html/pda-overseas-uniapp
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(auth): revoke overseas PDA session on user logout

Browse Source
This commit is contained in:
ouyangxq
2026-10-04 21:28:53 +08:00
parent 12de982dac
commit b247b0cbb4
4 changed files with 204 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/api/auth.js
+19 -3
View File
@@ -1,6 +1,8 @@
import { API_ROOT } from '../config/runtime.js'
function authRequest(path, data) {
const pendingRefreshes = new Map()
function authRequest(path, data, accessToken = '') {
return new Promise((resolve, reject) => {
const url = `${API_ROOT}${path}`
console.info('[Overseas PDA auth] request', { method: 'POST', url })
@@ -8,6 +10,8 @@ function authRequest(path, data) {
url,
method: 'POST',
data,
header: { Accept: 'application/json', 'Content-Type': 'application/json',
...(accessToken ? { Authorization: `Bearer ${accessToken}` } : {}) },
success(response) {
const body = response.data || {}
console.info('[Overseas PDA auth] response', { url, statusCode: response.statusCode, code: body.code,
@@ -15,9 +19,10 @@ function authRequest(path, data) {
contentType: response.header?.['Content-Type'] || response.header?.['content-type'],
requestId: body.requestId || response.header?.['X-Request-Id'] || response.header?.['x-request-id'],
traceId: body.traceId || response.header?.['X-Trace-Id'] || response.header?.['x-trace-id'] })
if (String(body.code ?? response.statusCode) !== '200') {
if (response.statusCode !== 200 || String(body.code) !== '200') {
const error = new Error(body.message || '认证服务请求失败')
error.code = body.code || response.statusCode
error.statusCode = response.statusCode
error.requestId = body.requestId || response.header?.['X-Request-Id'] || response.header?.['x-request-id']
error.traceId = body.traceId || response.header?.['X-Trace-Id'] || response.header?.['x-trace-id']
reject(error)
@@ -40,5 +45,16 @@ export function login(loginId, password) {
}
export function refresh(refreshToken) {
return authRequest('/auth/refresh', { refreshToken })
if (pendingRefreshes.has(refreshToken)) return pendingRefreshes.get(refreshToken)
const pending = authRequest('/auth/refresh', { refreshToken }).finally(() => {
if (pendingRefreshes.get(refreshToken) === pending) pendingRefreshes.delete(refreshToken)
})
pendingRefreshes.set(refreshToken, pending)
return pending
}
export function getPendingRefresh(refreshToken) { return pendingRefreshes.get(refreshToken) || null }
export function logout(accessToken, refreshToken) {
return authRequest('/auth/logout', { refreshToken }, accessToken)
}
src/api/logout-session.js
+53
View File
@@ -0,0 +1,53 @@
import { logout, refresh, getPendingRefresh } from './auth.js'
import { session, signOut, getSessionRevision, decodeAccessToken } from '../stores/session.js'
function replacementForCapturedSession(captured, tokens) {
if (!tokens?.accessToken || typeof tokens.refreshToken !== 'string' || !tokens.refreshToken.trim()) {
throw new Error('退出刷新响应缺少会话凭据')
}
const previous = decodeAccessToken(captured.accessToken)
const replacement = decodeAccessToken(tokens.accessToken)
if (!Number.isFinite(Number(replacement?.exp)) || Number(replacement.exp) * 1000 <= Date.now()) {
throw new Error('退出刷新凭据无效或已过期')
}
for (const name of ['user_id', 'membership_id', 'tenant_id', 'app_code', 'overseas_warehouse_id']) {
if (previous[name] == null || String(previous[name]) !== String(replacement[name])) {
throw new Error('退出刷新返回了不同作业主体，无法确认原会话撤销')
}
}
return { accessToken: tokens.accessToken, refreshToken: tokens.refreshToken }
}
// Active user logout only. Ordinary authentication failures continue to use local signOut.
export function logoutCurrentSession() {
const captured = {
accessToken: session.token, refreshToken: session.refreshToken,
pendingRefresh: getPendingRefresh(session.refreshToken)
}
signOut()
const clearedRevision = getSessionRevision()
const revoke = async () => {
if (!captured.accessToken || !captured.refreshToken) return { revoked: false, reason: 'NO_CAPTURED_SESSION' }
let credentials = captured
let refreshed = false
if (captured.pendingRefresh) {
// Auth rotates access/refresh credentials. Revoke the captured refresh's result,
// while the business refresh wrapper's revision guard prevents local restoration.
