优化

scripts/phase4-overseas-acceptance-entry-contract.test.mjs

@@ -44,10 +44,47 @@ test('entry accepts a separate overseas Gateway without exposing token state', (
   assert.equal(options.gateway, 'http://localhost:9000')
   assert.equal(options.overseasGateway, 'http://localhost:9300')
   assert.match(source, /this\.overseasToken = login\.overseasAccessToken \|\| ''/)
+  assert.match(source, /this\.refreshToken = login\.refreshToken \|\| ''/)
+  assert.match(source, /this\.overseasExpiresAt = Number\(login\.overseasExpiresIn\)/)
+  assert.match(source, /async refreshSession\(reason\)/)
+  assert.match(source, /refreshToken: this\.refreshToken/)
+  assert.match(source, /const replacement = \{[\s\S]*token: next\.accessToken[\s\S]*refreshToken: next\.refreshToken[\s\S]*overseasToken: next\.overseasAccessToken/)
+  assert.match(source, /module === 'system' && laterOverseasModule/)
+  assert.match(source, /system后新admin海外Token只读探针可用/)
+  assert.match(source, /module\.startsWith\('phase4-overseas-'\)[\s\S]*Date\.now\(\) \+ 120_000 >= this\.overseasExpiresAt/)
+  assert.match(source, /海外模块 \$\{module\} 执行前Token临近到期/)
   assert.match(source, /async requestOverseas\(/)
   assert.match(source, /async requestOverseasBinary\(/)
   assert.match(source, /async requestOverseasMultipart\(/)
-  assert.match(source, /forbiddenValues = \[this\.options\.password, this\.token, this\.overseasToken\]/)
+  assert.match(source, /forbiddenValues = \[this\.options\.password, this\.token, this\.refreshToken, this\.overseasToken\]/)
+})
+
+test('dual-token refresh replaces the whole session only after a complete response', async () => {
+  const run = new AcceptanceRun({ gateway: 'http://localhost:9000', overseasGateway: 'http://localhost:9300',
+    username: 'contract-user', password: 'contract-password', modules: [], output: '' })
+  Object.assign(run, { token: 'old-access', refreshToken: 'old-refresh', overseasToken: 'old-overseas', overseasExpiresAt: 1 })
+  run.request = async (method, path, body, token) => {
+    assert.equal(method, 'POST'); assert.equal(path, '/api/auth/refresh')
+    assert.deepEqual(body, { refreshToken: 'old-refresh' }); assert.equal(token, '')
+    return { method, path, http: 200, body: { code: '200', data: {
+      accessToken: 'new-access', refreshToken: 'new-refresh', overseasAccessToken: 'new-overseas',
+      overseasExpiresIn: 900,
+    } }, requestId: 'refresh-request', traceId: 'refresh-trace' }
+  }
+  assert.equal(await run.refreshSession('contract'), true)
+  assert.equal(run.token, 'new-access')
+  assert.equal(run.refreshToken, 'new-refresh')
+  assert.equal(run.overseasToken, 'new-overseas')
+  assert.ok(run.overseasExpiresAt > Date.now())
+
+  const frozen = { token: run.token, refreshToken: run.refreshToken,
+    overseasToken: run.overseasToken, overseasExpiresAt: run.overseasExpiresAt }
+  run.request = async (method, path) => ({ method, path, http: 200,
+    body: { code: '200', data: { accessToken: 'partial-only' } },
+    requestId: 'partial-request', traceId: 'partial-trace' })
+  assert.equal(await run.refreshSession('incomplete-contract'), false)
+  assert.deepEqual({ token: run.token, refreshToken: run.refreshToken,
+    overseasToken: run.overseasToken, overseasExpiresAt: run.overseasExpiresAt }, frozen)
 })
 
 test('entry has no built-in environment address or password and requires explicit execution options', () => {