@epxing/core 5.3.0-beta.2 → 5.3.0-beta.4

package/src/axios.js

@@ -1,318 +1,311 @@
-import axios from 'axios'
-import util from '@epxing/core/src/runtime-utils/util'
-import { getXsrfToken, setXsrfToken } from '@epxing/utils/src/storage'
-import { consumeUrlToken, getStoredToken, setStoredToken, removeStoredToken } from '@epxing/utils/src/token-storage'
-import { ElMessage } from 'element-plus/es/components/message/index.mjs'
-// 菜单直达路由(appMenu/hallMenu)角色兜底：纯函数层，无依赖不成环
-import { MENU_ROUTE_ALIAS, roleStorage } from '@epxing/core/src/menu-route'
-
-/* global __EPX_VUE2_COMPAT__ */
-
-let message = null
-let timer = null
-const normalizeBearerToken = authorization => {
-  if (typeof authorization !== 'string') return ''
-  return authorization.replace(/^Bearer\s+/i, '').trim()
-}
-
-const requestAuthorization = config => {
-  if (!config || !config.headers) return ''
-  return normalizeBearerToken(config.headers.Authorization || config.headers.authorization)
-}
-
-const tokenContext = (config, fallbackClientCode = '') => {
-  if (config && config.epxingTokenContext) return config.epxingTokenContext
-  const clientCode = fallbackClientCode || ''
-  return {
-    clientCode,
-    storageKey: clientCode + '-token',
-    requestToken: requestAuthorization(config)
-  }
-}
-
-// 一次登录失效响应，只有在它对应的正是"当前生效"的那个 token 时才能清；
-// 否则就是一条晚到的旧请求，把刚登录换来的新 token 误杀
-const canApplyTokenResponse = context => {
-  if (!context.requestToken) return true
-  return getStoredToken(context.storageKey) === context.requestToken
-}
-
-const isStaleTokenResponse = context => {
-  const currentToken = getStoredToken(context.storageKey)
-  return !!(context.requestToken && currentToken && currentToken !== context.requestToken)
-}
-
-const delayToLogin = function (msg) {
-  if (timer) clearTimeout(timer)
-  timer = setTimeout(() => {
-    if (message) message.close()
-    message = ElMessage({
-      message: msg || '登录失效，请重新登录',
-      type: 'error'
-    })
-    // 存储上一次未登录页面
-    if (util.toLogin) {
-      util.toLogin()
-    }
-  }, 100)
-}
-
-// ===== 混合加密（RSA + AES）=====
-// 对称密钥不在 server→client 明文传输。
-// AES key 由前端本地随机生成，用服务器 RSA 公钥加密后随请求上送；
-// 服务器用 RSA 私钥解出该 key，再用它加密响应，前端用本地 key/iv 解密。
-let cryptoReadyPromise = null
-let sessionAesKey = null // 本会话本地随机生成的 AES key（CryptoJS WordArray，16 字节 = AES-128）
-let encryptedAesKey = null // RSA 公钥加密后的 AES key（Base64），随请求头上送
-
-// 懒加载加密依赖、获取公钥、本地生成并 RSA 加密 AES key（整个会话仅执行一次）
-const ensureCrypto = () => {
-  if (cryptoReadyPromise) return cryptoReadyPromise
-  cryptoReadyPromise = (async () => {
-    const [CryptoJS, jsEncryptModule] = await Promise.all([
-      import('crypto-js'),
-      import('jsencrypt/bin/jsencrypt.min')
-    ])
-    const JSEncrypt = jsEncryptModule.default
-    // 取 RSA 公钥（v2 只返回 publicKey，不再下发 aesKey，见 store/modules/config.js GET_DECRYPT_KEY）
-    let rsaKey = window.store.state.config.decryptKey.rsaKey
-    if (!rsaKey) {
-      const decryptKey = await window.store.dispatch('GET_DECRYPT_KEY')
-      rsaKey = decryptKey.rsaKey
-    }
-    // 本地随机生成 AES key（不再从服务器获取、不全局复用明文）
-    sessionAesKey = CryptoJS.lib.WordArray.random(16)
-    // RSA 公钥加密 AES key，上送 Base64
-    const encrypt = new JSEncrypt()
-    encrypt.setPublicKey(rsaKey)
-    encryptedAesKey = encrypt.encrypt(CryptoJS.enc.Base64.stringify(sessionAesKey))
-    return CryptoJS
-  })()
-  return cryptoReadyPromise
-}
-
-const init = () => {
-  const instance = axios.create({
-    timeout: 1200 * 1000,
-    baseURL: ''
-  })
-  instance.defaults.withCredentials = !!window.WITH_CREDENTIALS
-  // 站点不使用 Cookie：关闭 axios 内置的「读 XSRF-TOKEN cookie 回填请求头」逻辑，
