修复第三方登录旧响应覆盖新会话并补充跨标签回归

app/lib/auth.js

@@ -695,6 +695,22 @@ const useAuth = defineStore("auth", () => {
     localStorage.setItem("jwt", jwt);
   }
 
+  // 身份结果只归属于请求开始时的会话；也检查持久凭证，覆盖 storage 事件尚未处理的窗口。
+  function prepareLogin() {
+    const version = sessionVersion;
+    const persistedToken = localStorage.getItem("jwt");
+    const isCurrent = () =>
+      version === sessionVersion &&
+      persistedToken === localStorage.getItem("jwt");
+    return {
+      isCurrent,
+      commit(jwt) {
+        if (!isCurrent()) throw Error("登录状态已变化，请重新发起登录。");
+        loginWithJwt(jwt);
+      },
+    };
+  }
+
   // 旧平台带来的凭证先暂存待验证，不立即写成已登录状态，避免路由守卫误放行。
   function prepareLegacyLogin(jwt = localStorage.getItem("jwt")) {
     clear();
@@ -726,6 +742,7 @@ const useAuth = defineStore("auth", () => {
       );
     }
     if (session.promise) return session.promise;
+    const loginAttempt = prepareLogin();
     const apiBase = String(useRuntimeConfig().public.apiBase ?? "");
     const controller = new AbortController();
     session.controller = controller;
@@ -764,7 +781,7 @@ const useAuth = defineStore("auth", () => {
           account.id <= 0
         )
           throw Error("暂时无法验证登录身份，请稍后重试。");
-        loginWithJwt(session.jwt);
+        loginAttempt.commit(session.jwt);
         overview.value = account;
       },
       15_000,
@@ -800,7 +817,7 @@ const useAuth = defineStore("auth", () => {
     if (type === "code" && account.includes("@"))
       throw Error("验证码登录仅支持手机号");
     const api = useApi();
-    const version = sessionVersion;
+    const loginAttempt = prepareLogin();
     loading.value = true;
     try {
       const result = await api.post(
@@ -819,11 +836,11 @@ const useAuth = defineStore("auth", () => {
         false,
         { timeoutMs: 15_000 },
       );
-      if (version !== sessionVersion) throw Error("登录状态已变化，请重试");
+      if (!loginAttempt.isCurrent()) throw Error("登录状态已变化，请重试");
       ft(result);
       if (!ut(result?.jwt))
         throw Error("登录响应无效，请重新登录；若持续失败，请联系客服。");
-      loginWithJwt(result.jwt);
+      loginAttempt.commit(result.jwt);
     } finally {
       loading.value = false;
     }
@@ -886,7 +903,7 @@ const useAuth = defineStore("auth", () => {
     loading,
     isLoggedIn,
     login,
-    loginWithJwt,
+    prepareLogin,
     fetchOverview,
     refreshOverview,
     logout,