完善桌面端回归与安全边界复审

frontend/src/session/sessionManager.test.ts

@@ -7,6 +7,8 @@ vi.mock("../router", () => ({
   },
 }));
 
+const channelPostMessage = vi.fn();
+
 vi.mock("../api/authClient", () => ({
   extendToken: vi.fn(),
 }));
@@ -39,14 +41,15 @@ describe("session manager idle logout", () => {
       value: storage,
       configurable: true,
     });
-    Object.defineProperty(window, "BroadcastChannel", {
-      value: class {
+    channelPostMessage.mockClear();
+    vi.stubGlobal(
+      "BroadcastChannel",
+      class {
         onmessage: ((event: MessageEvent) => void) | null = null;
-        postMessage() {}
+        postMessage = channelPostMessage;
         close() {}
       },
-      configurable: true,
-    });
+    );
   });
 
   it("shows a timeout warning one minute before automatic logout", async () => {
@@ -92,4 +95,24 @@ describe("session manager idle logout", () => {
     expect(session.timeoutWarningVisible).toBe(false);
     expect(session.timeoutAt).toBe(0);
   });
+
+  it("does not persist refreshed tokens through the storage broadcast fallback", async () => {
+    vi.setSystemTime(new Date("2026-03-10T01:00:00.000Z"));
+    const { extendToken } = await import("../api/authClient");
+    vi.mocked(extendToken).mockResolvedValue({
+      data: {
+        accessToken: "new-token",
+        expiresAt: "2026-03-10T02:00:00.000Z",
+      },
+    } as any);
+    const { setToken } = await import("../utils/auth");
+    await setToken("old-token");
+    const { extendAccessToken } = await import("./sessionManager");
+
+    const result = await extendAccessToken("response-401");
+
+    expect(result).toEqual({ token: "new-token", authFailed: false });
+    expect(channelPostMessage).toHaveBeenCalledWith({ type: "TOKEN_UPDATED", token: "new-token" });
+    expect(window.localStorage.getItem("ctms_auth_broadcast")).toBeNull();
+  });
 });