonPropertyName("file_max_downloads")] public int[] FileMaxDownloads { get; init; } = ServerSettingChoices.FileMaxDownloads;
     [JsonPropertyName("max_visitors")] public required int[] MaxVisitors { get; init; }
@@ -61,7 +61,7 @@ public sealed class LimitsBody
     [JsonPropertyName("max_channel_bytes")] public required long MaxChannelBytes { get; init; }
     [JsonPropertyName("max_workspace_bytes")] public required long MaxWorkspaceBytes { get; init; }
     [JsonPropertyName("max_workspace_channel_bytes")] public required long MaxWorkspaceChannelBytes { get; init; }
-    [JsonPropertyName("max_seats")] public required int MaxSeats { get; init; }
+    [JsonPropertyName("max_members")] public required int MaxMembers { get; init; }
     [JsonPropertyName("max_ttl_seconds")] public required int MaxTtlSeconds { get; init; }
     [JsonPropertyName("min_ttl_seconds")] public required int MinTtlSeconds { get; init; }
     [JsonPropertyName("max_items")] public required int MaxItems { get; init; }
@@ -152,6 +152,13 @@ public sealed class MemberBody
     [JsonPropertyName("username")] public required string Username { get; init; }
     [JsonPropertyName("role")] public required string Role { get; init; }
     [JsonPropertyName("joined_at")] public required long JoinedAt { get; init; }
+
+    /// <summary>该账号此刻在本频道有至少一个活动订阅(WebSocket/SSE)。</summary>
+    [JsonPropertyName("online")] public required bool Online { get; init; }
+
+    /// <summary>该账号在本频道登记过的设备(终端)数;设备只是账号的属性,不是独立成员。</summary>
+    [JsonPropertyName("devices")] public required int Devices { get; init; }
+    [JsonPropertyName("online_devices")] public required int OnlineDevices { get; init; }
 }
 
 public sealed class AccountProfileRequest
@@ -227,8 +234,8 @@ public sealed class WorkspaceGroupCreatedBody
 [JsonSerializable(typeof(FinishShareRequest))]
 [JsonSerializable(typeof(CreateChannelRequest))]
 [JsonSerializable(typeof(ChannelSettingsPatch))]
-[JsonSerializable(typeof(SeatJoined))]
-[JsonSerializable(typeof(List<SeatInfo>))]
+[JsonSerializable(typeof(JoinResult))]
+[JsonSerializable(typeof(List<GuestInfo>))]
 [JsonSerializable(typeof(AppendResult))]
 [JsonSerializable(typeof(AccountRegisterRequest))]
 [JsonSerializable(typeof(AccountDeviceSigningRequest))]

server/src/WebDrop.Api/ChannelHub.cs

@@ -12,6 +12,9 @@ public sealed class ChannelHub : IChannelEvents
     private readonly object _gate = new();
     private readonly Dictionary<Id16, Signal> _signals = [];
 
+    // 在线状态:频道 -> 账号 -> 账号设备 -> 活动订阅数。只记账号,访客没有可跨设备识别的身份,不参与。
+    private readonly Dictionary<Id16, Dictionary<string, Dictionary<string, int>>> _presence = [];
+
     public Subscription Subscribe(Id16 id)
     {
         lock (_gate)
@@ -22,9 +25,57 @@ public sealed class ChannelHub : IChannelEvents
         }
     }
 
+    /// <summary>登记一个活动订阅,释放返回值即下线。只供成员接口读取,不向订阅流推送,以免改变流的线格式。</summary>
+    public IDisposable Connected(Id16 id, string? account, string deviceKey)
+    {
+        if (account is null) return NoPresence.Instance;
+        string endpoint = deviceKey;
+        lock (_gate)
+        {
+            if (!_presence.TryGetValue(id, out var accounts)) _presence[id] = accounts = [];
+            if (!accounts.TryGetValue(account, out var endpoints)) accounts[account] = endpoints = [];
+            endpoints[endpoint] = endpoints.GetValueOrDefault(endpoint) + 1;
+        }
+        return new Connection(() => Disconnected(id, account, endpoint));
+    }
+
+    private void Disconnected(Id16 id, string account, string endpoint)
+    {
+        lock (_gate)
+        {
+            if (_presence.TryGetValue(id, out var accounts) && accounts.TryGetValue(account, out var endpoints) && endpoints.TryGetValue(endpoint, out int count))
+            {
+                if (count <= 1) endpoints.Remove(endpoint); else endpoints[endpoint] = count - 1;
+                if (endpoints.Count == 0) accounts.Remove(account);
+                if (accounts.Count == 0) _presence.Remove(id);
+            }
+        }
+    }
+
+    public (bool Online, int Devices) Presence(Id16 id, string account)
+    {
+        lock (_gate)
+        {
+            return _presence.TryGetValue(id, out var accounts) && accounts.TryGetValue(account, out var endpoints)
+                ? (endpoints.Count > 0, endpoints.Count) : (false, 0);
+        }
+    }
+
+    private sealed class Connection(Action release) : IDisposable
+    {
+        private Action? _release = release;
+        public void Dispose() => Interlocked.Exchange(ref _release, null)?.Invoke();
+    }
+
+    private sealed class NoPresence : IDisposable
+    {
+        public static readonly NoPresence Instance = new();
+        public void Dispose() { }
+    }
+
     public void Advanced(Id16 channelId, long seq) => Publish(channelId, s => s.Seq = Math.Max(s.Seq, seq));
     public void SettingsChanged(Id16 channelId) => Publish(channelId, s => s.SettingsVersion++);
-    public void SeatsChanged(Id16 channelId) => Publish(channelId, s => s.SeatsVersion++);
+    public void MembersChanged(Id16 channelId) => Publish(channelId, s => s.MembersVersion++);
     public void ChannelDeleted(Id16 channelId) => Publish(channelId, s => s.Deleted = true);
 
     private void Publish(Id16 id, Action<Signal> mutate)
@@ -53,7 +104,7 @@ public sealed class ChannelHub : IChannelEvents
         public int Refs;
         public long Seq;
         public int SettingsVersion;
-        public int SeatsVersion;
+        public int MembersVersion;
         public bool Deleted;
 
         public Task Changed => _tcs.Task;
@@ -91,9 +142,9 @@ public sealed class ChannelHub : IChannelEvents
             get { lock (_hub._gate) return _signal.Changed; }
         }
 
