Flask Session -> Double Token

frontend/templates/login_control.html

@@ -172,6 +172,7 @@
   }
   .divider::before, .divider::after { background: var(--divider); }
 </style>
+<script src="/static/js/token.js"></script>
 <script src="/static/js/passkey_bridge.js"></script>
 <script src="/static/js/theme.js"></script>
 </head>
@@ -247,12 +248,10 @@
   });
 
   function checkStatus(callback) {
-    var xhr = new XMLHttpRequest();
-    xhr.open('GET', '/api/auth/status');
-    xhr.onload = function () {
-      if (xhr.status === 200) callback(JSON.parse(xhr.responseText));
-    };
-    xhr.send();
+    Auth.fetchWithAuth('/api/auth/status')
+      .then(function (r) { return r.json(); })
+      .then(function (data) { callback(data); })
+      .catch(function () { callback({}); });
   }
 
   function showLoginForm(mfaConfigured) {
@@ -280,6 +279,7 @@
     xhr.onload = function () {
       var res = JSON.parse(xhr.responseText || '{}');
       if (xhr.status === 200) {
+        if (res.access_token) Auth.setAccess(res.access_token);
         if (res.method === 'temp_password' || res.must_configure_mfa) {
           _redirect('/mfa-setup');
         } else {
@@ -358,6 +358,7 @@
           verify.onload = function () {
             var res = JSON.parse(verify.responseText || '{}');
             if (verify.status === 200) {
+              if (res.access_token) Auth.setAccess(res.access_token);
               statusEl.textContent = '✅ 登录成功！';
               _redirect(redirect);
             } else {