refactor(middle): Context 函数零散

internal/logic/admin/admin.go

@@ -1,8 +1,6 @@
 package admin
 
 import (
-	"context"
-
 	"github.com/qianfree/team-api/internal/service"
 )
 
@@ -17,16 +15,3 @@ func New() *sAdmin {
 func init() {
 	service.RegisterAdmin(New())
 }
-
-// getCtxUserID extracts the admin user ID from context.
-// The key "userId" is set by admin_auth middleware.
-func getCtxUserID(ctx context.Context) int64 {
-	val := ctx.Value("userId")
-	if val == nil {
-		return 0
-	}
-	if id, ok := val.(int64); ok {
-		return id
-	}
-	return 0
-}

internal/logic/admin/admin_user.go

@@ -190,7 +190,7 @@ func (s *sAdmin) UpdateUser(ctx context.Context, req *v1.AdminUserUpdateReq) (*v
 
 // DeleteUser deletes an admin user.
 func (s *sAdmin) DeleteUser(ctx context.Context, req *v1.AdminUserDeleteReq) (*v1.AdminUserDeleteRes, error) {
-	currentUserID := ctxUserID(ctx)
+	currentUserID := common.GetCtxUserID(ctx)
 
 	if req.Id == currentUserID {
 		return nil, common.NewBadRequestError("不能删除当前登录的用户")
@@ -226,7 +226,7 @@ func (s *sAdmin) DeleteUser(ctx context.Context, req *v1.AdminUserDeleteReq) (*v
 
 // UpdateUserStatus enables or disables an admin user.
 func (s *sAdmin) UpdateUserStatus(ctx context.Context, req *v1.AdminUserUpdateStatusReq) (*v1.AdminUserUpdateStatusRes, error) {
-	currentUserID := ctxUserID(ctx)
+	currentUserID := common.GetCtxUserID(ctx)
 
 	if req.Id == currentUserID {
 		return nil, common.NewBadRequestError("不能修改当前登录用户的状态")

internal/logic/admin/auth.go

@@ -19,29 +19,8 @@ import (
 	"github.com/qianfree/team-api/internal/utility/crypto"
 )
 
-// ctxUserID extracts user ID from context.
-func ctxUserID(ctx context.Context) int64 {
-	val := ctx.Value("userId")
-	if val == nil {
-		return 0
-	}
-	if id, ok := val.(int64); ok {
-		return id
-	}
-	return 0
-}
-
-// ctxSessionID extracts session ID from context.
-func ctxSessionID(ctx context.Context) int64 {
-	val := ctx.Value("sessionId")
-	if val == nil {
-		return 0
-	}
-	if id, ok := val.(int64); ok {
-		return id
-	}
-	return 0
-}
+// NOTE: ctxUserID and ctxSessionID have been removed.
+// Use common.GetCtxUserID(ctx) and common.GetCtxSessionID(ctx) instead.
 
 // Login handles admin login.
 func (s *sAdmin) Login(ctx context.Context, req *v1.AdminLoginReq) (*v1.AdminLoginRes, error) {
@@ -159,7 +138,7 @@ func (s *sAdmin) Login(ctx context.Context, req *v1.AdminLoginReq) (*v1.AdminLog
 
 // Logout handles admin logout.
 func (s *sAdmin) Logout(ctx context.Context, _ *v1.AdminLogoutReq) (*v1.AdminLogoutRes, error) {
-	sessionID := ctxSessionID(ctx)
+	sessionID := common.GetCtxSessionID(ctx)
 
 	// Mark session as revoked in Redis for instant effect
 	common.MarkSessionRevoked(ctx, sessionID)
@@ -235,7 +214,7 @@ func (s *sAdmin) Refresh(ctx context.Context, req *v1.AdminRefreshReq) (*v1.Admi
 
 // ListSessions returns active sessions for the current admin user.
 func (s *sAdmin) ListSessions(ctx context.Context, req *v1.AdminSessionListReq) (*v1.AdminSessionListRes, error) {
-	currentSessionID := ctxSessionID(ctx)
+	currentSessionID := common.GetCtxSessionID(ctx)
 	page := req.Page
 	pageSize := req.PageSize
 	if page < 1 {
@@ -346,7 +325,7 @@ func (s *sAdmin) ForceLogout(ctx context.Context, req *v1.AdminForceLogoutReq) (
 
 // ChangePassword handles admin password change.
 func (s *sAdmin) ChangePassword(ctx context.Context, req *v1.AdminChangePasswordReq) (*v1.AdminChangePasswordRes, error) {
-	userID := ctxUserID(ctx)
+	userID := common.GetCtxUserID(ctx)
 
 	var user *entity.SysAdminUsers
 	err := dao.SysAdminUsers.Ctx(ctx).

internal/logic/admin/changelog.go

@@ -18,7 +18,7 @@ func (s *sAdmin) CreateChangelog(ctx context.Context, req *v1.ChangelogCreateReq
 		"content":    req.Content,
 		"type":       req.Type,
 		"status":     "draft",
-		"created_by": getCtxUserID(ctx),
+		"created_by": common.GetCtxUserID(ctx),
 	}).Insert()
 	if err != nil {
 		return nil, err

internal/logic/admin/data_governance.go

@@ -59,7 +59,7 @@ func (s *sAdmin) DataGovernanceExport(ctx context.Context, req *v1.DataGovernanc
 	payload, _ := json.Marshal(map[string]any{
 		"tenant_id":    req.TenantID,
 		"scopes":       req.Scopes,
-		"requested_by": getCtxUserID(ctx),
+		"requested_by": common.GetCtxUserID(ctx),
 	})
 	result, err := dao.TskTasks.Ctx(ctx).Data(do.TskTasks{
 		Name:       fmt.Sprintf("数据导出 [租户%d]", req.TenantID),
@@ -93,7 +93,7 @@ func (s *sAdmin) DataGovernanceDeletion(ctx context.Context, req *v1.DataGoverna
 	payload, _ := json.Marshal(map[string]any{
 		"tenant_id":    req.TenantID,
 		"reason":       req.Reason,
-		"requested_by": getCtxUserID(ctx),
+		"requested_by": common.GetCtxUserID(ctx),
 	})
 	result, err := dao.TskTasks.Ctx(ctx).Data(do.TskTasks{
 		Name:       fmt.Sprintf("数据删除 [租户%d]", req.TenantID),

internal/logic/admin/error_log.go

@@ -10,6 +10,7 @@ import (
 
 	v1 "github.com/qianfree/team-api/api/admin/v1"
 	"github.com/qianfree/team-api/internal/dao"
+	"github.com/qianfree/team-api/internal/logic/common"
 )
 
 // ErrorLogList returns a paginated list of system error logs.
@@ -83,7 +84,7 @@ func (s *sAdmin) ErrorLogDetail(ctx context.Context, req *v1.ErrorLogDetailReq)
 
 // ErrorLogResolve marks an error log as resolved.
 func (s *sAdmin) ErrorLogResolve(ctx context.Context, req *v1.ErrorLogResolveReq) (*v1.ErrorLogResolveRes, error) {
-	userID := getCtxUserID(ctx)
+	userID := common.GetCtxUserID(ctx)
 	_, err := dao.SysErrorLogs.Ctx(ctx).
 		Where("id", req.Id).
 		Data(g.Map{
@@ -99,7 +100,7 @@ func (s *sAdmin) ErrorLogResolve(ctx context.Context, req *v1.ErrorLogResolveReq
 
 // ErrorLogBatchResolve marks multiple error logs as resolved.
 func (s *sAdmin) ErrorLogBatchResolve(ctx context.Context, req *v1.ErrorLogBatchResolveReq) (*v1.ErrorLogBatchResolveRes, error) {
-	userID := getCtxUserID(ctx)
+	userID := common.GetCtxUserID(ctx)
 	_, err := dao.SysErrorLogs.Ctx(ctx).
 		WhereIn("id", req.Ids).
 		Data(g.Map{

internal/logic/admin/feedback.go

@@ -104,7 +104,7 @@ func (s *sAdmin) ReplyToFeedback(ctx context.Context, req *v1.FeedbackReplyReq)
 
 	updateData := g.Map{
 		"admin_reply":    req.Reply,
-		"admin_reply_by": getCtxUserID(ctx),
+		"admin_reply_by": common.GetCtxUserID(ctx),
 		"admin_reply_at": gtime.Now(),
 	}
 	if req.Status != "" {

internal/logic/admin/help_center.go

@@ -197,7 +197,7 @@ func (s *sAdmin) CreateHelpArticle(ctx context.Context, req *v1.HelpArticleCreat
 		"content":     req.Content,
 		"summary":     req.Summary,
 		"status":      req.Status,
-		"author_id":   getCtxUserID(ctx),
+		"author_id":   common.GetCtxUserID(ctx),
 		"sort_order":  req.SortOrder,
 		"keywords":    req.Keywords,
 	}

internal/logic/admin/notification.go

@@ -255,7 +255,7 @@ func (s *sAdmin) CreateAnnouncement(ctx context.Context, req *v1.AnnouncementCre
 	}
 
 	// Get admin user ID from context
-	adminUserID := getCtxUserID(ctx)
+	adminUserID := common.GetCtxUserID(ctx)
 
 	data := do.NtfAnnouncements{
 		Title:           req.Title,

internal/logic/admin/order.go

@@ -60,7 +60,7 @@ func (s *sAdmin) GetOrder(ctx context.Context, req *v1.OrderDetailReq) (*v1.Orde
 
 // RefundOrder 发起退款
 func (s *sAdmin) RefundOrder(ctx context.Context, req *v1.OrderRefundReq) (*v1.OrderRefundRes, error) {
-	adminUserID := ctxUserID(ctx)
+	adminUserID := common.GetCtxUserID(ctx)
 
 	var order struct {
 		TenantID       int64   `json:"tenant_id"`
@@ -106,7 +106,7 @@ func (s *sAdmin) RefundOrder(ctx context.Context, req *v1.OrderRefundReq) (*v1.O
 
 // OrderComplete 手动完成订单
 func (s *sAdmin) OrderComplete(ctx context.Context, req *v1.OrderCompleteReq) (*v1.OrderCompleteRes, error) {
-	adminUserID := ctxUserID(ctx)
+	adminUserID := common.GetCtxUserID(ctx)
 
 	orderNo, err := getOrderForComplete(ctx, req.Id)
 	if err != nil {

internal/logic/admin/security.go

@@ -99,7 +99,7 @@ func (s *sAdmin) Verify2FA(ctx context.Context, req *v1.Admin2FAVerifyReq) (*v1.
 
 // Setup2FA starts the 2FA setup process for the current admin user.
 func (s *sAdmin) Setup2FA(ctx context.Context, _ *v1.Admin2FASetupReq) (*v1.Admin2FASetupRes, error) {
-	userID := ctxUserID(ctx)
+	userID := common.GetCtxUserID(ctx)
 	secret, uri, err := common.Setup2FA(ctx, "admin", userID)
 	if err != nil {
 		return nil, err
@@ -122,7 +122,7 @@ func (s *sAdmin) Setup2FA(ctx context.Context, _ *v1.Admin2FASetupReq) (*v1.Admi
 
 // Enable2FA confirms and enables 2FA after verifying the code.
 func (s *sAdmin) Enable2FA(ctx context.Context, req *v1.Admin2FAEnableReq) (*v1.Admin2FAEnableRes, error) {
-	userID := ctxUserID(ctx)
+	userID := common.GetCtxUserID(ctx)
 
 	// Get pending secret from session/cache (stored temporarily during setup)
 	secret, err := getPendingTOTPSecret(ctx, userID)
@@ -143,7 +143,7 @@ func (s *sAdmin) Enable2FA(ctx context.Context, req *v1.Admin2FAEnableReq) (*v1.
 
