修复第三方登录旧响应覆盖新会话并补充跨标签回归

app/components/AuthProviders.vue

@@ -133,6 +133,7 @@ var fe = {
             W = null,
             G = null,
             K = 0,
+            loginAttempt = null,
             q = null;
           function J() {
             W !== null && (clearInterval(W), (W = null));
@@ -154,6 +155,8 @@ var fe = {
             // 只在桌面展示区域申请新二维码，并核对图片、ticket 与 token 的完整性。
             if (!k.value || L.value) return;
             let e = ++K;
+            const attempt = C.prepareLogin();
+            loginAttempt = attempt;
             (Z(),
               (z.value = ``),
               (R.value = !1),
@@ -165,7 +168,7 @@ var fe = {
               let t = await E.get(`/mp_weixin_notice/qrcode`, void 0, !1, {
                 timeoutMs: 15e3,
               });
-              if (e !== K) return;
+              if (e !== K || !attempt.isCurrent()) return;
               if (
                 typeof t?.img_url != `string` ||
                 !t.img_url ||
@@ -177,7 +180,7 @@ var fe = {
                 throw Error(`二维码加载失败，请重新获取`);
               ((I.value = t), (z.value = ``), Ee());
             } catch (t) {
-              if (e !== K) return;
+              if (e !== K || !attempt.isCurrent()) return;
               (J(),
                 Y(),
                 (z.value = loginErrorMessage(t, `二维码加载失败，请稍后重试`)));
@@ -187,7 +190,7 @@ var fe = {
           }
           async function De() {
             // 同一代次最多一个查询在途；Wait/Success/Expired/SelectClient/WaitBind 分别处理。
-            if (!I.value || q === K) return;
+            if (!I.value || q === K || !loginAttempt?.isCurrent()) return;
             let e = K,
               t = I.value;
             q = e;
@@ -203,7 +206,7 @@ var fe = {
                   timeoutMs: 1e4,
                 },
               );
-              if (e !== K) return;
+              if (e !== K || !loginAttempt.isCurrent()) return;
               if (!n || typeof n.status != `string`)
                 throw Error(`扫码登录状态异常，请重新获取二维码`);
               if (n.status === `Wait`) return;
@@ -252,7 +255,7 @@ var fe = {
               }
               (Z(), (z.value = `扫码登录状态异常，请重新获取二维码`));
             } catch (t) {
-              if (e !== K) return;
+              if (e !== K || !loginAttempt.isCurrent()) return;
               (Z(),
                 (z.value = loginErrorMessage(
                   t,
@@ -270,6 +273,7 @@ var fe = {
             (K++,
               Z(),
               (I.value = null),
+              (loginAttempt = null),
               (L.value = !1),
               (H.value = !1),
               (R.value = !1),
@@ -283,11 +287,13 @@ var fe = {
               z.value = `登录响应无效，请重新扫码；若持续失败，请联系客服。`;
               return;
             }
-            (C.loginWithJwt(e), K++, T.push(auth_redirect_r(w.query.redirect)));
+            (loginAttempt.commit(e),
+              K++,
+              T.push(auth_redirect_r(w.query.redirect)));
           }
           async function Oe() {
             // 多账号扫码只能提交当前返回列表中明确可登录的账号，且请求绑定当前二维码代次。
-            if (H.value) return;
+            if (H.value || !loginAttempt?.isCurrent()) return;
             if (
               !I.value ||
               !B.value.some((e) => e.id === V.value && e.status === 1)
@@ -310,12 +316,12 @@ var fe = {
                   timeoutMs: 15e3,
                 },
               );
-              if (e !== K) return;
+              if (e !== K || !loginAttempt.isCurrent()) return;
               t?.jwt
                 ? $(t.jwt)
                 : (z.value = `登录响应无效，请重新扫码；若持续失败，请联系客服。`);
             } catch (t) {
-              if (e !== K) return;
+              if (e !== K || !loginAttempt.isCurrent()) return;
               z.value = loginErrorMessage(t);
             } finally {
               e === K && (H.value = !1);
@@ -329,6 +335,7 @@ var fe = {
                 await D().catch(() => {}));
             }),
             watch(N, Q),
+            watch(() => C.token, Q),
             onUnmounted(() => {
               (A?.removeEventListener(`change`, j), Q());
             }),

app/lib/auth.js

@@ -695,6 +695,22 @@ const useAuth = defineStore("auth", () => {
     localStorage.setItem("jwt", jwt);
   }
 
