fix(auth): revoke expired admin sessions without restoring login

src/shared/api/http.test.ts

@@ -18,6 +18,23 @@ afterEach(() => {
 })
 
 describe('API error diagnostics', () => {
+  it('keeps a logout bound to its explicit token after a different session has logged in', async () => {
+    localStorage.setItem('cc-admin-token', 'new-login-access')
+    let authorization: unknown
+    http.defaults.adapter = async config => {
+      authorization = config.headers.Authorization
+      return { status: 200, statusText: 'OK', headers: {}, config, data: { code: '200', data: null } }
+    }
+    try {
+      await http.post('/auth/logout', { refreshToken: 'previous-refresh' }, {
+        headers: { Authorization: 'Bearer previous-access' },
+      })
+      expect(authorization).toBe('Bearer previous-access')
+    } finally {
+      localStorage.removeItem('cc-admin-token')
+    }
+  })
+
   it('does not attach a stale access token to anonymous authentication requests', async () => {
     localStorage.setItem('cc-admin-token', 'stale-large-token')
     let authorization: unknown

src/shared/api/http.ts

@@ -91,7 +91,8 @@ http.interceptors.request.use((config) => {
   const token = localStorage.getItem('cc-admin-token')
   const isAnonymousAuthEndpoint = typeof config.url === 'string'
     && ['/auth/login', '/auth/refresh', '/auth/register'].includes(config.url)
-  if (token && !isAnonymousAuthEndpoint) {
+  const hasExplicitLogoutToken = config.url === '/auth/logout' && Boolean(config.headers.Authorization)
+  if (token && !isAnonymousAuthEndpoint && !hasExplicitLogoutToken) {
     config.headers.Authorization = `Bearer ${token}`
   }
   return config