加固后台管理安全

frontend/src/shared/api/client.ts

@@ -100,6 +100,7 @@ import type { ApiResponse } from '@/shared/types/types'
 export const apiClient = axios.create({
   baseURL: '/api',
   timeout: 30000, // 增加到 30 秒，避免大文件上传超时
+  withCredentials: true,
   headers: {
     'Content-Type': 'application/json',
   },
@@ -149,11 +150,18 @@ function rejectPendingRequests(scope: AuthScope, error: unknown) {
 }
 
 export async function refreshAccessToken(scope: AuthScope): Promise<string> {
+  if (scope === 'admin') {
+    await axios.post('/api/admin/auth/refresh', {}, { timeout: 10000, withCredentials: true })
+    return ''
+  }
   const refreshToken = getRefreshToken(scope)
   if (!refreshToken) throw new Error('no refresh token')
 
-  const endpoint = scope === 'admin' ? '/api/admin/auth/refresh' : '/api/auth/refresh'
-  const { data } = await axios.post(endpoint, { refresh_token: refreshToken }, { timeout: 10000 })
+  const { data } = await axios.post(
+    '/api/auth/refresh',
+    { refresh_token: refreshToken },
+    { timeout: 10000 }
+  )
   const tokens = {
     access_token: data.data.access_token,
     refresh_token: data.data.refresh_token,
@@ -239,7 +247,9 @@ apiClient.interceptors.response.use(
         state.pendingRequests.push({ resolve, reject })
       }).then(newToken => {
         originalRequest._retry = true
-        originalRequest.headers.Authorization = `Bearer ${newToken}`
+        if (newToken) {
+          originalRequest.headers.Authorization = `Bearer ${newToken}`
+        }
         return apiClient(originalRequest)
       })
     }
@@ -249,7 +259,9 @@ apiClient.interceptors.response.use(
       const newToken = await refreshAccessToken(scope)
       resolvePendingRequests(scope, newToken)
       originalRequest._retry = true
-      originalRequest.headers.Authorization = `Bearer ${newToken}`
+      if (newToken) {
+        originalRequest.headers.Authorization = `Bearer ${newToken}`
+      }
       return apiClient(originalRequest)
     } catch (refreshError) {
       rejectPendingRequests(scope, refreshError)

frontend/src/shared/utils/authStorage.ts

@@ -14,7 +14,7 @@ const userKeys = {
 const adminKeys = {
   accessToken: 'admin_access_token',
   refreshToken: 'admin_refresh_token',
-  profile: ['admin_id', 'admin_username'],
+  profile: ['admin_id', 'admin_username', 'admin_support_status', 'admin_password_must_change'],
 }
 
 function keysFor(scope: AuthScope) {
@@ -22,15 +22,23 @@ function keysFor(scope: AuthScope) {
 }
 
 export function getAccessToken(scope: AuthScope) {
+  if (scope === 'admin') return ''
   return localStorage.getItem(keysFor(scope).accessToken) || ''
 }
 
 export function getRefreshToken(scope: AuthScope) {
+  if (scope === 'admin') return ''
   return localStorage.getItem(keysFor(scope).refreshToken) || ''
 }
 
 export function setAuthTokens(scope: AuthScope, tokens: AuthTokenPair) {
   const keys = keysFor(scope)
+  if (scope === 'admin') {
+    localStorage.removeItem(keys.accessToken)
+    localStorage.removeItem(keys.refreshToken)
+    notifyAuthStorageChanged(scope)
+    return
+  }
   localStorage.setItem(keys.accessToken, tokens.access_token)
   localStorage.setItem(keys.refreshToken, tokens.refresh_token)
   notifyAuthStorageChanged(scope)