Flask Session -> Double Token

frontend/templates/display_custom.html

@@ -75,6 +75,7 @@
   </div>
 </div>
 
+<script src="/static/js/token.js"></script>
 <script>
 (function () {
   'use strict';
@@ -149,21 +150,28 @@
 
   // SSE: listen for control commands (force_refresh / mode_change / custom_notification)
   function connectSSE() {
-    var es = new EventSource('/api/events');
-    es.onmessage = function (e) {
-      try {
-        var msg = JSON.parse(e.data);
-        if (msg.type === 'force_refresh' || msg.type === 'display_mode_changed') {
-          location.reload();
-        } else if (msg.type === 'custom_notification') {
-          showCustomNotification(msg.data);
-        }
-      } catch (_) {}
-    };
-    es.onerror = function () {
-      es.close();
-      setTimeout(connectSSE, 5000);
-    };
+    // EventSource 不能带 Authorization header → 先换一次性 ticket
+    Auth.request('POST', '/api/events/ticket', null, function (res, status) {
+      if (status !== 201 || !res.ticket) {
+        setTimeout(connectSSE, 5000);
+        return;
+      }
+      var es = new EventSource('/api/events?ticket=' + encodeURIComponent(res.ticket));
+      es.onmessage = function (e) {
+        try {
+          var msg = JSON.parse(e.data);
+          if (msg.type === 'force_refresh' || msg.type === 'display_mode_changed') {
+            location.reload();
+          } else if (msg.type === 'custom_notification') {
+            showCustomNotification(msg.data);
+          }
+        } catch (_) {}
+      };
+      es.onerror = function () {
+        es.close();
+        setTimeout(connectSSE, 5000);
+      };
+    });
   }
   connectSSE();
 })();