diff --git a/packages/core/src/context.ts b/packages/core/src/context.ts
index 554083ad3d..feedceef1c 100644
--- a/packages/core/src/context.ts
+++ b/packages/core/src/context.ts
@@ -468,6 +468,7 @@ export class Context {
   private createTimerDispose(timer: NodeJS.Timeout) {
     const dispose = () => {
       clearTimeout(timer)
+      if (!this.state) return
       return remove(this.state.disposables, dispose)
     }
     this.state.disposables.push(dispose)
diff --git a/plugins/frontend/auth/client/index.ts b/plugins/frontend/auth/client/index.ts
index 2b5e9357a2..06b9b24ec5 100644
--- a/plugins/frontend/auth/client/index.ts
+++ b/plugins/frontend/auth/client/index.ts
@@ -1,6 +1,5 @@
-import { Context } from '~/client'
+import { Context, store } from '~/client'
 import { Icons } from '~/components'
-import { user } from './utils'
 import Login from './login.vue'
 import Profile from './profile.vue'
 import SignIn from './icons/sign-in.vue'
@@ -12,11 +11,19 @@ Icons.register('sign-out', SignOut)
 Icons.register('user-full', UserFull)
 
 export default (ctx: Context) => {
+  const dispose = Context.router.beforeEach((route, from) => {
+    if (route.meta.authority && !store.user) {
+      return history.state.forward === '/login' ? '/' : '/login'
+    }
+  })
+
+  ctx.disposables.push(dispose)
+
   ctx.addPage({
     path: '/login',
     name: '登录',
     icon: 'sign-in',
-    position: () => user.value ? 'hidden' : 'bottom',
+    position: () => store.user ? 'hidden' : 'bottom',
     component: Login,
   })
 
@@ -24,7 +31,7 @@ export default (ctx: Context) => {
     path: '/profile',
     name: '用户资料',
     icon: 'user-full',
-    position: () => user.value ? 'bottom' : 'hidden',
+    position: () => store.user ? 'bottom' : 'hidden',
     component: Profile,
   })
 }
diff --git a/plugins/frontend/auth/client/login.vue b/plugins/frontend/auth/client/login.vue
index 65ad920c32..d94e89beb8 100644
--- a/plugins/frontend/auth/client/login.vue
+++ b/plugins/frontend/auth/client/login.vue
@@ -1,12 +1,12 @@
 <template>
   <k-card class="login">
-    <template v-if="data.token">
+    <template v-if="user">
       <h1><span>平台账户登录</span></h1>
-      <p class="hint">欢迎你，{{ data.name || 'Koishi 用户' }}！</p>
+      <p class="hint">欢迎你，{{ user.name || 'Koishi 用户' }}！</p>
       <p class="hint">请用上述账号将下面的验证码私聊发送给任意机器人</p>
-      <p class="token">{{ data.token }}</p>
+      <p class="token">{{ user.token }}</p>
       <div class="control">
-        <k-button @click="data.token = null">返回上一步</k-button>
+        <k-button @click="user.token = null">返回上一步</k-button>
       </div>
     </template>
     <template v-else>
@@ -19,7 +19,7 @@
       <template v-if="config.authType === 0">
         <k-input prefix="at" placeholder="平台名" v-model="config.platform"/>
         <k-input prefix="user" placeholder="账号" v-model="config.userId" @enter="enter"/>
-        <p class="error" v-if="data.message">{{ data.message }}</p>
+        <p class="error" v-if="message">{{ message }}</p>
         <div class="control">
           <k-button @click="$router.back()">返回</k-button>
           <k-button @click="enter">获取验证码</k-button>
@@ -32,7 +32,7 @@
           :suffix="config.showPass ? 'eye' : 'eye-slash'"
           @click-suffix="config.showPass = !config.showPass"
         />
-        <p class="error" v-if="data.message">{{ data.message }}</p>
+        <p class="error" v-if="message">{{ message }}</p>
         <div class="control">
           <k-button @click="$router.back()">返回</k-button>
           <k-button @click="login">登录</k-button>
@@ -45,28 +45,29 @@
 <script lang="ts" setup>
 
 import { ref, watch } from 'vue'
-import { useRouter } from 'vue-router'
-import { config, sha256, user } from './utils'
-import { send, receive } from '~/client'
-
-interface LoginData {
-  token?: string
-  name?: string
-  message?: string
-}
+import { useRouter, useRoute } from 'vue-router'
+import { config, sha256 } from './utils'
+import { send, store } from '~/client'
+import { LoginUser } from '@koishijs/plugin-auth'
 
 const secure = isSecureContext
 if (!secure) config.authType = 0
-const data = ref<LoginData>({})
 
 const router = useRouter()
-receive('login', body => data.value = body)
 