+  // 身份结果只归属于请求开始时的会话；也检查持久凭证，覆盖 storage 事件尚未处理的窗口。
+  function prepareLogin() {
+    const version = sessionVersion;
+    const persistedToken = localStorage.getItem("jwt");
+    const isCurrent = () =>
+      version === sessionVersion &&
+      persistedToken === localStorage.getItem("jwt");
+    return {
+      isCurrent,
+      commit(jwt) {
+        if (!isCurrent()) throw Error("登录状态已变化，请重新发起登录。");
+        loginWithJwt(jwt);
+      },
+    };
+  }
+
   // 旧平台带来的凭证先暂存待验证，不立即写成已登录状态，避免路由守卫误放行。
   function prepareLegacyLogin(jwt = localStorage.getItem("jwt")) {
     clear();
@@ -726,6 +742,7 @@ const useAuth = defineStore("auth", () => {
       );
     }
     if (session.promise) return session.promise;
+    const loginAttempt = prepareLogin();
     const apiBase = String(useRuntimeConfig().public.apiBase ?? "");
     const controller = new AbortController();
     session.controller = controller;
@@ -764,7 +781,7 @@ const useAuth = defineStore("auth", () => {
           account.id <= 0
         )
           throw Error("暂时无法验证登录身份，请稍后重试。");
-        loginWithJwt(session.jwt);
+        loginAttempt.commit(session.jwt);
         overview.value = account;
       },
       15_000,
@@ -800,7 +817,7 @@ const useAuth = defineStore("auth", () => {
     if (type === "code" && account.includes("@"))
       throw Error("验证码登录仅支持手机号");
     const api = useApi();
-    const version = sessionVersion;
+    const loginAttempt = prepareLogin();
     loading.value = true;
     try {
       const result = await api.post(
@@ -819,11 +836,11 @@ const useAuth = defineStore("auth", () => {
         false,
         { timeoutMs: 15_000 },
       );
-      if (version !== sessionVersion) throw Error("登录状态已变化，请重试");
+      if (!loginAttempt.isCurrent()) throw Error("登录状态已变化，请重试");
       ft(result);
       if (!ut(result?.jwt))
         throw Error("登录响应无效，请重新登录；若持续失败，请联系客服。");
-      loginWithJwt(result.jwt);
+      loginAttempt.commit(result.jwt);
     } finally {
       loading.value = false;
     }
@@ -886,7 +903,7 @@ const useAuth = defineStore("auth", () => {
     loading,
     isLoggedIn,
     login,
-    loginWithJwt,
+    prepareLogin,
     fetchOverview,
     refreshOverview,
     logout,

app/pages/oauth/bind.vue

@@ -119,6 +119,7 @@ var ve = {
           H = ref(``),
           U = ref(!1),
           W = ref(!1),
+          loginAttempt = null,
           G = !0;
         onBeforeUnmount(() => {
           G = !1;
@@ -127,6 +128,8 @@ var ve = {
         async function K() {
           if (!W.value && G) {
             ((W.value = !0), (U.value = !1), (H.value = ``));
+            const attempt = A.prepareLogin();
+            loginAttempt = attempt;
             try {
               if (N) {
                 if (!P) throw Error(`扫码会话已过期，请返回登录重新扫码`);
@@ -134,10 +137,10 @@ var ve = {
                   ticket: P.ticket,
                   token: P.token,
                 });
-                if (!G) return;
+                if (!G || !attempt.isCurrent()) return;
                 if (e.status === `Success` && isValidJwt(e.jwt)) {
                   (wechat_binding_t(sessionStorage),
-                    A.loginWithJwt(e.jwt),
+                    attempt.commit(e.jwt),
                     await navigateTo(F));
                   return;
                 }
@@ -147,7 +150,7 @@ var ve = {
                 return;
               }
               let t = await S.get(`/oauth/token`);
-              if (!G) return;
+              if (!G || !attempt.isCurrent()) return;
               let n = oauth_n(
                 t,
                 window.location.origin,
@@ -159,7 +162,7 @@ var ve = {
                 ).origin,
               );
               if (n.kind === `login`) {
-                (A.loginWithJwt(n.jwt), await navigateTo(`/`));
+                (attempt.commit(n.jwt), await navigateTo(`/`));
                 return;
               }
               if (n.kind !== `bind`)
@@ -167,6 +170,7 @@ var ve = {
               U.value = !0;
             } catch (e) {
               G &&
+                attempt.isCurrent() &&
                 (H.value = e instanceof Error ? e.message : `验证授权会话失败`);
             } finally {
               G && (W.value = !1);
@@ -210,7 +214,8 @@ var ve = {
         // 必须先验证授权会话并同意协议；提交验证码绑定，微信额外携带扫码 ticket/token，成功响应的 JWT 合法后才建立会话。
         async function Le() {
           if (!V.value && G) {
-            if (((H.value = ``), !U.value)) {
+            if (((H.value = ``), !U.value || !loginAttempt.isCurrent())) {
+              U.value = !1;
               H.value = `请先验证授权会话；会话失效时请返回登录重新授权`;
               return;
             }
@@ -223,6 +228,7 @@ var ve = {
               return;
             }
             V.value = !0;
+            const attempt = loginAttempt;
             try {
               let e = q.validationError?.();
               if (e) throw Error(e);
@@ -244,14 +250,15 @@ var ve = {
                     : {}),
                 },
               );
-              if (!G) return;
+              if (!G || !attempt.isCurrent()) return;
               if (!isValidJwt(t?.jwt))
                 throw Error(`绑定会话已失效，请返回登录后重新发起第三方授权`);
               (N && wechat_binding_t(sessionStorage),
-                A.loginWithJwt(t.jwt),
+                attempt.commit(t.jwt),
                 await navigateTo(F));
             } catch (e) {
               G &&
+                attempt.isCurrent() &&
                 ((H.value =
                   e instanceof Error ? e.message : `绑定失败，请重试`),
                 await q.handleError?.(e));

