优化

src/core/auth/auth.test.ts

@@ -184,29 +184,17 @@ describe('admin auth session', () => {
     expect(auth.isAuthenticated).toBe(true)
   })
 
-  it('refreshes a valid persisted session so newly granted permissions appear after reload', async () => {
+  it('reuses a valid persisted session without blocking reload on refresh', async () => {
     localStorage.setItem('cc-admin-token', token())
     localStorage.setItem('cc-admin-refresh-token', 'refresh-old')
     localStorage.setItem('cc-admin-permission-codes', '["platform:warehouse:list"]')
-    const refreshedToken = token({
-      token_version: 2,
-    })
-    mocks.post.mockResolvedValue(loginResponse(refreshedToken, 'refresh-rotated'))
-    mocks.listCurrentPlatformPermissionCodes.mockResolvedValue([
-      'platform:warehouse:list',
-      'platform:firstleg:inbound:list',
-    ])
     const auth = useAuthStore()
 
     await expect(auth.restoreSession()).resolves.toBe(true)
 
-    expect(mocks.post).toHaveBeenCalledWith('/auth/refresh', { refreshToken: 'refresh-old' })
+    expect(mocks.post).not.toHaveBeenCalled()
-    expect([...auth.permissionCodes]).toEqual([
+    expect([...auth.permissionCodes]).toEqual(['platform:warehouse:list'])
-      'platform:warehouse:list',
+    expect(localStorage.getItem('cc-admin-permission-codes')).toBe('["platform:warehouse:list"]')
-      'platform:firstleg:inbound:list',
-    ])
-    expect(localStorage.getItem('cc-admin-permission-codes'))
-      .toBe('["platform:warehouse:list","platform:firstleg:inbound:list"]')
   })
 
   it('reuses a session rotated by another tab without refreshing it again', async () => {

src/core/auth/auth.ts

@@ -224,15 +224,11 @@ export const useAuthStore = defineStore('admin-auth', () => {
   }
 
   async function restoreSession() {
-    if (isAuthenticated.value) {
+    // The constructor has already validated a persisted access token. Reusing
-      if (!refreshToken.value) return true
+    // a still-valid token lets the app mount immediately; refresh only remains
-      try {
+    // necessary after the access token has expired and the constructor has
-        await refreshSession()
+    // retained the persisted refresh token for recovery.
-        return true
+    if (isAuthenticated.value) return true
-      } catch {
-        return false
-      }
-    }
     if (!refreshToken.value) return false
     try {
       await refreshSession()