d9f0fe11c6
- 新增三個 refresh 端點(member/provider/admin),revoke 舊 token 發行新 7 天 token - axios.js / coachAxios.js:401 interceptor 改為 refresh-then-retry,含 isRefreshing queue 防並發、isRedirecting flag 防雙重 redirect - auth.js / coachAuth.js / AuthCallbackView.vue:localStorage 全改為 sessionStorage - echo.js / notificationAxios.js:同步改為 sessionStorage - notifications.js:401 時停止 polling(stopPolling),不印 error log - 新增 TokenRefreshTest.php(11 tests / 24 assertions):refresh 成功/失效/跨角色 403 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
82 lines
2.0 KiB
JavaScript
82 lines
2.0 KiB
JavaScript
import axios from 'axios'
|
|
|
|
const api = axios.create({
|
|
baseURL: import.meta.env.VITE_API_URL + '/api',
|
|
headers: { Accept: 'application/json' },
|
|
})
|
|
|
|
api.interceptors.request.use((config) => {
|
|
const token = sessionStorage.getItem('token')
|
|
if (token) {
|
|
config.headers.Authorization = `Bearer ${token}`
|
|
}
|
|
return config
|
|
})
|
|
|
|
let isRefreshing = false
|
|
let isRedirecting = false
|
|
let pendingRequests = []
|
|
|
|
function resolvePending(token) {
|
|
pendingRequests.forEach((cb) => cb(token))
|
|
pendingRequests = []
|
|
}
|
|
|
|
function rejectPending(error) {
|
|
pendingRequests.forEach((cb) => cb(null, error))
|
|
pendingRequests = []
|
|
}
|
|
|
|
api.interceptors.response.use(
|
|
(response) => response,
|
|
async (error) => {
|
|
const config = error.config
|
|
const status = error.response?.status
|
|
|
|
const isAuthEndpoint =
|
|
config.url.includes('/login') ||
|
|
config.url.includes('/register') ||
|
|
config.url.includes('/refresh')
|
|
|
|
if (status !== 401 || isAuthEndpoint || config._retry) {
|
|
return Promise.reject(error)
|
|
}
|
|
|
|
if (isRefreshing) {
|
|
return new Promise((resolve, reject) => {
|
|
pendingRequests.push((token, err) => {
|
|
if (err) return reject(err)
|
|
config.headers.Authorization = `Bearer ${token}`
|
|
resolve(api(config))
|
|
})
|
|
})
|
|
}
|
|
|
|
config._retry = true
|
|
isRefreshing = true
|
|
|
|
try {
|
|
const { data } = await api.post('/member/refresh')
|
|
const newToken = data.data.token
|
|
sessionStorage.setItem('token', newToken)
|
|
api.defaults.headers.common['Authorization'] = `Bearer ${newToken}`
|
|
resolvePending(newToken)
|
|
config.headers.Authorization = `Bearer ${newToken}`
|
|
return api(config)
|
|
} catch {
|
|
rejectPending(error)
|
|
if (!isRedirecting) {
|
|
isRedirecting = true
|
|
sessionStorage.removeItem('token')
|
|
sessionStorage.removeItem('user')
|
|
window.location.href = '/login'
|
|
}
|
|
return Promise.reject(error)
|
|
} finally {
|
|
isRefreshing = false
|
|
}
|
|
}
|
|
)
|
|
|
|
export default api
|