-        public (int Settings, int Seats, bool Deleted) State
+        public (int Settings, int MaxMembers, bool Deleted) State
         {
-            get { lock (_hub._gate) return (_signal.SettingsVersion, _signal.SeatsVersion, _signal.Deleted); }
+            get { lock (_hub._gate) return (_signal.SettingsVersion, _signal.MembersVersion, _signal.Deleted); }
         }
 
         public void Dispose()

server/src/WebDrop.Api/Endpoints.ChannelAccess.cs

@@ -47,8 +47,18 @@ public static partial class Endpoints
             if (accountStore.GetPublicKey(username) is null) throw new WebDropException(ErrorCode.NotFound);
             return Json(svc.InvitationPlan(ParseId(id), RequestAuth.FromHeaders(ctx.Request, false), username), ApiJson.Default.InvitationCryptoPlan);
         });
-        api.MapGet("/channels/{id}/members", (string id, HttpContext ctx, ChannelService svc) =>
-            Json(svc.Members(ParseId(id), RequestAuth.FromHeaders(ctx.Request, true)).Select(m => new MemberBody { Username = m.Username, Role = m.Role, JoinedAt = m.JoinedAt }).ToList(), ApiJson.Default.ListMemberBody));
+        api.MapGet("/channels/{id}/members", (string id, HttpContext ctx, ChannelService svc, ChannelHub hub) =>
+        {
+            var channelId = ParseId(id);
+            var members = svc.Members(channelId, RequestAuth.FromHeaders(ctx.Request, true)).Select(member =>
+            {
+                var (online, onlineDevices) = hub.Presence(channelId, member.Username);
+                // 设备是账号的属性:总数取账号的登录设备,在线数取该账号在本频道有订阅的设备
+                return new MemberBody { Username = member.Username, Role = member.Role, JoinedAt = member.JoinedAt,
+                    Online = online, Devices = Math.Max(accounts.Devices(member.Username, null).Count, onlineDevices), OnlineDevices = onlineDevices };
+            }).ToList();
+            return Json(members, ApiJson.Default.ListMemberBody);
+        });
         api.MapPost("/channels/{id}/invitations", async (string id, HttpContext ctx, ChannelService svc, CancellationToken ct) =>
         {
             var req = await ReadJson(ctx.Request, ApiJson.Default.InvitationRequest, ct);

server/src/WebDrop.Api/Endpoints.cs

@@ -32,7 +32,7 @@ public static partial class Endpoints
             Defaults = new DefaultsBody { Channel = CreationDefaults.Channel(limits), Share = CreationDefaults.Share(limits) },
             Choices = new SettingChoicesBody
             {
-                Seats = new[] { 2, 3, 5, 10, limits.MaxSeats }.Where(n => n >= 1 && n <= limits.MaxSeats).Distinct().Order().ToArray(),
+                MaxMembers = new[] { 2, 3, 5, 10, limits.MaxMembers }.Where(n => n >= 1 && n <= limits.MaxMembers).Distinct().Order().ToArray(),
                 TtlSeconds = new[] { 3600, 86_400, 604_800, limits.MinTtlSeconds, limits.MaxTtlSeconds, CreationDefaults.Channel(limits).TtlSeconds }
                     .Where(n => n >= limits.MinTtlSeconds && n <= limits.MaxTtlSeconds).Distinct().Order().ToArray(),
                 MaxVisitors = new[] { 0, 2, 5, 10, 20, limits.MaxVisitors }.Where(n => n <= limits.MaxVisitors).Distinct().Order().ToArray(),
@@ -44,7 +44,7 @@ public static partial class Endpoints
                 MaxChannelBytes = limits.MaxChannelBytes,
                 MaxWorkspaceBytes = limits.MaxWorkspaceBytes,
                 MaxWorkspaceChannelBytes = limits.MaxWorkspaceChannelBytes,
-                MaxSeats = limits.MaxSeats,
+                MaxMembers = limits.MaxMembers,
                 MaxTtlSeconds = limits.MaxTtlSeconds,
                 MinTtlSeconds = limits.MinTtlSeconds,
                 MaxItems = limits.MaxItemsLimit,
@@ -85,42 +85,24 @@ public static partial class Endpoints
             return Results.NoContent();
         });
 
-        // ───────── 席位 ─────────
+        // ───────── 加入 ─────────
 
-        api.MapPost("/channels/{id}/seats", async (string id, HttpContext ctx, ChannelService svc, CancellationToken ct) =>
+        api.MapPost("/channels/{id}/join", async (string id, HttpContext ctx, ChannelService svc, CancellationToken ct) =>
         {
             var request = ctx.Request.ContentType?.StartsWith("application/json", StringComparison.OrdinalIgnoreCase) == true ? await ReadJson(ctx.Request, ApiJson.Default.JoinRequest, ct) : new JoinRequest();
-            return Json(svc.Join(ParseId(id), RequestAuth.FromHeaders(ctx.Request, requireEndpoint: true), request.Password), ApiJson.Default.SeatJoined);
+            return Json(svc.Join(ParseId(id), RequestAuth.FromHeaders(ctx.Request, requireEndpoint: true), request.Password), ApiJson.Default.JoinResult);
         });
 
         MapChannelAccess(api, accounts);
 
