修复工作人员端令牌失效后的登录恢复

apps/service_app/test/app/auth_navigation_test.dart

@@ -0,0 +1,39 @@
+// 功能描述：验证工作人员端登录目标页构造、站内地址校验及开放重定向防护。
+// 版本：1.0.0
+import 'package:flutter_test/flutter_test.dart';
+import 'package:service_app/app/auth_navigation.dart';
+
+/// 覆盖合法深链接、登录循环和外部地址攻击场景。
+void main() {
+  test('保留站内目标页的路径、查询参数和片段', () {
+    const target = '/tasks/task-1?stage=delivery#evidence';
+
+    expect(sanitizeRedirectTarget(target), target);
+    final loginUri = Uri.parse(
+      buildAuthLocation(
+        redirectTarget: target,
+        sessionExpired: true,
+      ),
+    );
+    expect(loginUri.path, '/login');
+    expect(loginUri.queryParameters['redirect'], target);
+    expect(loginUri.queryParameters['reason'], 'expired');
+  });
+
+  test('拒绝外部地址、协议相对地址和登录页循环', () {
+    expect(sanitizeRedirectTarget('https://example.com/tasks'), isNull);
+    expect(sanitizeRedirectTarget('//example.com/tasks'), isNull);
+    expect(sanitizeRedirectTarget(r'/\example.com/tasks'), isNull);
+    expect(sanitizeRedirectTarget('/login'), isNull);
+    expect(sanitizeRedirectTarget('/login?redirect=/preflight'), isNull);
+  });
+
+  test('非法目标页不写入登录地址', () {
+    final loginUri = Uri.parse(
+      buildAuthLocation(redirectTarget: 'https://example.com'),
+    );
+
+    expect(loginUri.path, '/login');
+    expect(loginUri.queryParameters, isEmpty);
+  });
+}