-watch(user, (value) => {
+watch(() => store.user, (value) => {
   if (!value) return
-  router.push(router.currentRoute.value.redirectedFrom?.fullPath || '/profile')
+  const from = router.currentRoute.value.redirectedFrom
+  if (from && from.name !== '登录') {
+    router.push(from)
+  } else {
+    router.push('/profile')
+  }
 })
 
+const message = ref<string>()
+const user = ref<LoginUser>()
+
 let timestamp = 0
 async function enter() {
   const now = Date.now()
@@ -74,12 +75,20 @@ async function enter() {
   const { platform, userId } = config
   if (!platform || !userId) return
   timestamp = now + 1000
-  send('token', { platform, userId })
+  try {
+    user.value = await send('login/platform', platform, userId)
+  } catch (e) {
+    message.value = e.message
+  }
 }
 
 async function login() {
   const { username, password } = config
-  send('login', { username, password: await sha256(password) })
+  try {
+    await send('login/password', username, await sha256(password))
+  } catch (e) {
+    message.value = e.message
+  }
 }
 
 </script>
diff --git a/plugins/frontend/auth/client/profile.vue b/plugins/frontend/auth/client/profile.vue
index 03d5750b0b..61aedda65b 100644
--- a/plugins/frontend/auth/client/profile.vue
+++ b/plugins/frontend/auth/client/profile.vue
@@ -1,7 +1,7 @@
 <template>
   <k-card title="基本资料">
-    <p>用户名：{{ user.name }}</p>
-    <p>权限等级：{{ user.authority }}</p>
+    <p>用户名：{{ store.user.name }}</p>
+    <p>权限等级：{{ store.user.authority }}</p>
   </k-card>
   <k-card title="设置密码" v-if="secure">
     <k-input v-model="password" @enter="enter"
@@ -17,8 +17,8 @@
 
 <script lang="ts" setup>
 
-import { send } from '~/client'
-import { sha256, config, user } from './utils'
+import { send, store } from '~/client'
+import { sha256, config } from './utils'
 import { ref } from 'vue'
 
 const secure = isSecureContext
@@ -26,8 +26,7 @@ const password = ref(config.password)
 
 async function enter() {
   if (!password.value) return
-  const { id, token } = user.value
-  send('password', { id, token, password: await sha256(password.value) })
+  send('user/modify', { password: await sha256(password.value) })
   config.password = password.value
 }
 
diff --git a/plugins/frontend/auth/client/utils.ts b/plugins/frontend/auth/client/utils.ts
index cab3a68e39..e4c4c57b43 100644
--- a/plugins/frontend/auth/client/utils.ts
+++ b/plugins/frontend/auth/client/utils.ts
@@ -1,16 +1,15 @@
 import { useStorage } from '@vueuse/core'
 import { reactive, ref } from 'vue'
+import {} from '@koishijs/plugin-auth'
 
 export function useVersionStorage<T extends object>(key: string, version: string, fallback?: () => T) {
-  const storage = useStorage('koishi.' + key, {})
+  const storage = useStorage('koishi.console.' + key, {})
   if (storage.value['version'] !== version) {
     storage.value = { version, data: fallback() }
   }
   return reactive<T>(storage.value['data'])
 }
 
-export const user = ref()
-
 interface AuthConfig {
   authType: 0 | 1
   username?: string
@@ -18,9 +17,11 @@ interface AuthConfig {
   platform?: string
   userId?: string
   showPass?: boolean
+  token?: string
+  expire?: number
 }
 