-        api.MapGet("/channels/{id}/seats", (string id, HttpContext ctx, ChannelService svc) =>
-        {
-            var seats = svc.ListSeats(ParseId(id), RequestAuth.FromHeaders(ctx.Request, requireEndpoint: false));
-            return Json([.. seats], ApiJson.Default.ListSeatInfo);
-        });
+        // 访客是未登录的终端;账号成员只按用户管理(members / invitations),设备不对外列出
+        api.MapGet("/channels/{id}/guests", (string id, HttpContext ctx, ChannelService svc) =>
+            Json([.. svc.ListGuests(ParseId(id), RequestAuth.FromHeaders(ctx.Request, requireEndpoint: false))], ApiJson.Default.ListGuestInfo));
 
-        api.MapPut("/channels/{id}/seats/me", async (string id, HttpContext ctx, ChannelService svc, ServerLimits limits, CancellationToken ct) =>
-        {
-            var creds = RequestAuth.FromHeaders(ctx.Request, requireEndpoint: true);
-            byte[] label = await ReadBody(ctx.Request, limits.MaxSeatLabelBytes, ct);
-            svc.SetSeatLabel(ParseId(id), creds, label);
-            return Results.NoContent();
-        });
-
-        api.MapPut("/channels/{id}/seats/{endpointHash}/label", async (string id, string endpointHash, HttpContext ctx, ChannelService svc, ServerLimits limits, CancellationToken ct) =>
+        api.MapDelete("/channels/{id}/guests/{endpointHash}", (string id, string endpointHash, HttpContext ctx, ChannelService svc) =>
         {
             if (!Codec.TryDecodeExact(endpointHash, TokenHash.Size, out var hash)) throw new WebDropException(ErrorCode.BadRequest);
-            byte[] label = await ReadBody(ctx.Request, limits.MaxSeatLabelBytes, ct);
-            svc.SetSeatLabelForEndpoint(ParseId(id), RequestAuth.FromHeaders(ctx.Request, requireEndpoint: false), hash, label);
-            return Results.NoContent();
-        });
-
-        api.MapDelete("/channels/{id}/seats/{endpointHash}", (string id, string endpointHash, HttpContext ctx, ChannelService svc) =>
-        {
-            if (!Codec.TryDecodeExact(endpointHash, TokenHash.Size, out var hash)) throw new WebDropException(ErrorCode.BadRequest);
-            svc.ReleaseSeat(ParseId(id), RequestAuth.FromHeaders(ctx.Request, requireEndpoint: false), hash);
+            svc.ReleaseGuest(ParseId(id), RequestAuth.FromHeaders(ctx.Request, requireEndpoint: false), hash);
             return Results.NoContent();
         });
 

server/src/WebDrop.Api/LogStreamer.cs

@@ -29,6 +29,7 @@ public static class LogStreamer
     {
         using var sub = hub.Subscribe(id);
         ILogSink? sink = null;
+        IDisposable? presence = null;
         long cursor = from;
         var (settingsV, seatsV, _) = sub.State;
 
@@ -40,6 +41,8 @@ public static class LogStreamer
                 var changed = sub.Changed; // 先取任务再读状态:读取期间的发布不会丢
                 var page = await svc.ReadLogAsync(id, creds, cursor, PageSize, ct).ConfigureAwait(false);
                 sink ??= await open().ConfigureAwait(false);
+                // 鉴权与首次读取都成功之后才算在线
+                presence ??= hub.Connected(id, creds.AccountName, creds.AccountDeviceId ?? Convert.ToHexString(creds.EndpointHash));
 
                 foreach (var record in page.Records)
                 {
@@ -56,7 +59,7 @@ public static class LogStreamer
                 if (seatsNow != seatsV)
                 {
                     seatsV = seatsNow;
-                    await sink.SendControlAsync("""{"t":"seats"}""", ct).ConfigureAwait(false);
+                    await sink.SendControlAsync("""{"t":"members"}""", ct).ConfigureAwait(false);
                 }
                 if (deleted) throw new WebDropException(ErrorCode.NotFound);
 
@@ -80,6 +83,10 @@ public static class LogStreamer
         {
             await sink.FailAsync(e.Code, CancellationToken.None).ConfigureAwait(false);
         }
+        finally
+        {
+            presence?.Dispose();
+        }
     }
 }
 

server/src/WebDrop.Api/RequestAuth.cs

@@ -35,7 +35,8 @@ public static class RequestAuth
             deviceId = accounts.SessionDevice(accountToken);
         }
         if (role == Role.Owner && accountName is null) throw new WebDropException(ErrorCode.AccountRequired);
-        return new Credentials(role, token, ParseEndpoint(req.Headers[EndpointHeader].ToString(), requireEndpoint), accountName, deviceId, accountName is not null);
+        // 账号以会话鉴权,终端密钥只对未登录访客是必需的
+        return new Credentials(role, token, ParseEndpoint(req.Headers[EndpointHeader].ToString(), requireEndpoint && accountName is null), accountName, deviceId, accountName is not null);
     }
 
     /// <summary>
@@ -68,7 +69,7 @@ public static class RequestAuth
         }
         var parsedRole = ParseRole(role);
         if (parsedRole == Role.Owner && accountName is null) throw new WebDropException(ErrorCode.AccountRequired);
-        return new Credentials(parsedRole, token, ParseEndpoint(endpoint, requireEndpoint: true), accountName, deviceId, accountName is not null);
+        return new Credentials(parsedRole, token, ParseEndpoint(endpoint, requireEndpoint: accountName is null), accountName, deviceId, accountName is not null);
     }
 
     public static byte[] ParseEndpointHash(string? header) => ParseEndpoint(header, requireEndpoint: true);

server/src/WebDrop.Core/Abstractions.cs

@@ -42,7 +42,7 @@ public interface IChannelEvents
 {
     void Advanced(Id16 channelId, long seq);
     void SettingsChanged(Id16 channelId);
-    void SeatsChanged(Id16 channelId);
+    void MembersChanged(Id16 channelId);
     void ChannelDeleted(Id16 channelId);
 }
 
@@ -50,7 +50,7 @@ public sealed class NullChannelEvents : IChannelEvents
 {
     public void Advanced(Id16 channelId, long seq) { }
     public void SettingsChanged(Id16 channelId) { }
-    public void SeatsChanged(Id16 channelId) { }
+    public void MembersChanged(Id16 channelId) { }
     public void ChannelDeleted(Id16 channelId) { }
 }
 
