fix(auth): revoke expired admin sessions without restoring login

src/core/auth/auth.ts

@@ -1,5 +1,6 @@
 import { computed, ref } from 'vue'
 import { defineStore } from 'pinia'
+import { isAxiosError } from 'axios'
 import type { CurrentUser } from '@chongchong/shared'
 import {
   http,
@@ -157,9 +158,29 @@ export const useAuthStore = defineStore('admin-auth', () => {
   }
 
   async function revokeTokenPair(accessToken: string, refreshTokenToRevoke: string) {
-    await http.post('/auth/logout', { refreshToken: refreshTokenToRevoke }, {
-      headers: { Authorization: `Bearer ${accessToken}` },
-    })
+    async function revoke(access: string, refresh: string) {
+      const response = await http.post<ApiEnvelope<null>, ApiEnvelope<null>>(
+        '/auth/logout', { refreshToken: refresh }, { headers: { Authorization: `Bearer ${access}` } },
+      )
+      unwrapApiResponse(response)
+    }
+    if (accessToken) {
+      try {
+        await revoke(accessToken, refreshTokenToRevoke)
+        return
+      } catch (error) {
+        if (!isAxiosError(error) || error.response?.status !== 401) throw error
+      }
+    }
+    // Logout has already cleared local state. Refresh only this captured pair
+    // for revocation; never apply it to this tab or overwrite a subsequent login.
+    const response = await http.post<ApiEnvelope<LoginResponse>, ApiEnvelope<LoginResponse>>(
+      '/auth/refresh', { refreshToken: refreshTokenToRevoke },
+    )
+    const rotated = unwrapApiResponse<LoginResponse>(response)
+    sessionFromToken(rotated.accessToken)
+    if (!rotated.refreshToken) throw new Error('退出时刷新响应缺少会话凭据')
+    await revoke(rotated.accessToken, rotated.refreshToken)
   }
 
   async function login(account: string, password: string) {
@@ -245,7 +266,7 @@ export const useAuthStore = defineStore('admin-auth', () => {
     const accessToken = token.value
     const tokenToRevoke = refreshToken.value
     clearSession()
-    if (accessToken && tokenToRevoke) {
+    if (tokenToRevoke) {
       await revokeTokenPair(accessToken, tokenToRevoke)
     }
   }