-  // 防 CSRF 的 xsrf_token 改由响应头下发、存 sessionStorage（见下方响应拦截器）
-  instance.defaults.xsrfCookieName = null
-  // 直接 import axios 的零散调用（如登录页取图形验证码）也走全局默认，一并关掉
-  axios.defaults.xsrfCookieName = null
-  // 添加请求拦截器
-  instance.interceptors.request.use(async config => {
-    // 仅旧产品令牌走懒加载垫片，新令牌和 AbortSignal 保持原契约。
-    const legacyCancelToken = config.cancelToken
-    if ((typeof __EPX_VUE2_COMPAT__ === 'undefined' || __EPX_VUE2_COMPAT__) &&
-        window.__EPX_VUE2_COMPAT__ !== false && legacyCancelToken &&
-        typeof legacyCancelToken.subscribe !== 'function' && typeof legacyCancelToken.promise?.then === 'function') {
-      const { adaptLegacyCancelToken } = await import('./vue2-cancel-token-compat')
-      config = adaptLegacyCancelToken(config)
-    }
-    // 在发送请求之前做些什么
-    if (window.IP) {
-      config.baseURL = window.IP
-    }
-    let name = null
-    let params = {}
-    if (window.router) {
-      params = window.router.currentRoute.value.params
-      name = window.router.currentRoute.value.name
-    }
-    const locationUrl = window.location.hash.split('?')[0]
-    var reg = /(app\/role\/select|hall\/role\/select|app|hall\/login|hall|login|system|client|service\/setting|recruit\/register)\/(\w+)\/?([\w-]+)?\/(\w+)\/?([\w-_]+)?/
-    var regResult = reg.exec(locationUrl)
-    const regClientCode = regResult ? RegExp.$2 === 'login' ? RegExp.$3 : RegExp.$2 : null
-    const regSystemCode = regResult ? RegExp.$3 : null
-    const regAppCode = regResult ? RegExp.$1 === 'hall' ? 'FM_SERVICE_HALL' : RegExp.$4 : null
-    const regRoleCode = regResult ? RegExp.$1 === 'hall' ? RegExp.$3 : RegExp.$1 === 'system' ? RegExp.$4 : RegExp.$5 : null
-    // 根据sysId获取请求服务
-    const { clientConfig = {}, appConfig = {}, temporaryRole } = window.store.state.config
-    const { CODE: CLIENT_CODE = '' } = clientConfig
-    const { CODE: APP_CODE = '', EXTEND_OF_COMPETENCE } = appConfig
-    const clientCode = params.client || regClientCode || CLIENT_CODE
-    const appCode = params.app || APP_CODE || regAppCode
-    let roleCode = params.role || regRoleCode || ''
-    // 菜单直达路由（appMenu/hallMenu）URL 末段是 menuKey 不是 role——上面的 regRoleCode 会
-    // 误取 menuKey，导致 Role 头带上 32 位 hex 垃圾值，后端角色过滤失效（菜单不按角色过滤，
-    // 冒出本应隐藏的菜单）。这类路由改从持久化角色（roleStorage）取，与守卫/菜单加载同源。
-    if (MENU_ROUTE_ALIAS[name]) {
-      roleCode = params.role || roleStorage.get(regClientCode, regSystemCode) || ''
-    }
-    if (name === 'Config') roleCode = 'SYSTEM'
-    const token = consumeUrlToken(clientCode ? clientCode + '-token' : '')
-    if (window.IP && token) {
-      config.headers.Authorization = `Bearer ${token}`
-    }
-    config.epxingTokenContext = {
-      clientCode,
-      storageKey: clientCode + '-token',
-      requestToken: token || ''
-    }
-    config.headers.Language = config.headers.Language || util.getCurrentLanguage()
-    if (name === 'manage' || locationUrl.startsWith('#/manage')) config.headers.Mode = 'manage'
-    config.headers.Client = clientCode
-    config.headers['App-Agent'] = appCode
-    if (params.system || regSystemCode) {
-      config.headers.System = params.system || regSystemCode
-    }
-    if ((EXTEND_OF_COMPETENCE !== 'allRole' && roleCode) || temporaryRole) {
-      config.headers.Role = temporaryRole?.code || roleCode
-    }
-    const xsrfToken = getXsrfToken()
-    if (xsrfToken) {
-      config.headers.xsrf_token = xsrfToken
-    }
-    config.params = {
-      ...config.params,
-      nonceStr: util.uuid().replaceAll('-', ''),
-      timestamp: new Date().getTime()
-    }