@@ -130,7 +130,6 @@ public interface IResourceTx
     int CountMembers(Id16 channelId);
     void InsertSeat(Id16 channelId, Seat seat);
     bool DeleteSeat(Id16 channelId, ReadOnlySpan<byte> endpointHash);
-    void SetSeatLabel(Id16 channelId, ReadOnlySpan<byte> endpointHash, byte[] label);
     IReadOnlyList<Seat> ListSeats(Id16 channelId);
 
     // 条目

server/src/WebDrop.Core/ChannelAdmission.cs

@@ -56,7 +56,7 @@ public sealed partial class ChannelService
             tx.DenyAccount(id, username);
             return 0;
         });
-        events.SeatsChanged(id);
+        events.MembersChanged(id);
     }
 
     public IReadOnlyList<ChannelMember> Members(Id16 id, Credentials creds) => store.Read(tx =>
@@ -72,7 +72,7 @@ public sealed partial class ChannelService
     public void ReleaseAccountDevice(string username, string deviceId)
     {
         var channels = store.Write(tx => tx.DeleteDeviceSeats(username, deviceId));
-        foreach (var id in channels) events.SeatsChanged(id);
+        foreach (var id in channels) events.MembersChanged(id);
     }
 
     public void SaveOwnerKeyPackage(Id16 id, Credentials creds, string payload)

server/src/WebDrop.Core/ChannelService.cs

@@ -59,7 +59,6 @@ public sealed partial class ChannelService(
             tx.PutWorkspace(id, NewWorkspace(creatorAccount, now));
             tx.PutChannelMember(id, new ChannelMember(creatorAccount, "owner", now));
             if (req.KeyPackage is not null) tx.PutKeyPackage(id, creatorAccount, req.KeyPackage, now);
-            tx.InsertSeat(id, new Seat(endpointHash, now, null, creatorAccount, accountDeviceId));
             return 0;
         });
         return ToInfo(channel, 1);
@@ -112,92 +111,60 @@ public sealed partial class ChannelService(
 
     // ───────────────────────── 席位 ─────────────────────────
 
-    public SeatJoined Join(Id16 id, Credentials creds, string? password = null)
+    /// <summary>
+    /// 加入频道。账号成员只登记成员关系(同一账号的多台设备不增加人数,也不登记终端);
+    /// 未登录访客登记终端,每个终端按一个访客成员计入上限。
+    /// </summary>
+    public JoinResult Join(Id16 id, Credentials creds, string? password = null)
     {
         var (joined, isNew) = store.Write(tx =>
         {
             var (channel, principal) = Authenticate(tx, id, creds, SeatRule.None);
-            var existing = tx.GetSeat(id, principal.EndpointHash);
-            if (existing?.AccountName is not null && existing.AccountName != creds.AccountName) throw new WebDropException(ErrorCode.AccountRequired);
-            if (existing?.AccountDeviceId is not null && existing.AccountDeviceId != creds.AccountDeviceId) throw new WebDropException(ErrorCode.AccountRequired);
             int membersUsed = tx.CountMembers(id);
-            bool accountAlreadyMember = creds.AccountName is not null && tx.GetChannelMember(id, creds.AccountName) is not null;
-            if (existing is not null)
+            JoinResult Result(long joinedAt, int used) => new() { JoinedAt = joinedAt, MembersUsed = used, MembersMax = channel.Settings.MaxMembers };
+
+            if (creds.AccountName is not null)
             {
-                if (existing.AccountName is not null && existing.AccountDeviceId is null && creds.AccountDeviceId is not null)
-                    tx.BindSeatDevice(id, principal.EndpointHash, creds.AccountDeviceId);
-                return (new SeatJoined { EndpointHash = Codec.Encode(existing.EndpointHash), JoinedAt = existing.JoinedAt, SeatsUsed = membersUsed, SeatsMax = channel.Settings.Seats }, false);
+                if (tx.GetChannelMember(id, creds.AccountName) is { } existingMember) return (Result(existingMember.JoinedAt, membersUsed), false);
+                CheckAdmission(tx, channel, creds, password);
+                if (membersUsed >= channel.Settings.MaxMembers) throw new WebDropException(ErrorCode.MembersFull);
+                long memberAt = clock.NowMs;
+                tx.PutChannelMember(id, new ChannelMember(creds.AccountName, "member", memberAt));
+                return (Result(memberAt, membersUsed + 1), true);
             }
 
+            if (tx.GetSeat(id, principal.EndpointHash) is { } existing) return (Result(existing.JoinedAt, membersUsed), false);
             CheckAdmission(tx, channel, creds, password);
-
-            bool newMember = creds.AccountName is null || !accountAlreadyMember;
-            if (newMember && membersUsed >= channel.Settings.Seats) throw new WebDropException(ErrorCode.SeatsFull);
+            if (membersUsed >= channel.Settings.MaxMembers) throw new WebDropException(ErrorCode.MembersFull);
             long now = clock.NowMs;
-            tx.InsertSeat(id, new Seat(principal.EndpointHash, now, null, creds.AccountName, creds.AccountDeviceId));
-            if (creds.AccountName is not null) tx.PutChannelMember(id, new ChannelMember(creds.AccountName, "member", now));
-            return (new SeatJoined { EndpointHash = Codec.Encode(principal.EndpointHash), JoinedAt = now, SeatsUsed = membersUsed + (newMember ? 1 : 0), SeatsMax = channel.Settings.Seats }, true);
+            tx.InsertSeat(id, new Seat(principal.EndpointHash, now));
+            return (Result(now, membersUsed + 1), true);
         });
-        if (isNew) events.SeatsChanged(id);
+        if (isNew) events.MembersChanged(id);
         return joined;
     }
 