 // Disable2FA disables 2FA for the current admin user.
 func (s *sAdmin) Disable2FA(ctx context.Context, req *v1.Admin2FADisableReq) (*v1.Admin2FADisableRes, error) {
-	userID := ctxUserID(ctx)
+	userID := common.GetCtxUserID(ctx)
 	err := common.Disable2FA(ctx, "admin", userID, req.Code)
 	if err != nil {
 		return nil, err
@@ -153,7 +153,7 @@ func (s *sAdmin) Disable2FA(ctx context.Context, req *v1.Admin2FADisableReq) (*v
 
 // RegenerateBackupCodes generates new backup codes.
 func (s *sAdmin) RegenerateBackupCodes(ctx context.Context, req *v1.Admin2FARegenerateBackupCodesReq) (*v1.Admin2FARegenerateBackupCodesRes, error) {
-	userID := ctxUserID(ctx)
+	userID := common.GetCtxUserID(ctx)
 	codes, err := common.RegenerateBackupCodes(ctx, "admin", userID, req.Code)
 	if err != nil {
 		return nil, err
@@ -163,7 +163,7 @@ func (s *sAdmin) RegenerateBackupCodes(ctx context.Context, req *v1.Admin2FARege
 
 // ConfirmHighRisk generates a confirm token for high-risk operations.
 func (s *sAdmin) ConfirmHighRisk(ctx context.Context, req *v1.Admin2FAConfirmReq) (*v1.Admin2FAConfirmRes, error) {
-	userID := ctxUserID(ctx)
+	userID := common.GetCtxUserID(ctx)
 
 	enabled, err := common.Is2FAEnabled(ctx, "admin", userID)
 	if err != nil {

internal/logic/admin/ticket.go

@@ -198,7 +198,7 @@ func (s *sAdmin) ReplyToTicketAdmin(ctx context.Context, req *v1.TicketReplyReq)
 		return nil, common.NewBadRequestError("回复内容不能为空")
 	}
 
-	adminID := getCtxUserID(ctx)
+	adminID := common.GetCtxUserID(ctx)
 
 	var ticket *struct {
 		Status          string `json:"status"`

internal/logic/common/session.go

@@ -232,3 +232,29 @@ func CleanExpiredSessions(ctx context.Context) (int64, error) {
 	}
 	return result.RowsAffected()
 }
+
+// GetCtxUserID extracts user ID from context.
+// The key "userId" is set by admin_auth or tenant_auth middleware.
+func GetCtxUserID(ctx context.Context) int64 {
+	val := ctx.Value("userId")
+	if val == nil {
+		return 0
+	}
+	if id, ok := val.(int64); ok {
+		return id
+	}
+	return 0
+}
+
+// GetCtxSessionID extracts session ID from context.
+// The key "sessionId" is set by admin_auth or tenant_auth middleware.
+func GetCtxSessionID(ctx context.Context) int64 {
+	val := ctx.Value("sessionId")
+	if val == nil {
+		return 0
+	}
+	if id, ok := val.(int64); ok {
+		return id
+	}
+	return 0
+}

internal/logic/open/open_api.go

@@ -11,6 +11,7 @@ import (
 	v1 "github.com/qianfree/team-api/api/open/v1"
 	"github.com/qianfree/team-api/internal/dao"
 	"github.com/qianfree/team-api/internal/logic/relay"
+	"github.com/qianfree/team-api/internal/middleware"
 	do "github.com/qianfree/team-api/internal/model/do"
 	"github.com/qianfree/team-api/internal/service"
 	"github.com/qianfree/team-api/internal/utility/crypto"
@@ -26,34 +27,12 @@ func init() {
 	service.RegisterOpen(New())
 }
 
-// ctxOpenTenantID extracts tenant_id from context (injected by OpenPlatformAuth middleware).
-func ctxOpenTenantID(ctx context.Context) int64 {
-	val := ctx.Value("openTenantId")
-	if val != nil {
-		if id, ok := val.(int64); ok {
-			return id
-		}
-	}
-	return 0
-}
-
-// ctxOpenAppID extracts app id from context.
-func ctxOpenAppID(ctx context.Context) int64 {
-	val := ctx.Value("openAppId")
-	if val != nil {
-		if id, ok := val.(int64); ok {
-			return id
-		}
-	}
-	return 0
-}
-
 // ============================================================
 // 成员管理
 // ============================================================
 
 func (s *sOpen) OpenMemberList(ctx context.Context, req *v1.OpenMemberListReq) (*v1.OpenMemberListRes, error) {
-	tenantID := ctxOpenTenantID(ctx)
+	tenantID := middleware.GetOpenTenantID(ctx)
 	if tenantID == 0 {
 		return nil, fmt.Errorf("unauthorized")
 	}
@@ -113,7 +92,7 @@ func (s *sOpen) OpenMemberList(ctx context.Context, req *v1.OpenMemberListReq) (
 }
 
 func (s *sOpen) OpenMemberCreate(ctx context.Context, req *v1.OpenMemberCreateReq) (*v1.OpenMemberCreateRes, error) {
-	tenantID := ctxOpenTenantID(ctx)
+	tenantID := middleware.GetOpenTenantID(ctx)
 	if tenantID == 0 {
 		return nil, fmt.Errorf("unauthorized")
 	}
@@ -147,7 +126,7 @@ func (s *sOpen) OpenMemberCreate(ctx context.Context, req *v1.OpenMemberCreateRe
 }
 
 func (s *sOpen) OpenMemberUpdate(ctx context.Context, req *v1.OpenMemberUpdateReq) (*v1.OpenMemberUpdateRes, error) {
-	tenantID := ctxOpenTenantID(ctx)
+	tenantID := middleware.GetOpenTenantID(ctx)
 	if tenantID == 0 {
 		return nil, fmt.Errorf("unauthorized")
 	}
@@ -172,7 +151,7 @@ func (s *sOpen) OpenMemberUpdate(ctx context.Context, req *v1.OpenMemberUpdateRe
 }
 
 func (s *sOpen) OpenMemberDelete(ctx context.Context, req *v1.OpenMemberDeleteReq) (*v1.OpenMemberDeleteRes, error) {
-	tenantID := ctxOpenTenantID(ctx)
+	tenantID := middleware.GetOpenTenantID(ctx)
 	if tenantID == 0 {
 		return nil, fmt.Errorf("unauthorized")
 	}
@@ -201,7 +180,7 @@ func (s *sOpen) OpenMemberDelete(ctx context.Context, req *v1.OpenMemberDeleteRe
 // ============================================================
 
 func (s *sOpen) OpenMemberQuota(ctx context.Context, req *v1.OpenMemberQuotaReq) (*v1.OpenMemberQuotaRes, error) {
-	tenantID := ctxOpenTenantID(ctx)
+	tenantID := middleware.GetOpenTenantID(ctx)
 	if tenantID == 0 {
 		return nil, fmt.Errorf("unauthorized")
 	}
@@ -230,7 +209,7 @@ func (s *sOpen) OpenMemberQuota(ctx context.Context, req *v1.OpenMemberQuotaReq)
 }
 
 func (s *sOpen) OpenMemberQuotaUpdate(ctx context.Context, req *v1.OpenMemberQuotaUpdateReq) (*v1.OpenMemberQuotaUpdateRes, error) {
-	tenantID := ctxOpenTenantID(ctx)
+	tenantID := middleware.GetOpenTenantID(ctx)
 	if tenantID == 0 {
 		return nil, fmt.Errorf("unauthorized")
 	}
@@ -263,7 +242,7 @@ func (s *sOpen) OpenMemberQuotaUpdate(ctx context.Context, req *v1.OpenMemberQuo
 }
 
 func (s *sOpen) OpenMemberModels(ctx context.Context, req *v1.OpenMemberModelsReq) (*v1.OpenMemberModelsRes, error) {
-	tenantID := ctxOpenTenantID(ctx)
+	tenantID := middleware.GetOpenTenantID(ctx)
 	if tenantID == 0 {
 		return nil, fmt.Errorf("unauthorized")
 	}
@@ -288,7 +267,7 @@ func (s *sOpen) OpenMemberModels(ctx context.Context, req *v1.OpenMemberModelsRe
 }
 
 func (s *sOpen) OpenMemberModelsUpdate(ctx context.Context, req *v1.OpenMemberModelsUpdateReq) (*v1.OpenMemberModelsUpdateRes, error) {
-	tenantID := ctxOpenTenantID(ctx)
+	tenantID := middleware.GetOpenTenantID(ctx)
 	if tenantID == 0 {
 		return nil, fmt.Errorf("unauthorized")
 	}
@@ -325,7 +304,7 @@ func (s *sOpen) OpenMemberModelsUpdate(ctx context.Context, req *v1.OpenMemberMo
 // ============================================================
 
 func (s *sOpen) OpenKeyList(ctx context.Context, req *v1.OpenKeyListReq) (*v1.OpenKeyListRes, error) {
-	tenantID := ctxOpenTenantID(ctx)
+	tenantID := middleware.GetOpenTenantID(ctx)
 	if tenantID == 0 {
 		return nil, fmt.Errorf("unauthorized")
 	}
@@ -378,7 +357,7 @@ func (s *sOpen) OpenKeyList(ctx context.Context, req *v1.OpenKeyListReq) (*v1.Op
 }
 
 func (s *sOpen) OpenKeyCreate(ctx context.Context, req *v1.OpenKeyCreateReq) (*v1.OpenKeyCreateRes, error) {
-	tenantID := ctxOpenTenantID(ctx)
+	tenantID := middleware.GetOpenTenantID(ctx)
 	if tenantID == 0 {
 		return nil, fmt.Errorf("unauthorized")
 	}
@@ -424,7 +403,7 @@ func (s *sOpen) OpenKeyCreate(ctx context.Context, req *v1.OpenKeyCreateReq) (*v
 }
 
 func (s *sOpen) OpenKeyDelete(ctx context.Context, req *v1.OpenKeyDeleteReq) (*v1.OpenKeyDeleteRes, error) {
-	tenantID := ctxOpenTenantID(ctx)
+	tenantID := middleware.GetOpenTenantID(ctx)
 	if tenantID == 0 {
 		return nil, fmt.Errorf("unauthorized")
 	}
@@ -438,7 +417,7 @@ func (s *sOpen) OpenKeyDelete(ctx context.Context, req *v1.OpenKeyDeleteReq) (*v
 // ============================================================
 
 func (s *sOpen) OpenUsageQuery(ctx context.Context, req *v1.OpenUsageQueryReq) (*v1.OpenUsageQueryRes, error) {
-	tenantID := ctxOpenTenantID(ctx)
+	tenantID := middleware.GetOpenTenantID(ctx)
 	if tenantID == 0 {
 		return nil, fmt.Errorf("unauthorized")
 	}
@@ -516,7 +495,7 @@ func (s *sOpen) OpenUsageQuery(ctx context.Context, req *v1.OpenUsageQueryReq) (
 // ============================================================
 
 func (s *sOpen) OpenBillingQuery(ctx context.Context, req *v1.OpenBillingQueryReq) (*v1.OpenBillingQueryRes, error) {
-	tenantID := ctxOpenTenantID(ctx)
+	tenantID := middleware.GetOpenTenantID(ctx)
 	if tenantID == 0 {
 		return nil, fmt.Errorf("unauthorized")
 	}

internal/logic/tenant/api_key.go

@@ -12,6 +12,7 @@ import (
 	"github.com/qianfree/team-api/internal/consts"
 	lcommon "github.com/qianfree/team-api/internal/logic/common"
 	"github.com/qianfree/team-api/internal/logic/relay"
+	"github.com/qianfree/team-api/internal/middleware"
 	do "github.com/qianfree/team-api/internal/model/do"
 
 	v1 "github.com/qianfree/team-api/api/tenant/v1"
@@ -20,9 +21,9 @@ import (
 
 // ApiKeyList 列出 API Keys，支持按类型过滤
 func (s *sTenant) ApiKeyList(ctx context.Context, req *v1.TenantApiKeyListReq) (*v1.TenantApiKeyListRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
-	role := ctxUserRole(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
+	role := middleware.GetUserRole(ctx)
 	page, pageSize := lcommon.NormalizePagination(req.Page, req.PageSize)
 
 	// member 只能查看个人密钥
@@ -111,9 +112,9 @@ func (s *sTenant) ApiKeyList(ctx context.Context, req *v1.TenantApiKeyListReq) (
 
 // ApiKeyCreate 创建新的 API Key
 func (s *sTenant) ApiKeyCreate(ctx context.Context, req *v1.TenantApiKeyCreateReq) (*v1.TenantApiKeyCreateRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
-	role := ctxUserRole(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
+	role := middleware.GetUserRole(ctx)
 
 	keyType := req.KeyType
 	if keyType == "" {
@@ -204,9 +205,9 @@ func (s *sTenant) ApiKeyCreate(ctx context.Context, req *v1.TenantApiKeyCreateRe
 
 // ApiKeyDelete 禁用 API Key
 func (s *sTenant) ApiKeyDelete(ctx context.Context, req *v1.TenantApiKeyDeleteReq) (*v1.TenantApiKeyDeleteRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
-	role := ctxUserRole(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
+	role := middleware.GetUserRole(ctx)
 	keyID := req.Id
 
