fix: 调整 chat WS/WT dev 接入

WT 目前沿用 JToken 的 JWT 校验；撤销一致性留到后续 WT 专用网关设计。

app/chat/api/internal/handler/chat/messaging.go

@@ -64,6 +64,12 @@ func (h *Handler) handleJoin(conn protocol.Connection, msg *WsMessage) error {
 
 func (h *Handler) handleLeave(conn protocol.Connection, msg *WsMessage) error {
 	uid := h.getUserId(conn)
+	if uid <= 0 {
+		return conn.SendJSON(context.Background(), WsResponse{
+			Type:    "error",
+			Content: "authentication required",
+		})
+	}
 	sessionId := msg.SessionId
 	if sessionId <= 0 {
 		if sid, ok := conn.Metadata()["sessionId"].(int64); ok {
@@ -73,6 +79,12 @@ func (h *Handler) handleLeave(conn protocol.Connection, msg *WsMessage) error {
 	if sessionId <= 0 {
 		return nil
 	}
+	if !h.svcCtx.Store.IsParticipant(sessionId, uid) {
+		return conn.SendJSON(context.Background(), WsResponse{
+			Type:    "error",
+			Content: "not a member of this session",
+		})
+	}
 
 	session, err := h.svcCtx.Store.GetSession(sessionId)
 	if err == nil {
@@ -108,6 +120,12 @@ func (h *Handler) handleMessage(conn protocol.Connection, msg *WsMessage) error
 			Content: "sessionId is required, join a session first",
 		})
 	}
+	if !h.svcCtx.Store.IsParticipant(sessionId, uid) {
+		return conn.SendJSON(context.Background(), WsResponse{
+			Type:    "error",
+			Content: "not a member of this session",
+		})
+	}
 
 	msgType := chatcore.MessageType(msg.MsgType)
 	if msgType == "" {
@@ -151,12 +169,25 @@ func (h *Handler) handleMessage(conn protocol.Connection, msg *WsMessage) error
 }
 
 func (h *Handler) handleHistory(conn protocol.Connection, msg *WsMessage) error {
+	uid := h.getUserId(conn)
+	if uid <= 0 {
+		return conn.SendJSON(context.Background(), WsResponse{
+			Type:    "error",
+			Content: "authentication required",
+		})
+	}
 	if msg.SessionId <= 0 {
 		return conn.SendJSON(context.Background(), WsResponse{
 			Type:    "error",
 			Content: "sessionId is required",
 		})
 	}
+	if !h.svcCtx.Store.IsParticipant(msg.SessionId, uid) {
+		return conn.SendJSON(context.Background(), WsResponse{
+			Type:    "error",
+			Content: "not a member of this session",
+		})
+	}
 
 	messages := h.svcCtx.Store.GetMessages(msg.SessionId, 0, 50)