修复工作人员端令牌失效后的登录恢复

apps/service_app/test/app/auth_navigation_test.dart

@@ -0,0 +1,39 @@
+// 功能描述：验证工作人员端登录目标页构造、站内地址校验及开放重定向防护。
+// 版本：1.0.0
+import 'package:flutter_test/flutter_test.dart';
+import 'package:service_app/app/auth_navigation.dart';
+
+/// 覆盖合法深链接、登录循环和外部地址攻击场景。
+void main() {
+  test('保留站内目标页的路径、查询参数和片段', () {
+    const target = '/tasks/task-1?stage=delivery#evidence';
+
+    expect(sanitizeRedirectTarget(target), target);
+    final loginUri = Uri.parse(
+      buildAuthLocation(
+        redirectTarget: target,
+        sessionExpired: true,
+      ),
+    );
+    expect(loginUri.path, '/login');
+    expect(loginUri.queryParameters['redirect'], target);
+    expect(loginUri.queryParameters['reason'], 'expired');
+  });
+
+  test('拒绝外部地址、协议相对地址和登录页循环', () {
+    expect(sanitizeRedirectTarget('https://example.com/tasks'), isNull);
+    expect(sanitizeRedirectTarget('//example.com/tasks'), isNull);
+    expect(sanitizeRedirectTarget(r'/\example.com/tasks'), isNull);
+    expect(sanitizeRedirectTarget('/login'), isNull);
+    expect(sanitizeRedirectTarget('/login?redirect=/preflight'), isNull);
+  });
+
+  test('非法目标页不写入登录地址', () {
+    final loginUri = Uri.parse(
+      buildAuthLocation(redirectTarget: 'https://example.com'),
+    );
+
+    expect(loginUri.path, '/login');
+    expect(loginUri.queryParameters, isEmpty);
+  });
+}

apps/service_app/test/app/router_test.dart

@@ -0,0 +1,102 @@
+// 功能描述：验证工作人员端鉴权守卫保留目标页，并在重新登录后返回原页面。
+// 版本：1.0.0
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:http/http.dart' as http;
+import 'package:http/testing.dart';
+import 'package:service_app/app/dependencies.dart';
+import 'package:service_app/app/router.dart';
+import 'package:service_app/data/offline/encrypted_draft_store.dart';
+import 'package:service_app/data/repositories/service_repository.dart';
+import 'package:service_app/data/services/api_client.dart';
+import 'package:service_app/data/services/location_service.dart';
+import 'package:service_app/data/services/secure_session_store.dart';
+
+/// 提供无需平台插件的空会话存储。
+class _EmptySessionStore implements SessionStore {
+  @override
+  Future<void> delete(String key) async {}
+
+  @override
+  Future<String?> read(String key) async => null;
+
+  @override
+  Future<void> write(String key, String value) async {}
+}
+
+/// 提供可切换鉴权状态的测试会话。
+class _RouterTestSession extends StaffSession {
+  _RouterTestSession({required this.authenticated, required this.expired})
+    : super(_EmptySessionStore());
+
+  bool authenticated;
+  bool expired;
+
+  @override
+  bool get isAuthenticated => authenticated;
+
+  @override
+  bool get hasExpired => expired;
+
+  @override
+  String get roleCode => 'delivery';
+
+  /// 模拟工作人员重新登录成功并唤醒路由刷新。
+  void authenticate() {
+    authenticated = true;
+    expired = false;
+    notifyListeners();
+  }
+}
+
+/// 提供不会在路由测试中访问系统定位的占位实现。
+class _UnusedLocationService implements LocationService {
+  @override
+  Future<LocationPoint> current() => throw UnimplementedError();
+}
+
+/// 覆盖过期提示、查询参数保留和登录后回跳。
+void main() {
+  testWidgets('令牌失效后跳转登录并在登录后返回原目标页', (tester) async {
+    final session = _RouterTestSession(authenticated: false, expired: true);
+    final dependencies = AppDependencies(
+      session: session,
+      repository: ServiceRepository(
+        ApiClient(
+          () => '',
+          baseUrl: 'https://api.example.com',
+          client: MockClient(
+            (request) async => http.Response(
+              '{"code":0,"details":{"role_code":"delivery","work_status":"off_duty","can_work":false,"checks":{}}}',
+              200,
+            ),
+          ),
+        ),
+        _UnusedLocationService(),
+      ),
+      drafts: EncryptedDraftStore(),
+    );
+    final router = createRouter(
+      dependencies,
+      initialLocation: '/preflight?source=expired#checks',
+    );
+    addTearDown(router.dispose);
+
+    await tester.pumpWidget(MaterialApp.router(routerConfig: router));
+    await tester.pumpAndSettle();
+
+    final loginUri = router.routeInformationProvider.value.uri;
+    expect(loginUri.path, '/login');
+    expect(loginUri.queryParameters['redirect'], '/preflight?source=expired#checks');
+    expect(loginUri.queryParameters['reason'], 'expired');
+    expect(find.text('登录状态已失效，请重新登录'), findsOneWidget);
+
+    session.authenticate();
+    await tester.pumpAndSettle();
+
+    final restoredUri = router.routeInformationProvider.value.uri;
+    expect(restoredUri.path, '/preflight');
+    expect(restoredUri.queryParameters['source'], 'expired');
+    expect(restoredUri.fragment, 'checks');
+  });
+}

