路由与权限

// router/index.ts
router.beforeEach(async (to) => {
    startNavigation(to.fullPath)

    // 1. 登录检查：管理后台与需登录的站点页面
    if ((requiresAdminAuth(to) || requiresSiteLogin(to)) && !getToken()) {
        window.location.assign(await buildOidcAuthorizeUrl(to.fullPath))
        return false
    }

    // 2. 未激活账号拦截（激活页引导流程启用时）
    if (!ACTIVATION_BYPASS_PATHS.has(to.path) && getToken() && !isActivated()) {
        return { path: '/activation', query: { redirect: to.fullPath } }
    }

    // 3. 管理后台权限检查
    if (requiresAdminAuth(to)) {
        await refreshAuthSnapshot()
        if (!hasAdminAccess()) return '/progress'
        if (!canAccessAdminPath(to)) return firstAccessibleAdminPath()
    }

    // 4. 登录页处理：已登录用户重定向到工作台/后台
    if (to.path === '/login' && getToken()) {
        return hasAdminAccess() ? firstAccessibleAdminPath() : '/progress'
    }
})

function resilientView(loader: () => Promise<any>) {
    return async () => {
        let lastError: unknown
        for (let attempt = 0; attempt <= ROUTE_LOAD_RETRIES; attempt++) {
            try {
                return await loader()
            } catch (error) {
                lastError = error
                if (!isRecoverableRouteLoadError(error) || attempt === ROUTE_LOAD_RETRIES) break
                await waitForOnline()
                await sleep(450 * 2 ** attempt)
            }
        }
        throw lastError
    }
}