app/pages/oauth/callback.vue

@@ -54,9 +54,10 @@ var w = {
       async function A() {
         if (k && !D.value) {
           ((D.value = !0), (O.value = ``));
+          const loginAttempt = E.prepareLogin();
           try {
             let t = await T.get(`/oauth/token`);
-            if (!k) return;
+            if (!k || !loginAttempt.isCurrent()) return;
             let n = oauth_n(
               t,
               window.location.origin,
@@ -68,7 +69,7 @@ var w = {
               ).origin,
             );
             if (n.kind === `login`) {
-              E.loginWithJwt(n.jwt);
+              loginAttempt.commit(n.jwt);
               try {
                 sessionStorage.removeItem(`console-oauth-pending`);
               } catch {}
@@ -79,7 +80,9 @@ var w = {
               window.location.replace(n.url);
             } else throw Error(`授权会话已过期，请返回登录并重新授权`);
           } catch (e) {
-            k && (O.value = e instanceof Error ? e.message : `恢复登录失败`);
+            k &&
+              loginAttempt.isCurrent() &&
+              (O.value = e instanceof Error ? e.message : `恢复登录失败`);
           } finally {
             k && (D.value = !1);
           }

app/plugins/03-session.client.js

@@ -20,7 +20,7 @@ export default defineNuxtPlugin({
       // Read the latest value: several storage events may already be queued.
       const persisted = localStorage.getItem("jwt");
       if (persisted === auth.token) return;
-      if (isValidJwt(persisted)) auth.loginWithJwt(persisted);
+      if (isValidJwt(persisted)) auth.prepareLogin().commit(persisted);
       else auth.clear();
       const route = router.currentRoute.value;
       if (!auth.isLoggedIn && !isPublicRoute(route)) {

