fix(miniapp): persist session token for WeChat login

Return sessionToken from login endpoints and store it client-side because
wx.request cannot rely on Set-Cookie. Also fix multi-cookie parsing,
start on login page, and guard chat rendering fields.

Co-authored-by: Cursor <cursoragent@cursor.com>

miniapp/utils/api.js

@@ -1,9 +1,36 @@
 const SESSION_KEY = 'tkmind_session';
-const { createUuid } = require('./config');
+const { createUuid, SESSION_COOKIE_NAME } = require('./config');
 
 let apiBaseUrl = '';
 let cookie = '';
 
+function buildSessionCookie(token) {
+  const value = String(token ?? '').trim();
+  if (!value) return '';
+  return `${SESSION_COOKIE_NAME}=${encodeURIComponent(value)}`;
+}
+
+function applySessionToken(token) {
+  const nextCookie = buildSessionCookie(token);
+  if (!nextCookie) return;
+  cookie = nextCookie;
+  const previous = getStoredSession() || {};
+  saveSession({ ...previous, cookie: nextCookie });
+}
+
+function restoreSessionCookie() {
+  try {
+    const session = wx.getStorageSync(SESSION_KEY);
+    if (session?.cookie) {
+      cookie = session.cookie;
+    }
+  } catch {
+    // Ignore storage read errors during cold start.
+  }
+}
+
+restoreSessionCookie();
+
 function setApiBaseUrl(value) {
   apiBaseUrl = String(value || '').replace(/\/$/, '');
 }
@@ -68,14 +95,34 @@ function clearSession() {
 function normalizeSetCookie(headers = {}) {
   const raw = headers['Set-Cookie'] || headers['set-cookie'];
   if (!raw) return '';
-  if (Array.isArray(raw)) {
-    return raw.map((item) => String(item).split(';')[0]).join('; ');
+  const items = Array.isArray(raw) ? raw : [String(raw)];
+  let sessionCookie = '';
+  for (const item of items) {
+    const firstPart = String(item).trim().split(';')[0].trim();
+    const separator = firstPart.indexOf('=');
+    if (separator <= 0) continue;
+    const name = firstPart.slice(0, separator);
+    const value = firstPart.slice(separator + 1);
+    if (name === SESSION_COOKIE_NAME && value) {
+      sessionCookie = `${name}=${value}`;
+    }
+  }
+  return sessionCookie;
+}
+
+function persistLoginResult(result, loginType) {
+  if (result?.sessionToken) {
+    applySessionToken(result.sessionToken);
+  }
+  saveSession({
+    cookie,
+    user: result?.user || null,
+    loginType,
+  });
+  const app = getApp?.();
+  if (app && result?.user) {
+    app.globalData.user = result.user;
   }
-  return String(raw)
-    .split(/,(?=\s*[^;,]+=)/)
-    .map((item) => item.trim().split(';')[0])
-    .filter(Boolean)
-    .join('; ');
 }
 
 function request(path, options = {}) {
@@ -140,7 +187,7 @@ async function loginWithPassword(username, password) {
     method: 'POST',
     body: { username, password }
   });
-  saveSession({ cookie, user: result?.user || result || null, loginType: 'password' });
+  persistLoginResult(result, 'password');
   return result;
 }
 
@@ -169,7 +216,7 @@ async function loginWithWechatCode(loginPath) {
     method: 'POST',
     body: { code }
   });
-  saveSession({ cookie, user: result?.user || result || null, loginType: 'wechat' });
+  persistLoginResult(result, 'wechat');
   return result;
 }
 

miniapp/utils/config.js

@@ -16,6 +16,7 @@ function createUuid() {
 const defaults = {
   API_BASE_URL: LOCAL_DEV ? 'http://127.0.0.1:8081' : 'https://m.tkmind.cn',
   MINIAPP_LOGIN_PATH: '/auth/wechat-miniapp/login',
+  SESSION_COOKIE_NAME: 'tkmind_user_session',
   SELECTED_SESSION_KEY: 'tkmind_selected_session_id',
   AGENT_RUN_POLL_MS: 1200,
   AGENT_RUN_MAX_POLLS: 120,