加固后台管理安全

frontend/src/router/index.ts

@@ -77,19 +77,28 @@ router.beforeEach(async to => {
 
   const adminSession = useAdminSessionStore()
   adminSession.syncFromStorage()
-  if (to.path === '/admin/login' && adminSession.token) {
-    return '/admin/dashboard'
+  if (to.path === '/admin/login') {
+    if (!adminSession.hasSessionHint) return true
+    try {
+      await adminSession.loadMe()
+      return '/admin/dashboard'
+    } catch {
+      adminSession.logout()
+      return true
+    }
   }
   if (to.meta.requiresAdmin) {
-    if (!adminSession.token) {
-      return '/admin/login'
-    }
-    if (adminSession.permissions.length === 0) {
-      try {
+    try {
+      if (
+        !adminSession.hasSessionHint ||
+        adminSession.permissions.length === 0 ||
+        adminSession.passwordMustChange
+      ) {
         await adminSession.loadMe()
-      } catch {
-        // 权限加载失败，仍然允许访问（降级为无权限状态）
       }
+    } catch {
+      adminSession.logout()
+      return { path: '/admin/login', query: { redirect: to.fullPath } }
     }
   }
   return true