-export const config = useVersionStorage<AuthConfig>('managerConfig', '2.0', () => ({
+export const config = useVersionStorage<AuthConfig>('auth', '1.0', () => ({
   authType: 0,
 }))
 
diff --git a/plugins/frontend/auth/package.json b/plugins/frontend/auth/package.json
index 366d4c14ec..23b153b303 100644
--- a/plugins/frontend/auth/package.json
+++ b/plugins/frontend/auth/package.json
@@ -30,6 +30,7 @@
     "authentication",
     "login",
     "console",
+    "required:database",
     "required:console"
   ],
   "peerDependencies": {
diff --git a/plugins/frontend/auth/src/index.ts b/plugins/frontend/auth/src/index.ts
index ab6d792028..ea18c74e48 100644
--- a/plugins/frontend/auth/src/index.ts
+++ b/plugins/frontend/auth/src/index.ts
@@ -1,17 +1,143 @@
-import { Context, Schema } from 'koishi'
-import {} from '@koishijs/plugin-console'
+import { Awaitable, Context, pick, Schema, Time, User } from 'koishi'
+import { DataService, SocketHandle } from '@koishijs/plugin-console'
 import { resolve } from 'path'
+import { v4 } from 'uuid'
 
-export interface Config {}
+declare module 'koishi' {
+  interface User {
+    password: string
+    token: string
+    expire: number
+  }
+}
+
+declare module '@koishijs/plugin-console' {
+  interface SocketHandle {
+    user?: AuthUser
+  }
 
-export const name = 'auth'
-export const using = ['console'] as const
-export const schema: Schema<Config> = Schema.object({})
+  namespace Console {
+    interface Services {
+      user: AuthService
+    }
+  }
 
-export function apply(ctx: Context) {
-  if (ctx.console.config.devMode) {
-    ctx.console.addEntry(resolve(__dirname, '../client/index.ts'))
-  } else {
-    ctx.console.addEntry(resolve(__dirname, '../dist'))
+  interface Events {
+    'login/platform'(this: SocketHandle, platform: string, userId: string): Awaitable<LoginUser>
+    'login/password'(this: SocketHandle, name: string, password: string): void
+    'login/token'(this: SocketHandle, id: string, token: string): void
+    'user/modify'(this: SocketHandle, data: Partial<Pick<User, 'name' | 'password'>>): void
   }
 }
+
+export type AuthUser = Pick<User, 'id' | 'name' | 'password' | 'authority' | 'token' | 'expire'>
+export type LoginUser = Pick<User, 'id' | 'name' | 'token' | 'expire'>
+
+const authFields = ['name', 'password', 'authority', 'id', 'expire', 'token'] as (keyof AuthUser)[]
+
+function initAuth(handle: SocketHandle, value: AuthUser) {
+  handle.user = value
+  handle.send({ type: 'data', body: { key: 'user', value } })
+}
+
+class AuthService extends DataService<AuthUser> {
+  static using = ['console', 'database'] as const
+
+  constructor(ctx: Context, private config: AuthService.Config) {
+    super(ctx, 'user')
+
+    ctx.model.extend('user', {
+      password: 'string(63)',
+      token: 'string(63)',
+      expire: 'unsigned(20)',
+    })
+
+    if (ctx.console.config.devMode) {
+      ctx.console.addEntry(resolve(__dirname, '../client/index.ts'))
+    } else {
+      ctx.console.addEntry(resolve(__dirname, '../dist'))
+    }
+
+    this.initLogin()
+  }
+
+  initLogin() {
+    const { ctx, config } = this
+    const states: Record<string, [string, number, SocketHandle]> = {}
+
+    ctx.console.addListener('login/password', async function (name, password) {
+      const user = await ctx.database.getUser('name', name, authFields)
+      if (!user || user.password !== password) throw new Error('用户名或密码错误。')
+      user.token = v4()
+      user.expire = Date.now() + config.authTokenExpire
+      await ctx.database.setUser('name', name, pick(user, ['token', 'expire']))
+      initAuth(this, user)
+    })
+
+    ctx.console.addListener('login/token', async function (id, token) {
+      const user = await ctx.database.getUser('id', id, authFields)
+      if (!user) throw new Error('用户不存在。')
+      if (user.token !== token || user.expire <= Date.now()) throw new Error('令牌已失效。')
+      initAuth(this, user)
+    })
+  
+    ctx.console.addListener('login/platform', async function (platform, userId) {
+      const user = await ctx.database.getUser(platform, userId, ['name'])
+      if (!user) throw new Error('找不到此账户。')
+      const id = `${platform}:${userId}`
+      const token = v4()
+      const expire = Date.now() + config.loginTokenExpire
+      states[id] = [token, expire, this]
+
+      const listener = () => {
+        delete states[id]
+        dispose()
+        this.socket.off('close', listener)
+      }
+      const dispose = ctx.setTimeout(() => {
+        if (states[id]?.[1] >= Date.now()) listener()
+      }, config.loginTokenExpire)
+      this.socket.on('close', listener)
+
+      return { id: user.id, name: user.name, token, expire }
+    })
+
+    ctx.any().private().middleware(async (session, next) => {
+      const state = states[session.uid]
+      if (state && state[0] === session.content) {
+        const user = await session.observeUser(authFields)
+        user.token = v4()
+        user.expire = Date.now() + config.authTokenExpire
+        return initAuth(state[2], user)
+      }
+      return next()
+    }, true)
+
+    ctx.on('console/intercept', async (handle, listener) => {
+      if (!listener.authority) return false
+      if (!handle.user) return true
+      if (handle.user.expire <= Date.now()) return true
+      return handle.user.authority < listener.authority
+    })
+  
+    ctx.console.addListener('user/modify', async function ({ name, password }) {
+      // const user = await ctx.database.getUser('id', id, ['token', 'expire', 'authority', 'password'])
+      // if (!user || password === user.password) return
+      // await ctx.database.setUser('id', id, { password })
+    })
+  }
+}
+
+namespace AuthService {
+  export interface Config {
+    authTokenExpire?: number
+    loginTokenExpire?: number
+  }
+
+  export const Config: Schema<Config> = Schema.object({
+    authTokenExpire: Schema.natural().role('ms').default(Time.week).description('用户令牌有效期。'),
+    loginTokenExpire: Schema.natural().role('ms').default(Time.minute * 10).description('登录令牌有效期。'),
+  })
+}
+
+export default AuthService
diff --git a/plugins/frontend/console/client/client.ts b/plugins/frontend/console/client/client.ts
index 5b2b222dd7..589bd33ef9 100644
--- a/plugins/frontend/console/client/client.ts
+++ b/plugins/frontend/console/client/client.ts
@@ -100,6 +100,7 @@ export function getValue<T>(computed: Computed<T>): T {
 
