修复工作人员端令牌失效后的登录恢复

apps/service_app/test/app/auth_navigation_test.dart

@@ -0,0 +1,39 @@
+// 功能描述：验证工作人员端登录目标页构造、站内地址校验及开放重定向防护。
+// 版本：1.0.0
+import 'package:flutter_test/flutter_test.dart';
+import 'package:service_app/app/auth_navigation.dart';
+
+/// 覆盖合法深链接、登录循环和外部地址攻击场景。
+void main() {
+  test('保留站内目标页的路径、查询参数和片段', () {
+    const target = '/tasks/task-1?stage=delivery#evidence';
+
+    expect(sanitizeRedirectTarget(target), target);
+    final loginUri = Uri.parse(
+      buildAuthLocation(
+        redirectTarget: target,
+        sessionExpired: true,
+      ),
+    );
+    expect(loginUri.path, '/login');
+    expect(loginUri.queryParameters['redirect'], target);
+    expect(loginUri.queryParameters['reason'], 'expired');
+  });
+
+  test('拒绝外部地址、协议相对地址和登录页循环', () {
+    expect(sanitizeRedirectTarget('https://example.com/tasks'), isNull);
+    expect(sanitizeRedirectTarget('//example.com/tasks'), isNull);
+    expect(sanitizeRedirectTarget(r'/\example.com/tasks'), isNull);
+    expect(sanitizeRedirectTarget('/login'), isNull);
+    expect(sanitizeRedirectTarget('/login?redirect=/preflight'), isNull);
+  });
+
+  test('非法目标页不写入登录地址', () {
+    final loginUri = Uri.parse(
+      buildAuthLocation(redirectTarget: 'https://example.com'),
+    );
+
+    expect(loginUri.path, '/login');
+    expect(loginUri.queryParameters, isEmpty);
+  });
+}

apps/service_app/test/app/router_test.dart

@@ -0,0 +1,102 @@
+// 功能描述：验证工作人员端鉴权守卫保留目标页，并在重新登录后返回原页面。
+// 版本：1.0.0
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:http/http.dart' as http;
+import 'package:http/testing.dart';
+import 'package:service_app/app/dependencies.dart';
+import 'package:service_app/app/router.dart';
+import 'package:service_app/data/offline/encrypted_draft_store.dart';
+import 'package:service_app/data/repositories/service_repository.dart';
+import 'package:service_app/data/services/api_client.dart';
+import 'package:service_app/data/services/location_service.dart';
+import 'package:service_app/data/services/secure_session_store.dart';
+
+/// 提供无需平台插件的空会话存储。
+class _EmptySessionStore implements SessionStore {
+  @override
+  Future<void> delete(String key) async {}
+
+  @override
+  Future<String?> read(String key) async => null;
+
+  @override
+  Future<void> write(String key, String value) async {}
+}
+
+/// 提供可切换鉴权状态的测试会话。
+class _RouterTestSession extends StaffSession {
+  _RouterTestSession({required this.authenticated, required this.expired})
+    : super(_EmptySessionStore());
+
+  bool authenticated;
+  bool expired;
+
+  @override
+  bool get isAuthenticated => authenticated;
+
+  @override
+  bool get hasExpired => expired;
+
+  @override
+  String get roleCode => 'delivery';
+
+  /// 模拟工作人员重新登录成功并唤醒路由刷新。
+  void authenticate() {
+    authenticated = true;
+    expired = false;
+    notifyListeners();
+  }
+}
+
+/// 提供不会在路由测试中访问系统定位的占位实现。
+class _UnusedLocationService implements LocationService {
+  @override
+  Future<LocationPoint> current() => throw UnimplementedError();
+}
+
+/// 覆盖过期提示、查询参数保留和登录后回跳。
+void main() {
+  testWidgets('令牌失效后跳转登录并在登录后返回原目标页', (tester) async {
+    final session = _RouterTestSession(authenticated: false, expired: true);
+    final dependencies = AppDependencies(
+      session: session,
+      repository: ServiceRepository(
+        ApiClient(
+          () => '',
+          baseUrl: 'https://api.example.com',
+          client: MockClient(
+            (request) async => http.Response(
+              '{"code":0,"details":{"role_code":"delivery","work_status":"off_duty","can_work":false,"checks":{}}}',
+              200,
+            ),
+          ),
+        ),
+        _UnusedLocationService(),
+      ),
+      drafts: EncryptedDraftStore(),
+    );
+    final router = createRouter(
+      dependencies,
+      initialLocation: '/preflight?source=expired#checks',
+    );
+    addTearDown(router.dispose);
+
+    await tester.pumpWidget(MaterialApp.router(routerConfig: router));
+    await tester.pumpAndSettle();
+
+    final loginUri = router.routeInformationProvider.value.uri;
+    expect(loginUri.path, '/login');
+    expect(loginUri.queryParameters['redirect'], '/preflight?source=expired#checks');
+    expect(loginUri.queryParameters['reason'], 'expired');
+    expect(find.text('登录状态已失效，请重新登录'), findsOneWidget);
+
+    session.authenticate();
+    await tester.pumpAndSettle();
+
+    final restoredUri = router.routeInformationProvider.value.uri;
+    expect(restoredUri.path, '/preflight');
+    expect(restoredUri.queryParameters['source'], 'expired');
+    expect(restoredUri.fragment, 'checks');
+  });
+}