apps/service_app/test/app/staff_session_test.dart

@@ -0,0 +1,115 @@
+// 功能描述：验证工作人员会话失效的幂等清理、旧请求隔离和存储异常降级。
+// 版本：1.0.0
+import 'package:flutter_test/flutter_test.dart';
+import 'package:service_app/app/dependencies.dart';
+import 'package:service_app/data/services/secure_session_store.dart';
+
+/// 提供可观测的内存会话存储，避免测试依赖真实平台插件。
+class _MemorySessionStore implements SessionStore {
+  _MemorySessionStore({Map<String, String>? values, this.deleteError}) : values = {...?values};
+
+  final Map<String, String> values;
+  final Object? deleteError;
+  final Map<String, int> deleteCounts = {};
+
+  @override
+  Future<void> delete(String key) async {
+    deleteCounts[key] = (deleteCounts[key] ?? 0) + 1;
+    if (deleteError != null) throw deleteError!;
+    values.remove(key);
+  }
+
+  @override
+  Future<String?> read(String key) async => values[key];
+
+  @override
+  Future<void> write(String key, String value) async {
+    values[key] = value;
+  }
+}
+
+/// 覆盖并发 401、迟到旧请求、设备标识保留和安全存储删除失败。
+void main() {
+  const tokenKey = 'service_app_access_token';
+  const identityKey = 'service_app_identity';
+  const roleKey = 'service_app_role';
+  const deviceKey = 'service_app_device';
+
+  test('同一失效令牌只清理并通知一次且保留设备标识', () async {
+    final store = _MemorySessionStore(
+      values: const {
+        tokenKey: 'JWT expired-token',
+        identityKey: 'staff-1',
+        roleKey: 'delivery',
+        deviceKey: 'device-1',
+      },
+    );
+    final session = StaffSession(store);
+    await session.restore();
+    var notificationCount = 0;
+    session.addListener(() => notificationCount++);
+
+    session.invalidate('JWT expired-token');
+    session.invalidate('JWT expired-token');
+    await Future<void>.delayed(Duration.zero);
+
+    expect(session.token, isEmpty);
+    expect(session.identity, isEmpty);
+    expect(session.roleCode, isEmpty);
+    expect(session.deviceIdentity, 'device-1');
+    expect(session.hasExpired, isTrue);
+    expect(store.deleteCounts[tokenKey], 1);
+    expect(store.deleteCounts[identityKey], 1);
+    expect(store.deleteCounts[roleKey], 1);
+    expect(store.deleteCounts[deviceKey], isNull);
+    expect(store.values[deviceKey], 'device-1');
+    expect(notificationCount, 1);
+  });
+
+  test('迟到的旧请求不得使当前会话失效', () async {
+    final store = _MemorySessionStore(
+      values: const {
+        tokenKey: 'JWT current-token',
+        identityKey: 'staff-1',
+        roleKey: 'installer',
+        deviceKey: 'device-1',
+      },
+    );
+    final session = StaffSession(store);
+    await session.restore();
+
+    session.invalidate('JWT old-token');
+    await Future<void>.delayed(Duration.zero);
+
+    expect(session.token, 'JWT current-token');
+    expect(session.identity, 'staff-1');
+    expect(session.roleCode, 'installer');
+    expect(session.hasExpired, isFalse);
+    expect(store.deleteCounts, isEmpty);
+  });
+
+  test('持久化删除失败也立即清空内存会话并保留设备标识', () async {
+    final store = _MemorySessionStore(
+      values: const {
+        tokenKey: 'JWT expired-token',
+        identityKey: 'staff-1',
+        roleKey: 'operations',
+        deviceKey: 'device-1',
+      },
+      deleteError: StateError('storage unavailable'),
+    );
+    final session = StaffSession(store);
+    await session.restore();
+
+    session.invalidate('JWT expired-token');
+    await Future<void>.delayed(Duration.zero);
+
+    expect(session.token, isEmpty);
+    expect(session.identity, isEmpty);
+    expect(session.roleCode, isEmpty);
+    expect(session.deviceIdentity, 'device-1');
+    expect(session.hasExpired, isTrue);
+    expect(store.deleteCounts.keys, containsAll([tokenKey, identityKey, roleKey]));
+    expect(store.deleteCounts[deviceKey], isNull);
+  });
+}

