Merge branch 'main' into feature/windows

client/lib/bridge/vpn_bridge_provider.dart

@@ -16,7 +16,7 @@ import 'dart:io' show Platform;
 /// P1 方案B 开关:macOS 是否走原生 System Extension(VpnNativeBridge)而非 PoC 的
 /// sudo 子进程(DesktopVpnBridge)。默认 false——待 PacketTunnel target/签名就绪、
 /// 原生侧联调通过后置 true。见 docs/p1-macos-system-extension.md。
-const bool kUseNativeVpnMacOS = false;
+const bool kUseNativeVpnMacOS = true;
 
 /// 全局单例 VpnBridge。Ref 生命周期内不变。
 final vpnBridgeProvider = Provider<VpnBridge>((ref) {

client/lib/screens/account_page.dart

@@ -7,6 +7,7 @@ import '../l10n/app_text.dart';
 import '../pangolin_theme.dart';
 import '../state/account_providers.dart';
 import '../state/app_providers.dart';
+import '../state/auth_provider.dart';
 import '../state/navigation_provider.dart';
 import '../widgets/account_screens.dart';
 import '../widgets/app_top_bar.dart';
@@ -93,7 +94,13 @@ class AccountPage extends ConsumerWidget {
         ]),
         const SizedBox(height: 16),
         _Card(children: [
-          _NavRow(icon: PangolinIcons.logOut, title: t.signOut, danger: true, onTap: () {}),
+          _NavRow(
+            icon: PangolinIcons.logOut,
+            title: t.signOut,
+            danger: true,
+            // 清除本地令牌 → authProvider 置未登录 → 根据登录态回登录页。
+            onTap: () => ref.read(authProvider.notifier).logout(),
+          ),
         ]),
       ],
     );

client/lib/services/api_config.dart

@@ -1,8 +1,9 @@
 // api_config.dart — 控制面 API 基址单源。
 //
 // 历史上各 service/provider 各自重复声明 _kApiUrl；统一收敛到这里,
-// 由 --dart-define=PANGOLIN_API_URL 注入(默认本地 8080)。
+// 由 --dart-define=PANGOLIN_API_URL 注入。
+// TODO(联调临时): 默认值改成测试节点,避免 release 构建漏传 dart-define;发版前改回 localhost 或正式控制面域名。
 const String kApiBaseUrl = String.fromEnvironment(
   'PANGOLIN_API_URL',
-  defaultValue: 'http://localhost:8080',
+  defaultValue: 'http://103.119.13.48:8080',
 );

client/lib/services/auth_api.dart

@@ -99,15 +99,20 @@ class AuthApi {
 
   Future<http.Response> _post(String path, Map<String, dynamic> body) async {
     final uri = Uri.parse('$baseUrl$path');
+    print('>>>AUTHLOG POST $uri (baseUrl=$baseUrl) 发起...');
+    final sw = Stopwatch()..start();
     try {
-      return await _client
+      final resp = await _client
           .post(
             uri,
             headers: {'Content-Type': 'application/json'},
             body: jsonEncode(body),
           )
           .timeout(const Duration(seconds: 15));
+      print('>>>AUTHLOG POST $uri -> HTTP ${resp.statusCode} (${sw.elapsedMilliseconds}ms)');
+      return resp;
     } on Exception catch (e) {
+      print('>>>AUTHLOG POST $uri 失败 (${sw.elapsedMilliseconds}ms): ${e.runtimeType}: $e');
       throw AuthApiException(
         statusCode: -1,
         messageZh: '网络请求失败，请检查连接后重试',

client/lib/state/connection_provider.dart

@@ -12,6 +12,7 @@ import 'package:flutter_riverpod/flutter_riverpod.dart';
 import '../bridge/vpn_bridge.dart';
 import '../bridge/vpn_bridge_provider.dart';
 import '../l10n/app_text.dart';
+import '../services/api_config.dart';
 import '../services/connect_api.dart';
 import 'app_providers.dart';
 import 'auth_provider.dart';
@@ -25,12 +26,7 @@ const _kDeviceId = String.fromEnvironment(
   defaultValue: 'mac-001',
 );
 