-    public IReadOnlyList<SeatInfo> ListSeats(Id16 id, Credentials creds) => store.Read(tx =>
+    /// <summary>所有者查看访客(未登录终端)。账号成员按用户管理,其设备不对外列出。</summary>
+    public IReadOnlyList<GuestInfo> ListGuests(Id16 id, Credentials creds) => store.Read(tx =>
     {
         var (_, principal) = Authenticate(tx, id, creds, SeatRule.None);
         RequireOwner(principal);
-        return (IReadOnlyList<SeatInfo>)tx.ListSeats(id).Select(s => new SeatInfo
-        {
-            EndpointHash = Codec.Encode(s.EndpointHash),
-            JoinedAt = s.JoinedAt,
-            Label = s.Label is null ? null : Codec.Encode(s.Label),
-            AccountName = s.AccountName,
-        }).ToList();
+        return (IReadOnlyList<GuestInfo>)tx.ListSeats(id).Where(s => s.AccountName is null)
+            .Select(s => new GuestInfo { EndpointHash = Codec.Encode(s.EndpointHash), JoinedAt = s.JoinedAt }).ToList();
     });
 
-    public void SetSeatLabel(Id16 id, Credentials creds, byte[] label)
-    {
-        ValidateSeatLabel(label);
-        store.Write(tx =>
-        {
-            var (_, principal) = Authenticate(tx, id, creds, SeatRule.Required);
-            tx.SetSeatLabel(id, principal.EndpointHash, label);
-            return 0;
-        });
-        events.SeatsChanged(id);
-    }
-
-    public void SetSeatLabelForEndpoint(Id16 id, Credentials creds, byte[] endpointHash, byte[] label)
-    {
-        ValidateSeatLabel(label);
-        store.Write(tx =>
-        {
-            var (_, principal) = Authenticate(tx, id, creds, SeatRule.None);
-            RequireOwner(principal);
-            if (tx.GetSeat(id, endpointHash) is null) throw new WebDropException(ErrorCode.NotFound);
-            tx.SetSeatLabel(id, endpointHash, label);
-            return 0;
-        });
-        events.SeatsChanged(id);
-    }
-
-    private void ValidateSeatLabel(byte[] label)
-    {
-        if (label.Length == 0) throw new WebDropException(ErrorCode.BadRequest);
-        if (label.Length > limits.MaxSeatLabelBytes) throw new WebDropException(ErrorCode.TooLarge);
-    }
-
-    public void ReleaseSeat(Id16 id, Credentials creds, byte[] endpointHash)
+    /// <summary>所有者移除一个访客终端并禁止它再加入。账号成员改用撤销邀请(RevokeInvitation)。</summary>
+    public void ReleaseGuest(Id16 id, Credentials creds, byte[] endpointHash)
     {
         store.Write(tx =>
         {
             var (_, principal) = Authenticate(tx, id, creds, SeatRule.None);
             RequireOwner(principal);
-            if (!tx.DeleteSeat(id, endpointHash)) throw new WebDropException(ErrorCode.NotFound);
+            if (tx.GetSeat(id, endpointHash) is not { AccountName: null } || !tx.DeleteSeat(id, endpointHash)) throw new WebDropException(ErrorCode.NotFound);
             tx.DenyEndpoint(id, endpointHash);
             return 0;
         });
-        events.SeatsChanged(id);
+        events.MembersChanged(id);
     }
 
     // ───────────────────────── 追加帧 ─────────────────────────
@@ -505,7 +472,7 @@ public sealed partial class ChannelService(
             if (item.ExpiresAt <= now) throw new WebDropException(ErrorCode.Gone);
             if (item.CloseDeadline is { } deadline && (fromIndex == 0 || now >= deadline))
                 throw new WebDropException(ErrorCode.Gone);
-            if (item.IsGated && fromIndex > 0 && !tx.HasDownloadGrant(id, itemId, principal.EndpointHash))
+            if (item.IsGated && fromIndex > 0 && !tx.HasDownloadGrant(id, itemId, principal.GrantKey))
                 throw new WebDropException(ErrorCode.Gone);
 
             if (fromIndex == 0 && item.IsGated)
@@ -518,7 +485,7 @@ public sealed partial class ChannelService(
                     ? now + limits.DownloadGraceSeconds * 1000L
                     : item.CloseDeadline;
                 tx.UpdateItem(item with { Downloads = downloads, CloseDeadline = closeAt });
-                tx.AddDownloadGrant(id, itemId, principal.EndpointHash);
+                tx.AddDownloadGrant(id, itemId, principal.GrantKey);
             }
             return 0;
         });
@@ -536,7 +503,7 @@ public sealed partial class ChannelService(
             var item = tx.GetItem(id, itemId) ?? throw new WebDropException(ErrorCode.NotFound);
             if (!CanReadObject(tx, space, principal, itemId)) throw new WebDropException(ErrorCode.Forbidden);
             if (item.ExpiresAt <= clock.NowMs) throw new WebDropException(ErrorCode.Gone);
-            if (item.IsGated && !tx.HasDownloadGrant(id, itemId, principal.EndpointHash))
+            if (item.IsGated && !tx.HasDownloadGrant(id, itemId, principal.GrantKey))
                 throw new WebDropException(ErrorCode.Gone);
             if (item.CloseDeadline is { } d && clock.NowMs >= d) throw new WebDropException(ErrorCode.Gone);
 