tests/review-oauth-session.e2e.test.mjs

@@ -0,0 +1,425 @@
+/** 登录结果的会话归属：真实页面、真实跨标签 storage 事件和受控外部 HTTP 响应。 */
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import {
+  appOrigin,
+  backendOrigin,
+  eventually,
+  login,
+  scenario,
+} from "./helpers/console-browser.mjs";
+
+function deferred() {
+  let resolve;
+  const promise = new Promise((done) => (resolve = done));
+  return { promise, resolve };
+}
+
+async function respond(route, data, status = 200, msg = "") {
+  return route.fulfill({
+    json: { status, msg, data },
+    headers: { "Access-Control-Allow-Origin": "*" },
+  });
+}
+
+async function oauthBoundary(page, handle) {
+  // 只声明 OAuth 的外部协议；普通登录、账户和列表仍使用独立 HTTP 假后端。
+  await page
+    .context()
+    .route(`${backendOrigin}/console/v1/**`, async (route) => {
+      const path = new URL(route.request().url()).pathname.replace(
+        /^\/console\/v1/,
+        "",
+      );
+      if (await handle(route, path)) return;
+      // 基线复现若错误接纳旧会话，让该外部账号的真实首页继续加载，不以 401 掩盖覆盖。
+      const previousAccount = {
+        "/index": {
+          account: { id: 99, username: "older-oauth-account", credit: "0.00" },
+        },
+        "/menu": { menu: [] },
+        "/client_care/mail": { credit_limit: { count: 0, list: [], type: [] } },
+        "/certification/info": {},
+        "/host": { list: [], count: 0 },
+        "/ticket": { list: [], count: 0 },
+        "/ticket/status": { list: [] },
+        "/ticket/statistic": {},
+        "/announcement": { list: [], count: 0 },
+        "/recommend/promoter": {},
+        "/transaction": { list: [], count: 0 },
+        "/withdraw/rule/credit": {},
+        "/ssh_key": { list: [], count: 0 },
+      };
+      if (
+        route.request().headers().authorization ===
+          "Bearer test-older-oauth-session" &&
+        Object.hasOwn(previousAccount, path)
+      )
+        return respond(route, previousAccount[path]);
+      return route.fallback();
+    });
+}
+
+async function changeSession(page, transition) {
+  // 不预置 token，也不手工派发 storage；另一个真实标签完成登录和可选的退出。
+  await page.evaluate(() => {
+    window.oauthSessionTransitions = [];
+    window.addEventListener("storage", (event) => {
+      if (event.key === "jwt")
+        window.oauthSessionTransitions.push(
+          event.newValue ? "login" : "logout",
+        );
+    });
+  });
+  const other = await page.context().newPage();
+  await login(other);
+  await other.getByText("audit-01", { exact: true }).waitFor();
+  await eventually(
+    () => page.evaluate(() => window.oauthSessionTransitions),
+    (events) => events.includes("login"),
+    "New login must synchronize before the pending OAuth result is released",
+  );
+  if (transition === "logout") {
+    await other.getByRole("button", { name: "用户菜单", exact: true }).click();
+    await other
+      .getByRole("menuitem", { name: "退出登录", exact: true })
+      .click();
+    await other.waitForURL((url) => url.pathname === "/login");
+    await eventually(
+      () => page.evaluate(() => window.oauthSessionTransitions),
+      (events) => events.includes("logout"),
+      "Logout must synchronize before the pending OAuth result is released",
+    );
+  }
+  return other;
+}
+
+async function sessionIsPreserved(page, transition) {
+  assert.equal(
+    await page.evaluate(
+      (loggedOut) =>
+        localStorage.getItem("jwt") ===
+        (loggedOut ? null : "e2e-session-token"),
+      transition === "logout",
+    ),
+    true,
+    "An older result must preserve the session established by the newer action",
+  );
+}
+
+test(
+  "OAuth callback establishes a current session normally",
+  { timeout: 25000 },
+  (t) =>
+    scenario(t, {}, async (page) => {
+      await oauthBoundary(page, async (route, path) => {
+        if (path !== "/oauth/token") return false;
+        await respond(route, { jwt: "e2e-session-token" });
+        return true;
+      });
+      await page.goto(`${appOrigin}/oauth/callback`);
+      await page.waitForURL((url) => url.pathname === "/");
+      await page
+        .getByRole("button", { name: "用户菜单", exact: true })
+        .waitFor();
+      await sessionIsPreserved(page, "login");
+      return { currentOAuthSessionAccepted: true, memberHomeVisible: true };
+    }),
+);
+
+test(
+  "OAuth verified binding establishes a current session normally",
+  { timeout: 25000 },
+  (t) =>
+    scenario(t, {}, async (page) => {
+      await oauthBoundary(page, async (route, path) => {
+        if (path === "/oauth/token") {
+          await respond(route, { url: "/oauth/bind" });
+          return true;
+        }
+        if (path === "/oauth/client/bind") {
+          await respond(route, { jwt: "e2e-session-token" });
+          return true;
+        }
+        return false;
+      });
+      await page.goto(`${appOrigin}/oauth/bind?redirect=/security/ssh-keys`);
+      await page.getByLabel("手机号", { exact: true }).fill("13800138000");
+      await page.getByLabel("验证码", { exact: true }).fill("123456");