apps/service_app/test/app/staff_session_test.dart

@@ -0,0 +1,115 @@
+// 功能描述：验证工作人员会话失效的幂等清理、旧请求隔离和存储异常降级。
+// 版本：1.0.0
+import 'package:flutter_test/flutter_test.dart';
+import 'package:service_app/app/dependencies.dart';
+import 'package:service_app/data/services/secure_session_store.dart';
+
+/// 提供可观测的内存会话存储，避免测试依赖真实平台插件。
+class _MemorySessionStore implements SessionStore {
+  _MemorySessionStore({Map<String, String>? values, this.deleteError}) : values = {...?values};
+
+  final Map<String, String> values;
+  final Object? deleteError;
+  final Map<String, int> deleteCounts = {};
+
+  @override
+  Future<void> delete(String key) async {
+    deleteCounts[key] = (deleteCounts[key] ?? 0) + 1;
+    if (deleteError != null) throw deleteError!;
+    values.remove(key);
+  }
+
+  @override
+  Future<String?> read(String key) async => values[key];
+
+  @override
+  Future<void> write(String key, String value) async {
+    values[key] = value;
+  }
+}
+
+/// 覆盖并发 401、迟到旧请求、设备标识保留和安全存储删除失败。
+void main() {
+  const tokenKey = 'service_app_access_token';
+  const identityKey = 'service_app_identity';
+  const roleKey = 'service_app_role';
+  const deviceKey = 'service_app_device';
+
+  test('同一失效令牌只清理并通知一次且保留设备标识', () async {
+    final store = _MemorySessionStore(
+      values: const {
+        tokenKey: 'JWT expired-token',
+        identityKey: 'staff-1',
+        roleKey: 'delivery',
+        deviceKey: 'device-1',
+      },
+    );
+    final session = StaffSession(store);
+    await session.restore();
+    var notificationCount = 0;
+    session.addListener(() => notificationCount++);
+
+    session.invalidate('JWT expired-token');
+    session.invalidate('JWT expired-token');
+    await Future<void>.delayed(Duration.zero);
+
+    expect(session.token, isEmpty);
+    expect(session.identity, isEmpty);
+    expect(session.roleCode, isEmpty);
+    expect(session.deviceIdentity, 'device-1');
+    expect(session.hasExpired, isTrue);
+    expect(store.deleteCounts[tokenKey], 1);
+    expect(store.deleteCounts[identityKey], 1);
+    expect(store.deleteCounts[roleKey], 1);
+    expect(store.deleteCounts[deviceKey], isNull);
+    expect(store.values[deviceKey], 'device-1');
+    expect(notificationCount, 1);
+  });
+
+  test('迟到的旧请求不得使当前会话失效', () async {
+    final store = _MemorySessionStore(
+      values: const {
+        tokenKey: 'JWT current-token',
+        identityKey: 'staff-1',
+        roleKey: 'installer',
+        deviceKey: 'device-1',
+      },
+    );
+    final session = StaffSession(store);
+    await session.restore();
+
+    session.invalidate('JWT old-token');
+    await Future<void>.delayed(Duration.zero);
+
+    expect(session.token, 'JWT current-token');
+    expect(session.identity, 'staff-1');
+    expect(session.roleCode, 'installer');
+    expect(session.hasExpired, isFalse);
+    expect(store.deleteCounts, isEmpty);
+  });
+
+  test('持久化删除失败也立即清空内存会话并保留设备标识', () async {
+    final store = _MemorySessionStore(
+      values: const {
+        tokenKey: 'JWT expired-token',
+        identityKey: 'staff-1',
+        roleKey: 'operations',
+        deviceKey: 'device-1',
+      },
+      deleteError: StateError('storage unavailable'),
+    );
+    final session = StaffSession(store);
+    await session.restore();
+
+    session.invalidate('JWT expired-token');
+    await Future<void>.delayed(Duration.zero);
+
+    expect(session.token, isEmpty);
+    expect(session.identity, isEmpty);
+    expect(session.roleCode, isEmpty);
+    expect(session.deviceIdentity, 'device-1');
+    expect(session.hasExpired, isTrue);
+    expect(store.deleteCounts.keys, containsAll([tokenKey, identityKey, roleKey]));
+    expect(store.deleteCounts[deviceKey], isNull);
+  });
+}