-    // 混合加密：随请求上送「RSA 加密后的 AES key」+「本次请求随机 IV」，
-    // 供服务器在 respEncrypt=YES 时用其加密响应。公钥接口本身不参与，避免递归。
-    if (!config.url || !/\/api\/v1\/rsa\/public/.test(config.url)) {
-      try {
-        const CryptoJS = await ensureCrypto()
-        const iv = CryptoJS.lib.WordArray.random(16) // 每次请求新生成 IV，不复用、不等于 key
-        config.headers['X-Encrypted-Key'] = encryptedAesKey
-        config.headers['X-Encrypt-Iv'] = CryptoJS.enc.Base64.stringify(iv)
-        // 暂存本次请求的 key / iv，供响应拦截器解密使用
-        config.encryptAesKey = sessionAesKey
-        config.encryptIv = iv
-      } catch (e) {
-        // 加密初始化失败（如公钥获取失败）时不阻断请求，按明文发送
-        console.error('混合加密初始化失败', e)
-      }
-    }
-    return config
-  })
-
-  instance.interceptors.response.use(async function (response) {
-    let params = {}
-    if (window.router) {
-      params = window.router.currentRoute.value.params
-    }
-    const reg = /(login|hall\/login|hall|app\/role\/select|app|system|client|service\/setting)\/(\w+)/
-    reg.exec(window.location.hash)
-    // 根据sysId获取请求服务
-    const { 'CLIENT|CODE': CLIENT_CODE = '' } = window.store.state.config.appConfig
-    const clientCode = params.client || RegExp.$2 || CLIENT_CODE
-    const context = tokenContext(response.config, clientCode)
-    const authorization = response.headers.authorization
-    if (authorization) {
-      const token = normalizeBearerToken(authorization)
-      if (token && canApplyTokenResponse(context)) {
-        setStoredToken(context.storageKey, token)
-      }
-    }
-    // 后端若通过响应头下发防 CSRF 令牌（xsrf_token / X-XSRF-TOKEN），存 sessionStorage，
-    // 后续请求由请求拦截器回填到 xsrf_token 请求头；不再依赖服务端 Set-Cookie
-    const xsrfHeader = response.headers.xsrf_token || response.headers['x-xsrf-token']
-    if (xsrfHeader) setXsrfToken(xsrfHeader)
-    const { data = {} } = response
-    if (data instanceof Blob) {
-      const content = response.headers['content-disposition'] || ''
-      const filename = content.replace(/(.+)filename="(.+)"/, '$2')
-      return Promise.resolve({ blob: data, filename: decodeURIComponent(filename) })
-    } else if (data.code === '0') {
-      // 处理成功
-      if (data.responseEncrypt) {
-        // aes 解密：使用本次请求本地生成、并随请求上送给服务器的 key / iv，
-        // 服务器用同一把 key/iv 加密响应。密钥不再由服务器明文下发。
-        const key = response.config.encryptAesKey
-        const iv = response.config.encryptIv
-        return import('crypto-js').then(CryptoJS => {
-          const decrypted = CryptoJS.AES.decrypt(data.data, key, {
-            iv,
-            mode: CryptoJS.mode.CBC,
-            padding: CryptoJS.pad.Pkcs7
-          })
-          const decryptedData = JSON.parse(decrypted.toString(CryptoJS.enc.Utf8))
-          return Promise.resolve(decryptedData)
-        })
-      } else {
-        return Promise.resolve(data.data)
-      }
-    } else {
-      // 处理失败
-      if (data.code === 'error.nologin' || data.code === 'login.expired' || data.code === '401') {
-        if (isStaleTokenResponse(context)) {
-          data.message = data.msg
-          return Promise.reject(data)
-        }
-        removeStoredToken(context.storageKey)
-        // 单点登录
-        if (data.urlToRedirectTo) {
-          window.location.href = data.urlToRedirectTo
-        } else {
-          delayToLogin(data.msg)
-        }
-      } else {
-        data.message = data.msg
-        return Promise.reject(data)
-      }
-    }
-  }, function (error) {
-    // T34 axios 0.19→1.x：取消请求的错误对象从 Cancel（toString()==='Cancel'）变成
-    // CanceledError（toString()==='CanceledError: canceled'）—— 字符串比对会失配，
-    // 取消的请求会掉进下面的错误分支弹「处理失败」。改用 axios.isCancel（两个版本都有）。