 	// 先查询密钥信息以判断类型
@@ -262,9 +263,9 @@ func (s *sTenant) ApiKeyDelete(ctx context.Context, req *v1.TenantApiKeyDeleteRe
 
 // ApiKeyUpdate 更新 API Key 的可编辑字段
 func (s *sTenant) ApiKeyUpdate(ctx context.Context, req *v1.TenantApiKeyUpdateReq) (*v1.TenantApiKeyUpdateRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
-	role := ctxUserRole(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
+	role := middleware.GetUserRole(ctx)
 	keyID := req.Id
 
 	// 查询密钥信息
@@ -388,9 +389,9 @@ func (s *sTenant) ApiKeyUpdate(ctx context.Context, req *v1.TenantApiKeyUpdateRe
 
 // ApiKeyUpdateScopes 更新 API Key 的模型 scope
 func (s *sTenant) ApiKeyUpdateScopes(ctx context.Context, req *v1.TenantApiKeyUpdateScopesReq) (*v1.TenantApiKeyUpdateScopesRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
-	role := ctxUserRole(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
+	role := middleware.GetUserRole(ctx)
 	keyID := req.Id
 
 	// 先查询密钥信息以判断类型
@@ -448,7 +449,7 @@ func (s *sTenant) ApiKeyUpdateScopes(ctx context.Context, req *v1.TenantApiKeyUp
 
 // ApiKeyModelScopes 查询 API Key 的模型范围
 func (s *sTenant) ApiKeyModelScopes(ctx context.Context, req *v1.TenantApiKeyModelScopesReq) (*v1.TenantApiKeyModelScopesRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	// 验证 key 属于该租户
 	count, err := dao.ApiKeys.Ctx(ctx).
@@ -556,8 +557,8 @@ func listProjectApiKeys(ctx context.Context, tenantID, projectID int64, page, pa
 
 // ExportApiKeys exports the tenant API key list as CSV or Excel.
 func (s *sTenant) ExportApiKeys(ctx context.Context, req *v1.TenantApiKeyExportReq) (*v1.TenantApiKeyExportRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	columns := []export.Column{
 		{Field: "id", Header: "ID"},

internal/logic/tenant/audit_config.go

@@ -12,6 +12,7 @@ import (
 	"github.com/qianfree/team-api/internal/model/entity"
 
 	"github.com/qianfree/team-api/internal/logic/common"
+	"github.com/qianfree/team-api/internal/middleware"
 
 	v1 "github.com/qianfree/team-api/api/tenant/v1"
 )
@@ -48,11 +49,11 @@ func saveTenantSettings(ctx context.Context, tenantID int64, settings map[string
 // AuditConfigGet returns the tenant's own audit level.
 // 租户审计级别与全局级别完全独立，未设置时默认 masked。
 func (s *sTenant) AuditConfigGet(ctx context.Context, req *v1.TenantAuditConfigGetReq) (*v1.TenantAuditConfigGetRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	tenantLevel := common.GetTenantAuditLevel(ctx, tenantID)
 	if tenantLevel == "" {
@@ -70,7 +71,7 @@ func (s *sTenant) AuditConfigUpdate(ctx context.Context, req *v1.TenantAuditConf
 	if err := ownerOnly(ctx); err != nil {
 		return nil, err
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	level := req.AuditLevel
 
@@ -94,11 +95,11 @@ func (s *sTenant) AuditConfigUpdate(ctx context.Context, req *v1.TenantAuditConf
 
 // AuditLogs returns a paginated list of audit logs for the tenant.
 func (s *sTenant) AuditLogs(ctx context.Context, req *v1.TenantAuditLogsReq) (*v1.TenantAuditLogsRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	page, pageSize := common.NormalizePagination(req.Page, req.PageSize)
 
@@ -152,11 +153,11 @@ func isValidAuditLevel(level string) bool {
 
 // TenantRequestAuditLogs 分页查询租户的请求审计日志（不含 body，性能优先）
 func (s *sTenant) TenantRequestAuditLogs(ctx context.Context, req *v1.TenantRequestAuditLogsReq) (*v1.TenantRequestAuditLogsRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	page, pageSize := common.NormalizePagination(req.Page, req.PageSize)
 
 	var conditions []string
@@ -236,11 +237,11 @@ func (s *sTenant) TenantRequestAuditLogs(ctx context.Context, req *v1.TenantRequ
 
 // TenantRequestAuditLogDetail 查询单条请求审计日志详情（含 request_body 和 response_body）
 func (s *sTenant) TenantRequestAuditLogDetail(ctx context.Context, req *v1.TenantRequestAuditLogDetailReq) (*v1.TenantRequestAuditLogDetailRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	var record *entity.AudRequestLogs
 	err := dao.AudRequestLogs.Ctx(ctx).

internal/logic/tenant/auth.go

@@ -19,6 +19,7 @@ import (
 	"github.com/qianfree/team-api/internal/consts"
 	"github.com/qianfree/team-api/internal/dao"
 	"github.com/qianfree/team-api/internal/logic/common"
+	"github.com/qianfree/team-api/internal/middleware"
 	"github.com/qianfree/team-api/internal/model/entity"
 	"github.com/qianfree/team-api/internal/utility/crypto"
 )
@@ -386,7 +387,7 @@ func (s *sTenant) Login(ctx context.Context, req *v1.TenantLoginReq) (*v1.Tenant
 
 // Logout handles tenant user logout.
 func (s *sTenant) Logout(ctx context.Context, req *v1.TenantLogoutReq) (*v1.TenantLogoutRes, error) {
-	sessionID := ctxSessionID(ctx)
+	sessionID := middleware.GetSessionID(ctx)
 	common.MarkSessionRevoked(ctx, sessionID)
 	err := common.RevokeSession(ctx, sessionID)
 	if err != nil {
@@ -450,7 +451,7 @@ func (s *sTenant) Refresh(ctx context.Context, req *v1.TenantRefreshReq) (*v1.Te
 
 // ChangePassword handles tenant user password change.
 func (s *sTenant) ChangePassword(ctx context.Context, req *v1.TenantChangePasswordReq) (*v1.TenantChangePasswordRes, error) {
-	userID := ctxUserID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	var user *entity.TntUsers
 	err := dao.TntUsers.Ctx(ctx).
@@ -490,8 +491,8 @@ func (s *sTenant) ChangePassword(ctx context.Context, req *v1.TenantChangePasswo
 
 // ListSessions returns active sessions for the current tenant user.
 func (s *sTenant) ListSessions(ctx context.Context, req *v1.TenantSessionListReq) (*v1.TenantSessionListRes, error) {
-	userID := ctxUserID(ctx)
-	currentSessionID := ctxSessionID(ctx)
+	userID := middleware.GetUserID(ctx)
+	currentSessionID := middleware.GetSessionID(ctx)
 
 	sessions, err := common.ListSessions(ctx, "tenant", userID)
 	if err != nil {

internal/logic/tenant/billing.go

@@ -14,16 +14,17 @@ import (
 	"github.com/gogf/gf/v2/os/gtime"
 
 	v1 "github.com/qianfree/team-api/api/tenant/v1"
+	"github.com/qianfree/team-api/internal/middleware"
 	"github.com/qianfree/team-api/internal/utility/export"
 )
 
 // Wallet 获取租户钱包余额
 func (s *sTenant) Wallet(ctx context.Context, req *v1.TenantWalletReq) (*v1.TenantWalletRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	type walletRow struct {
 		Balance          float64 `json:"balance"`
@@ -73,11 +74,11 @@ func (s *sTenant) Wallet(ctx context.Context, req *v1.TenantWalletReq) (*v1.Tena
 
 // WalletTransactions 获取租户钱包流水
 func (s *sTenant) WalletTransactions(ctx context.Context, req *v1.TenantWalletTransactionsReq) (*v1.TenantWalletTransactionsRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	page, pageSize := common.NormalizePagination(req.Page, req.PageSize)
 
 	query := dao.BilTransactions.Ctx(ctx).
@@ -150,9 +151,9 @@ func (s *sTenant) WalletTransactions(ctx context.Context, req *v1.TenantWalletTr
 
 // UsageLogs 获取租户用量日志
 func (s *sTenant) UsageLogs(ctx context.Context, req *v1.TenantUsageLogsReq) (*v1.TenantUsageLogsRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
-	role := ctxUserRole(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
+	role := middleware.GetUserRole(ctx)
 	page, pageSize := common.NormalizePagination(req.Page, req.PageSize)
 
 	var conditions []string
@@ -242,9 +243,9 @@ func (s *sTenant) UsageLogs(ctx context.Context, req *v1.TenantUsageLogsReq) (*v
 
 // ExportUsageLogs exports the tenant usage logs as CSV or Excel.
 func (s *sTenant) ExportUsageLogs(ctx context.Context, req *v1.TenantUsageLogsExportReq) (*v1.TenantUsageLogsExportRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
-	role := ctxUserRole(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
+	role := middleware.GetUserRole(ctx)
 
 	columns := []export.Column{
 		{Field: "id", Header: "ID"},
@@ -344,12 +345,12 @@ func (s *sTenant) ExportUsageLogs(ctx context.Context, req *v1.TenantUsageLogsEx
 
 // ExportWalletTransactions exports the tenant wallet transactions as CSV or Excel.
 func (s *sTenant) ExportWalletTransactions(ctx context.Context, req *v1.TenantWalletTransactionsExportReq) (*v1.TenantWalletTransactionsExportRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
 
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	columns := []export.Column{
 		{Field: "id", Header: "ID"},
@@ -413,11 +414,11 @@ func (s *sTenant) ExportWalletTransactions(ctx context.Context, req *v1.TenantWa
 
 // WalletFrozenItems 获取冻结明细
 func (s *sTenant) WalletFrozenItems(ctx context.Context, req *v1.TenantWalletFrozenItemsReq) (*v1.TenantWalletFrozenItemsRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	items, err := billing.GetFrozenItems(ctx, tenantID)
 	if err != nil {

internal/logic/tenant/dashboard.go

@@ -11,15 +11,16 @@ import (
 	"github.com/gogf/gf/v2/frame/g"
 
 	v1 "github.com/qianfree/team-api/api/tenant/v1"
+	"github.com/qianfree/team-api/internal/middleware"
 )
 
 // Dashboard returns the tenant dashboard statistics.
 func (s *sTenant) Dashboard(ctx context.Context, req *v1.TenantDashboardReq) (*v1.TenantDashboardRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	today := time.Now().Format("2006-01-02")
 	monthStart := time.Now().Format("2006-01") + "-01"
 
@@ -102,11 +103,11 @@ func (s *sTenant) Dashboard(ctx context.Context, req *v1.TenantDashboardReq) (*v
 
 // TokenTrends returns daily token usage for the past N days.
 func (s *sTenant) TokenTrends(ctx context.Context, req *v1.TenantTokenTrendsReq) (*v1.TenantTokenTrendsRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	days := req.Days
 	if days <= 0 || days > 90 {
 		days = 30
@@ -160,11 +161,11 @@ func (s *sTenant) TokenTrends(ctx context.Context, req *v1.TenantTokenTrendsReq)
 
 // ModelDistribution returns the distribution of model usage.
 func (s *sTenant) ModelDistribution(ctx context.Context, req *v1.TenantModelDistributionReq) (*v1.TenantModelDistributionRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	days := req.Days
 	if days <= 0 || days > 90 {
 		days = 30
@@ -219,11 +220,11 @@ func (s *sTenant) ModelDistribution(ctx context.Context, req *v1.TenantModelDist
 
 // BalancePrediction predicts when the balance will be exhausted.
 func (s *sTenant) BalancePrediction(ctx context.Context, req *v1.TenantBalancePredictionReq) (*v1.TenantBalancePredictionRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	sevenDaysAgo := time.Now().AddDate(0, 0, -7).Format("2006-01-02")
 
@@ -282,7 +283,7 @@ func (s *sTenant) BalancePrediction(ctx context.Context, req *v1.TenantBalancePr
 
 // BudgetAlerts checks member and project budget usage and returns those above 80%.
 func (s *sTenant) BudgetAlerts(ctx context.Context, req *v1.TenantBudgetAlertsReq) (*v1.TenantBudgetAlertsRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
@@ -294,11 +295,11 @@ func (s *sTenant) BudgetAlerts(ctx context.Context, req *v1.TenantBudgetAlertsRe
 
