diff --git a/server-rs/crates/api-server/src/app.rs b/server-rs/crates/api-server/src/app.rs index a3a761b3f..d4d081884 100644 --- a/server-rs/crates/api-server/src/app.rs +++ b/server-rs/crates/api-server/src/app.rs @@ -4933,17 +4933,20 @@ mod tests { .expect("stale refresh request should succeed"); assert_eq!(stale_refresh_response.status(), StatusCode::UNAUTHORIZED); + // 轮换竞争或重放都不能清空浏览器当前的 refresh cookie：清 cookie 会删掉并发 + // 请求刚刚写入的有效 cookie，把一次竞争放大成登出。cookie 的失效只由会话吊销、 + // 过期或身份变更决定，客户端在收敛重试后仍收到 401 时才清本地会话。 assert!( stale_refresh_response .headers() .get("set-cookie") .and_then(|value| value.to_str().ok()) - .is_some_and(|value| value.contains("Max-Age=0")) + .is_none_or(|value| !value.contains("Max-Age=0")) ); } #[tokio::test] - async fn refresh_session_rejects_missing_cookie_and_clears_cookie() { + async fn refresh_session_rejects_missing_cookie_without_touching_cookies() { let app = build_router(AppState::new(AppConfig::default()).expect("state should build")); let response = app @@ -4963,7 +4966,7 @@ mod tests { .headers() .get("set-cookie") .and_then(|value| value.to_str().ok()) - .is_some_and(|value| value.contains("Max-Age=0")) + .is_none_or(|value| !value.contains("Max-Age=0")) ); } diff --git a/server-rs/crates/api-server/src/refresh_session.rs b/server-rs/crates/api-server/src/refresh_session.rs index c6c783f67..a1bff0077 100644 --- a/server-rs/crates/api-server/src/refresh_session.rs +++ b/server-rs/crates/api-server/src/refresh_session.rs @@ -12,8 +12,7 @@ use crate::{ api_response::json_success_body, auth::RefreshSessionToken, auth_session::{ - attach_set_cookie_header, build_clear_refresh_session_cookie_header, - build_refresh_session_cookie_header, map_refresh_session_error, + attach_set_cookie_header, build_refresh_session_cookie_header, map_refresh_session_error, record_daily_login_tracking_event_after_auth_success, sign_access_token_for_user, }, http_error::AppError, @@ -30,10 +29,9 @@ pub async fn refresh_session( .map(|token| token.0.token().to_string()) .unwrap_or_default(); if raw_refresh_token.trim().is_empty() { - return Err(map_refresh_error_with_clear_cookie( - &state, - RefreshSessionError::MissingToken, - )); + // 缺少 cookie 时同样不下发清 cookie 响应：这里没有可清的对象，失败关闭由 + // 客户端"收敛重试后仍 401 才登出"的判据负责。 + return Err(map_refresh_session_error(RefreshSessionError::MissingToken)); } let refresh_token_hash = hash_refresh_session_token(&raw_refresh_token); let next_refresh_token = platform_auth::create_refresh_session_token(); @@ -57,13 +55,11 @@ pub async fn refresh_session( OffsetDateTime::now_utc(), ) { Ok(rotated) => rotated, - Err(RefreshSessionError::SessionNotFound) => { - return Err(map_refresh_error_with_clear_cookie( - &state, - RefreshSessionError::SessionNotFound, - )); - } - Err(error) => return Err(map_refresh_error_with_clear_cookie(&state, error)), + // 轮换失败不下发清空 refresh cookie 的响应。并发或乱序刷新时，清 cookie 会删掉 + // 另一个请求刚刚写入的有效 refresh cookie，把一次轮换竞争放大成登出；refresh + // cookie 的失效只由会话吊销、过期或身份变更语义决定。客户端在收敛重试后仍然 + // 收到 401 / 403 时才清本地会话。 + Err(error) => return Err(map_refresh_session_error(error)), }; let access_token = sign_access_token_for_user( &state, @@ -103,12 +99,3 @@ pub async fn refresh_session( ), )) } - -fn map_refresh_error_with_clear_cookie(state: &AppState, error: RefreshSessionError) -> AppError { - let response_error = map_refresh_session_error(error); - if let Ok(set_cookie) = build_clear_refresh_session_cookie_header(state) { - return response_error.with_header("set-cookie", set_cookie); - } - - response_error -} diff --git a/src/services/apiClient.test.ts b/src/services/apiClient.test.ts index b04406338..fcd08330e 100644 --- a/src/services/apiClient.test.ts +++ b/src/services/apiClient.test.ts @@ -322,6 +322,7 @@ describe('apiClient', () => { it('emits auth change events when refresh fails on protected requests', async () => { setStoredAccessToken('expired-token', { emit: false }); fetchMock + .mockResolvedValueOnce(createResponseMock({ status: 401 })) .mockResolvedValueOnce(createResponseMock({ status: 401 })) .mockResolvedValueOnce(createResponseMock({ status: 401 })); @@ -330,7 +331,12 @@ describe('apiClient', () => { }); expect(response.status).toBe(401); - expect(fetchMock).toHaveBeenCalledTimes(2); + // 业务 401 + refresh 401 收敛重试 + refresh 仍 401：只有两次刷新都被明确拒绝， + // 才判定登录态权威失效并广播一次全局鉴权变化。 + expect( + fetchMock.mock.calls.filter(([input]) => input === '/api/auth/refresh'), + ).toHaveLength(2); + expect(fetchMock).toHaveBeenCalledTimes(3); expect(dispatchEventMock).toHaveBeenCalledTimes(1); expect(getStoredAccessToken()).toBe(''); }); @@ -405,7 +411,9 @@ describe('apiClient', () => { it('keeps local token when explicit refresh opts out of clearing on failure', async () => { setStoredAccessToken('usable-local-token', { emit: false }); - fetchMock.mockResolvedValueOnce(createResponseMock({ status: 401 })); + fetchMock + .mockResolvedValueOnce(createResponseMock({ status: 401 })) + .mockResolvedValueOnce(createResponseMock({ status: 401 })); await expect( refreshStoredAccessToken({ clearOnFailure: false }), @@ -456,7 +464,9 @@ describe('apiClient', () => { it('clears local token when refresh confirms the session is unauthorized', async () => { setStoredAccessToken('expired-local-token', { emit: false }); - fetchMock.mockResolvedValueOnce(createResponseMock({ status: 401 })); + fetchMock + .mockResolvedValueOnce(createResponseMock({ status: 401 })) + .mockResolvedValueOnce(createResponseMock({ status: 401 })); await expect(refreshStoredAccessToken()).rejects.toMatchObject({ status: 401, @@ -466,6 +476,32 @@ describe('apiClient', () => { expect(getStoredAccessToken()).toBe(''); }); + it('retries refresh once with the current cookie after a rotation race', async () => { + setStoredAccessToken('expired-local-token', { emit: false }); + fetchMock + // 并发轮换竞争：这一次 refresh 拿到的是被另一个客户端轮换过的旧 cookie。 + .mockResolvedValueOnce(createResponseMock({ status: 401 })) + // 收敛重试使用浏览器当前 cookie，拿到轮换后的新 token。 + .mockResolvedValueOnce( + createResponseMock({ + status: 200, + body: JSON.stringify({ + ok: true, + data: { token: 'converged-token' }, + error: null, + meta: { apiVersion: '2026-06-16' }, + }), + }), + ); + + await expect(refreshStoredAccessToken()).resolves.toBe('converged-token'); + expect( + fetchMock.mock.calls.filter(([input]) => input === '/api/auth/refresh'), + ).toHaveLength(2); + expect(getStoredAccessToken()).toBe('converged-token'); + expect(dispatchEventMock).not.toHaveBeenCalled(); + }); + it('does not clear auth when protected request refresh fails transiently', async () => { setStoredAccessToken('expired-token-during-restart', { emit: false }); fetchMock diff --git a/src/services/apiClient.ts b/src/services/apiClient.ts index 880e52921..f594ca662 100644 --- a/src/services/apiClient.ts +++ b/src/services/apiClient.ts @@ -775,7 +775,7 @@ async function refreshAccessToken() { return refreshAccessTokenAttempt.promise; } - const promise = (async () => { + const performRefresh = async () => { const response = await fetch('/api/auth/refresh', { method: 'POST', credentials: 'same-origin', @@ -802,6 +802,23 @@ async function refreshAccessToken() { publishRefreshedAccessToken(nextToken, authStateSnapshot); return nextToken; + }; + const promise = (async () => { + try { + return await performRefresh(); + } catch (error) { + const authoritative = + error instanceof ApiClientError && + (error.status === 401 || error.status === 403); + // 登录态已经变化（换号 / 退出 / 另一个 refresh 已发布新 token）时不要重试： + // 这次 refresh 的归属已经过期，重试只会把旧账号的结论带到新代次上。 + if (!authoritative || !isCurrentAuthState(authStateSnapshot)) { + throw error; + } + // 并发轮换收敛：另一个标签页 / 客户端可能刚刚轮换过 refresh cookie，用当前 + // cookie 再试一次。重试成功则继续使用新凭据；重试仍被明确拒绝才算权威失效。 + return await performRefresh(); + } })(); const attempt: RefreshAccessTokenAttempt = { ...authStateSnapshot,