修复刷新轮换竞争被放大成登出

- refresh 接口的轮换失败不再下发清空 refresh cookie 的响应，避免删掉并发请求刚写入的有效 cookie - 缺少 refresh cookie 的失败保持无副作用，cookie 失效只由吊销、过期或身份变更决定 - 网站前端在刷新返回 401 时先用当前 cookie 收敛重试一次，重试仍被拒绝才判权威失效 - 网站前端只在当前鉴权代次未变化时重试刷新，避免旧账号结论污染新代次 - 更新 api-server 与前端断言，覆盖轮换竞争与收敛重试两条路径
2026-09-16 16:51:36 +08:00
parent 4182979a19
commit 479120d368
4 changed files with 72 additions and 29 deletions
@@ -4933,17 +4933,20 @@ mod tests {
            .expect("stale refresh request should succeed");

        assert_eq!(stale_refresh_response.status(), StatusCode::UNAUTHORIZED);
+        // 轮换竞争或重放都不能清空浏览器当前的 refresh cookie：清 cookie 会删掉并发
+        // 请求刚刚写入的有效 cookie，把一次竞争放大成登出。cookie 的失效只由会话吊销、
+        // 过期或身份变更决定，客户端在收敛重试后仍收到 401 时才清本地会话。
        assert!(
            stale_refresh_response
                .headers()
                .get("set-cookie")
                .and_then(|value| value.to_str().ok())
-                .is_some_and(|value| value.contains("Max-Age=0"))
+                .is_none_or(|value| !value.contains("Max-Age=0"))
        );
    }

    #[tokio::test]
-    async fn refresh_session_rejects_missing_cookie_and_clears_cookie() {
+    async fn refresh_session_rejects_missing_cookie_without_touching_cookies() {
        let app = build_router(AppState::new(AppConfig::default()).expect("state should build"));

        let response = app
@@ -4963,7 +4966,7 @@ mod tests {
                .headers()
                .get("set-cookie")
                .and_then(|value| value.to_str().ok())
-                .is_some_and(|value| value.contains("Max-Age=0"))
+                .is_none_or(|value| !value.contains("Max-Age=0"))
        );
    }

@@ -12,8 +12,7 @@ use crate::{
    api_response::json_success_body,
    auth::RefreshSessionToken,
    auth_session::{
-        attach_set_cookie_header, build_clear_refresh_session_cookie_header,
-        build_refresh_session_cookie_header, map_refresh_session_error,
+        attach_set_cookie_header, build_refresh_session_cookie_header, map_refresh_session_error,
        record_daily_login_tracking_event_after_auth_success, sign_access_token_for_user,
    },
    http_error::AppError,
@@ -30,10 +29,9 @@ pub async fn refresh_session(
        .map(|token| token.0.token().to_string())
        .unwrap_or_default();
    if raw_refresh_token.trim().is_empty() {
-        return Err(map_refresh_error_with_clear_cookie(
-            &state,
-            RefreshSessionError::MissingToken,
-        ));
+        // 缺少 cookie 时同样不下发清 cookie 响应：这里没有可清的对象，失败关闭由
+        // 客户端"收敛重试后仍 401 才登出"的判据负责。
+        return Err(map_refresh_session_error(RefreshSessionError::MissingToken));
    }
    let refresh_token_hash = hash_refresh_session_token(&raw_refresh_token);
    let next_refresh_token = platform_auth::create_refresh_session_token();
@@ -57,13 +55,11 @@ pub async fn refresh_session(
        OffsetDateTime::now_utc(),
    ) {
        Ok(rotated) => rotated,
-        Err(RefreshSessionError::SessionNotFound) => {
-            return Err(map_refresh_error_with_clear_cookie(
-                &state,
-                RefreshSessionError::SessionNotFound,
-            ));
-        }
-        Err(error) => return Err(map_refresh_error_with_clear_cookie(&state, error)),
+        // 轮换失败不下发清空 refresh cookie 的响应。并发或乱序刷新时，清 cookie 会删掉
+        // 另一个请求刚刚写入的有效 refresh cookie，把一次轮换竞争放大成登出；refresh
+        // cookie 的失效只由会话吊销、过期或身份变更语义决定。客户端在收敛重试后仍然
+        // 收到 401 / 403 时才清本地会话。
+        Err(error) => return Err(map_refresh_session_error(error)),
    };
    let access_token = sign_access_token_for_user(
        &state,
@@ -103,12 +99,3 @@ pub async fn refresh_session(
        ),
    ))
 }
-
-fn map_refresh_error_with_clear_cookie(state: &AppState, error: RefreshSessionError) -> AppError {
-    let response_error = map_refresh_session_error(error);
-    if let Ok(set_cookie) = build_clear_refresh_session_cookie_header(state) {
-        return response_error.with_header("set-cookie", set_cookie);
-    }
-
-    response_error
-}
@@ -322,6 +322,7 @@ describe('apiClient', () => {
  it('emits auth change events when refresh fails on protected requests', async () => {
    setStoredAccessToken('expired-token', { emit: false });
    fetchMock
+      .mockResolvedValueOnce(createResponseMock({ status: 401 }))
      .mockResolvedValueOnce(createResponseMock({ status: 401 }))
      .mockResolvedValueOnce(createResponseMock({ status: 401 }));