 // GetMemberUsageRanking returns top members by usage cost in a given date range.
 func (s *sTenant) GetMemberUsageRanking(ctx context.Context, req *v1.TenantMemberUsageRankingReq) (*v1.TenantMemberUsageRankingRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	days := req.Days
 	if days <= 0 || days > 90 {
 		days = 30

internal/logic/tenant/email.go

@@ -9,6 +9,7 @@ import (
 	"github.com/qianfree/team-api/internal/consts"
 	"github.com/qianfree/team-api/internal/dao"
 	"github.com/qianfree/team-api/internal/logic/common"
+	"github.com/qianfree/team-api/internal/middleware"
 	"github.com/qianfree/team-api/internal/model/entity"
 	"github.com/qianfree/team-api/internal/utility/crypto"
 )
@@ -102,8 +103,8 @@ func (s *sTenant) ResetPassword(ctx context.Context, req *v1.TenantResetPassword
 
 // ChangeEmail handles email change for a tenant user.
 func (s *sTenant) ChangeEmail(ctx context.Context, req *v1.TenantChangeEmailReq) (*v1.TenantChangeEmailRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 	newEmail := strings.TrimSpace(strings.ToLower(req.NewEmail))
 
 	// Verify code for new email

internal/logic/tenant/feedback.go

@@ -6,14 +6,15 @@ import (
 
 	v1 "github.com/qianfree/team-api/api/tenant/v1"
 	"github.com/qianfree/team-api/internal/logic/common"
+	"github.com/qianfree/team-api/internal/middleware"
 
 	"github.com/gogf/gf/v2/frame/g"
 )
 
 // CreateFeedback 提交反馈
 func (s *sTenant) CreateFeedback(ctx context.Context, req *v1.FeedbackCreateReq) (*v1.FeedbackCreateRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	metadata := "{}"
 	if req.Metadata != nil {
@@ -40,8 +41,8 @@ func (s *sTenant) CreateFeedback(ctx context.Context, req *v1.FeedbackCreateReq)
 
 // ListFeedbacks 我的反馈列表
 func (s *sTenant) ListFeedbacks(ctx context.Context, req *v1.FeedbackListReq) (*v1.FeedbackListRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 	page, pageSize := normalizePagination(req.Page, req.PageSize)
 
 	query := g.DB().Model("spt_feedbacks").Ctx(ctx).
@@ -73,8 +74,8 @@ func (s *sTenant) ListFeedbacks(ctx context.Context, req *v1.FeedbackListReq) (*
 
 // GetFeedback 反馈详情
 func (s *sTenant) GetFeedback(ctx context.Context, req *v1.FeedbackGetReq) (*v1.FeedbackGetRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	var row v1.FeedbackGetRes
 	err := g.DB().Model("spt_feedbacks").Ctx(ctx).

internal/logic/tenant/invitation.go

@@ -7,13 +7,14 @@ import (
 	v1 "github.com/qianfree/team-api/api/tenant/v1"
 	"github.com/qianfree/team-api/internal/dao"
 	"github.com/qianfree/team-api/internal/logic/common"
+	"github.com/qianfree/team-api/internal/middleware"
 
 	"github.com/gogf/gf/v2/os/gtime"
 )
 
 // InvitationList returns a paginated list of invitation records for the tenant.
 func (s *sTenant) InvitationList(ctx context.Context, req *v1.TenantInvitationListReq) (*v1.TenantInvitationListRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	page, pageSize := common.NormalizePagination(req.Page, req.PageSize)
 
 	type row struct {
@@ -102,7 +103,7 @@ func (s *sTenant) InvitationList(ctx context.Context, req *v1.TenantInvitationLi
 
 // RevokeInvitation revokes a pending invitation by setting used_by_user_id = -1.
 func (s *sTenant) RevokeInvitation(ctx context.Context, req *v1.TenantInvitationRevokeReq) (*v1.TenantInvitationRevokeRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	var inv struct {
 		ID           int64 `json:"id"`

internal/logic/tenant/lifecycle.go

@@ -11,6 +11,7 @@ import (
 	"github.com/gogf/gf/v2/os/gtime"
 
 	v1 "github.com/qianfree/team-api/api/tenant/v1"
+	"github.com/qianfree/team-api/internal/middleware"
 )
 
 // 合法状态转换映射
@@ -72,7 +73,7 @@ func TransitionTenantStatus(ctx context.Context, tenantID int64, newStatus strin
 
 // RequestClosure 申请关户
 func (s *sTenant) RequestClosure(ctx context.Context, req *v1.TenantRequestClosureReq) (*v1.TenantRequestClosureRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	if err := TransitionTenantStatus(ctx, tenantID, "closing"); err != nil {
 		return nil, err
 	}
@@ -81,7 +82,7 @@ func (s *sTenant) RequestClosure(ctx context.Context, req *v1.TenantRequestClosu
 
 // CancelClosure 取消关户
 func (s *sTenant) CancelClosure(ctx context.Context, req *v1.TenantCancelClosureReq) (*v1.TenantCancelClosureRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	if err := TransitionTenantStatus(ctx, tenantID, "active"); err != nil {
 		return nil, err
 	}

internal/logic/tenant/member.go

@@ -18,13 +18,14 @@ import (
 	"github.com/qianfree/team-api/internal/consts"
 	"github.com/qianfree/team-api/internal/dao"
 	"github.com/qianfree/team-api/internal/logic/common"
+	"github.com/qianfree/team-api/internal/middleware"
 	"github.com/qianfree/team-api/internal/utility/crypto"
 	"github.com/qianfree/team-api/internal/utility/export"
 )
 
 // ListMembers returns a paginated list of tenant members.
 func (s *sTenant) ListMembers(ctx context.Context, req *v1.TenantMemberListReq) (*v1.TenantMemberListRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	page, pageSize := common.NormalizePagination(req.Page, req.PageSize)
 
@@ -83,8 +84,8 @@ func (s *sTenant) ListMembers(ctx context.Context, req *v1.TenantMemberListReq)
 
 // InviteMember generates an invitation link.
 func (s *sTenant) InviteMember(ctx context.Context, req *v1.TenantMemberInviteReq) (*v1.TenantMemberInviteRes, error) {
-	tenantID := ctxTenantID(ctx)
-	creatorID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	creatorID := middleware.GetUserID(ctx)
 
 	// Check member limit
 	memberCount, err := dao.TntUsers.Ctx(ctx).
@@ -358,7 +359,7 @@ func (s *sTenant) JoinByInvite(ctx context.Context, req *v1.TenantMemberJoinReq)
 
 // CreateMember directly creates a member account within the tenant.
 func (s *sTenant) CreateMember(ctx context.Context, req *v1.TenantMemberCreateReq) (*v1.TenantMemberCreateRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	// Validate role
 	if err := common.ValidateTenantRole(req.Role); err != nil {
@@ -464,8 +465,8 @@ func (s *sTenant) CreateMember(ctx context.Context, req *v1.TenantMemberCreateRe
 // RemoveMember removes a member from the tenant.
 // Revokes all API keys, anonymizes personal data, releases member model scopes.
 func (s *sTenant) RemoveMember(ctx context.Context, req *v1.TenantMemberRemoveReq) (*v1.TenantMemberRemoveRes, error) {
-	tenantID := ctxTenantID(ctx)
-	currentUserID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	currentUserID := middleware.GetUserID(ctx)
 	memberID := req.Id
 
 	if memberID == currentUserID {
@@ -596,8 +597,8 @@ func (s *sTenant) EnableMember(ctx context.Context, tenantID, userID int64) erro
 
 // UpdateMemberRole updates a member's role.
 func (s *sTenant) UpdateMemberRole(ctx context.Context, req *v1.TenantMemberUpdateRoleReq) (*v1.TenantMemberUpdateRoleRes, error) {
-	tenantID := ctxTenantID(ctx)
-	currentUserID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	currentUserID := middleware.GetUserID(ctx)
 	memberID := req.Id
 
 	if memberID == currentUserID {
@@ -637,8 +638,8 @@ func (s *sTenant) UpdateMemberRole(ctx context.Context, req *v1.TenantMemberUpda
 
 // ResetMemberPassword resets a member's password. Only admins can reset other members' passwords.
 func (s *sTenant) ResetMemberPassword(ctx context.Context, req *v1.TenantMemberResetPasswordReq) (*v1.TenantMemberResetPasswordRes, error) {
-	tenantID := ctxTenantID(ctx)
-	currentUserID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	currentUserID := middleware.GetUserID(ctx)
 	memberID := req.Id
 
 	if memberID == currentUserID {
@@ -686,7 +687,7 @@ func (s *sTenant) ResetMemberPassword(ctx context.Context, req *v1.TenantMemberR
 
 // GetMember returns a single member's detail.
 func (s *sTenant) GetMember(ctx context.Context, req *v1.TenantMemberGetReq) (*v1.TenantMemberGetRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	var user struct {
 		Id          int64  `json:"id"`
@@ -723,7 +724,7 @@ func (s *sTenant) GetMember(ctx context.Context, req *v1.TenantMemberGetReq) (*v
 
 // GetMemberUsage returns usage statistics for a single member.
 func (s *sTenant) GetMemberUsage(ctx context.Context, req *v1.TenantMemberUsageReq) (*v1.TenantMemberUsageRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	// Verify member exists in tenant
 	var user struct {
@@ -776,7 +777,7 @@ func (s *sTenant) GetMemberUsage(ctx context.Context, req *v1.TenantMemberUsageR
 
 // ListMemberApiKeys returns a paginated list of API keys belonging to a specific member.
 func (s *sTenant) ListMemberApiKeys(ctx context.Context, req *v1.TenantMemberApiKeysReq) (*v1.TenantMemberApiKeysRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	page, pageSize := common.NormalizePagination(req.Page, req.PageSize)
 
@@ -843,7 +844,7 @@ func (s *sTenant) ListMemberApiKeys(ctx context.Context, req *v1.TenantMemberApi
 
 // ExportMembers exports the tenant member list as CSV or Excel.
 func (s *sTenant) ExportMembers(ctx context.Context, req *v1.TenantMemberExportReq) (*v1.TenantMemberExportRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	columns := []export.Column{
 		{Field: "id", Header: "ID"},

internal/logic/tenant/member_import.go

@@ -16,6 +16,7 @@ import (
 	"github.com/gogf/gf/v2/os/gtime"
 
 	"github.com/qianfree/team-api/internal/logic/common"
+	"github.com/qianfree/team-api/internal/middleware"
 	"github.com/qianfree/team-api/internal/utility/crypto"
 
 	v1 "github.com/qianfree/team-api/api/tenant/v1"
@@ -31,8 +32,8 @@ type ImportResult struct {
 
 // MemberImport parses CSV content, validates, creates an import record.
 func (s *sTenant) MemberImport(ctx context.Context, req *v1.TenantMemberImportReq) (*v1.TenantMemberImportRes, error) {
-	tenantID := ctxTenantID(ctx)
-	creatorID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	creatorID := middleware.GetUserID(ctx)
 
 	// Get CSV from multipart form file
 	file := g.RequestFromCtx(ctx).GetUploadFile("file")
@@ -60,7 +61,7 @@ func (s *sTenant) MemberImport(ctx context.Context, req *v1.TenantMemberImportRe
 
 // ImportRecords returns a paginated list of import records.
 func (s *sTenant) ImportRecords(ctx context.Context, req *v1.TenantImportRecordsReq) (*v1.TenantImportRecordsRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	page, pageSize := common.NormalizePagination(req.Page, req.PageSize)
 
@@ -117,7 +118,7 @@ func (s *sTenant) ImportRecords(ctx context.Context, req *v1.TenantImportRecords
 
 // ImportRecordGet returns the status of a member import.
 func (s *sTenant) ImportRecordGet(ctx context.Context, req *v1.TenantImportRecordGetReq) (*v1.TenantImportRecordGetRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	var record struct {
 		ID           int64  `json:"id"`

internal/logic/tenant/member_model_scope.go

@@ -9,11 +9,12 @@ import (
 	do "github.com/qianfree/team-api/internal/model/do"
 
 	v1 "github.com/qianfree/team-api/api/tenant/v1"
+	"github.com/qianfree/team-api/internal/middleware"
 )
 
 // MemberModelScopes returns the model IDs available for a member.
 func (s *sTenant) MemberModelScopes(ctx context.Context, req *v1.TenantMemberModelScopesReq) (*v1.TenantMemberModelScopesRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	var rows []struct {
 		ModelID int64 `json:"model_id"`
@@ -35,7 +36,7 @@ func (s *sTenant) MemberModelScopes(ctx context.Context, req *v1.TenantMemberMod
 
