fix(R61): 增加 session hint cookie 消除 bootstrap refresh 401

server/src/routes/auth.js

@@ -118,6 +118,16 @@ function refreshCookieOptions(config) {
   };
 }
 
+function sessionHintCookieOptions(config) {
+  return {
+    httpOnly: false,
+    sameSite: "strict",
+    secure: config.cookieSecure,
+    path: "/",
+    maxAge: config.refreshTtlSeconds,
+  };
+}
+
 function oidcCookieOptions(config) {
   return {
     httpOnly: true,
@@ -420,6 +430,7 @@ async function authRoutes(fastify) {
       refreshToken,
       refreshCookieOptions(fastify.config),
     );
+    reply.setCookie("has_session", "1", sessionHintCookieOptions(fastify.config));
 
     const accessToken = fastify.issueAccessToken(employee);
     return sendData(reply, request, {
@@ -540,6 +551,7 @@ async function authRoutes(fastify) {
       }
 
       reply.clearCookie(fastify.config.refreshCookieName, refreshCookieOptions(fastify.config));
+      reply.clearCookie("has_session", sessionHintCookieOptions(fastify.config));
       throw new AppError({
         code: "AUTH_005",
         message: "Refresh Token 无效/已撤销",
@@ -607,6 +619,7 @@ async function authRoutes(fastify) {
       newRefreshToken,
       refreshCookieOptions(fastify.config),
     );
+    reply.setCookie("has_session", "1", sessionHintCookieOptions(fastify.config));
 
     const accessToken = fastify.issueAccessToken(employee);
     return sendData(reply, request, {
@@ -857,6 +870,7 @@ async function authRoutes(fastify) {
       refreshToken,
       refreshCookieOptions(fastify.config),
     );
+    reply.setCookie("has_session", "1", sessionHintCookieOptions(fastify.config));
     reply.clearCookie(oidcCookieName, oidcCookieOptions(fastify.config));
 
     const origin = resolvePrimaryAppOrigin(fastify.config, request);
@@ -894,6 +908,7 @@ async function authRoutes(fastify) {
     }
 
     reply.clearCookie(fastify.config.refreshCookieName, refreshCookieOptions(fastify.config));
+    reply.clearCookie("has_session", sessionHintCookieOptions(fastify.config));
     return sendData(reply, request, {});
   });
 
@@ -1019,6 +1034,7 @@ async function authRoutes(fastify) {
       refreshToken,
       refreshCookieOptions(fastify.config),
     );
+    reply.setCookie("has_session", "1", sessionHintCookieOptions(fastify.config));
 
     const accessToken = fastify.issueAccessToken(updatedEmployee);
     return sendData(reply, request, {
@@ -1245,6 +1261,7 @@ async function authRoutes(fastify) {
     }
 
     reply.clearCookie(fastify.config.refreshCookieName, refreshCookieOptions(fastify.config));
+    reply.clearCookie("has_session", sessionHintCookieOptions(fastify.config));
     return sendData(reply, request, {});
   });
 }