feat(appointments): simplify planning and preserve source warehouse intent

src/core/auth/auth.test.ts

@@ -242,6 +242,62 @@ describe('admin auth session', () => {
     expect(localStorage.getItem('cc-admin-token')).toBeNull()
   })
 
+  it('rejects an old refresh after another tab has switched to a different account', async () => {
+    localStorage.setItem('cc-admin-token', token())
+    localStorage.setItem('cc-admin-refresh-token', 'admin-refresh')
+    localStorage.setItem('cc-admin-permission-codes', '["platform:warehouse:list"]')
+    let finishRefresh!: (value: ReturnType<typeof loginResponse>) => void
+    mocks.post.mockImplementation(() => new Promise(resolve => { finishRefresh = resolve }))
+    mocks.listCurrentPlatformPermissionCodes.mockResolvedValue(['platform:warehouse:list'])
+    const listeners = vi.spyOn(window, 'addEventListener')
+    const auth = useAuthStore()
+    const onStorage = listeners.mock.calls.find(([name]) => name === 'storage')![1] as (event: StorageEvent) => void
+    listeners.mockRestore()
+    const refreshing = auth.refreshSession()
+    await Promise.resolve()
+    const salesToken = token({ user_id: '2000002', username: 'sales' })
+    localStorage.setItem('cc-admin-token', salesToken)
+    localStorage.setItem('cc-admin-refresh-token', 'sales-refresh')
+    localStorage.setItem('cc-admin-permission-codes', '["platform:fleet:capacity-offer:list"]')
+    onStorage(new StorageEvent('storage', { key: 'cc-admin-token' }))
+    expect(auth.user?.account).toBe('sales')
+    finishRefresh(loginResponse(token(), 'admin-rotated'))
+    await expect(refreshing).rejects.toThrow('登录会话已被后续操作替代')
+    expect(auth.user?.account).toBe('sales')
+    expect(auth.token).toBe(salesToken)
+    expect(localStorage.getItem('cc-admin-refresh-token')).toBe('sales-refresh')
+    expect([...auth.permissionCodes]).toEqual(['platform:fleet:capacity-offer:list'])
+  })
+
+  it('discards late permission results after another tab switches accounts without clearing the new session', async () => {
+    mocks.post.mockResolvedValue(loginResponse())
+    let finishPermissions!: (value: string[]) => void
+    let permissionsStarted!: () => void
+    const started = new Promise<void>(resolve => { permissionsStarted = resolve })
+    mocks.listCurrentPlatformPermissionCodes.mockImplementation(() => {
+      permissionsStarted()
+      return new Promise(resolve => { finishPermissions = resolve })
+    })
+    const listeners = vi.spyOn(window, 'addEventListener')
+    const auth = useAuthStore()
+    const onStorage = listeners.mock.calls.find(([name]) => name === 'storage')![1] as (event: StorageEvent) => void
+    listeners.mockRestore()
+    const login = auth.login('platform_admin', 'password')
+    await started
+    const salesToken = token({ user_id: '2000002', username: 'sales' })
+    localStorage.setItem('cc-admin-token', salesToken)
+    localStorage.setItem('cc-admin-refresh-token', 'sales-refresh')
+    localStorage.setItem('cc-admin-permission-codes', '["platform:fleet:capacity-offer:list"]')
+    onStorage(new StorageEvent('storage', { key: 'cc-admin-token' }))
+    finishPermissions(['platform:warehouse:list'])
+    await expect(login).rejects.toThrow('登录会话已被后续操作替代')
+    expect(auth.user?.account).toBe('sales')
+    expect(auth.token).toBe(salesToken)
+    expect(localStorage.getItem('cc-admin-refresh-token')).toBe('sales-refresh')
+    expect([...auth.permissionCodes]).toEqual(['platform:fleet:capacity-offer:list'])
+    expect(mocks.post).toHaveBeenCalledTimes(1)
+  })
+
   it('refreshes a rejected logout once and revokes the rotated pair without restoring local state', async () => {
     const previous = token()
     const rotated = token({ token_version: 2 })

src/core/auth/auth.ts

@@ -144,6 +144,10 @@ export const useAuthStore = defineStore('admin-auth', () => {
     try {
       const session = sessionFromToken(storedToken)
       const cachedPermissions = JSON.parse(localStorage.getItem(PERMISSION_CODES_KEY) || '[]') as unknown
+      // A different account in another tab supersedes this tab's pending login/refresh responses.
+      if (user.value?.id !== session.user.id || user.value?.account !== session.user.account) {
+        sessionGeneration += 1
+      }
       token.value = storedToken
       refreshToken.value = storedRefreshToken
       user.value = session.user