 // MemberModelScopesSet sets the available models for a member (full replace).
 func (s *sTenant) MemberModelScopesSet(ctx context.Context, req *v1.TenantMemberModelScopesSetReq) (*v1.TenantMemberModelScopesSetRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	err := g.DB().Transaction(ctx, func(ctx context.Context, tx gdb.TX) error {
 		// Delete existing scopes

internal/logic/tenant/member_quota.go

@@ -10,10 +10,11 @@ import (
 
 	v1 "github.com/qianfree/team-api/api/tenant/v1"
 	"github.com/qianfree/team-api/internal/dao"
+	"github.com/qianfree/team-api/internal/middleware"
 )
 
 func (s *sTenant) MemberQuota(ctx context.Context, req *v1.TenantMemberQuotaReq) (*v1.TenantMemberQuotaRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	var row struct {
 		QuotaType    string     `json:"quota_type"`
@@ -49,7 +50,7 @@ func (s *sTenant) MemberQuota(ctx context.Context, req *v1.TenantMemberQuotaReq)
 }
 
 func (s *sTenant) MemberQuotaSet(ctx context.Context, req *v1.TenantMemberQuotaSetReq) (*v1.TenantMemberQuotaSetRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	if req.QuotaType == "periodic" && req.Period == "" {
 		return nil, fmt.Errorf("周期类型不能为空")

internal/logic/tenant/model.go

@@ -6,6 +6,7 @@ import (
 
 	v1 "github.com/qianfree/team-api/api/tenant/v1"
 	"github.com/qianfree/team-api/internal/dao"
+	"github.com/qianfree/team-api/internal/middleware"
 )
 
 // pricingTierRow 阶梯定价行（与 billing.pricingTierRow 结构一致）
@@ -18,7 +19,7 @@ type pricingTierRow struct {
 
 // ListAvailableModels 获取租户可用的模型列表
 func (s *sTenant) ListAvailableModels(ctx context.Context, req *v1.TenantAvailableModelsReq) (*v1.TenantAvailableModelsRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	query := dao.MdlTenantModels.Ctx(ctx).
 		LeftJoin("mdl_models m ON mdl_tenant_models.model_id = m.id").

internal/logic/tenant/model_comparison.go

@@ -10,10 +10,11 @@ import (
 	"github.com/gogf/gf/v2/os/gtime"
 
 	v1 "github.com/qianfree/team-api/api/tenant/v1"
+	"github.com/qianfree/team-api/internal/middleware"
 )
 
 func (s *sTenant) ModelComparison(ctx context.Context, req *v1.ModelComparisonReq) (*v1.ModelComparisonRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	if req.Days <= 0 {
 		req.Days = 7

internal/logic/tenant/notification.go

@@ -15,14 +15,15 @@ import (
 	v1 "github.com/qianfree/team-api/api/tenant/v1"
 
 	"github.com/qianfree/team-api/internal/logic/common"
+	"github.com/qianfree/team-api/internal/middleware"
 	"github.com/qianfree/team-api/internal/utility/export"
 )
 
 // Notifications 获取用户的通知列表（个人消息 + 广播消息）
 func (s *sTenant) Notifications(ctx context.Context, req *v1.TenantNotificationsReq) (*v1.TenantNotificationsRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
-	role := ctxUserRole(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
+	role := middleware.GetUserRole(ctx)
 
 	page, pageSize := common.NormalizePagination(req.Page, req.PageSize)
 
@@ -69,9 +70,9 @@ func (s *sTenant) Notifications(ctx context.Context, req *v1.TenantNotifications
 
 // UnreadCount 获取未读消息数量
 func (s *sTenant) UnreadCount(ctx context.Context, req *v1.TenantUnreadCountReq) (*v1.TenantUnreadCountRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
-	role := ctxUserRole(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
+	role := middleware.GetUserRole(ctx)
 
 	// Count personal unread messages
 	personalUnread, err := dao.NtfMessages.Ctx(ctx).
@@ -108,8 +109,8 @@ func (s *sTenant) UnreadCount(ctx context.Context, req *v1.TenantUnreadCountReq)
 
 // MarkRead 标记消息为已读
 func (s *sTenant) MarkRead(ctx context.Context, req *v1.TenantMarkReadReq) (*v1.TenantMarkReadRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	// Verify the message belongs to this tenant
 	var msg *struct {
@@ -132,7 +133,7 @@ func (s *sTenant) MarkRead(ctx context.Context, req *v1.TenantMarkReadReq) (*v1.
 
 	// Check role access for broadcast messages
 	if msg.IsBroadcast == 1 && msg.TargetRoles != "" {
-		role := ctxUserRole(ctx)
+		role := middleware.GetUserRole(ctx)
 		if !containsRole(msg.TargetRoles, role) {
 			return nil, common.NewForbiddenError("无权访问该消息")
 		}
@@ -174,9 +175,9 @@ func (s *sTenant) MarkRead(ctx context.Context, req *v1.TenantMarkReadReq) (*v1.
 
 // MarkAllRead 标记所有未读消息为已读
 func (s *sTenant) MarkAllRead(ctx context.Context, req *v1.TenantMarkAllReadReq) (*v1.TenantMarkAllReadRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
-	role := ctxUserRole(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
+	role := middleware.GetUserRole(ctx)
 
 	// Mark all personal unread messages as read
 	_, err := dao.NtfMessages.Ctx(ctx).
@@ -233,8 +234,8 @@ func (s *sTenant) MarkAllRead(ctx context.Context, req *v1.TenantMarkAllReadReq)
 
 // DeleteNotification 删除已读的个人消息（广播消息不允许用户删除）
 func (s *sTenant) DeleteNotification(ctx context.Context, req *v1.TenantNotificationDeleteReq) (*v1.TenantNotificationDeleteRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	var msg struct {
 		ID          int64  `json:"id"`
@@ -275,8 +276,8 @@ func (s *sTenant) DeleteNotification(ctx context.Context, req *v1.TenantNotifica
 
 // NotificationPreferencesGet 获取合并后的通知偏好（组织 + 用户）
 func (s *sTenant) NotificationPreferencesGet(ctx context.Context, req *v1.TenantNotificationPreferencesGetReq) (*v1.TenantNotificationPreferencesGetRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	orgPrefs := loadPreferences(ctx, tenantID, 0, "org")
 	userPrefs := loadPreferences(ctx, tenantID, userID, "user")
@@ -291,15 +292,15 @@ func (s *sTenant) NotificationPreferencesGet(ctx context.Context, req *v1.Tenant
 
 // NotificationPreferencesUpdate 更新通知偏好
 func (s *sTenant) NotificationPreferencesUpdate(ctx context.Context, req *v1.TenantNotificationPreferencesUpdateReq) (*v1.TenantNotificationPreferencesUpdateRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	if req.Scope != "user" && req.Scope != "org" {
 		return nil, common.NewBadRequestError("scope 必须是 'user' 或 'org'")
 	}
 
 	// Safety categories cannot be fully disabled
-	if req.Scope == "org" && ctxUserRole(ctx) != "owner" {
+	if req.Scope == "org" && middleware.GetUserRole(ctx) != "owner" {
 		return nil, common.NewForbiddenError("仅组织所有者可修改组织级通知偏好")
 	}
 	validateSafetyCategories(req.Preferences)
@@ -524,9 +525,9 @@ func splitString(s, sep string) []string {
 
 // ExportNotifications exports the tenant notification list as CSV or Excel.
 func (s *sTenant) ExportNotifications(ctx context.Context, req *v1.TenantNotificationsExportReq) (*v1.TenantNotificationsExportRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
-	role := ctxUserRole(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
+	role := middleware.GetUserRole(ctx)
 
 	columns := []export.Column{
 		{Field: "id", Header: "ID"},

internal/logic/tenant/oauth.go

@@ -13,6 +13,7 @@ import (
 
 	v1 "github.com/qianfree/team-api/api/tenant/v1"
 	"github.com/qianfree/team-api/internal/logic/common"
+	"github.com/qianfree/team-api/internal/middleware"
 
 	"github.com/gogf/gf/v2/frame/g"
 )
@@ -278,8 +279,8 @@ func (s *sTenant) LinkOAuth(ctx context.Context, req *v1.OAuthLinkReq) (*v1.OAut
 		return nil, common.NewBusinessError(10059, "该 OAuth 供应商未启用")
 	}
 
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	oauthToken, err := provider.ExchangeToken(ctx, req.Code)
 	if err != nil {
@@ -336,8 +337,8 @@ func (s *sTenant) LinkOAuth(ctx context.Context, req *v1.OAuthLinkReq) (*v1.OAut
 
 // UnlinkOAuth 解绑 OAuth 账号
 func (s *sTenant) UnlinkOAuth(ctx context.Context, req *v1.OAuthUnlinkReq) (*v1.OAuthUnlinkRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	_, err := g.DB().Model("tnt_oauth_identities").Ctx(ctx).
 		Where("tenant_id", tenantID).
@@ -353,8 +354,8 @@ func (s *sTenant) UnlinkOAuth(ctx context.Context, req *v1.OAuthUnlinkReq) (*v1.
 
 // ListOAuthProviders 获取已绑定的 OAuth 供应商列表
 func (s *sTenant) ListOAuthProviders(ctx context.Context, req *v1.OAuthListProvidersReq) (*v1.OAuthListProvidersRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	type row struct {
 		Provider         string `json:"provider" orm:"provider"`

internal/logic/tenant/open_platform.go

@@ -15,6 +15,7 @@ import (
 	v1 "github.com/qianfree/team-api/api/tenant/v1"
 	"github.com/qianfree/team-api/internal/dao"
 	"github.com/qianfree/team-api/internal/logic/common"
+	"github.com/qianfree/team-api/internal/middleware"
 	do "github.com/qianfree/team-api/internal/model/do"
 	"github.com/qianfree/team-api/internal/model/entity"
 	"github.com/qianfree/team-api/internal/utility/crypto"
@@ -25,11 +26,11 @@ import (
 // ============================================================
 
 func (s *sTenant) OpenAppList(ctx context.Context, req *v1.OpenAppListReq) (*v1.OpenAppListRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	page := req.Page
 	pageSize := req.PageSize
 	if page < 1 {
@@ -81,11 +82,11 @@ func (s *sTenant) OpenAppList(ctx context.Context, req *v1.OpenAppListReq) (*v1.
 }
 
 func (s *sTenant) OpenAppCreate(ctx context.Context, req *v1.OpenAppCreateReq) (*v1.OpenAppCreateRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	// Generate app_id (opn_xxxxxxxx)
 	appIDBytes := make([]byte, 12)
@@ -152,11 +153,11 @@ func (s *sTenant) OpenAppCreate(ctx context.Context, req *v1.OpenAppCreateReq) (
 }
 
 func (s *sTenant) OpenAppUpdate(ctx context.Context, req *v1.OpenAppUpdateReq) (*v1.OpenAppUpdateRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	data := g.Map{}
 
 	if req.Name != nil {
@@ -186,11 +187,11 @@ func (s *sTenant) OpenAppUpdate(ctx context.Context, req *v1.OpenAppUpdateReq) (
 }
 
 func (s *sTenant) OpenAppDelete(ctx context.Context, req *v1.OpenAppDeleteReq) (*v1.OpenAppDeleteRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	_, err := dao.OpnApps.Ctx(ctx).Where("id", req.Id).Where("tenant_id", tenantID).Delete()
 	if err != nil {
 		return nil, err
@@ -201,11 +202,11 @@ func (s *sTenant) OpenAppDelete(ctx context.Context, req *v1.OpenAppDeleteReq) (
 }
 
 func (s *sTenant) OpenAppResetSecret(ctx context.Context, req *v1.OpenAppResetSecretReq) (*v1.OpenAppResetSecretRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	// Generate new secret
 	secretBytes := make([]byte, 24)
@@ -241,11 +242,11 @@ func (s *sTenant) OpenAppResetSecret(ctx context.Context, req *v1.OpenAppResetSe
 }
 
 func (s *sTenant) OpenAppToggleStatus(ctx context.Context, req *v1.OpenAppToggleStatusReq) (*v1.OpenAppToggleStatusRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	_, err := dao.OpnApps.Ctx(ctx).Where("id", req.Id).Where("tenant_id", tenantID).Data(g.Map{
 		"status": req.Status,
 	}).Update()
@@ -257,11 +258,11 @@ func (s *sTenant) OpenAppToggleStatus(ctx context.Context, req *v1.OpenAppToggle
 // ============================================================
 