@@ -330,7 +331,12 @@ describe('apiClient', () => {
    });

    expect(response.status).toBe(401);
-    expect(fetchMock).toHaveBeenCalledTimes(2);
+    // 业务 401 + refresh 401 收敛重试 + refresh 仍 401：只有两次刷新都被明确拒绝，
+    // 才判定登录态权威失效并广播一次全局鉴权变化。
+    expect(
+      fetchMock.mock.calls.filter(([input]) => input === '/api/auth/refresh'),
+    ).toHaveLength(2);
+    expect(fetchMock).toHaveBeenCalledTimes(3);
    expect(dispatchEventMock).toHaveBeenCalledTimes(1);
    expect(getStoredAccessToken()).toBe('');
  });
@@ -405,7 +411,9 @@ describe('apiClient', () => {

  it('keeps local token when explicit refresh opts out of clearing on failure', async () => {
    setStoredAccessToken('usable-local-token', { emit: false });
-    fetchMock.mockResolvedValueOnce(createResponseMock({ status: 401 }));
+    fetchMock
+      .mockResolvedValueOnce(createResponseMock({ status: 401 }))
+      .mockResolvedValueOnce(createResponseMock({ status: 401 }));

    await expect(
      refreshStoredAccessToken({ clearOnFailure: false }),
@@ -456,7 +464,9 @@ describe('apiClient', () => {

  it('clears local token when refresh confirms the session is unauthorized', async () => {
    setStoredAccessToken('expired-local-token', { emit: false });
-    fetchMock.mockResolvedValueOnce(createResponseMock({ status: 401 }));
+    fetchMock
+      .mockResolvedValueOnce(createResponseMock({ status: 401 }))
+      .mockResolvedValueOnce(createResponseMock({ status: 401 }));

    await expect(refreshStoredAccessToken()).rejects.toMatchObject({
      status: 401,
@@ -466,6 +476,32 @@ describe('apiClient', () => {
    expect(getStoredAccessToken()).toBe('');
  });

+  it('retries refresh once with the current cookie after a rotation race', async () => {
+    setStoredAccessToken('expired-local-token', { emit: false });
+    fetchMock
+      // 并发轮换竞争：这一次 refresh 拿到的是被另一个客户端轮换过的旧 cookie。
+      .mockResolvedValueOnce(createResponseMock({ status: 401 }))
+      // 收敛重试使用浏览器当前 cookie，拿到轮换后的新 token。
+      .mockResolvedValueOnce(
+        createResponseMock({
+          status: 200,
+          body: JSON.stringify({
+            ok: true,
+            data: { token: 'converged-token' },
+            error: null,
+            meta: { apiVersion: '2026-06-16' },
+          }),
+        }),
+      );
+
+    await expect(refreshStoredAccessToken()).resolves.toBe('converged-token');
+    expect(
+      fetchMock.mock.calls.filter(([input]) => input === '/api/auth/refresh'),
+    ).toHaveLength(2);
+    expect(getStoredAccessToken()).toBe('converged-token');
+    expect(dispatchEventMock).not.toHaveBeenCalled();
+  });
+
  it('does not clear auth when protected request refresh fails transiently', async () => {
    setStoredAccessToken('expired-token-during-restart', { emit: false });
    fetchMock
@@ -775,7 +775,7 @@ async function refreshAccessToken() {
    return refreshAccessTokenAttempt.promise;
  }

-  const promise = (async () => {
+  const performRefresh = async () => {
    const response = await fetch('/api/auth/refresh', {
      method: 'POST',
      credentials: 'same-origin',
@@ -802,6 +802,23 @@ async function refreshAccessToken() {

    publishRefreshedAccessToken(nextToken, authStateSnapshot);
    return nextToken;
+  };
+  const promise = (async () => {
+    try {
+      return await performRefresh();
+    } catch (error) {
+      const authoritative =
+        error instanceof ApiClientError &&
+        (error.status === 401 || error.status === 403);
+      // 登录态已经变化（换号 / 退出 / 另一个 refresh 已发布新 token）时不要重试：
+      // 这次 refresh 的归属已经过期，重试只会把旧账号的结论带到新代次上。
+      if (!authoritative || !isCurrentAuthState(authStateSnapshot)) {
+        throw error;
+      }
+      // 并发轮换收敛：另一个标签页 / 客户端可能刚刚轮换过 refresh cookie，用当前
+      // cookie 再试一次。重试成功则继续使用新凭据；重试仍被明确拒绝才算权威失效。
+      return await performRefresh();
+    }
  })();
  const attempt: RefreshAccessTokenAttempt = {
    ...authStateSnapshot,