fix(auth): revoke captured client sessions safely on logout

src/modules/auth/store/auth.ts

@@ -61,6 +61,7 @@ export const useAuthStore = defineStore('client-auth', () => {
   const permissionCodes = ref<string[]>([])
   const sessionRestored = ref(false)
 
+  let logoutRequest: { accessToken: string; refreshToken: string; promise: Promise<void> } | undefined
   let generation = 0
   let contextRequest: { generation: number; promise: Promise<void> } | undefined
   let restoreTimer: ReturnType<typeof setTimeout> | undefined
@@ -199,10 +200,20 @@ export const useAuthStore = defineStore('client-auth', () => {
     await restoreSession()
   }
 
-  async function logout() {
+  function logout() {
+    const accessToken = getAccessToken()
     const refreshToken = getRefreshToken()
+    if (logoutRequest && ((!accessToken && !refreshToken)
+      || (logoutRequest.accessToken === accessToken && logoutRequest.refreshToken === refreshToken))) return logoutRequest.promise
+    const pending = accessToken || refreshToken
+      ? logoutMerchant(accessToken, refreshToken)
+      : Promise.resolve()
     clearSession()
-    if (refreshToken) await logoutMerchant(refreshToken)
+    const request = { accessToken, refreshToken, promise: pending.finally(() => {
+      if (logoutRequest === request) logoutRequest = undefined
+    }) }
+    logoutRequest = request
+    return request.promise
   }
 
   function hasPermission(permission?: string) {