fix: token刷新数据源统一+非空断言修复+并发竞态锁 (#1416)

apps/web/src/api/client.ts

@@ -5,8 +5,8 @@
 import axios, { AxiosError, InternalAxiosRequestConfig } from "axios"
 import { message } from "antd"
 import { useAuthStore } from "@/store/authStore"
-import { refreshAccessToken } from "./auth"
-import { scheduleProactiveRefresh, cancelProactiveRefresh } from "./auth/tokenRefresh"
+
+import { cancelProactiveRefresh, executeTokenRefresh } from "./auth/tokenRefresh"
 
 // 创建 Axios 实例
 const apiClient = axios.create({
@@ -98,21 +98,26 @@ apiClient.interceptors.response.use(
       isRefreshing = true
 
       try {
-        const data = await refreshAccessToken(refreshToken)
-        const newAccessToken = data.access_token
-        const newRefreshToken = data.refresh_token ?? refreshToken
+        // 使用共享的刷新函数（带并发锁 + 安全检查）
+        const refreshPromise = executeTokenRefresh()
+        if (!refreshPromise) {
+          // user 或 refreshToken 为空，无法刷新
+          cancelProactiveRefresh()
+          useAuthStore.getState().clearAuth()
+          window.location.href = "/"
+          return Promise.reject(new Error("Unable to refresh: missing user or refresh token"))
+        }
+        await refreshPromise
 
-        // 更新 Zustand + localStorage
-        useAuthStore
-          .getState()
-          .setAuth(useAuthStore.getState().user!, newAccessToken, newRefreshToken)
+        // 获取刷新后的新 token
+        const newAccessToken = useAuthStore.getState().accessToken
+        if (!newAccessToken) {
+          return Promise.reject(new Error("Token refresh failed: no new access token"))
+        }
 
         // 处理排队的请求
         processQueue(null, newAccessToken)
 
-        // 重新调度主动刷新（基于新 token 的过期时间）
-        scheduleProactiveRefresh()
-
         // 重试原始请求
         if (originalRequest.headers) {
           originalRequest.headers.Authorization = `Bearer ${newAccessToken}`