Flask Session -> Double Token

frontend/templates/login.html

@@ -155,6 +155,7 @@
   .theme-light .alt-btn:active { background: #e4e9f0; }
   .theme-light .recovery-mode input[type="text"] { background: #fafafa; border-color: #d7dfe8; }
 </style>
+<script src="/static/js/token.js"></script>
 <script src="/static/js/passkey_bridge.js"></script>
 <script src="/static/js/theme.js"></script>
 </head>
@@ -227,17 +228,15 @@
   }
 
   // ─── Auth status check ──────────────────
-  var xhr = new XMLHttpRequest();
-  xhr.open('GET', '/api/auth/status');
-  xhr.onload = function () {
-    if (xhr.status === 200) {
-      var status = JSON.parse(xhr.responseText);
+  // 携带本地 access token 检查（token 有效则直接放行，避免重复登录）
+  Auth.fetchWithAuth('/api/auth/status')
+    .then(function (r) { return r.json(); })
+    .then(function (status) {
       if (status.authenticated) {
         _redirect(redirect);
       }
-    }
-  };
-  xhr.send();
+    })
+    .catch(function () {});
 
   // ─── TOTP dots ──────────────────────────
   function updateDots(ok) {
@@ -259,6 +258,7 @@
     xhr.onload = function () {
       if (xhr.status === 200) {
         var res = JSON.parse(xhr.responseText || '{}');
+        if (res.access_token) Auth.setAccess(res.access_token);
         if (res.method === 'temp_password' || res.must_configure_mfa) {
           _redirect('/mfa-setup');
         } else {
@@ -317,6 +317,7 @@
           verify.onload = function () {
             var res = JSON.parse(verify.responseText || '{}');
             if (verify.status === 200) {
+              if (res.access_token) Auth.setAccess(res.access_token);
               msgEl.textContent = '✅ 登录成功！';
               setTimeout(function () { _redirect(redirect); }, 300);
             } else {
@@ -368,6 +369,7 @@
     xhr.onload = function () {
       var res = JSON.parse(xhr.responseText || '{}');
       if (xhr.status === 200) {
+        if (res.access_token) Auth.setAccess(res.access_token);
         _redirect(redirect);
       } else {
         msgEl.textContent = res.error || '恢复码错误';
@@ -383,32 +385,6 @@
     }
   });
 
-  // ─── SSE background listener ────────────
-  (function () {
-    function connectSSE() {
-      var es = new EventSource('/api/events');
-      es.onmessage = function (e) {
-        try {
-          var msg = JSON.parse(e.data);
-          if (msg.type === 'force_refresh' || msg.type === 'display_mode_changed') {
-            location.href = '/';
-          } else if (msg.type === 'kick_all') {
-            var xhr = new XMLHttpRequest();
-            xhr.open('POST', '/api/auth/logout');
-            xhr.onload = function () { location.reload(); };
-            xhr.send();
-          }
-        } catch (_) {}
-      };
-      es.onerror = function () {
-        es.close();
-        setTimeout(connectSSE, 5000);
-      };
-    }
-
-    connectSSE();
-  })();
-
   // ─── Helpers ────────────────────────────
   // Convert base64url (from server/webauthn) to ArrayBuffer
   function _base64ToArrayBuffer(b64) {