@@ -712,12 +679,12 @@ public sealed partial class ChannelService(
         var role = VerifyRole(channel, creds);
         var member = creds.AccountName is null ? null : tx.GetChannelMember(id, creds.AccountName);
         if (role == Role.Owner && member?.Role != "owner") throw new WebDropException(ErrorCode.AccountRequired);
-        if (seat == SeatRule.Required)
+        if (seat == SeatRule.Required && member is null)
         {
+            // 账号成员只凭账号会话鉴权,不再需要终端登记;未登录访客必须先有终端登记
             var endpoint = tx.GetSeat(id, creds.EndpointHash);
             if (endpoint is null) throw new WebDropException(ErrorCode.NotJoined);
-            if (endpoint.AccountName is not null && (endpoint.AccountName != creds.AccountName || member is null)) throw new WebDropException(ErrorCode.AccountRequired);
-            if (endpoint.AccountDeviceId is not null && endpoint.AccountDeviceId != creds.AccountDeviceId) throw new WebDropException(ErrorCode.AccountRequired);
+            if (endpoint.AccountName is not null) throw new WebDropException(ErrorCode.AccountRequired);
         }
         return (channel, new Principal(role, creds.EndpointHash, creds.AccountName));
     }
@@ -755,7 +722,7 @@ public sealed partial class ChannelService(
         PasswordRequired = channel.JoinPasswordHash is not null,
         Mode = channel.Mode,
         Settings = channel.Settings,
-        SeatsUsed = membersUsed,
+        MembersUsed = membersUsed,
         OldestSeq = channel.CompactedThrough + 1,
         LastSeq = channel.LastSeq,
         CreatedAt = channel.CreatedAt,

server/src/WebDrop.Core/Dtos.cs

@@ -60,7 +60,7 @@ public sealed class ChannelInfo
     [JsonPropertyName("mode")] public required ChannelMode Mode { get; init; }
     [JsonPropertyName("settings")] public required ChannelSettings Settings { get; init; }
     /// <summary>v5: 账号成员数加匿名访客终端数,不统计账号设备数。</summary>
-    [JsonPropertyName("seats_used")] public required int SeatsUsed { get; init; }
+    [JsonPropertyName("members_used")] public required int MembersUsed { get; init; }
 
     /// <summary>从该 seq 起的续传有效;0 &lt; from &lt; oldest_seq 的续传会得到 410,需从 0 全量同步。</summary>
     [JsonPropertyName("oldest_seq")] public required long OldestSeq { get; init; }
@@ -70,21 +70,19 @@ public sealed class ChannelInfo
     [JsonPropertyName("expires_at")] public required long ExpiresAt { get; init; }
 }
 
-public sealed class SeatJoined
+public sealed class JoinResult
 {
-    [JsonPropertyName("endpoint_hash")] public required string EndpointHash { get; init; }
     [JsonPropertyName("joined_at")] public required long JoinedAt { get; init; }
     /// <summary>加入后的成员人数,同一账号的其他终端不增加此值。</summary>
-    [JsonPropertyName("seats_used")] public required int SeatsUsed { get; init; }
-    [JsonPropertyName("seats_max")] public required int SeatsMax { get; init; }
+    [JsonPropertyName("members_used")] public required int MembersUsed { get; init; }
+    [JsonPropertyName("members_max")] public required int MembersMax { get; init; }
 }
 
-public sealed class SeatInfo
+/// <summary>未登录访客的一次加入(终端)。账号成员按用户管理,不在这里出现。</summary>
+public sealed class GuestInfo
 {
-    [JsonPropertyName("account_name")] public string? AccountName { get; init; }
     [JsonPropertyName("endpoint_hash")] public required string EndpointHash { get; init; }
     [JsonPropertyName("joined_at")] public required long JoinedAt { get; init; }
-    [JsonPropertyName("label")] public string? Label { get; init; }
 }
 
 public sealed class AppendResult

server/src/WebDrop.Core/Errors.cs

@@ -6,7 +6,7 @@ public enum ErrorCode
     Unauthorized,
     Forbidden,
     NotJoined,
-    SeatsFull,
+    MembersFull,
     ModeMismatch,
     NotFound,
     Conflict,
@@ -47,7 +47,7 @@ public static class ErrorCodes
         ErrorCode.Unauthorized => "unauthorized",
         ErrorCode.Forbidden => "forbidden",
         ErrorCode.NotJoined => "not_joined",
-        ErrorCode.SeatsFull => "seats_full",
+        ErrorCode.MembersFull => "members_full",
         ErrorCode.ModeMismatch => "mode_mismatch",
         ErrorCode.NotFound => "not_found",
         ErrorCode.Conflict => "conflict",
@@ -70,7 +70,7 @@ public static class ErrorCodes
     {
         ErrorCode.BadRequest => 400,
         ErrorCode.Unauthorized => 401,
-        ErrorCode.Forbidden or ErrorCode.NotJoined or ErrorCode.SeatsFull or ErrorCode.ModeMismatch => 403,
+        ErrorCode.Forbidden or ErrorCode.NotJoined or ErrorCode.MembersFull or ErrorCode.ModeMismatch => 403,
         ErrorCode.NotFound => 404,
         ErrorCode.Conflict => 409,
         ErrorCode.Sealed => 409,

server/src/WebDrop.Core/Models.cs

@@ -82,7 +82,8 @@ public sealed record Item(
     public bool IsComplete => FinalIndex is { } f && FrameCount == f + 1;
 }
 
-public sealed record Seat(byte[] EndpointHash, long JoinedAt, byte[]? Label, string? AccountName = null, string? AccountDeviceId = null);
+/// <summary>频道内的终端登记(账号设备或访客终端)。设备只是账号的属性,不是成员;不再有单独的设备名。</summary>
+public sealed record Seat(byte[] EndpointHash, long JoinedAt, string? AccountName = null, string? AccountDeviceId = null);
 public sealed record ChannelInvitation(Id16 ChannelId, string Username, string Payload, long CreatedAt);
 public sealed record ChannelMember(string Username, string Role, long JoinedAt);
 public sealed record ChannelKeyPackage(Id16 ChannelId, string Username, string Role, string Payload, long CreatedAt);
@@ -101,7 +102,13 @@ public sealed record StoredFrame(
 public sealed record LogEntry(long Seq, LogKind Kind, Id16 ItemId, uint FrameIndex, byte Aux, long CreatedAt);
 
