fix: 修复 AI 设计会话失效后的伪登录

问题：Main 刷新令牌返回 401 后已清空会话，但 Renderer 仍保留用户信息，AI 设计持续返回 AUTH_REQUIRED。

实现：认证初始化等待 Main 同步完成；同步或刷新失败清理登录态；Workspace 识别结构化认证错误并在重新登录后恢复加载；路由守卫响应登录状态变化。

验证：49 个聚焦测试通过，TypeScript、聚焦 Lint 与 Vite 生产构建通过。

tests/unit/auth-store.test.ts

@@ -36,21 +36,23 @@ describe('auth store', () => {
   });
 
   it('starts browser authorization through the host api and stores the session', async () => {
-    hostApiFetchMock.mockResolvedValueOnce({
-      success: true,
-      token: {
-        access_token: 'access-token',
-        refresh_token: 'refresh-token',
-        token_type: 'Bearer',
-        expires_in: 60,
-        username: 'zhangsan',
-        user_id: '1',
-        tenant_id: 7,
-        dept_id: 9,
-        authorities: ['ROLE_USER'],
-        client_id: 'app',
-      },
-    });
+    hostApiFetchMock
+      .mockResolvedValueOnce({
+        success: true,
+        token: {
+          access_token: 'access-token',
+          refresh_token: 'refresh-token',
+          token_type: 'Bearer',
+          expires_in: 60,
+          username: 'zhangsan',
+          user_id: '1',
+          tenant_id: 7,
+          dept_id: 9,
+          authorities: ['ROLE_USER'],
+          client_id: 'app',
+        },
+      })
+      .mockResolvedValueOnce({ success: true });
 
     await useAuthStore.getState().loginWithBrowser();
 
@@ -152,6 +154,72 @@ describe('auth store', () => {
     });
   });
 
+  it('waits for Main session sync before marking persisted auth initialized', async () => {
+    let resolveSync!: (value: { success: boolean }) => void;
+    hostApiFetchMock.mockImplementationOnce(() => new Promise((resolve) => {
+      resolveSync = resolve;
+    }));
+    useAuthStore.setState({
+      initialized: false,
+      loading: false,
+      error: null,
+      authBase: 'https://biz.nianxx.cn/auth/',
+      clientId: 'app',
+      accessToken: 'persisted-access-token',
+      refreshToken: 'persisted-refresh-token',
+      tokenType: 'Bearer',
+      expiresAt: Date.now() + 60_000,
+      user: {
+        username: 'zhangsan',
+        userId: '1',
+        tenantId: 7,
+        deptId: 9,
+        authorities: ['ROLE_USER'],
+      },
+    });
+
+    const initialization = useAuthStore.getState().init();
+
+    expect(useAuthStore.getState().initialized).toBe(false);
+
+    resolveSync({ success: true });
+    await initialization;
+
+    expect(useAuthStore.getState().initialized).toBe(true);
+  });
+
+  it('clears persisted renderer auth when Main session sync fails', async () => {
+    hostApiFetchMock.mockRejectedValueOnce(new Error('Host API unavailable'));
+    useAuthStore.setState({
+      initialized: false,
+      loading: false,
+      error: null,
+      authBase: 'https://biz.nianxx.cn/auth/',
+      clientId: 'app',
+      accessToken: 'persisted-access-token',
+      refreshToken: 'persisted-refresh-token',
+      tokenType: 'Bearer',
+      expiresAt: Date.now() + 60_000,
+      user: {
+        username: 'zhangsan',
+        userId: '1',
+        tenantId: 7,
+        deptId: 9,
+        authorities: ['ROLE_USER'],
+      },
+    });
+
+    await useAuthStore.getState().init();
+
+    expect(useAuthStore.getState()).toMatchObject({
+      initialized: true,
+      accessToken: null,
+      refreshToken: null,
+      user: null,
+      error: '登录状态恢复失败，请重新登录。',
+    });
+  });
+
   it('syncs a refreshed session to Main', async () => {
     hostApiFetchMock
       .mockResolvedValueOnce({
@@ -200,6 +268,36 @@ describe('auth store', () => {
     });
   });
 
+  it('clears stale renderer auth when refresh fails', async () => {
+    hostApiFetchMock.mockRejectedValueOnce(new Error('Invalid refresh token'));
+    useAuthStore.setState({
+      initialized: true,
+      loading: false,
+      error: null,
+      authBase: 'https://biz.nianxx.cn/auth/',
+      clientId: 'app',
+      accessToken: 'expired-access-token',
+      refreshToken: 'invalid-refresh-token',
+      tokenType: 'Bearer',
+      expiresAt: Date.now() - 1,
+      user: {
+        username: 'zhangsan',
+        userId: '1',
+        tenantId: 7,
+        deptId: 9,
+        authorities: ['ROLE_USER'],
+      },
+    });
+
+    await expect(useAuthStore.getState().refreshSession()).resolves.toBeNull();
+
+    expect(useAuthStore.getState()).toMatchObject({
+      accessToken: null,
+      refreshToken: null,
+      user: null,
+    });
+  });
+
   it('logs out remotely and clears the local session', async () => {
     hostApiFetchMock.mockResolvedValueOnce({ success: true });
     useAuthStore.setState({

