pda-overseas-uniapp/src/stores/session.js

import { reactive } from 'vue'
import { OVERSEAS_API_ROOT } from '../config/runtime.js'
import { resetReceivingSession } from './receiving.js'
import { resetFulfillmentSession } from './fulfillment.js'

const SESSION_KEY = 'overseas-pda-auth-session'
export const PDA_ROLE = 'OVERSEAS_WAREHOUSE_PDA_OPERATOR'
export const PDA_AUTHORITY = 'lastleg:pda:operate'

export const session = reactive({ currentUser: null, token: '', domesticToken: '', refreshToken: '', tenantId: '', apiBase: OVERSEAS_API_ROOT })

function decodeBase64Url(value) {
	const normalized = value.replace(/-/g, '+').replace(/_/g, '/')
	const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, '=')
	if (typeof atob === 'function') return decodeURIComponent(Array.from(atob(padded), (char) => `%${char.charCodeAt(0).toString(16).padStart(2, '0')}`).join(''))
	throw new Error('当前运行环境无法解析登录令牌')
}

export function decodeAccessToken(token) {
	const payload = String(token || '').split('.')[1]
	if (!payload) throw new Error('登录响应中的 accessToken 格式无效')
	try {
		const decoded = decodeBase64Url(payload)
		// Preserve snowflake IDs before JSON.parse rounds unquoted JWT numbers beyond Number.MAX_SAFE_INTEGER.
		const safeLongClaims = decoded.replace(
			/("(?:user_id|membership_id|tenant_id|overseas_warehouse_id)"\s*:\s*)(-?\d{16,})(?=\s*[,}])/g,
			'$1"$2"'
		)
		return JSON.parse(safeLongClaims)
	} catch (error) {
		if (error.message === '当前运行环境无法解析登录令牌') throw error
		throw new Error('登录响应中的 accessToken 无法解析')
	}
}

function claimId(claims, name) {
	const value = claims?.[name]
	return value === null || value === undefined ? '' : String(value)
}

function includesClaim(values, expected) {
	return Array.isArray(values) && values.map(String).includes(expected)
}

function requireActiveClaims(claims, label) {
	if (claims.exp && Number(claims.exp) * 1000 <= Date.now()) throw new Error(`${label}已过期`)
	if (claims.app_code !== 'PLATFORM' || claimId(claims, 'tenant_id') !== '0') {
		throw new Error('当前账号不属于平台仓库作业端')
	}
	if (!claimId(claims, 'user_id') || !claimId(claims, 'membership_id')) {
		throw new Error(`${label}缺少完整作业主体`)
	}
}

export function validatePdaTokenPair(accessToken, overseasAccessToken) {
	const domestic = decodeAccessToken(accessToken)
	const overseas = decodeAccessToken(overseasAccessToken)
	requireActiveClaims(domestic, '登录状态')
	requireActiveClaims(overseas, '海外作业令牌')
	for (const claim of ['user_id', 'membership_id', 'tenant_id', 'app_code', 'overseas_warehouse_id']) {
		if (claimId(domestic, claim) !== claimId(overseas, claim)) throw new Error('国内与海外令牌作业主体不一致')
	}
	const warehouseId = claimId(overseas, 'overseas_warehouse_id')
	if (!/^\d+$/.test(warehouseId) || warehouseId === '0') throw new Error('海外PDA账号未绑定有效作业仓库')
	if (!includesClaim(overseas.roles, PDA_ROLE)) throw new Error('当前账号不是海外仓 PDA 作业员')
	if (!includesClaim(overseas.authorities, PDA_AUTHORITY)) throw new Error(`当前账号缺少${PDA_AUTHORITY}权限`)
	return { domestic, overseas, warehouseId }
}

function userFromClaims(pair, saved = {}) {
	const savedWarehouseId = String(saved?.warehouseId || '')
	const sameWarehouse = savedWarehouseId === pair.warehouseId
	return {
		id: claimId(pair.domestic, 'user_id'),
		name: pair.domestic.username || '仓库作业员',
		role: PDA_ROLE,
		roles: [...pair.overseas.roles],
		warehouse: sameWarehouse && saved.warehouseName ? saved.warehouseName : '',
		warehouseId: pair.warehouseId,
		warehouseCode: sameWarehouse ? (saved.warehouseCode || '') : '',
		warehouseName: sameWarehouse ? (saved.warehouseName || '') : ''
	}
}