 func (s *sTenant) WebhookConfigList(ctx context.Context, _ *v1.WebhookConfigListReq) (*v1.WebhookConfigListRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	var configs []entity.OpnWebhookConfigs
 	err := dao.OpnWebhookConfigs.Ctx(ctx).Where("tenant_id", tenantID).OrderDesc("created_at").Scan(&configs)
 	if err != nil {
@@ -293,11 +294,11 @@ func (s *sTenant) WebhookConfigList(ctx context.Context, _ *v1.WebhookConfigList
 }
 
 func (s *sTenant) WebhookConfigCreate(ctx context.Context, req *v1.WebhookConfigCreateReq) (*v1.WebhookConfigCreateRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	// Generate signing key
 	keyBytes := make([]byte, 24)
@@ -330,11 +331,11 @@ func (s *sTenant) WebhookConfigCreate(ctx context.Context, req *v1.WebhookConfig
 }
 
 func (s *sTenant) WebhookConfigUpdate(ctx context.Context, req *v1.WebhookConfigUpdateReq) (*v1.WebhookConfigUpdateRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	data := g.Map{}
 
 	if req.Name != nil {
@@ -363,21 +364,21 @@ func (s *sTenant) WebhookConfigUpdate(ctx context.Context, req *v1.WebhookConfig
 }
 
 func (s *sTenant) WebhookConfigDelete(ctx context.Context, req *v1.WebhookConfigDeleteReq) (*v1.WebhookConfigDeleteRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	_, err := dao.OpnWebhookConfigs.Ctx(ctx).Where("id", req.Id).Where("tenant_id", tenantID).Delete()
 	return nil, err
 }
 
 func (s *sTenant) WebhookDeliveryLogs(ctx context.Context, req *v1.WebhookDeliveryLogsReq) (*v1.WebhookDeliveryLogsRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	page := req.Page
 	pageSize := req.PageSize
 	if page < 1 {
@@ -423,11 +424,11 @@ func (s *sTenant) WebhookDeliveryLogs(ctx context.Context, req *v1.WebhookDelive
 }
 
 func (s *sTenant) WebhookRetry(ctx context.Context, req *v1.WebhookRetryReq) (*v1.WebhookRetryRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	result, err := dao.OpnWebhookEvents.Ctx(ctx).
 		Where("id", req.EventId).

internal/logic/tenant/order.go

@@ -14,16 +14,17 @@ import (
 
 	lcommon "github.com/qianfree/team-api/internal/logic/common"
 	"github.com/qianfree/team-api/internal/logic/payment"
+	"github.com/qianfree/team-api/internal/middleware"
 	"github.com/qianfree/team-api/internal/utility/export"
 )
 
 // OrderList 获取租户订单列表
 func (s *sTenant) OrderList(ctx context.Context, req *v1.TenantOrderListReq) (*v1.TenantOrderListRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, lcommon.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	page, pageSize := lcommon.NormalizePagination(req.Page, req.PageSize)
 	status := req.Status
 
@@ -51,11 +52,11 @@ func (s *sTenant) OrderList(ctx context.Context, req *v1.TenantOrderListReq) (*v
 
 // OrderDetail 获取订单详情
 func (s *sTenant) OrderDetail(ctx context.Context, req *v1.TenantOrderDetailReq) (*v1.TenantOrderDetailRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, lcommon.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	var order map[string]any
 	err := dao.OrdOrders.Ctx(ctx).
 		Where("id", req.Id).
@@ -72,12 +73,12 @@ func (s *sTenant) OrderDetail(ctx context.Context, req *v1.TenantOrderDetailReq)
 
 // OrderCreate 创建订单
 func (s *sTenant) OrderCreate(ctx context.Context, req *v1.TenantOrderCreateReq) (*v1.TenantOrderCreateRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, lcommon.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 	planID := req.PlanID
 	months := req.Months
 
@@ -140,11 +141,11 @@ func (s *sTenant) OrderCreate(ctx context.Context, req *v1.TenantOrderCreateReq)
 
 // OrderCancel 取消订单
 func (s *sTenant) OrderCancel(ctx context.Context, req *v1.TenantOrderCancelReq) (*v1.TenantOrderCancelRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, lcommon.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	result, err := dao.OrdOrders.Ctx(ctx).
 		Where("id", req.Id).
 		Where("tenant_id", tenantID).
@@ -165,11 +166,11 @@ func (s *sTenant) OrderCancel(ctx context.Context, req *v1.TenantOrderCancelReq)
 
 // OrderPay 支付订单
 func (s *sTenant) OrderPay(ctx context.Context, req *v1.TenantOrderPayReq) (*v1.TenantOrderPayRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, lcommon.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	orderID := req.Id
 
 	// 支付渠道
@@ -230,7 +231,7 @@ func (s *sTenant) OrderPay(ctx context.Context, req *v1.TenantOrderPayReq) (*v1.
 
 // PaymentInfo 获取租户可用的支付信息（渠道列表、金额选项、折扣）
 func (s *sTenant) PaymentInfo(ctx context.Context, req *v1.TenantPaymentInfoReq) (*v1.TenantPaymentInfoRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, lcommon.NewForbiddenError("需要 owner 或 admin 权限")
 	}
@@ -293,12 +294,12 @@ func updateOrderPaymentChannel(ctx context.Context, orderID int64, channel, paym
 
 // RechargeCreate 创建充值订单并发起支付（一步完成）
 func (s *sTenant) RechargeCreate(ctx context.Context, req *v1.TenantRechargeCreateReq) (*v1.TenantRechargeCreateRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, lcommon.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	// 1. 校验金额
 	settings, _ := payment.GetGlobalPaymentSettings(ctx)
@@ -392,12 +393,12 @@ func (s *sTenant) RechargeCreate(ctx context.Context, req *v1.TenantRechargeCrea
 
 // ExportOrders exports the tenant order list as CSV or Excel.
 func (s *sTenant) ExportOrders(ctx context.Context, req *v1.TenantOrderExportReq) (*v1.TenantOrderExportRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, lcommon.NewForbiddenError("需要 owner 或 admin 权限")
 	}
 
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	columns := []export.Column{
 		{Field: "id", Header: "ID"},

internal/logic/tenant/organization.go

@@ -9,12 +9,13 @@ import (
 	v1 "github.com/qianfree/team-api/api/tenant/v1"
 	"github.com/qianfree/team-api/internal/dao"
 	"github.com/qianfree/team-api/internal/logic/common"
+	"github.com/qianfree/team-api/internal/middleware"
 	"github.com/qianfree/team-api/internal/utility/crypto"
 )
 
 // ownerOnly checks if the current user is the tenant owner.
 func ownerOnly(ctx context.Context) error {
-	if ctxUserRole(ctx) != "owner" {
+	if middleware.GetUserRole(ctx) != "owner" {
 		return common.NewForbiddenError("仅组织所有者可执行此操作")
 	}
 	return nil
@@ -22,7 +23,7 @@ func ownerOnly(ctx context.Context) error {
 
 // GetOrgInfo returns tenant organization info.
 func (s *sTenant) GetOrgInfo(ctx context.Context, req *v1.TenantOrgInfoReq) (*v1.TenantOrgInfoRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	var tenant *struct {
 		Id         int64  `json:"id"`
@@ -67,7 +68,7 @@ func (s *sTenant) UpdateOrgInfo(ctx context.Context, req *v1.TenantOrgUpdateReq)
 	if err := ownerOnly(ctx); err != nil {
 		return nil, err
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	data := do.TntTenants{}
 	if req.Name != nil {
@@ -89,8 +90,8 @@ func (s *sTenant) TransferOwnership(ctx context.Context, req *v1.TenantOrgTransf
 	if err := ownerOnly(ctx); err != nil {
 		return nil, err
 	}
-	tenantID := ctxTenantID(ctx)
-	currentOwnerID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	currentOwnerID := middleware.GetUserID(ctx)
 
 	if req.NewOwnerID == currentOwnerID {
 		return nil, common.NewBadRequestError("不能转让给自己")
@@ -171,7 +172,7 @@ func (s *sTenant) TransferOwnership(ctx context.Context, req *v1.TenantOrgTransf
 
 // GetProfile returns current user's profile.
 func (s *sTenant) GetProfile(ctx context.Context, req *v1.TenantProfileReq) (*v1.TenantProfileRes, error) {
-	userID := ctxUserID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	var user *struct {
 		Id          int64  `json:"id"`
@@ -204,7 +205,7 @@ func (s *sTenant) GetProfile(ctx context.Context, req *v1.TenantProfileReq) (*v1
 
 // UpdateProfile updates current user's profile.
 func (s *sTenant) UpdateProfile(ctx context.Context, req *v1.TenantProfileUpdateReq) (*v1.TenantProfileUpdateRes, error) {
-	userID := ctxUserID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	data := do.TntUsers{}
 	if req.DisplayName != nil {

internal/logic/tenant/personal_dashboard.go

@@ -8,12 +8,13 @@ import (
 	"github.com/gogf/gf/v2/frame/g"
 
 	v1 "github.com/qianfree/team-api/api/tenant/v1"
+	"github.com/qianfree/team-api/internal/middleware"
 )
 
 // PersonalDashboard returns the personal dashboard overview for the current user.
 func (s *sTenant) PersonalDashboard(ctx context.Context, req *v1.PersonalDashboardReq) (*v1.PersonalDashboardRes, error) {
-	userID := ctxUserID(ctx)
-	tenantID := ctxTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	now := time.Now()
 	todayStart := now.Format("2006-01-02") + " 00:00:00"
@@ -206,8 +207,8 @@ func (s *sTenant) PersonalDashboard(ctx context.Context, req *v1.PersonalDashboa
 
 // PersonalTokenTrends returns daily token usage trends for the current user.
 func (s *sTenant) PersonalTokenTrends(ctx context.Context, req *v1.PersonalTokenTrendsReq) (*v1.PersonalTokenTrendsRes, error) {
-	userID := ctxUserID(ctx)
-	tenantID := ctxTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	days := req.Days
 	if days <= 0 || days > 90 {
 		days = 30
@@ -240,8 +241,8 @@ func (s *sTenant) PersonalTokenTrends(ctx context.Context, req *v1.PersonalToken
 
 // PersonalModelDistribution returns model usage distribution for the current user.
 func (s *sTenant) PersonalModelDistribution(ctx context.Context, req *v1.PersonalModelDistReq) (*v1.PersonalModelDistRes, error) {
-	userID := ctxUserID(ctx)
-	tenantID := ctxTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	days := req.Days
 	if days <= 0 || days > 90 {
 		days = 30
@@ -275,8 +276,8 @@ func (s *sTenant) PersonalModelDistribution(ctx context.Context, req *v1.Persona
 
 // PersonalApiKeyUsage returns per-API-key usage breakdown for the current user.
 func (s *sTenant) PersonalApiKeyUsage(ctx context.Context, req *v1.PersonalApiKeyUsageReq) (*v1.PersonalApiKeyUsageRes, error) {
-	userID := ctxUserID(ctx)
-	tenantID := ctxTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	days := req.Days
 	if days <= 0 || days > 90 {
 		days = 30

internal/logic/tenant/plan.go

@@ -11,11 +11,12 @@ import (
 	v1 "github.com/qianfree/team-api/api/tenant/v1"
 
 	"github.com/gogf/gf/v2/frame/g"
+	"github.com/qianfree/team-api/internal/middleware"
 )
 
 // PlanList 获取可购买的套餐列表（仅 active）
 func (s *sTenant) PlanList(ctx context.Context, req *v1.TenantPlanListReq) (*v1.TenantPlanListRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
@@ -47,11 +48,11 @@ func (s *sTenant) PlanList(ctx context.Context, req *v1.TenantPlanListReq) (*v1.
 