-    if (axios.isCancel(error)) {
-      // 取消请求
-      return
-    }
-    const {
-      data = {
-        code: '500',
-        msg: '处理失败'
-      }, status
-    } = error.response || {}
-    if (status === 304) {
-      return Promise.resolve({
-        notModified: true,
-        etag: error.response.headers.etag || ''
-      })
-    } else if (data instanceof Blob) {
-      const fileReader = new FileReader()
-      fileReader.readAsText(data, 'utf-8')
-      return new Promise((resolve, reject) => {
-        fileReader.onload = function () {
-          const errors = JSON.parse(fileReader.result)
-          // eslint-disable-next-line prefer-promise-reject-errors
-          reject({ message: errors.msg, ...errors })
-        }
-      })
-    } else if (data.code === 'error.nologin' || data.code === 'login.expired' || data.code === '401' || status === 401) {
-      let params = {}
-      if (window.router) {
-        params = window.router.currentRoute.value.params
-      }
-      const reg = /(login|hall\/login|hall|app\/role\/select|app|system|client|service\/setting)\/(\w+)/
-      reg.exec(window.location.hash)
-      // 根据sysId获取请求服务
-      const { 'CLIENT|CODE': CLIENT_CODE = '' } = window.store.state.config.appConfig
-      const clientCode = params.client || RegExp.$2 || CLIENT_CODE
-      const context = tokenContext(error.config, clientCode)
-      if (isStaleTokenResponse(context)) {
-        if (data.msg) data.message = data.msg
-        return Promise.reject(data)
-      }
-      removeStoredToken(context.storageKey)
-      // 单点登录
-      if (data.urlToRedirectTo) {
-        window.location.href = data.urlToRedirectTo
-      } else {
-        delayToLogin(data.msg)
-      }
-    } else {
-      if (data.msg) data.message = data.msg
-      return Promise.reject(data)
-    }
-  })
-
-  return instance
-}
-
-export default init()
+import axios from 'axios'
+import util from '@epxing/core/src/runtime-utils/util'
+import { getXsrfToken, setXsrfToken } from '@epxing/utils/src/storage'
+import { consumeUrlToken, getStoredToken, setStoredToken, removeStoredToken } from '@epxing/utils/src/token-storage'
+import { ElMessage } from 'element-plus/es/components/message/index.mjs'
+import { resolveRouteRole } from '@epxing/core/src/menu-route'
+
+/* global __EPX_VUE2_COMPAT__ */
+
+let message = null
+let timer = null
+const normalizeBearerToken = authorization => {
+  if (typeof authorization !== 'string') return ''
+  return authorization.replace(/^Bearer\s+/i, '').trim()
+}
+
+const requestAuthorization = config => {
+  if (!config || !config.headers) return ''
+  return normalizeBearerToken(config.headers.Authorization || config.headers.authorization)
+}
+
+const tokenContext = (config, fallbackClientCode = '') => {
+  if (config && config.epxingTokenContext) return config.epxingTokenContext
+  const clientCode = fallbackClientCode || ''
+  return {
+    clientCode,
+    storageKey: clientCode + '-token',
+    requestToken: requestAuthorization(config)
+  }
+}
+
+// 一次登录失效响应，只有在它对应的正是"当前生效"的那个 token 时才能清；
+// 否则就是一条晚到的旧请求，把刚登录换来的新 token 误杀
+const canApplyTokenResponse = context => {
+  if (!context.requestToken) return true
+  return getStoredToken(context.storageKey) === context.requestToken
+}
+
+const isStaleTokenResponse = context => {
+  const currentToken = getStoredToken(context.storageKey)
+  return !!(context.requestToken && currentToken && currentToken !== context.requestToken)
+}
+
+const delayToLogin = function (msg) {
+  if (timer) clearTimeout(timer)
+  timer = setTimeout(() => {