apps/service_app/test/data/api_client_test.dart

@@ -0,0 +1,115 @@
+// 功能描述：验证工作人员端统一请求的鉴权失效通知和上传处理。
+// 版本：1.0.0
+import 'dart:typed_data';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:http/http.dart' as http;
+import 'package:http/testing.dart';
+import 'package:image_picker/image_picker.dart';
+import 'package:service_app/data/services/api_client.dart';
+
+/// 覆盖 HTTP 状态、业务码、匿名请求、请求令牌快照和上传场景。
+void main() {
+  test('受保护接口返回 HTTP 401 时通知会话并抛出专用异常', () async {
+    final rejectedTokens = <String>[];
+    final client = ApiClient(
+      () => 'JWT expired-token',
+      baseUrl: 'https://api.example.com',
+      onUnauthorized: rejectedTokens.add,
+      client: MockClient((request) async => http.Response('', 401)),
+    );
+
+    await expectLater(
+      client.get('/protected'),
+      throwsA(isA<SessionExpiredException>()),
+    );
+    expect(rejectedTokens, ['JWT expired-token']);
+  });
+
+  test('受保护接口返回鉴权业务码时通知会话', () async {
+    final rejectedTokens = <String>[];
+    final client = ApiClient(
+      () => 'JWT expired-token',
+      baseUrl: 'https://api.example.com',
+      onUnauthorized: rejectedTokens.add,
+      client: MockClient(
+        (request) async => http.Response(
+          '{"code":1308,"message":"Token Expired","details":null}',
+          200,
+        ),
+      ),
+    );
+
+    await expectLater(
+      client.get('/protected'),
+      throwsA(isA<SessionExpiredException>()),
+    );
+    expect(rejectedTokens, ['JWT expired-token']);
+  });
+
+  test('未鉴权接口返回 401 时不得清理已有会话', () async {
+    final rejectedTokens = <String>[];
+    final client = ApiClient(
+      () => 'JWT current-token',
+      baseUrl: 'https://api.example.com',
+      onUnauthorized: rejectedTokens.add,
+      client: MockClient((request) async => http.Response('', 401)),
+    );
+
+    await expectLater(
+      client.post('/login', authenticated: false),
+      throwsA(
+        isA<ApiException>()
+            .having((error) => error.code, 'code', 401)
+            .having((error) => error is SessionExpiredException, 'session expired', isFalse),
+      ),
+    );
+    expect(rejectedTokens, isEmpty);
+  });
+
+  test('请求发送后令牌变化时仍上报实际被拒绝的旧令牌', () async {
+    var currentToken = 'JWT old-token';
+    final rejectedTokens = <String>[];
+    final client = ApiClient(
+      () => currentToken,
+      baseUrl: 'https://api.example.com',
+      onUnauthorized: rejectedTokens.add,
+      client: MockClient((request) async {
+        currentToken = 'JWT new-token';
+        return http.Response('', 401);
+      }),
+    );
+
+    await expectLater(
+      client.get('/protected'),
+      throwsA(isA<SessionExpiredException>()),
+    );
+    expect(rejectedTokens, ['JWT old-token']);
+  });
+
+  test('文件上传返回鉴权业务码时同样触发统一会话失效', () async {
+    final rejectedTokens = <String>[];
+    final client = ApiClient(
+      () => 'JWT expired-token',
+      baseUrl: 'https://api.example.com',
+      onUnauthorized: rejectedTokens.add,
+      client: MockClient(
+        (request) async => http.Response(
+          '{"code":1715,"message":"Unauthorized","details":null}',
+          200,
+        ),
+      ),
+    );
+    final file = XFile.fromData(
+      Uint8List.fromList(const [1, 2, 3]),
+      name: 'proof.jpg',
+      mimeType: 'image/jpeg',
+    );
+
+    await expectLater(
+      client.upload(file),
+      throwsA(isA<SessionExpiredException>()),
+    );
+    expect(rejectedTokens, ['JWT expired-token']);
+  });
+}