+      await page.getByRole("checkbox").check();
+      await page.getByRole("button", { name: "确认绑定", exact: true }).click();
+      await page.waitForURL((url) => url.pathname === "/security/ssh-keys");
+      await page.getByText("audit-01", { exact: true }).waitFor();
+      await sessionIsPreserved(page, "login");
+      return { verifiedBindingAccepted: true, protectedPageVisible: true };
+    }),
+);
+
+for (const pagePath of ["/oauth/callback", "/oauth/bind"]) {
+  for (const transition of ["login", "logout"]) {
+    for (const outcome of ["jwt", "bind", "error"]) {
+      test(
+        `${pagePath} ignores older ${outcome} after cross-tab ${transition}`,
+        { timeout: 25000 },
+        (t) =>
+          scenario(t, {}, async (page) => {
+            const started = deferred();
+            const release = deferred();
+            await oauthBoundary(page, async (route, path) => {
+              if (path !== "/oauth/token") return false;
+              started.resolve();
+              await release.promise;
+              await respond(
+                route,
+                outcome === "jwt"
+                  ? { jwt: "test-older-oauth-session" }
+                  : { url: "/oauth/bind" },
+                outcome === "error" ? 422 : 200,
+                outcome === "error" ? "过期授权请求失败" : "",
+              );
+              return true;
+            });
+            await page.goto(`${appOrigin}${pagePath}`);
+            await started.promise;
+            await changeSession(page, transition);
+            release.resolve();
+            const retry = page.getByRole("button", {
+              name:
+                pagePath === "/oauth/callback" ? "重新验证" : "验证授权会话",
+              exact: true,
+            });
+            await eventually(
+              () => retry.isEnabled().catch(() => false),
+              Boolean,
+              "The old request must finish without navigating or enabling its old binding flow",
+            );
+            assert.equal(new URL(page.url()).pathname, pagePath);
+            assert.equal(await page.getByRole("alert").count(), 0);
+            assert.equal(
+              await page.getByLabel("手机号", { exact: true }).count(),
+              0,
+            );
+            await sessionIsPreserved(page, transition);
+            return {
+              transition,
+              outcome,
+              newerSessionPreserved: true,
+              noOldNavigation: true,
+              noOldError: true,
+              noOldBindingForm: true,
+            };
+          }),
+      );
+    }
+  }
+}
+
+for (const transition of ["login", "logout"]) {
+  test(
+    `OAuth binding submission ignores its late session after cross-tab ${transition}`,
+    { timeout: 25000 },
+    (t) =>
+      scenario(t, {}, async (page) => {
+        const started = deferred();
+        const release = deferred();
+        await oauthBoundary(page, async (route, path) => {
+          if (path === "/oauth/token") {
+            await respond(route, { url: "/oauth/bind" });
+            return true;
+          }
+          if (path === "/oauth/client/bind") {
+            started.resolve();
+            await release.promise;
+            await respond(route, { jwt: "test-older-oauth-session" });
+            return true;
+          }
+          return false;
+        });
+        await page.goto(`${appOrigin}/oauth/bind?redirect=/security/ssh-keys`);
+        await page.getByLabel("手机号", { exact: true }).fill("13800138000");
+        await page.getByLabel("验证码", { exact: true }).fill("123456");
+        await page.getByRole("checkbox").check();
+        const submit = page.getByRole("button", {
+          name: "确认绑定",
+          exact: true,
+        });
+        await submit.click();
+        await started.promise;
+        await changeSession(page, transition);
+        release.resolve();
+        await eventually(
+          () => submit.isEnabled().catch(() => false),
+          Boolean,
+          "The old binding must finish without replacing the newer session",
+        );
+        assert.equal(new URL(page.url()).pathname, "/oauth/bind");
+        await sessionIsPreserved(page, transition);
+        return {
+          transition,
+          lateBindingIgnored: true,
+          newerSessionPreserved: true,
+        };
+      }),
+  );
+}
+
+async function wechatBoundary(page, statusHandler) {
+  await oauthBoundary(page, async (route, path) => {
+    if (path === "/common") {
+      await respond(route, {
+        website_name: "本地扫码验收",
+        login_phone_password: 1,
+        login_email_password: 1,
+        login_phone_verify: 1,
+        register_phone: 1,
+        register_email: 1,
+        plugin_configuration: { mp_weixin_notice: { scan_login: 1 } },
+        oauth: [],
+      });
+      return true;
+    }
+    if (path === "/mp_weixin_notice/qrcode") {
+      await respond(route, {
+        img_url:
+          "data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==",