+    if (message) message.close()
+    message = ElMessage({
+      message: msg || '登录失效，请重新登录',
+      type: 'error'
+    })
+    // 存储上一次未登录页面
+    if (util.toLogin) {
+      util.toLogin()
+    }
+  }, 100)
+}
+
+// ===== 混合加密（RSA + AES）=====
+// 对称密钥不在 server→client 明文传输。
+// AES key 由前端本地随机生成，用服务器 RSA 公钥加密后随请求上送；
+// 服务器用 RSA 私钥解出该 key，再用它加密响应，前端用本地 key/iv 解密。
+let cryptoReadyPromise = null
+let sessionAesKey = null // 本会话本地随机生成的 AES key（CryptoJS WordArray，16 字节 = AES-128）
+let encryptedAesKey = null // RSA 公钥加密后的 AES key（Base64），随请求头上送
+
+// 懒加载加密依赖、获取公钥、本地生成并 RSA 加密 AES key（整个会话仅执行一次）
+const ensureCrypto = () => {
+  if (cryptoReadyPromise) return cryptoReadyPromise
+  cryptoReadyPromise = (async () => {
+    const [cryptoModule, jsEncryptModule] = await Promise.all([
+      import('crypto-js'),
+      import('jsencrypt/bin/jsencrypt.min')
+    ])
+    const CryptoJS = 'default' in cryptoModule ? cryptoModule.default : cryptoModule
+    const JSEncrypt = jsEncryptModule.default
+    // 取 RSA 公钥（v2 只返回 publicKey，不再下发 aesKey，见 store/modules/config.js GET_DECRYPT_KEY）
+    let rsaKey = window.store.state.config.decryptKey.rsaKey
+    if (!rsaKey) {
+      const decryptKey = await window.store.dispatch('GET_DECRYPT_KEY')
+      rsaKey = decryptKey.rsaKey
+    }
+    // 本地随机生成 AES key（不再从服务器获取、不全局复用明文）
+    sessionAesKey = CryptoJS.lib.WordArray.random(16)
+    // RSA 公钥加密 AES key，上送 Base64
+    const encrypt = new JSEncrypt()
+    encrypt.setPublicKey(rsaKey)
+    encryptedAesKey = encrypt.encrypt(CryptoJS.enc.Base64.stringify(sessionAesKey))
+    return CryptoJS
+  })()
+  return cryptoReadyPromise
+}
+
+const init = () => {
+  const instance = axios.create({
+    timeout: 1200 * 1000,
+    baseURL: ''
+  })
+  instance.defaults.withCredentials = !!window.WITH_CREDENTIALS
+  // 站点不使用 Cookie：关闭 axios 内置的「读 XSRF-TOKEN cookie 回填请求头」逻辑，
+  // 防 CSRF 的 xsrf_token 改由响应头下发、存 sessionStorage（见下方响应拦截器）
+  instance.defaults.xsrfCookieName = null
+  // 直接 import axios 的零散调用（如登录页取图形验证码）也走全局默认，一并关掉
+  axios.defaults.xsrfCookieName = null
+  // 添加请求拦截器
+  instance.interceptors.request.use(async config => {
+    // 仅旧产品令牌走懒加载垫片，新令牌和 AbortSignal 保持原契约。
+    const legacyCancelToken = config.cancelToken
+    if ((typeof __EPX_VUE2_COMPAT__ === 'undefined' || __EPX_VUE2_COMPAT__) &&
+        window.__EPX_VUE2_COMPAT__ !== false && legacyCancelToken &&
+        typeof legacyCancelToken.subscribe !== 'function' && typeof legacyCancelToken.promise?.then === 'function') {
+      const { adaptLegacyCancelToken } = await import('./vue2-cancel-token-compat')
+      config = adaptLegacyCancelToken(config)
+    }
+    // 在发送请求之前做些什么
+    if (window.IP) {
+      config.baseURL = window.IP
+    }
+    const locationUrl = window.location.hash.split('?')[0]
+    const currentRoute = window.router?.currentRoute?.value
+    // 首轮导航尚未确认时也按路由定义解析命名参数，不能将菜单路径段猜成角色。
+    const route = currentRoute?.name ? currentRoute : window.router?.resolve?.(locationUrl.slice(1)) || currentRoute
+    const { name = null, params = {} } = route || {}
+    var reg = /(app\/role\/select|hall\/role\/select|app|hall\/login|hall|login|system|client|service\/setting|recruit\/register)\/(\w+)\/?([\w-]+)?\/(\w+)\/?([\w-_]+)?/
+    var regResult = reg.exec(locationUrl)
+    const regClientCode = regResult ? RegExp.$2 === 'login' ? RegExp.$3 : RegExp.$2 : null
+    const regSystemCode = regResult ? RegExp.$3 : null
+    const regAppCode = regResult ? RegExp.$1 === 'hall' ? 'FM_SERVICE_HALL' : RegExp.$4 : null
+    // 根据sysId获取请求服务
+    const { clientConfig = {}, appConfig = {}, temporaryRole } = window.store.state.config
