优化

tests/auth-session.test.mjs

@@ -26,10 +26,26 @@ test('refresh rotation persists the complete token pair and preserves operator c
 })
 
 test('app launch restores and validates persisted tokens before entering the workbench', async () => {
-	const [login, http] = await Promise.all([read('../pages/login/login.vue'), read('../api/http.js')])
+	const [login, http, session] = await Promise.all([read('../pages/login/login.vue'), read('../api/http.js'), read('../stores/session.js')])
 	assert.match(login, /async onLoad\(\)[\s\S]*?restoreSession\(\)[\s\S]*?await ensureAccessToken\(\)[\s\S]*?pages\/home\/home/)
 	assert.match(http, /export function ensureAccessToken\(\)/)
 	assert.match(login, /暂时无法恢复登录状态/)
+	assert.match(session, /id: String\(claims\.user_id \?\? savedUser\.id \?\? ''\)/)
+	assert.match(session, /persistSession\(\)[\s\S]*?return true/)
+})
+
+test('JWT decoding preserves 19 digit identity claims exactly', async () => {
+	const { decodeAccessToken } = await import('../utils/jwt-claims.js')
+	const payload = Buffer.from(JSON.stringify({
+		app_code: 'PLATFORM',
+		user_id: 1,
+		tenant_id: '2101483345056575489',
+		exp: 4102444800
+	}).replace('"user_id":1', '"user_id":2100885001485500418')).toString('base64url')
+	const claims = decodeAccessToken(`header.${payload}.signature`)
+	assert.equal(claims.user_id, '2100885001485500418')
+	assert.equal(claims.tenant_id, '2101483345056575489')
+	assert.equal(claims.exp, 4102444800)
 })
 
 test('confirmed session expiry clears sensitive state and redirects only once', async () => {