 /// <summary>一次请求验证通过后的身份。</summary>
-public sealed record Principal(Role Role, byte[] EndpointHash, string? AccountName = null);
+public sealed record Principal(Role Role, byte[] EndpointHash, string? AccountName = null)
+{
+    /// <summary>受限下载的计数单位:账号按用户计(设备只是账号的属性),访客按终端计。</summary>
+    public byte[] GrantKey => AccountName is null
+        ? EndpointHash
+        : System.Security.Cryptography.SHA256.HashData(System.Text.Encoding.UTF8.GetBytes("webdrop/grant/v1/" + AccountName));
+}
 
 /// <summary>请求携带的凭据,尚未验证。</summary>
 public sealed record Credentials(Role ClaimedRole, byte[]? Token, byte[] EndpointHash, string? AccountName = null, string? AccountDeviceId = null,

server/src/WebDrop.Core/Settings.cs

@@ -11,7 +11,7 @@ public sealed class ServerLimits
     public long MaxWorkspaceBytes { get; set; } = 1L << 40;
     public long MaxWorkspaceChannelBytes { get; set; } = 10L << 30;
     /// <summary>最大账号成员数。属性名和 info 字段保持旧线格式兼容。</summary>
-    public int MaxSeats { get; set; } = 64;
+    public int MaxMembers { get; set; } = 64;
     public int MaxVisitors { get; set; } = 10_000;
     public int MinTtlSeconds { get; set; } = 60;
     public int MaxTtlSeconds { get; set; } = 604_800;
@@ -19,7 +19,6 @@ public sealed class ServerLimits
     public int InlineThresholdBytes { get; set; } = 64 * 1024;
     public int DownloadGraceSeconds { get; set; } = 300;
     public int TombstoneRetentionSeconds { get; set; } = 604_800;
-    public int MaxSeatLabelBytes { get; set; } = 256;
 }
 
 public static class ServerSettingChoices
@@ -35,7 +34,7 @@ public sealed class ChannelSettings
     [JsonPropertyName("allow_guests")] public bool AllowGuests { get; set; } = true;
     [JsonPropertyName("name")] public string? Name { get; set; }
     /// <summary>成员人数上限;线字段名保留为 seats 以兼容已有频道设置。</summary>
-    [JsonPropertyName("seats")] public int Seats { get; set; } = 2;
+    [JsonPropertyName("max_members")] public int MaxMembers { get; set; } = 2;
     [JsonPropertyName("members_can_upload")] public bool MembersCanUpload { get; set; } = true;
     [JsonPropertyName("delete_policy")] public DeletePolicy DeletePolicy { get; set; } = DeletePolicy.Own;
     [JsonPropertyName("ttl_seconds")] public int TtlSeconds { get; set; } = 86_400;
@@ -47,7 +46,7 @@ public sealed class ChannelSettings
     {
         if (!Enum.IsDefined(JoinPolicy)) throw new WebDropException(ErrorCode.BadRequest);
         if (Name is { } name && (name.Length > 48 || name.Any(char.IsControl))) throw new WebDropException(ErrorCode.BadRequest);
-        if (Seats < 1 || Seats > limits.MaxSeats) throw new WebDropException(ErrorCode.BadRequest);
+        if (MaxMembers < 1 || MaxMembers > limits.MaxMembers) throw new WebDropException(ErrorCode.BadRequest);
         if (TtlSeconds < limits.MinTtlSeconds || TtlSeconds > limits.MaxTtlSeconds) throw new WebDropException(ErrorCode.BadRequest);
         if (MaxItems < 1 || MaxItems > limits.MaxItemsLimit) throw new WebDropException(ErrorCode.BadRequest);
         if (FileMaxDownloads < 0) throw new WebDropException(ErrorCode.BadRequest);
@@ -60,7 +59,7 @@ public sealed class ChannelSettingsPatch
     [JsonPropertyName("allow_guests")] public bool? AllowGuests { get; init; }
     [JsonPropertyName("join_password")] public string? JoinPassword { get; init; }
     [JsonPropertyName("name")] public string? Name { get; init; }
-    [JsonPropertyName("seats")] public int? Seats { get; init; }
+    [JsonPropertyName("max_members")] public int? MaxMembers { get; init; }
     [JsonPropertyName("members_can_upload")] public bool? MembersCanUpload { get; init; }
     [JsonPropertyName("delete_policy")] public DeletePolicy? DeletePolicy { get; init; }
     [JsonPropertyName("ttl_seconds")] public int? TtlSeconds { get; init; }
@@ -73,7 +72,7 @@ public sealed class ChannelSettingsPatch
         JoinPolicy = JoinPolicy ?? s.JoinPolicy,
         AllowGuests = AllowGuests ?? s.AllowGuests,
         Name = Name is null ? s.Name : string.IsNullOrWhiteSpace(Name) ? null : Name.Trim(),
-        Seats = Seats ?? s.Seats,
+        MaxMembers = MaxMembers ?? s.MaxMembers,
         MembersCanUpload = MembersCanUpload ?? s.MembersCanUpload,
         DeletePolicy = DeletePolicy ?? s.DeletePolicy,
         TtlSeconds = TtlSeconds ?? s.TtlSeconds,
@@ -120,7 +119,7 @@ public static class CreationDefaults
     public static ChannelSettings Channel(ServerLimits limits) => new()
     {
         JoinPolicy = JoinPolicy.Invite, AllowGuests = false,
-        Seats = Math.Min(10, limits.MaxSeats),
+        MaxMembers = Math.Min(10, limits.MaxMembers),
         TtlSeconds = Math.Clamp(86_400, limits.MinTtlSeconds, limits.MaxTtlSeconds),
         MaxItems = Math.Min(1000, limits.MaxItemsLimit),
     };