+    const { CODE: CLIENT_CODE = '' } = clientConfig
+    const { CODE: APP_CODE = '', EXTEND_OF_COMPETENCE } = appConfig
+    const clientCode = params.client || regClientCode || CLIENT_CODE
+    const appCode = params.app || APP_CODE || regAppCode
+    // 角色与导航使用同一来源；大厅没有系统段，不能拿菜单或角色段作为存储作用域。
+    let roleCode = resolveRouteRole({ params: { ...params, client: clientCode, system: params.client ? params.system : regSystemCode } })
+    if (name === 'Config') roleCode = 'SYSTEM'
+    const token = consumeUrlToken(clientCode ? clientCode + '-token' : '')
+    if (window.IP && token) {
+      config.headers.Authorization = `Bearer ${token}`
+    }
+    config.epxingTokenContext = {
+      clientCode,
+      storageKey: clientCode + '-token',
+      requestToken: token || ''
+    }
+    config.headers.Language = config.headers.Language || util.getCurrentLanguage()
+    if (name === 'manage' || locationUrl.startsWith('#/manage')) config.headers.Mode = 'manage'
+    config.headers.Client = clientCode
+    config.headers['App-Agent'] = appCode
+    if (params.system || regSystemCode) {
+      config.headers.System = params.system || regSystemCode
+    }
+    if ((EXTEND_OF_COMPETENCE !== 'allRole' && roleCode) || temporaryRole) {
+      config.headers.Role = temporaryRole?.code || roleCode
+    }
+    const xsrfToken = getXsrfToken()
+    if (xsrfToken) {
+      config.headers.xsrf_token = xsrfToken
+    }
+    config.params = {
+      ...config.params,
+      nonceStr: util.uuid().replaceAll('-', ''),
+      timestamp: new Date().getTime()
+    }
+    // 混合加密：随请求上送「RSA 加密后的 AES key」+「本次请求随机 IV」，
+    // 供服务器在 respEncrypt=YES 时用其加密响应。公钥接口本身不参与，避免递归。
+    if (!config.url || !/\/api\/v1\/rsa\/public/.test(config.url)) {
+      try {
+        const CryptoJS = await ensureCrypto()
+        const iv = CryptoJS.lib.WordArray.random(16) // 每次请求新生成 IV，不复用、不等于 key
+        config.headers['X-Encrypted-Key'] = encryptedAesKey
+        config.headers['X-Encrypt-Iv'] = CryptoJS.enc.Base64.stringify(iv)
+        // 暂存本次请求的 key / iv，供响应拦截器解密使用
+        config.encryptAesKey = sessionAesKey
+        config.encryptIv = iv
+      } catch (e) {
+        // 加密初始化失败（如公钥获取失败）时不阻断请求，按明文发送
+        console.error('混合加密初始化失败', e)
+      }
+    }
+    return config
+  })
+
+  instance.interceptors.response.use(async function (response) {
+    let params = {}
+    if (window.router) {
+      params = window.router.currentRoute.value.params
+    }
+    const reg = /(login|hall\/login|hall|app\/role\/select|app|system|client|service\/setting)\/(\w+)/
+    reg.exec(window.location.hash)
+    // 根据sysId获取请求服务
+    const { 'CLIENT|CODE': CLIENT_CODE = '' } = window.store.state.config.appConfig
+    const clientCode = params.client || RegExp.$2 || CLIENT_CODE
+    const context = tokenContext(response.config, clientCode)
+    const authorization = response.headers.authorization
+    if (authorization) {
+      const token = normalizeBearerToken(authorization)
+      if (token && canApplyTokenResponse(context)) {
+        setStoredToken(context.storageKey, token)
+      }
+    }
+    // 后端若通过响应头下发防 CSRF 令牌（xsrf_token / X-XSRF-TOKEN），存 sessionStorage，
+    // 后续请求由请求拦截器回填到 xsrf_token 请求头；不再依赖服务端 Set-Cookie
+    const xsrfHeader = response.headers.xsrf_token || response.headers['x-xsrf-token']
+    if (xsrfHeader) setXsrfToken(xsrfHeader)
+    const { data = {} } = response
+    if (data instanceof Blob) {
+      const content = response.headers['content-disposition'] || ''
+      const filename = content.replace(/(.+)filename="(.+)"/, '$2')