 export class Context {
   static app: App
+  static router = router
   static pending: Dict<DisposableExtension[]> = {}
 
   public disposables: Disposable[] = []
diff --git a/plugins/frontend/console/client/index.d.ts b/plugins/frontend/console/client/index.d.ts
index 2feb33f188..f0170409e9 100644
--- a/plugins/frontend/console/client/index.d.ts
+++ b/plugins/frontend/console/client/index.d.ts
@@ -16,6 +16,8 @@ declare module '~/components' {
 
 declare module '~/client' {
   import { App, Component } from 'vue'
+  import { Router } from 'vue-router'
+  import { Promisify } from 'koishi'
   import { Console, Events, DataService, ClientConfig } from '@koishijs/plugin-console'
 
   // data api
@@ -27,7 +29,7 @@ declare module '~/client' {
   export const config: ClientConfig
   export const store: Store
 
-  export function send<K extends keyof Events>(type: K, ...args: Parameters<Events[K]>): ReturnType<Events[K]>
+  export function send<K extends keyof Events>(type: K, ...args: Parameters<Events[K]>): Promisify<ReturnType<Events[K]>>
   export function send(type: string, ...args: any[]): Promise<any>
   export function receive<T = any>(event: string, listener: (data: T) => void): void
 
@@ -72,6 +74,7 @@ declare module '~/client' {
 
   export class Context {
     static app: App
+    static router: Router
     disposables: Disposable[] = []
 
     addPage(options: PageOptions): void
diff --git a/plugins/frontend/console/src/index.ts b/plugins/frontend/console/src/index.ts
index 34e6f108bc..b11c61606a 100644
--- a/plugins/frontend/console/src/index.ts
+++ b/plugins/frontend/console/src/index.ts
@@ -40,10 +40,10 @@ export class Console extends Service {
     this.http.addEntry(filename)
   }
 
-  addListener<K extends keyof Events>(event: K, callback: Events[K]): void
-  addListener(event: string, callback: Listener): void
-  addListener(event: string, callback: Listener) {
-    this.ws.addListener(event, callback)
+  addListener<K extends keyof Events>(event: K, callback: Events[K], options?: Listener.Options): void
+  addListener(event: string, callback: Listener.Callback, options?: Listener.Options): void
+  addListener(event: string, callback: Listener.Callback, options: Listener.Options = {}) {
+    this.ws.addListener(event, { callback, ...options })
   }
 }
 
