后台查询Asin文档更新

backend/blueprints/auth.py

@@ -1,7 +1,7 @@
 """
 认证蓝图：登录、登出、登录状态校验
 """
-from flask import Blueprint, request, redirect, url_for, session, jsonify
+from flask import Blueprint, request, redirect, url_for, session, jsonify, make_response, current_app
 from werkzeug.security import check_password_hash
 
 from utils.db import get_db
@@ -13,14 +13,23 @@ auth = Blueprint('auth', __name__, url_prefix='')
 
 @auth.route('/login', methods=['GET', 'POST'])
 def login():
-    if session.get('user_id') and is_session_user_valid():
+    force_relogin = request.args.get('logout') == '1' or request.args.get('switch') == '1'
+    if request.method == 'GET' and force_relogin:
+        session.clear()
+        response = make_response(render_html('login.html'))
+        response.delete_cookie(current_app.config.get('SESSION_COOKIE_NAME', 'session'))
+        response.headers['Cache-Control'] = 'no-store, no-cache, must-revalidate, max-age=0'
+        return response
+    if request.method == 'GET' and session.get('user_id') and is_session_user_valid():
         return redirect(url_for('main.admin_page'))
     if request.method == 'POST':
+        session.clear()
+        wants_json = request.is_json or request.headers.get('X-Requested-With') == 'XMLHttpRequest'
         data = request.get_json() if request.is_json else request.form
         username = (data.get('username') or '').strip()
         password = data.get('password') or ''
         if not username or not password:
-            if request.is_json:
+            if wants_json:
                 return jsonify({'success': False, 'error': '请输入用户名和密码'})
             return render_html('login.html', error='请输入用户名和密码')
         try:
@@ -36,14 +45,14 @@ def login():
                 session.permanent = True
                 session['user_id'] = row['id']
                 session['username'] = username
-                if request.is_json:
+                if wants_json:
                     return jsonify({'success': True, 'redirect': url_for('main.admin_page')})
                 return redirect(url_for('main.admin_page'))
         except Exception as exc:
-            if request.is_json:
+            if wants_json:
                 return jsonify({'success': False, 'error': str(exc)})
             return render_html('login.html', error='登录失败，请稍后重试')
-        if request.is_json:
+        if wants_json:
             return jsonify({'success': False, 'error': '用户名或密码错误'})
         return render_html('login.html', error='用户名或密码错误')
     return render_html('login.html')
@@ -71,4 +80,7 @@ def api_auth_check():
 @auth.route('/logout')
 def logout():
     session.clear()
-    return redirect(url_for('auth.login'))
+    response = redirect(url_for('auth.login', logout='1'))
+    response.delete_cookie(current_app.config.get('SESSION_COOKIE_NAME', 'session'))
+    response.headers['Cache-Control'] = 'no-store, no-cache, must-revalidate, max-age=0'
+    return response