fix(auth): restore cross-tab permissions and bind retries to session identity

2026-10-02 23:29:20 +08:00
parent e564353a80
commit 5f963f326e
7 changed files with 386 additions and 109 deletions
@@ -56,3 +56,15 @@ test('remembers only the login id and keeps it when session tokens are cleared',
  persistRememberedLoginId('merchant-user', false)
  assert.equal(getRememberedLoginId(), '')
 })
+
+test('normal token rotation never removes either shared token between writes', () => {
+  installStorage()
+  localStorage.setItem(ACCESS_TOKEN_KEY, 'old-access')
+  localStorage.setItem(REFRESH_TOKEN_KEY, 'old-refresh')
+  const removed = []
+  const remove = localStorage.removeItem
+  localStorage.removeItem = key => { removed.push(key); remove(key) }
+  persistTokenPair({ accessToken: 'new-access', refreshToken: 'new-refresh' })
+  assert.ok(!removed.includes(ACCESS_TOKEN_KEY))
+  assert.ok(!removed.includes(REFRESH_TOKEN_KEY))
+})