+        ticket: "local-qr-ticket",
+        token: "local-qr-token",
+      });
+      return true;
+    }
+    return statusHandler(route, path);
+  });
+}
+
+async function requestWechat(page) {
+  await page.goto(`${appOrigin}/login?redirect=/security/ssh-keys`);
+  await page.getByRole("button", { name: "获取二维码", exact: true }).click();
+  await page.getByRole("img", { name: "微信扫码登录", exact: true }).waitFor();
+}
+
+test(
+  "a current WeChat scan establishes its session normally",
+  { timeout: 25000 },
+  (t) =>
+    scenario(t, {}, async (page) => {
+      await wechatBoundary(page, async (route, path) => {
+        if (path !== "/mp_weixin_notice/qrcode/status") return false;
+        await respond(route, { status: "Success", jwt: "e2e-session-token" });
+        return true;
+      });
+      await requestWechat(page);
+      await page.waitForURL((url) => url.pathname === "/security/ssh-keys");
+      await page.getByText("audit-01", { exact: true }).waitFor();
+      await sessionIsPreserved(page, "login");
+      return { currentWechatSessionAccepted: true };
+    }),
+);
+
+test(
+  "a current WeChat account selection establishes its session normally",
+  { timeout: 25000 },
+  (t) =>
+    scenario(t, {}, async (page) => {
+      await wechatBoundary(page, async (route, path) => {
+        if (path === "/mp_weixin_notice/qrcode/status") {
+          await respond(route, {
+            status: "SelectClient",
+            client: [{ id: 1, username: "current-qr-account", status: 1 }],
+          });
+          return true;
+        }
+        if (path === "/mp_weixin_notice/qrcode/select_client_login") {
+          await respond(route, { jwt: "e2e-session-token" });
+          return true;
+        }
+        return false;
+      });
+      await requestWechat(page);
+      await page.locator(".qr-client-btn").click();
+      await page.waitForURL((url) => url.pathname === "/security/ssh-keys");
+      await page.getByText("audit-01", { exact: true }).waitFor();
+      await sessionIsPreserved(page, "login");
+      return { currentWechatSelectionAccepted: true };
+    }),
+);
+
+for (const outcome of ["Success", "WaitBind", "SelectClient"]) {
+  test(
+    `WeChat ${outcome} result cannot resume its old scan after a newer session`,
+    { timeout: 30000 },
+    (t) =>
+      scenario(t, {}, async (page) => {
+        const started = deferred();
+        const release = deferred();
+        const transition = outcome === "SelectClient" ? "logout" : "login";
+        await wechatBoundary(page, async (route, path) => {
+          if (path === "/mp_weixin_notice/qrcode/status") {
+            if (outcome === "SelectClient") {
+              await respond(route, {
+                status: "SelectClient",
+                client: [{ id: 99, username: "older-qr-account", status: 1 }],
+              });
+            } else {
+              started.resolve();
+              await release.promise;
+              await respond(route, {
+                status: outcome,
+                ...(outcome === "Success"
+                  ? { jwt: "test-older-oauth-session" }
+                  : {}),
+              });
+            }
+            return true;
+          }
+          if (path === "/mp_weixin_notice/qrcode/select_client_login") {
+            started.resolve();
+            await release.promise;
+            await respond(route, { jwt: "test-older-oauth-session" });
+            return true;
+          }
+          return false;
+        });
+        await requestWechat(page);
+        if (outcome === "SelectClient")
+          await page.locator(".qr-client-btn").click();
+        await started.promise;
+        await changeSession(page, transition);
+        const completed = page.waitForResponse((response) =>
+          response
+            .url()
+            .endsWith(
+              outcome === "SelectClient"
+                ? "/mp_weixin_notice/qrcode/select_client_login"
+                : "/mp_weixin_notice/qrcode/status?ticket=local-qr-ticket&token=local-qr-token",
+            ),
+        );
+        release.resolve();
+        await (await completed).finished();
+        // 网络完成后跨过一次实际渲染，观察迟到结果，而非在释放响应前就读取已清空的二维码。
+        await page.evaluate(
+          () =>
+            new Promise((done) =>
+              requestAnimationFrame(() => requestAnimationFrame(done)),
+            ),
+        );
+        await page
+          .getByRole("button", { name: "获取二维码", exact: true })
+          .waitFor();
+        assert.equal(new URL(page.url()).pathname, "/login");
+        assert.equal(await page.locator(".qr-client-btn").count(), 0);
+        assert.equal(
+          await page.evaluate(
+            () => sessionStorage.getItem("console.wechat-binding") === null,
+          ),
+          true,
+        );
+        await sessionIsPreserved(page, transition);
+        return {
+          outcome,
+          transition,
+          oldScanDiscarded: true,
+          newerSessionPreserved: true,
+        };
+      }),
+  );
+}