refreshed = true
credentials = replacementForCapturedSession(captured, await captured.pendingRefresh)
}
try {
await logout(credentials.accessToken, credentials.refreshToken)
} catch (error) {
if (error.network || error.statusCode !== 401 || refreshed) throw error
// Only an explicit expired-access HTTP 401 permits one refresh and one revoke.
credentials = replacementForCapturedSession(captured, await refresh(captured.refreshToken))
await logout(credentials.accessToken, credentials.refreshToken)
}
return { revoked: true }
}
return revoke().then(result => ({ ...result, clearedRevision }), error => {
error.logoutRevision = clearedRevision
throw error
})
}
src/pages/profile/profile.vue
+16 -3
View File
@@ -13,7 +13,7 @@
</view>
<button class="logout-action" @tap="openLogout">退出登录</button>
</view>
<uni-popup ref="logoutPopup" type="center" :is-mask-click="true" @change="handleLogoutChange"><view class="logout-dialog-card" role="dialog" aria-modal="true" aria-label="确认退出登录"><PopupHeader title="确认退出登录？" tone="danger" @close="closeLogout" /><text class="logout-dialog-content">退出后会清空海外 PDA 的本地登录会话；未提交作业数据不得跨账号保留。</text><view class="logout-dialog-actions"><button class="logout-dialog-cancel" @tap="closeLogout">取消</button><button class="logout-dialog-confirm" @tap="logout">确认退出</button></view></view></uni-popup>
<uni-popup ref="logoutPopup" type="center" :is-mask-click="true" @change="handleLogoutChange"><view class="logout-dialog-card" role="dialog" aria-modal="true" aria-label="确认退出登录"><PopupHeader title="确认退出登录？" tone="danger" @close="closeLogout" /><text class="logout-dialog-content">退出会撤销当前登录会话并清空本地作业草稿；未提交作业数据不得跨账号保留。</text><view class="logout-dialog-actions"><button class="logout-dialog-cancel" @tap="closeLogout">取消</button><button class="logout-dialog-confirm" @tap="logout">确认退出</button></view></view></uni-popup>
<view v-if="toast" class="app-toast warning" role="status">设置功能将在后续版本开放</view>
</view>
</template>
@@ -22,7 +22,8 @@
import PopupHeader from '@/components/PopupHeader.vue'
import { getCurrentWarehouseProfile } from '@/api/inbound.js'
import { currentLocale, LOCALE_OPTIONS, setLocale } from '@/i18n/index.js'
import { applyWarehouseProfile, session, requireSession, signOut } from '@/stores/session.js'
import { applyWarehouseProfile, session, requireSession, getSessionRevision } from '@/stores/session.js'
import { logoutCurrentSession } from '@/api/logout-session.js'
import { checkForAppUpdate } from '@/utils/app-update.js'
export default {
components: { PopupHeader, PortalHeader },
@@ -66,7 +67,19 @@
async loadWarehouseProfile() { try { this.user = applyWarehouseProfile(await getCurrentWarehouseProfile()) } catch (_) { this.user = session.currentUser } },
openLogout() { this.logoutOpen = true; this.$refs.logoutPopup.open() }, closeLogout() { this.logoutOpen = false; this.$refs.logoutPopup.close() }, handleLogoutChange(event) { this.logoutOpen = Boolean(event.show) },
showSettings() { clearTimeout(this._toastTimer); this.toast = true; this._toastTimer = setTimeout(() => { this.toast = false }, 2200) },
logout() { signOut(); uni.reLaunch({ url: '/pages/login/login' }) }
logout() {
if (this._logoutPromise) return this._logoutPromise
this.closeLogout()
const operation = logoutCurrentSession()
this.user = null
uni.reLaunch({ url: '/pages/login/login' })
this._logoutPromise = operation.catch(error => {
if (getSessionRevision() === error.logoutRevision) {
uni.showToast({ title: '已清除本地登录，服务端退出未确认', icon: 'none' })
}
})
return this._logoutPromise
}
}
}
</script>