fix(auth): revoke expired admin sessions without restoring login

src/core/auth/auth.test.ts

@@ -241,4 +241,101 @@ describe('admin auth session', () => {
     expect(auth.refreshToken).toBe('')
     expect(localStorage.getItem('cc-admin-token')).toBeNull()
   })
+
+  it('refreshes a rejected logout once and revokes the rotated pair without restoring local state', async () => {
+    const previous = token()
+    const rotated = token({ token_version: 2 })
+    localStorage.setItem('cc-admin-token', previous)
+    localStorage.setItem('cc-admin-refresh-token', 'refresh-old')
+    mocks.post.mockRejectedValueOnce({ isAxiosError: true, response: { status: 401 } })
+      .mockResolvedValueOnce(loginResponse(rotated, 'refresh-rotated'))
+      .mockResolvedValueOnce({ code: '200', data: null })
+    const auth = useAuthStore()
+
+    await expect(auth.logout()).resolves.toBeUndefined()
+
+    expect(mocks.post).toHaveBeenCalledTimes(3)
+    expect(mocks.post).toHaveBeenNthCalledWith(2, '/auth/refresh', { refreshToken: 'refresh-old' })
+    expect(mocks.post).toHaveBeenNthCalledWith(3, '/auth/logout', { refreshToken: 'refresh-rotated' }, {
+      headers: { Authorization: `Bearer ${rotated}` },
+    })
+    expect(auth.isAuthenticated).toBe(false)
+    expect(localStorage.getItem('cc-admin-token')).toBeNull()
+    expect(localStorage.getItem('cc-admin-refresh-token')).toBeNull()
+    expect(mocks.listCurrentPlatformPermissionCodes).not.toHaveBeenCalled()
+  })
+
+  it('revokes a persisted refresh session when startup already removed its expired access token', async () => {
+    localStorage.setItem('cc-admin-token', token({ exp: 1 }))
+    localStorage.setItem('cc-admin-refresh-token', 'refresh-old')
+    const rotated = token()
+    mocks.post.mockResolvedValueOnce(loginResponse(rotated, 'refresh-rotated'))
+      .mockResolvedValueOnce({ code: '200', data: null })
+    const auth = useAuthStore()
+    expect(auth.token).toBe('')
+
+    await auth.logout()
+
+    expect(mocks.post).toHaveBeenCalledTimes(2)
+    expect(mocks.post).toHaveBeenNthCalledWith(1, '/auth/refresh', { refreshToken: 'refresh-old' })
+    expect(mocks.post).toHaveBeenNthCalledWith(2, '/auth/logout', { refreshToken: 'refresh-rotated' }, {
+      headers: { Authorization: `Bearer ${rotated}` },
+    })
+    expect(auth.isAuthenticated).toBe(false)
+  })
+
+  it('leaves a subsequent login intact while finishing revocation of the previous session', async () => {
+    localStorage.setItem('cc-admin-token', token())
+    localStorage.setItem('cc-admin-refresh-token', 'refresh-old')
+    let finishRefresh: ((value: ReturnType<typeof loginResponse>) => void) | undefined
+    const started = new Promise<void>(resolve => {
+      mocks.post.mockRejectedValueOnce({ isAxiosError: true, response: { status: 401 } })
+        .mockImplementationOnce(() => { resolve(); return new Promise(done => { finishRefresh = done }) })
+    })
+    const auth = useAuthStore()
+    const loggingOut = auth.logout()
+    // Attach immediately so a regression rejecting early does not become an unhandled rejection.
+    const result = loggingOut.then(() => null, error => error)
+    await Promise.race([started, loggingOut.catch(() => undefined)])
+    expect(finishRefresh).toBeTypeOf('function')
+    const newAccess = token({ user_id: '1000002', username: 'second' })
+    mocks.post.mockResolvedValueOnce(loginResponse(newAccess, 'refresh-new-login'))
+      .mockResolvedValueOnce({ code: '200', data: null })
+    mocks.listCurrentPlatformPermissionCodes.mockResolvedValue(['platform:warehouse:list'])
+    await auth.login('second', 'password')
+    const revocationAccess = token({ token_version: 3 })
+    finishRefresh?.(loginResponse(revocationAccess, 'refresh-revocation-only'))
+
+    expect(await result).toBeNull()
+    expect(auth.token).toBe(newAccess)
+    expect(localStorage.getItem('cc-admin-refresh-token')).toBe('refresh-new-login')
+    expect(mocks.post).toHaveBeenLastCalledWith('/auth/logout', { refreshToken: 'refresh-revocation-only' }, {
+      headers: { Authorization: `Bearer ${revocationAccess}` },
+    })
+  })
+
+  it('does not refresh or retry an ambiguous logout transport failure', async () => {
+    localStorage.setItem('cc-admin-token', token())
+    localStorage.setItem('cc-admin-refresh-token', 'refresh-old')
+    const failure = { isAxiosError: true, response: { status: 503 } }
+    mocks.post.mockRejectedValue(failure)
+    const auth = useAuthStore()
+    await expect(auth.logout()).rejects.toBe(failure)
+    expect(mocks.post).toHaveBeenCalledTimes(1)
+    expect(auth.isAuthenticated).toBe(false)
+  })
+
+  it.each(['refresh', 'second-logout'])('stops after a %s rejection and never restores the logged-out session', async stage => {
+    localStorage.setItem('cc-admin-token', token())
+    localStorage.setItem('cc-admin-refresh-token', 'refresh-old')
+    const unauthorized = { isAxiosError: true, response: { status: 401 } }
+    mocks.post.mockRejectedValueOnce(unauthorized)
+    if (stage === 'second-logout') mocks.post.mockResolvedValueOnce(loginResponse())
+    mocks.post.mockRejectedValueOnce(unauthorized)
+    const auth = useAuthStore()
+    await expect(auth.logout()).rejects.toBe(unauthorized)
+    expect(mocks.post).toHaveBeenCalledTimes(stage === 'refresh' ? 2 : 3)
+    expect(localStorage.getItem('cc-admin-token')).toBeNull()
+    expect(localStorage.getItem('cc-admin-refresh-token')).toBeNull()
+  })
 })