@@ -52,7 +52,7 @@ export interface Events {}
 export namespace Console {
   export interface Config extends HttpService.Config, WsService.Config {}
 
-  export const Config = Schema.object({
+  export const Config: Schema<Config> = Schema.object({
     uiPath: Schema.string().description('前端页面呈现的路径。').default(''),
     apiPath: Schema.string().description('后端 API 服务的路径。').default('/status'),
     selfUrl: Schema.string().description('Koishi 服务暴露在公网的地址。').role('url').comment('与其他需要 selfUrl 配置项的地方不同的是，这里的属性不会继承 app.options.selfUrl 的值。这是因为，由于这里缺省时会使用相对路径，网页依旧可以正常访问。只有你将 uiPath 和 apiPath 分别部署到了不同的端口或域名时，这个选项才建议使用。').default(''),
diff --git a/plugins/frontend/console/src/ws.ts b/plugins/frontend/console/src/ws.ts
index 64fc48947c..ed5dafa82e 100644
--- a/plugins/frontend/console/src/ws.ts
+++ b/plugins/frontend/console/src/ws.ts
@@ -1,34 +1,40 @@
-import { Awaitable, coerce, Context, Dict, Logger, WebSocketLayer } from 'koishi'
+import { App, Awaitable, coerce, Context, Dict, Logger, WebSocketLayer } from 'koishi'
 import { v4 } from 'uuid'
 import { DataService } from './service'
 import WebSocket from 'ws'
 
 declare module 'koishi' {
   interface EventMap {
-    'console/validate'(handle: SocketHandle): Awaitable<boolean>
+    'console/intercept'(handle: SocketHandle, listener: Listener): Awaitable<boolean>
   }
 }
 
 const logger = new Logger('console')
 
 export class SocketHandle {
-  readonly ctx: Context
+  readonly app: App
   readonly id: string = v4()
 
   constructor(service: WsService, public socket: WebSocket) {
-    this.ctx = service.ctx
+    this.app = service.ctx.app
   }
 
   send(payload: any) {
     this.socket.send(JSON.stringify(payload))
   }
+}
 
-  async validate() {
-    return this.ctx.serial('console/validate', this)
-  }
+export interface Listener extends Listener.Options {
+  callback: Listener.Callback
 }
 
-export type Listener = (this: SocketHandle, ...args: any[]) => Awaitable<any>
+export namespace Listener {
+  export type Callback = (this: SocketHandle, ...args: any[]) => Awaitable<any>
+
+  export interface Options {
+    authority?: number
+  }
+}
 
 class WsService extends DataService {
   readonly handles: Dict<SocketHandle> = {}
@@ -50,8 +56,8 @@ class WsService extends DataService {
     this.layer.clients.forEach((socket) => socket.send(data))
   }
 
-  addListener(event: string, callback: Listener) {
-    this.listeners[event] = callback
+  addListener(event: string, listener: Listener) {
+    this.listeners[event] = listener
   }
 
   stop() {
@@ -72,16 +78,19 @@ class WsService extends DataService {
     }
 
     socket.on('message', async (data) => {
-      if (await handle.validate()) return
       const { type, args, id } = JSON.parse(data.toString())
       const listener = this.listeners[type]
       if (!listener) {
         logger.info('unknown message:', type, ...args)
-        return handle.send({ type: 'response', body: { id } })
+        return handle.send({ type: 'response', body: { id, error: 'not implemented' } })
+      }
+
+      if (await this.ctx.serial('console/intercept', handle, listener)) {
+        return handle.send({ type: 'response', body: { id, error: 'unauthorized' } })
       }
 
       try {
-        const value = await listener.call(handle, ...args)
+        const value = await listener.callback.call(handle, ...args)
         return handle.send({ type: 'response', body: { id, value } })
       } catch (error) {
         error = coerce(error)
diff --git a/plugins/frontend/console/tsconfig.json b/plugins/frontend/console/tsconfig.json
index 72a43d6a02..3d1da46518 100644
--- a/plugins/frontend/console/tsconfig.json
+++ b/plugins/frontend/console/tsconfig.json
@@ -2,7 +2,7 @@
   "extends": "../../../tsconfig.base",
   "compilerOptions": {
     "rootDir": "src",
-    "outDir": "lib",
+    "outFile": "temp/index.d.ts",
   },
   "include": [
     "src",