 // PlanCurrent 获取租户当前套餐
 func (s *sTenant) PlanCurrent(ctx context.Context, req *v1.TenantPlanCurrentReq) (*v1.TenantPlanCurrentRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	var plan v1.TenantPlanCurrentRes
 	err := dao.PlnTenantPlans.Ctx(ctx).As("tp").
 		Fields("tp.id, tp.tenant_id, tp.plan_id, tp.status, tp.start_at, tp.end_at, tp.auto_renew, tp.monthly_quota_tokens, tp.used_tokens, tp.last_reset_at, p.name, p.identifier, p.description, p.monthly_price, p.yearly_price").
@@ -74,11 +75,11 @@ func (s *sTenant) PlanCurrent(ctx context.Context, req *v1.TenantPlanCurrentReq)
 
 // PlanCancelAutoRenew 取消自动续费
 func (s *sTenant) PlanCancelAutoRenew(ctx context.Context, req *v1.TenantPlanCancelAutoRenewReq) (*v1.TenantPlanCancelAutoRenewRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	_, err := dao.PlnTenantPlans.Ctx(ctx).
 		Where("tenant_id", tenantID).
 		Where("status", "active").

internal/logic/tenant/playground.go

@@ -17,6 +17,7 @@ import (
 	"github.com/qianfree/team-api/internal/logic/billing"
 	"github.com/qianfree/team-api/internal/logic/common"
 	"github.com/qianfree/team-api/internal/logic/relay"
+	"github.com/qianfree/team-api/internal/middleware"
 	relaycommon "github.com/qianfree/team-api/relay/common"
 	"github.com/qianfree/team-api/relay/constant"
 	"github.com/qianfree/team-api/relay/handler"
@@ -32,8 +33,8 @@ type playgroundApiKey struct {
 }
 
 func findActiveApiKey(ctx context.Context) (*playgroundApiKey, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	var key *playgroundApiKey
 	err := dao.ApiKeys.Ctx(ctx).
@@ -57,8 +58,8 @@ func buildPlaygroundRelayContext(ctx context.Context, key *playgroundApiKey, rec
 		requestID = v.(string)
 	}
 	return &handler.RelayContext{
-		TenantID:  ctxTenantID(ctx),
-		UserID:    ctxUserID(ctx),
+		TenantID:  middleware.GetTenantID(ctx),
+		UserID:    middleware.GetUserID(ctx),
 		ApiKeyID:  key.Id,
 		RequestID: requestID,
 		Writer:    recorder,
@@ -439,7 +440,7 @@ func (s *sTenant) PlaygroundRerank(ctx context.Context, req *v1.PlaygroundRerank
 // ============================================================
 
 func (s *sTenant) SandboxChat(ctx context.Context, req *v1.SandboxChatReq) (*v1.SandboxChatRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	now := time.Now()
 	quotaKey := fmt.Sprintf("sandbox:quota:%d:%s", tenantID, now.Format("200601"))
@@ -480,7 +481,7 @@ func (s *sTenant) SandboxChat(ctx context.Context, req *v1.SandboxChatReq) (*v1.
 }
 
 func (s *sTenant) SandboxQuota(ctx context.Context, req *v1.SandboxQuotaReq) (*v1.SandboxQuotaRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	defaultQuota := g.Cfg().MustGet(ctx, "sandbox.sandbox_default_quota").Int()
 	if defaultQuota <= 0 {

internal/logic/tenant/plugin.go

@@ -4,6 +4,7 @@ import (
 	"context"
 
 	v1 "github.com/qianfree/team-api/api/tenant/v1"
+	"github.com/qianfree/team-api/internal/middleware"
 	"github.com/qianfree/team-api/internal/plugin"
 
 	"github.com/gogf/gf/v2/errors/gerror"
@@ -11,7 +12,7 @@ import (
 )
 
 func (s *sTenant) TenantPluginList(ctx context.Context, req *v1.TenantPluginListReq) (*v1.TenantPluginListRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	entries := plugin.AllPlugins()
 	items := make([]v1.TenantPluginItem, 0, len(entries))
 
@@ -44,7 +45,7 @@ func (s *sTenant) TenantPluginList(ctx context.Context, req *v1.TenantPluginList
 }
 
 func (s *sTenant) TenantPluginDetail(ctx context.Context, req *v1.TenantPluginDetailReq) (*v1.TenantPluginDetailRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	entry := plugin.GetPlugin(req.Name)
 	if entry == nil {
 		return nil, gerror.New("插件不存在")
@@ -76,7 +77,7 @@ func (s *sTenant) TenantPluginDetail(ctx context.Context, req *v1.TenantPluginDe
 }
 
 func (s *sTenant) TenantPluginConfigUpdate(ctx context.Context, req *v1.TenantPluginConfigUpdateReq) (*v1.TenantPluginConfigUpdateRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	if err := plugin.UpdatePluginConfigForTenant(ctx, req.Name, tenantID, req.Config); err != nil {
 		return nil, err
 	}
@@ -84,7 +85,7 @@ func (s *sTenant) TenantPluginConfigUpdate(ctx context.Context, req *v1.TenantPl
 }
 
 func (s *sTenant) TenantPluginEnable(ctx context.Context, req *v1.TenantPluginEnableReq) (*v1.TenantPluginEnableRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	if err := plugin.EnableForTenant(ctx, req.Name, tenantID); err != nil {
 		return nil, err
 	}
@@ -92,7 +93,7 @@ func (s *sTenant) TenantPluginEnable(ctx context.Context, req *v1.TenantPluginEn
 }
 
 func (s *sTenant) TenantPluginDisable(ctx context.Context, req *v1.TenantPluginDisableReq) (*v1.TenantPluginDisableRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	if err := plugin.DisableForTenant(ctx, req.Name, tenantID); err != nil {
 		return nil, err
 	}

internal/logic/tenant/project.go

@@ -12,6 +12,7 @@ import (
 	"github.com/qianfree/team-api/internal/model/do"
 
 	v1 "github.com/qianfree/team-api/api/tenant/v1"
+	"github.com/qianfree/team-api/internal/middleware"
 )
 
 type projectRow struct {
@@ -49,7 +50,7 @@ type usageLogRow struct {
 
 // ProjectList returns a paginated list of projects for a tenant.
 func (s *sTenant) ProjectList(ctx context.Context, req *v1.TenantProjectListReq) (*v1.TenantProjectListRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	page, pageSize := common.NormalizePagination(req.Page, req.PageSize)
 
 	var projects []projectRow
@@ -78,8 +79,8 @@ func (s *sTenant) ProjectList(ctx context.Context, req *v1.TenantProjectListReq)
 
 // ProjectCreate creates a new project for a tenant.
 func (s *sTenant) ProjectCreate(ctx context.Context, req *v1.TenantProjectCreateReq) (*v1.TenantProjectCreateRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	name := req.Name
 	if name == "" {
@@ -112,7 +113,7 @@ func (s *sTenant) ProjectCreate(ctx context.Context, req *v1.TenantProjectCreate
 
 // ProjectUpdate updates a project.
 func (s *sTenant) ProjectUpdate(ctx context.Context, req *v1.TenantProjectUpdateReq) (*v1.TenantProjectUpdateRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	var project *struct {
 		ID     int64  `json:"id"`
@@ -161,7 +162,7 @@ func (s *sTenant) ProjectUpdate(ctx context.Context, req *v1.TenantProjectUpdate
 
 // ProjectArchive archives a project and revokes all its keys.
 func (s *sTenant) ProjectArchive(ctx context.Context, req *v1.TenantProjectArchiveReq) (*v1.TenantProjectArchiveRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	var project *struct {
 		ID     int64  `json:"id"`
@@ -203,7 +204,7 @@ func (s *sTenant) ProjectArchive(ctx context.Context, req *v1.TenantProjectArchi
 
 // ProjectUnarchive restores an archived project. Keys are NOT auto-restored.
 func (s *sTenant) ProjectUnarchive(ctx context.Context, req *v1.TenantProjectUnarchiveReq) (*v1.TenantProjectUnarchiveRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	var project *struct {
 		ID     int64  `json:"id"`
@@ -287,7 +288,7 @@ func CheckBudgetExhausted(ctx context.Context) error {
 
 // ProjectGet 根据 ID 获取单个项目详情（含统计摘要）
 func (s *sTenant) ProjectGet(ctx context.Context, req *v1.TenantProjectGetReq) (*v1.TenantProjectGetRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	var p *projectRow
 	err := dao.TntProjects.Ctx(ctx).
@@ -350,12 +351,12 @@ func (s *sTenant) ProjectGet(ctx context.Context, req *v1.TenantProjectGetReq) (
 
 // ProjectApiKeyList 获取项目密钥列表（owner/admin 权限）
 func (s *sTenant) ProjectApiKeyList(ctx context.Context, req *v1.TenantProjectApiKeyListReq) (*v1.TenantProjectApiKeyListRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
 
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	page, pageSize := common.NormalizePagination(req.Page, req.PageSize)
 
 	var keys []apiKeyRow
@@ -385,13 +386,13 @@ func (s *sTenant) ProjectApiKeyList(ctx context.Context, req *v1.TenantProjectAp
 
 // ProjectApiKeyCreate 创建项目密钥（owner/admin 权限）
 func (s *sTenant) ProjectApiKeyCreate(ctx context.Context, req *v1.TenantProjectApiKeyCreateReq) (*v1.TenantProjectApiKeyCreateRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
 
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	// Verify project exists and belongs to tenant
 	var project *struct {
@@ -457,12 +458,12 @@ func (s *sTenant) ProjectApiKeyCreate(ctx context.Context, req *v1.TenantProject
 
 // ProjectApiKeyDelete 删除项目密钥（owner/admin 权限）
 func (s *sTenant) ProjectApiKeyDelete(ctx context.Context, req *v1.TenantProjectApiKeyDeleteReq) (*v1.TenantProjectApiKeyDeleteRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
 
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	// Verify the key belongs to the project and tenant
 	var key *struct {
@@ -495,12 +496,12 @@ func (s *sTenant) ProjectApiKeyDelete(ctx context.Context, req *v1.TenantProject
 
 // ProjectUsageStats 获取项目用量统计（按日汇总，近30天）（owner/admin 权限）
 func (s *sTenant) ProjectUsageStats(ctx context.Context, req *v1.TenantProjectUsageStatsReq) (*v1.TenantProjectUsageStatsRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
 
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	var project struct {
 		ID int64 `json:"id"`
@@ -603,12 +604,12 @@ func (s *sTenant) ProjectUsageStats(ctx context.Context, req *v1.TenantProjectUs
 
 // ProjectUsageLogs 获取项目用量日志（分页）（owner/admin 权限）
 func (s *sTenant) ProjectUsageLogs(ctx context.Context, req *v1.TenantProjectUsageLogsReq) (*v1.TenantProjectUsageLogsRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, common.NewForbiddenError("需要 owner 或 admin 权限")
 	}
 
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	page, pageSize := common.NormalizePagination(req.Page, req.PageSize)
 
 	// 获取项目关联的 API Key ID 列表

internal/logic/tenant/promo_code.go

@@ -10,13 +10,14 @@ import (
 	"github.com/gogf/gf/v2/frame/g"
 
 	lcommon "github.com/qianfree/team-api/internal/logic/common"
+	"github.com/qianfree/team-api/internal/middleware"
 
 	v1 "github.com/qianfree/team-api/api/tenant/v1"
 )
 
 // ValidatePromoCode 校验优惠码并返回折扣金额
 func (s *sTenant) ValidatePromoCode(ctx context.Context, req *v1.TenantValidatePromoCodeReq) (*v1.TenantValidatePromoCodeRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 
 	var promo *struct {
 		ID            int64     `json:"id"`

internal/logic/tenant/redemption.go

@@ -18,16 +18,17 @@ import (
 
 	v1 "github.com/qianfree/team-api/api/tenant/v1"
 	lcommon2 "github.com/qianfree/team-api/internal/logic/common"
+	"github.com/qianfree/team-api/internal/middleware"
 )
 
 // RedeemCode 租户兑换码
 func (s *sTenant) RedeemCode(ctx context.Context, req *v1.TenantRedeemCodeReq) (*v1.TenantRedeemCodeRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, lcommon.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	var redemption *struct {
 		ID           int64     `json:"id"`
@@ -190,11 +191,11 @@ func extendPlanDuration(ctx context.Context, tenantID int64, days int) {
 
 // ListRedemptionUsages 获取当前租户的兑换历史
 func (s *sTenant) ListRedemptionUsages(ctx context.Context, req *v1.TenantRedemptionUsagesReq) (*v1.TenantRedemptionUsagesRes, error) {
-	role := ctxUserRole(ctx)
+	role := middleware.GetUserRole(ctx)
 	if role != "owner" && role != "admin" {
 		return nil, lcommon.NewForbiddenError("需要 owner 或 admin 权限")
 	}
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	page, pageSize := lcommon2.NormalizePagination(req.Page, req.PageSize)
 
 	fromClause := "ord_redemption_usages ru LEFT JOIN ord_redemptions r ON ru.redemption_id = r.id"

internal/logic/tenant/security.go

@@ -15,6 +15,7 @@ import (
 	"github.com/qianfree/team-api/internal/consts"
 	"github.com/qianfree/team-api/internal/dao"
 	"github.com/qianfree/team-api/internal/logic/common"
+	"github.com/qianfree/team-api/internal/middleware"
 	do "github.com/qianfree/team-api/internal/model/do"
 	"github.com/qianfree/team-api/internal/model/entity"
 	"github.com/qianfree/team-api/internal/utility/crypto"
@@ -105,7 +106,7 @@ func (s *sTenant) Verify2FA(ctx context.Context, req *v1.Tenant2FAVerifyReq) (*v
 
