修复用户端令牌失效后的登录恢复

apps/user_app/test/app/auth_navigation_test.dart

@@ -0,0 +1,40 @@
+// 功能描述：验证登录目标页构造、站内地址校验及开放重定向防护。
+// 版本：1.0.0
+import 'package:flutter_test/flutter_test.dart';
+import 'package:user_app/app/auth_navigation.dart';
+
+/// 覆盖合法深链接、鉴权页循环和外部地址攻击场景。
+void main() {
+  test('保留站内目标页的路径、查询参数和片段', () {
+    const target = '/orders?status=pending#payment';
+
+    expect(sanitizeRedirectTarget(target), target);
+    final loginUri = Uri.parse(
+      buildAuthLocation(
+        '/login',
+        redirectTarget: target,
+        sessionExpired: true,
+      ),
+    );
+    expect(loginUri.path, '/login');
+    expect(loginUri.queryParameters['redirect'], target);
+    expect(loginUri.queryParameters['reason'], 'expired');
+  });
+
+  test('拒绝外部地址、协议相对地址和鉴权页循环', () {
+    expect(sanitizeRedirectTarget('https://example.com/orders'), isNull);
+    expect(sanitizeRedirectTarget('//example.com/orders'), isNull);
+    expect(sanitizeRedirectTarget(r'/\example.com/orders'), isNull);
+    expect(sanitizeRedirectTarget('/login'), isNull);
+    expect(sanitizeRedirectTarget('/register?redirect=/orders'), isNull);
+  });
+
+  test('非法目标页不写入登录地址', () {
+    final loginUri = Uri.parse(
+      buildAuthLocation('/login', redirectTarget: 'https://example.com'),
+    );
+
+    expect(loginUri.path, '/login');
+    expect(loginUri.queryParameters, isEmpty);
+  });
+}