+      return Promise.resolve({ blob: data, filename: decodeURIComponent(filename) })
+    } else if (data.code === '0') {
+      // 处理成功
+      if (data.responseEncrypt) {
+        // aes 解密：使用本次请求本地生成、并随请求上送给服务器的 key / iv，
+        // 服务器用同一把 key/iv 加密响应。密钥不再由服务器明文下发。
+        const key = response.config.encryptAesKey
+        const iv = response.config.encryptIv
+        return import('crypto-js').then(cryptoModule => {
+          const CryptoJS = 'default' in cryptoModule ? cryptoModule.default : cryptoModule
+          const decrypted = CryptoJS.AES.decrypt(data.data, key, {
+            iv,
+            mode: CryptoJS.mode.CBC,
+            padding: CryptoJS.pad.Pkcs7
+          })
+          const decryptedData = JSON.parse(decrypted.toString(CryptoJS.enc.Utf8))
+          return Promise.resolve(decryptedData)
+        })
+      } else {
+        return Promise.resolve(data.data)
+      }
+    } else {
+      // 处理失败
+      if (data.code === 'error.nologin' || data.code === 'login.expired' || data.code === '401') {
+        if (isStaleTokenResponse(context)) {
+          data.message = data.msg
+          return Promise.reject(data)
+        }
+        removeStoredToken(context.storageKey)
+        // 单点登录
+        if (data.urlToRedirectTo) {
+          window.location.href = data.urlToRedirectTo
+        } else {
+          delayToLogin(data.msg)
+        }
+      } else {
+        data.message = data.msg
+        return Promise.reject(data)
+      }
+    }
+  }, function (error) {
+    // T34 axios 0.19→1.x：取消请求的错误对象从 Cancel（toString()==='Cancel'）变成
+    // CanceledError（toString()==='CanceledError: canceled'）—— 字符串比对会失配，
+    // 取消的请求会掉进下面的错误分支弹「处理失败」。改用 axios.isCancel（两个版本都有）。
+    if (axios.isCancel(error)) {
+      // 取消请求
+      return
+    }
+    const {
+      data = {
+        code: '500',
+        msg: '处理失败'
+      }, status
+    } = error.response || {}
+    if (status === 304) {
+      return Promise.resolve({
+        notModified: true,
+        etag: error.response.headers.etag || ''
+      })
+    } else if (data instanceof Blob) {
+      const fileReader = new FileReader()
+      fileReader.readAsText(data, 'utf-8')
+      return new Promise((resolve, reject) => {
+        fileReader.onload = function () {
+          const errors = JSON.parse(fileReader.result)
+          // eslint-disable-next-line prefer-promise-reject-errors
+          reject({ message: errors.msg, ...errors })
+        }
+      })
+    } else if (data.code === 'error.nologin' || data.code === 'login.expired' || data.code === '401' || status === 401) {
+      let params = {}
+      if (window.router) {
+        params = window.router.currentRoute.value.params
+      }
+      const reg = /(login|hall\/login|hall|app\/role\/select|app|system|client|service\/setting)\/(\w+)/
+      reg.exec(window.location.hash)
+      // 根据sysId获取请求服务
+      const { 'CLIENT|CODE': CLIENT_CODE = '' } = window.store.state.config.appConfig
+      const clientCode = params.client || RegExp.$2 || CLIENT_CODE
+      const context = tokenContext(error.config, clientCode)
+      if (isStaleTokenResponse(context)) {
+        if (data.msg) data.message = data.msg
+        return Promise.reject(data)
+      }
+      removeStoredToken(context.storageKey)
+      // 单点登录
+      if (data.urlToRedirectTo) {
+        window.location.href = data.urlToRedirectTo
+      } else {
+        delayToLogin(data.msg)
+      }
+    } else {
+      if (data.msg) data.message = data.msg
+      return Promise.reject(data)
+    }
+  })
+
+  return instance
+}
+
+export default init()