tests/unit/image-canvas-page.test.tsx

@@ -3,6 +3,7 @@ import { MemoryRouter } from 'react-router-dom';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { ImageWorkspaceApiError } from '@/lib/image-workspace';
 import { ImageCanvas } from '@/pages/ImageCanvas';
+import { useAuthStore } from '@/stores/auth';
 import { useImageWorkspaceStore } from '@/stores/image-workspace';
 import type {
   DesignGenerationTask,
@@ -152,6 +153,57 @@ describe('ImageCanvas Workspace-first design experience', () => {
     expect(screen.getByText(/暂时无法连接设计服务/)).toBeInTheDocument();
   });
 
+  it('clears stale renderer auth when Main requires authentication', async () => {
+    useAuthStore.setState({
+      initialized: true,
+      loading: false,
+      error: null,
+      accessToken: 'expired-access-token',
+      refreshToken: 'invalid-refresh-token',
+      tokenType: 'Bearer',
+      expiresAt: Date.now() - 1,
+      user: {
+        username: 'brother7',
+        userId: '1',
+        tenantId: null,
+        deptId: null,
+        authorities: [],
+      },
+    });
+    fetchImageWorkspaceMock.mockRejectedValueOnce(new ImageWorkspaceApiError(
+      401,
+      'AUTH_REQUIRED',
+      '请先登录后再使用 AI 设计',
+    ));
+
+    render(<MemoryRouter><ImageCanvas /></MemoryRouter>);
+
+    await screen.findByTestId('image-workspace-unavailable');
+    expect(useAuthStore.getState()).toMatchObject({
+      accessToken: null,
+      refreshToken: null,
+      user: null,
+    });
+    expect(useImageWorkspaceStore.getState().status).toBe('auth-required');
+
+    useAuthStore.setState({
+      accessToken: 'fresh-access-token',
+      refreshToken: 'fresh-refresh-token',
+      tokenType: 'Bearer',
+      expiresAt: Date.now() + 60_000,
+      user: {
+        username: 'brother7',
+        userId: '1',
+        tenantId: null,
+        deptId: null,
+        authorities: [],
+      },
+    });
+
+    await waitFor(() => expect(fetchImageWorkspaceMock).toHaveBeenCalledTimes(2));
+    await waitFor(() => expect(useImageWorkspaceStore.getState().status).toBe('ready'));
+  });
+
   it('renders one fixed design Agent, a Quote, and the unified image/video task list', async () => {
     render(<MemoryRouter><ImageCanvas /></MemoryRouter>);
 

tests/unit/login-page.test.tsx

@@ -1,4 +1,4 @@
-import { fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { act, fireEvent, render, screen, waitFor } from '@testing-library/react';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { MemoryRouter, Route, Routes } from 'react-router-dom';
 import { Login } from '@/pages/Login';
@@ -66,6 +66,52 @@ describe('Login page', () => {
     expect(await screen.findByRole('button', { name: 'Continue in browser' })).toBeInTheDocument();
   });
 
+  it('redirects an open protected route when the current auth session is invalidated', async () => {
+    useSettingsStore.setState({ setupComplete: true });
+    useAuthStore.setState({
+      initialized: true,
+      loading: false,
+      error: null,
+      authBase: 'https://biz.nianxx.cn/auth/',
+      clientId: 'app',
+      accessToken: 'access-token',
+      refreshToken: 'refresh-token',
+      tokenType: 'Bearer',
+      expiresAt: Date.now() + 60_000,
+      user: {
+        username: 'brother7',
+        userId: '1',
+        tenantId: null,
+        deptId: null,
+        authorities: [],
+      },
+    });
+    hostApiFetchMock.mockResolvedValue({ success: true });
+
+    render(
+      <MemoryRouter initialEntries={['/makelore-home']}>
+        <App />
+      </MemoryRouter>,
+    );
+
+    await waitFor(() => expect(hostApiFetchMock).toHaveBeenCalledWith(
+      '/api/auth/session/sync',
+      expect.any(Object),
+    ));
+
+    act(() => {
+      useAuthStore.setState({
+        accessToken: null,
+        refreshToken: null,
+        tokenType: null,
+        expiresAt: null,
+        user: null,
+      });
+    });
+
+    expect(await screen.findByRole('button', { name: 'Continue in browser' })).toBeInTheDocument();
+  });
+
   it('opens only the local image workspace anonymously when the explicit development mode is active', async () => {
     useSettingsStore.setState({ setupComplete: true });
     window.electron.imageWorkspaceLocalDevelopment = true;