fix: token刷新数据源统一+非空断言修复+并发竞态锁 (#1416)

apps/web/src/api/auth/tokenRefresh.ts

@@ -9,6 +9,9 @@ import { refreshAccessToken } from "./login"
 
 let refreshTimer: ReturnType<typeof setTimeout> | null = null
 
+/** 正在执行刷新操作的 Promise，防止主动刷新和 401 被动刷新并发竞争 */
+let activeRefreshPromise: Promise<void> | null = null
+
 /** 提前刷新的缓冲时间（秒） */
 const REFRESH_BUFFER_SECONDS = 60
 
@@ -39,14 +42,55 @@ export function cancelProactiveRefresh(): void {
   }
 }
 
+/**
+ * 执行 token 刷新（带并发锁，供主动刷新和被动 401 共用）
+ * 返回当前刷新操作的 Promise；若已有刷新进行中则复用该 Promise。
+ */
+export function executeTokenRefresh(): Promise<void> | null {
+  // 已有刷新进行中 → 复用
+  if (activeRefreshPromise) {
+    return activeRefreshPromise
+  }
+
+  const { user, refreshToken: refreshTokenValue } = useAuthStore.getState()
+
+  // 安全检查：user 或 refreshToken 为空时跳过刷新
+  if (!user || !refreshTokenValue) {
+    return null
+  }
+
+  activeRefreshPromise = (async () => {
+    try {
+      const data = await refreshAccessToken(refreshTokenValue)
+      const newAccessToken = data.access_token
+      const newRefreshToken = data.refresh_token ?? refreshTokenValue
+
+      // 更新 Zustand store + localStorage
+      useAuthStore.getState().setAuth(user, newAccessToken, newRefreshToken)
+
+      // 递归调度下一次刷新
+      scheduleProactiveRefresh()
+    } catch {
+      // 刷新失败 → 清除认证状态，跳转登录页
+      cancelProactiveRefresh()
+      useAuthStore.getState().clearAuth()
+      window.location.href = "/login"
+    } finally {
+      activeRefreshPromise = null
+    }
+  })()
+
+  return activeRefreshPromise
+}
+
 /**
  * 调度主动刷新：在 token 过期前 REFRESH_BUFFER_SECONDS 秒自动刷新
  */
 export function scheduleProactiveRefresh(): void {
   cancelProactiveRefresh()
 
-  const accessToken = localStorage.getItem("access_token")
-  const refreshTokenValue = useAuthStore.getState().refreshToken
+  // 统一从 Zustand store 读取（与 setAuth 写入保持一致）
+  const { accessToken, refreshToken: refreshTokenValue } = useAuthStore.getState()
 
   if (!accessToken || !refreshTokenValue) return
 
@@ -59,24 +103,7 @@ export function scheduleProactiveRefresh(): void {
   // 如果 token 已经过期或即将在缓冲时间内过期，立即刷新
   const delaySeconds = Math.max(secondsUntilExpiry - REFRESH_BUFFER_SECONDS, 0)
 
-  refreshTimer = setTimeout(async () => {
-    try {
-      const data = await refreshAccessToken(refreshTokenValue)
-      const newAccessToken = data.access_token
-      const newRefreshToken = data.refresh_token ?? refreshTokenValue
-
-      // 更新 Zustand store + localStorage
-      useAuthStore
-        .getState()
-        .setAuth(useAuthStore.getState().user!, newAccessToken, newRefreshToken)
-
-      // 递归调度下一次刷新
-      scheduleProactiveRefresh()
-    } catch {
-      // 刷新失败 → 清除认证状态，跳转登录页
-      cancelProactiveRefresh()
-      useAuthStore.getState().clearAuth()
-      window.location.href = "/login"
-    }
+  refreshTimer = setTimeout(() => {
+    executeTokenRefresh()
   }, delaySeconds * 1000)
 }

apps/web/src/api/client.ts

@@ -5,8 +5,8 @@
 import axios, { AxiosError, InternalAxiosRequestConfig } from "axios"
 import { message } from "antd"
 import { useAuthStore } from "@/store/authStore"
-import { refreshAccessToken } from "./auth"
-import { scheduleProactiveRefresh, cancelProactiveRefresh } from "./auth/tokenRefresh"
+
+import { cancelProactiveRefresh, executeTokenRefresh } from "./auth/tokenRefresh"
 
 // 创建 Axios 实例
 const apiClient = axios.create({
@@ -98,21 +98,26 @@ apiClient.interceptors.response.use(
       isRefreshing = true
 
       try {
-        const data = await refreshAccessToken(refreshToken)
-        const newAccessToken = data.access_token
-        const newRefreshToken = data.refresh_token ?? refreshToken
+        // 使用共享的刷新函数（带并发锁 + 安全检查）
+        const refreshPromise = executeTokenRefresh()
+        if (!refreshPromise) {
+          // user 或 refreshToken 为空，无法刷新
+          cancelProactiveRefresh()
+          useAuthStore.getState().clearAuth()
+          window.location.href = "/"
+          return Promise.reject(new Error("Unable to refresh: missing user or refresh token"))
+        }
+        await refreshPromise
 
-        // 更新 Zustand + localStorage
-        useAuthStore
-          .getState()
-          .setAuth(useAuthStore.getState().user!, newAccessToken, newRefreshToken)
+        // 获取刷新后的新 token
+        const newAccessToken = useAuthStore.getState().accessToken
+        if (!newAccessToken) {
+          return Promise.reject(new Error("Token refresh failed: no new access token"))
+        }
 
         // 处理排队的请求
         processQueue(null, newAccessToken)
 
-        // 重新调度主动刷新（基于新 token 的过期时间）
-        scheduleProactiveRefresh()
-
         // 重试原始请求
         if (originalRequest.headers) {
           originalRequest.headers.Authorization = `Bearer ${newAccessToken}`