function storageAvailable() {
	return typeof uni !== 'undefined' && typeof uni.setStorageSync === 'function' && typeof uni.getStorageSync === 'function'
}

function persistSession() {
	if (!storageAvailable()) return
	uni.setStorageSync(SESSION_KEY, {
		currentUser: session.currentUser,
		token: session.token,
		domesticToken: session.domesticToken,
		refreshToken: session.refreshToken,
		tenantId: session.tenantId,
		apiBase: session.apiBase
	})
}

export function signIn(account, warehouse, options = {}) {
	session.currentUser = { id: String(account.id), name: account.name, role: account.role, roles: account.roles || [], warehouse,
		warehouseId: account.warehouseId || null, warehouseCode: account.warehouseCode || '', warehouseName: account.warehouseName || '' }
	session.token = options.token || account.token || ''
	session.domesticToken = options.domesticToken || account.domesticToken || ''
	session.refreshToken = options.refreshToken || account.refreshToken || ''
	session.tenantId = options.tenantId || account.tenantId || ''
	session.apiBase = options.apiBase || account.apiBase || OVERSEAS_API_ROOT
	persistSession()
	return session.currentUser
}

export function signInWithTokens(tokens) {
	if (!tokens?.accessToken) throw new Error('登录响应缺少 accessToken')
	if (!tokens?.overseasAccessToken) throw new Error('登录响应缺少 overseasAccessToken')
	const pair = validatePdaTokenPair(tokens.accessToken, tokens.overseasAccessToken)
	const user = userFromClaims(pair)
	return signIn(user, user.warehouse, {
		token: tokens.overseasAccessToken,
		domesticToken: tokens.accessToken,
		refreshToken: tokens.refreshToken || '',
		tenantId: claimId(pair.domestic, 'tenant_id')
	})
}

export function replaceTokens(tokens) {
	if (!tokens?.accessToken || !tokens?.overseasAccessToken) throw new Error('刷新响应缺少双区域访问令牌')
	const pair = validatePdaTokenPair(tokens.accessToken, tokens.overseasAccessToken)
	const user = userFromClaims(pair, session.currentUser)
	const nextRefreshToken = tokens.refreshToken || session.refreshToken
	// Validate the complete replacement before mutating reactive or persisted session state.
	session.domesticToken = tokens.accessToken
	session.token = tokens.overseasAccessToken
	session.refreshToken = nextRefreshToken
	session.tenantId = claimId(pair.domestic, 'tenant_id')
	session.currentUser = user
	persistSession()
}

export function applyWarehouseProfile(profile) {
	if (!session.currentUser) throw new Error('当前登录会话不存在')
	const warehouseId = String(profile?.warehouseId || '')
	if (!warehouseId || warehouseId !== String(session.currentUser.warehouseId)) throw new Error('仓库主档与当前登录仓库不一致')
	session.currentUser = {
		...session.currentUser,
		warehouse: profile.warehouseName || '',
		warehouseCode: String(profile.warehouseCode || ''),
		warehouseName: String(profile.warehouseName || '')
	}
	persistSession()
	return session.currentUser
}

export function restoreSession() {
	if (!storageAvailable()) return false
	const saved = uni.getStorageSync(SESSION_KEY)
	if (!saved?.token || !saved?.domesticToken || !saved?.refreshToken || !saved?.currentUser) {
		signOut()
		return false
	}
	try {
		const pair = validatePdaTokenPair(saved.domesticToken, saved.token)
		Object.assign(session, saved, {
			currentUser: userFromClaims(pair, saved.currentUser), tenantId: claimId(pair.domestic, 'tenant_id'),
			apiBase: OVERSEAS_API_ROOT
		})
		return true
	} catch (_) {
		signOut()
		return false
	}
}

export function signOut() {
	session.currentUser = null
	session.token = ''
	session.domesticToken = ''
	session.refreshToken = ''
	session.tenantId = ''
	session.apiBase = OVERSEAS_API_ROOT
	if (typeof uni !== 'undefined' && typeof uni.removeStorageSync === 'function') uni.removeStorageSync(SESSION_KEY)
	resetReceivingSession()
	resetFulfillmentSession()
}

export function requireSession() {
	if (session.currentUser || restoreSession()) return true
	uni.reLaunch({ url: '/pages/login/login' })
	return false
}