 // Setup2FA starts the 2FA setup process for the current tenant user.
 func (s *sTenant) Setup2FA(ctx context.Context, _ *v1.Tenant2FASetupReq) (*v1.Tenant2FASetupRes, error) {
-	userID := ctxUserID(ctx)
+	userID := middleware.GetUserID(ctx)
 	secret, uri, err := common.Setup2FA(ctx, "tenant", userID)
 	if err != nil {
 		return nil, err
@@ -127,7 +128,7 @@ func (s *sTenant) Setup2FA(ctx context.Context, _ *v1.Tenant2FASetupReq) (*v1.Te
 
 // Enable2FA confirms and enables 2FA.
 func (s *sTenant) Enable2FA(ctx context.Context, req *v1.Tenant2FAEnableReq) (*v1.Tenant2FAEnableRes, error) {
-	userID := ctxUserID(ctx)
+	userID := middleware.GetUserID(ctx)
 	secret, err := getPendingTOTPSecret(ctx, userID)
 	if err != nil || secret == "" {
 		return nil, common.NewBusinessError(consts.CodeBadRequest, "请先执行2FA设置")
@@ -144,7 +145,7 @@ func (s *sTenant) Enable2FA(ctx context.Context, req *v1.Tenant2FAEnableReq) (*v
 
 // Disable2FA disables 2FA for the current tenant user.
 func (s *sTenant) Disable2FA(ctx context.Context, req *v1.Tenant2FADisableReq) (*v1.Tenant2FADisableRes, error) {
-	userID := ctxUserID(ctx)
+	userID := middleware.GetUserID(ctx)
 	err := common.Disable2FA(ctx, "tenant", userID, req.Code)
 	if err != nil {
 		return nil, err
@@ -154,7 +155,7 @@ func (s *sTenant) Disable2FA(ctx context.Context, req *v1.Tenant2FADisableReq) (
 
 // RegenerateBackupCodes generates new backup codes.
 func (s *sTenant) RegenerateBackupCodes(ctx context.Context, req *v1.Tenant2FARegenerateBackupCodesReq) (*v1.Tenant2FARegenerateBackupCodesRes, error) {
-	userID := ctxUserID(ctx)
+	userID := middleware.GetUserID(ctx)
 	codes, err := common.RegenerateBackupCodes(ctx, "tenant", userID, req.Code)
 	if err != nil {
 		return nil, err
@@ -164,7 +165,7 @@ func (s *sTenant) RegenerateBackupCodes(ctx context.Context, req *v1.Tenant2FARe
 
 // ConfirmHighRisk generates a confirm token for high-risk operations.
 func (s *sTenant) ConfirmHighRisk(ctx context.Context, req *v1.Tenant2FAConfirmReq) (*v1.Tenant2FAConfirmRes, error) {
-	userID := ctxUserID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	enabled, err := common.Is2FAEnabled(ctx, "tenant", userID)
 	if err != nil {
@@ -193,9 +194,9 @@ func (s *sTenant) ConfirmHighRisk(ctx context.Context, req *v1.Tenant2FAConfirmR
 // LoginHistory returns the login history for tenant users.
 // owner/admin see all members in the tenant; member sees only own records.
 func (s *sTenant) LoginHistory(ctx context.Context, req *v1.TenantLoginHistoryReq) (*v1.TenantLoginHistoryRes, error) {
-	userID := ctxUserID(ctx)
-	tenantID := ctxTenantID(ctx)
-	role := ctxUserRole(ctx)
+	userID := middleware.GetUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	role := middleware.GetUserRole(ctx)
 	page, pageSize := common.NormalizePagination(req.Page, req.PageSize)
 
 	q := dao.AudLoginHistory.Ctx(ctx).
@@ -352,7 +353,7 @@ func getEncKey(ctx context.Context) []byte {
 
 // GetIPWhitelist returns the tenant's IP whitelist configuration.
 func (s *sTenant) GetIPWhitelist(ctx context.Context, _ *v1.TenantIPWhitelistGetReq) (*v1.TenantIPWhitelistGetRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	var tenant *entity.TntTenants
 	err := dao.TntTenants.Ctx(ctx).Where("id", tenantID).Scan(&tenant)
 	if err != nil {
@@ -385,7 +386,7 @@ func (s *sTenant) GetIPWhitelist(ctx context.Context, _ *v1.TenantIPWhitelistGet
 
 // UpdateIPWhitelist updates the tenant's IP whitelist configuration.
 func (s *sTenant) UpdateIPWhitelist(ctx context.Context, req *v1.TenantIPWhitelistUpdateReq) (*v1.TenantIPWhitelistUpdateRes, error) {
-	tenantID := ctxTenantID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
 	var tenant *entity.TntTenants
 	err := dao.TntTenants.Ctx(ctx).Where("id", tenantID).Scan(&tenant)
 	if err != nil {

internal/logic/tenant/task.go

@@ -6,14 +6,15 @@ import (
 	v1 "github.com/qianfree/team-api/api/tenant/v1"
 	"github.com/qianfree/team-api/internal/dao"
 	"github.com/qianfree/team-api/internal/logic/common"
+	"github.com/qianfree/team-api/internal/middleware"
 )
 
 // TenantTaskList 租户异步任务列表
 // owner/admin 可查看租户所有任务，member 只能查看自己的任务
 func (s *sTenant) TenantTaskList(ctx context.Context, req *v1.TenantTaskListReq) (*v1.TenantTaskListRes, error) {
-	tenantID := ctxTenantID(ctx)
-	role := ctxUserRole(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	role := middleware.GetUserRole(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	m := dao.TskModelTasks.Ctx(ctx).
 		LeftJoin("tnt_users u", "u.id = tsk_model_tasks.user_id AND u.tenant_id = tsk_model_tasks.tenant_id").
@@ -101,9 +102,9 @@ func (s *sTenant) TenantTaskList(ctx context.Context, req *v1.TenantTaskListReq)
 // TenantTaskDetail 租户异步任务详情
 // owner/admin 可查看租户所有任务，member 只能查看自己的任务
 func (s *sTenant) TenantTaskDetail(ctx context.Context, req *v1.TenantTaskDetailReq) (*v1.TenantTaskDetailRes, error) {
-	tenantID := ctxTenantID(ctx)
-	role := ctxUserRole(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	role := middleware.GetUserRole(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	var task struct {
 		Id              int64   `json:"id"`

internal/logic/tenant/tenant.go

@@ -1,8 +1,6 @@
 package tenant
 
 import (
-	"context"
-
 	"github.com/qianfree/team-api/internal/service"
 )
 
@@ -17,51 +15,3 @@ func New() *sTenant {
 func init() {
 	service.RegisterTenant(New())
 }
-
-// ctxUserID reads userId from context.
-func ctxUserID(ctx context.Context) int64 {
-	v := ctx.Value("userId")
-	if v == nil {
-		return 0
-	}
-	if id, ok := v.(int64); ok {
-		return id
-	}
-	return 0
-}
-
-// ctxTenantID reads tenantId from context.
-func ctxTenantID(ctx context.Context) int64 {
-	v := ctx.Value("tenantId")
-	if v == nil {
-		return 0
-	}
-	if id, ok := v.(int64); ok {
-		return id
-	}
-	return 0
-}
-
-// ctxSessionID reads sessionId from context.
-func ctxSessionID(ctx context.Context) int64 {
-	v := ctx.Value("sessionId")
-	if v == nil {
-		return 0
-	}
-	if id, ok := v.(int64); ok {
-		return id
-	}
-	return 0
-}
-
-// ctxUserRole reads role from context.
-func ctxUserRole(ctx context.Context) string {
-	v := ctx.Value("role")
-	if v == nil {
-		return ""
-	}
-	if role, ok := v.(string); ok {
-		return role
-	}
-	return ""
-}

internal/logic/tenant/ticket.go

@@ -7,6 +7,7 @@ import (
 
 	v1 "github.com/qianfree/team-api/api/tenant/v1"
 	"github.com/qianfree/team-api/internal/logic/common"
+	"github.com/qianfree/team-api/internal/middleware"
 
 	"github.com/gogf/gf/v2/database/gdb"
 	"github.com/gogf/gf/v2/os/gtime"
@@ -15,8 +16,8 @@ import (
 
 // TicketCreate 创建工单
 func (s *sTenant) TicketCreate(ctx context.Context, req *v1.TenantTicketCreateReq) (*v1.TenantTicketCreateRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	result, err := dao.SptTickets.Ctx(ctx).Insert(do.SptTickets{
 		TenantId:    tenantID,
@@ -37,8 +38,8 @@ func (s *sTenant) TicketCreate(ctx context.Context, req *v1.TenantTicketCreateRe
 
 // TicketList 获取租户工单列表
 func (s *sTenant) TicketList(ctx context.Context, req *v1.TenantTicketListReq) (*v1.TenantTicketListRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	page, pageSize := common.NormalizePagination(req.Page, req.PageSize)
 
@@ -70,8 +71,8 @@ func (s *sTenant) TicketList(ctx context.Context, req *v1.TenantTicketListReq) (
 
 // TicketGet 获取工单详情（含回复）
 func (s *sTenant) TicketGet(ctx context.Context, req *v1.TenantTicketGetReq) (*v1.TenantTicketGetRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	var ticket map[string]any
 	err := dao.SptTickets.Ctx(ctx).
@@ -113,8 +114,8 @@ func (s *sTenant) TicketGet(ctx context.Context, req *v1.TenantTicketGetReq) (*v
 
 // TicketReply 租户用户回复工单
 func (s *sTenant) TicketReply(ctx context.Context, req *v1.TenantTicketReplyReq) (*v1.TenantTicketReplyRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	if req.Content == "" {
 		return nil, common.NewBadRequestError("回复内容不能为空")
@@ -171,8 +172,8 @@ func (s *sTenant) TicketReply(ctx context.Context, req *v1.TenantTicketReplyReq)
 
 // TicketClose 租户用户关闭工单
 func (s *sTenant) TicketClose(ctx context.Context, req *v1.TenantTicketCloseReq) (*v1.TenantTicketCloseRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	result, err := dao.SptTickets.Ctx(ctx).
 		Where("id", req.Id).
@@ -194,8 +195,8 @@ func (s *sTenant) TicketClose(ctx context.Context, req *v1.TenantTicketCloseReq)
 
 // TicketReopen 租户用户重新打开工单
 func (s *sTenant) TicketReopen(ctx context.Context, req *v1.TenantTicketReopenReq) (*v1.TenantTicketReopenRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	result, err := dao.SptTickets.Ctx(ctx).
 		Where("id", req.Id).
@@ -217,8 +218,8 @@ func (s *sTenant) TicketReopen(ctx context.Context, req *v1.TenantTicketReopenRe
 
 // ExportTickets exports the tenant ticket list as CSV or Excel.
 func (s *sTenant) ExportTickets(ctx context.Context, req *v1.TenantTicketExportReq) (*v1.TenantTicketExportRes, error) {
-	tenantID := ctxTenantID(ctx)
-	userID := ctxUserID(ctx)
+	tenantID := middleware.GetTenantID(ctx)
+	userID := middleware.GetUserID(ctx)
 
 	columns := []export.Column{
 		{Field: "id", Header: "ID"},

internal/middleware/open_auth.go

@@ -147,3 +147,25 @@ func getEncKey(ctx context.Context) []byte {
 	}
 	return crypto.MustGetEncryptionKey(hexKey)
 }
+
+// GetOpenTenantID extracts the tenant ID injected by OpenPlatformAuth middleware.
+func GetOpenTenantID(ctx context.Context) int64 {
+	val := ctx.Value("openTenantId")
+	if val != nil {
+		if id, ok := val.(int64); ok {
+			return id
+		}
+	}
+	return 0
+}
+
+// GetOpenAppID extracts the app ID injected by OpenPlatformAuth middleware.
+func GetOpenAppID(ctx context.Context) int64 {
+	val := ctx.Value("openAppId")
+	if val != nil {
+		if id, ok := val.(int64); ok {
+			return id
+		}
+	}
+	return 0
+}