-// ── API base URL ─────────────────────────────────────────────────
-
-const _kApiUrl = String.fromEnvironment(
-  'PANGOLIN_API_URL',
-  defaultValue: 'http://localhost:8080',
-);
+// API base URL 统一用 api_config.dart 的 kApiBaseUrl(单一来源,勿再重复声明)。
 
 // ── 连接阶段枚举 ──────────────────────────────────────────────────
 
@@ -103,7 +99,6 @@ class ConnectionController extends StateNotifier<ConnectionState> {
   Future<void> _connect() async {
     state = const ConnectionState(phase: VpnPhase.connecting);
 
-    final token = _ref.read(authProvider).accessToken ?? '';
     final node = _ref.read(effectiveNodeProvider);
     final zh = _ref.read(localeProvider) == AppLang.zh;
 
@@ -119,14 +114,7 @@ class ConnectionController extends StateNotifier<ConnectionState> {
     }
 
     try {
-      _api?.dispose();
-      _api = ConnectApi(baseUrl: _kApiUrl, authToken: token);
-      final configJson = await _api!.fetchConfig(
-        nodeId: node.uuid,
-        deviceId: _kDeviceId,
-        // smartRoute 偏好 → 国内分流(#5):国内 IP/域名直连,不走隧道。
-        splitCN: _ref.read(settingsProvider).smartRoute,
-      );
+      final configJson = await _fetchConfigWithRefresh(node.uuid);
       // bridge.start() 不阻塞至连接建立；on 状态由 statusStream 回调驱动。
       await _bridge.start(configJson);
     } on ConnectApiException catch (e) {
@@ -142,6 +130,33 @@ class ConnectionController extends StateNotifier<ConnectionState> {
     }
   }
 
+  /// 取配置;access token 过期(401)时用 refresh token 续期后**重试一次**。
+  /// 续期失败(refresh 也过期 / 被拒)由 authProvider.refresh() 触发登出 → UI 回登录页。
+  Future<String> _fetchConfigWithRefresh(String nodeUuid) async {
+    Future<String> doFetch() {
+      final token = _ref.read(authProvider).accessToken ?? '';
+      _api?.dispose();
+      _api = ConnectApi(baseUrl: kApiBaseUrl, authToken: token);
+      return _api!.fetchConfig(
+        nodeId: nodeUuid,
+        deviceId: _kDeviceId,
+        // smartRoute 偏好 → 国内分流(#5):国内 IP/域名直连,不走隧道。
+        splitCN: _ref.read(settingsProvider).smartRoute,
+      );
+    }
+
+    try {
+      return await doFetch();
+    } on ConnectApiException catch (e) {
+      if (e.statusCode == 401) {
+        // token 过期 → 续期后重试一次;续期成功则用新 token 再取。
+        final ok = await _ref.read(authProvider.notifier).refresh();
+        if (ok) return await doFetch();
+      }
+      rethrow;
+    }
+  }
+
   Future<void> _disconnect() async {
     _stopElapsed();
     try {

client/lib/widgets/auth_screen.dart

@@ -8,17 +8,14 @@ import 'package:flutter_riverpod/flutter_riverpod.dart';
 
 import '../l10n/app_text.dart';
 import '../pangolin_theme.dart';
+import '../services/api_config.dart';
 import '../services/auth_api.dart';
 import '../state/auth_provider.dart';
 import 'pangolin_button.dart';
 import 'pangolin_icons.dart';
 import 'pangolin_logo.dart';
 
-// API base URL（由 --dart-define 注入）
-const _kApiUrl = String.fromEnvironment(
-  'PANGOLIN_API_URL',
-  defaultValue: 'http://localhost:8080',
-);
+// API base URL 统一用 api_config.dart 的 kApiBaseUrl(单一来源,勿再重复声明)。
 
 const _easeOut = Cubic(0.22, 1, 0.36, 1);
 
@@ -55,7 +52,7 @@ class _AuthScreenState extends ConsumerState<AuthScreen>
     duration: const Duration(milliseconds: 620),
   );
 
-  late final AuthApi _api = AuthApi(baseUrl: _kApiUrl);
+  late final AuthApi _api = AuthApi(baseUrl: kApiBaseUrl);
 
   bool get _emailValid => RegExp(r'\S+@\S+\.\S+').hasMatch(_email.text);