server/src/WebDrop.Storage/SqliteChannelStore.cs

@@ -37,6 +37,8 @@ public sealed class SqliteChannelStore : IResourceStore, IDisposable
             columns.CommandText = "SELECT COUNT(*) FROM pragma_table_info('seats') WHERE name='account_device_id'";
             if ((long)columns.ExecuteScalar()! == 0) Exec(_writeConn, "ALTER TABLE seats ADD COLUMN account_device_id TEXT;");
         }
+        // v7: 设置里的成员人数上限由 seats 改名为 max_members,迁移已有频道的设置 JSON(幂等)
+        Exec(_writeConn, "UPDATE channels SET settings = json_remove(json_set(settings, '$.max_members', json_extract(settings, '$.seats')), '$.seats') WHERE json_extract(settings, '$.seats') IS NOT NULL AND json_extract(settings, '$.max_members') IS NULL;");
         // Additive table: retain the running v2 database and its existing channel data.
         Exec(_writeConn, """
             CREATE TABLE IF NOT EXISTS channel_key_packages (
@@ -456,7 +458,7 @@ public sealed class SqliteChannelStore : IResourceStore, IDisposable
         public bool HasInvitation(Id16 id, string username) => Scalar("SELECT 1 FROM channel_invitations WHERE channel_id=@id AND username=@u", ("@id", id.ToArray()), ("@u", username)) is not null;
         public void PutInvitation(ChannelInvitation i) => Run("INSERT INTO channel_invitations(channel_id,username,payload,created_at) VALUES(@id,@u,@p,@t) ON CONFLICT(channel_id,username) DO UPDATE SET payload=excluded.payload,created_at=excluded.created_at", ("@id", i.ChannelId.ToArray()), ("@u", i.Username), ("@p", i.Payload), ("@t", i.CreatedAt));
         private static ChannelInvitation MapInvitation(SqliteDataReader r) => new(IdAt(r, 0), r.GetString(1), r.GetString(2), r.GetInt64(3));
-        public IReadOnlyList<ChannelInvitation> ListInvitations(Id16 id) => Many("SELECT channel_id,username,payload,created_at FROM channel_invitations WHERE channel_id=@id", MapInvitation, ("@id", id.ToArray()));
+        public IReadOnlyList<ChannelInvitation> ListInvitations(Id16 id) => Many("SELECT channel_id,username,payload,created_at FROM channel_invitations i WHERE channel_id=@id AND NOT EXISTS (SELECT 1 FROM channel_members m WHERE m.channel_id=i.channel_id AND m.username=i.username)", MapInvitation, ("@id", id.ToArray()));
         public IReadOnlyList<ChannelInvitation> ListUserInvitations(string username) => Many("SELECT i.channel_id,i.username,i.payload,i.created_at FROM channel_invitations i JOIN channels c ON c.id=i.channel_id WHERE i.username=@u AND c.expires_at>@now AND NOT EXISTS (SELECT 1 FROM channel_members m WHERE m.channel_id=i.channel_id AND m.username=i.username)", MapInvitation, ("@u", username), ("@now", DateTimeOffset.UtcNow.ToUnixTimeMilliseconds()));
         public void DeleteInvitation(Id16 id, string username) => Run("DELETE FROM channel_invitations WHERE channel_id=@id AND username=@u", ("@id", id.ToArray()), ("@u", username));
         public void PutKeyPackage(Id16 id, string username, string payload, long createdAt) => Run(
@@ -513,7 +515,7 @@ public sealed class SqliteChannelStore : IResourceStore, IDisposable
 
         // ───────── 席位 ─────────
 
-        private static Seat MapSeat(SqliteDataReader r) => new(Blob(r, 0), r.GetInt64(1), BlobOrNull(r, 2), r.IsDBNull(3) ? null : r.GetString(3), r.IsDBNull(4) ? null : r.GetString(4));
+        private static Seat MapSeat(SqliteDataReader r) => new(Blob(r, 0), r.GetInt64(1), r.IsDBNull(3) ? null : r.GetString(3), r.IsDBNull(4) ? null : r.GetString(4));
 
         public Seat? GetSeat(Id16 channelId, ReadOnlySpan<byte> endpointHash) => One(
             "SELECT endpoint_hash, joined_at, label, account_name,account_device_id FROM seats WHERE channel_id=@c AND endpoint_hash=@e",
@@ -526,17 +528,13 @@ public sealed class SqliteChannelStore : IResourceStore, IDisposable
             (int)(long)Scalar("SELECT (SELECT COUNT(*) FROM channel_members WHERE channel_id=@c) + (SELECT COUNT(*) FROM seats WHERE channel_id=@c AND account_name IS NULL)", ("@c", channelId.ToArray()))!;
 
         public void InsertSeat(Id16 channelId, Seat seat) => Run(
-            "INSERT INTO seats (channel_id, endpoint_hash, label, joined_at,account_name,account_device_id) VALUES (@c,@e,@l,@j,@a,@d)",
-            ("@c", channelId.ToArray()), ("@e", seat.EndpointHash), ("@l", seat.Label), ("@j", seat.JoinedAt), ("@a", seat.AccountName), ("@d", seat.AccountDeviceId));
+            "INSERT INTO seats (channel_id, endpoint_hash, joined_at,account_name,account_device_id) VALUES (@c,@e,@j,@a,@d)",
+            ("@c", channelId.ToArray()), ("@e", seat.EndpointHash), ("@j", seat.JoinedAt), ("@a", seat.AccountName), ("@d", seat.AccountDeviceId));
 
         public bool DeleteSeat(Id16 channelId, ReadOnlySpan<byte> endpointHash) => Run(
             "DELETE FROM seats WHERE channel_id=@c AND endpoint_hash=@e",
             ("@c", channelId.ToArray()), ("@e", endpointHash.ToArray())) > 0;
 
-        public void SetSeatLabel(Id16 channelId, ReadOnlySpan<byte> endpointHash, byte[] label) => Run(
-            "UPDATE seats SET label=@l WHERE channel_id=@c AND endpoint_hash=@e",
-            ("@l", label), ("@c", channelId.ToArray()), ("@e", endpointHash.ToArray()));
-
         public IReadOnlyList<Seat> ListSeats(Id16 channelId) => Many(
             "SELECT endpoint_hash, joined_at, label, account_name,account_device_id FROM seats WHERE channel_id=@c ORDER BY joined_at, endpoint_hash",
             MapSeat, ("@c", channelId.ToArray()));