apps/service_app/test/ui/preflight_page_test.dart

@@ -0,0 +1,77 @@
+// 功能描述：验证作业前检查页面失败重试不会向 setState 返回异步任务。
+// 版本：1.0.0
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:service_app/app/dependencies.dart';
+import 'package:service_app/data/repositories/service_repository.dart';
+import 'package:service_app/data/services/api_client.dart';
+import 'package:service_app/data/services/location_service.dart';
+import 'package:service_app/data/services/secure_session_store.dart';
+import 'package:service_app/domain/models/service_models.dart';
+import 'package:service_app/ui/features/preflight/preflight_page.dart';
+
+/// 提供无需平台插件的空会话存储。
+class _EmptySessionStore implements SessionStore {
+  @override
+  Future<void> delete(String key) async {}
+
+  @override
+  Future<String?> read(String key) async => null;
+
+  @override
+  Future<void> write(String key, String value) async {}
+}
+
+/// 提供不会在重试测试中访问系统定位的占位实现。
+class _UnusedLocationService implements LocationService {
+  @override
+  Future<LocationPoint> current() => throw UnimplementedError();
+}
+
+/// 首次加载失败、第二次成功，用于验证真实重试路径。
+class _FailOnceRepository extends ServiceRepository {
+  _FailOnceRepository()
+    : super(
+        ApiClient(() => '', baseUrl: 'https://api.example.com'),
+        _UnusedLocationService(),
+      );
+
+  int calls = 0;
+
+  @override
+  Future<PreflightResult> preflight() async {
+    calls += 1;
+    if (calls == 1) throw StateError('temporary failure');
+    return const PreflightResult(
+      roleCode: 'delivery',
+      workStatus: 'off_duty',
+      canWork: false,
+      checks: {},
+    );
+  }
+}
+
+/// 点击重新加载后应成功刷新，且测试过程不得出现 Flutter 断言。
+void main() {
+  testWidgets('作业检查失败后可重新加载', (tester) async {
+    final repository = _FailOnceRepository();
+    final session = StaffSession(_EmptySessionStore());
+    await tester.pumpWidget(
+      MaterialApp(
+        home: PreflightPage(session: session, repository: repository),
+      ),
+    );
+    await tester.pumpAndSettle();
+
+    expect(find.text('作业检查加载失败'), findsOneWidget);
+    expect(repository.calls, 1);
+
+    await tester.tap(find.text('重新加载'));
+    await tester.pumpAndSettle();
+
+    expect(find.text('作业检查加载失败'), findsNothing);
+    expect(find.text('仍有前置条件未完成'), findsOneWidget);
+    expect(repository.calls, 2);
+    expect(tester.takeException(), isNull);
+  });
+}