fix:批量修复了一些问题

frontend/src/admin/api.ts

@@ -25,7 +25,7 @@ export class ApiError extends Error {
 
 async function request<T>(
   path: string,
-  options: RequestInit & { timeoutMs?: number } = {},
+  options: RequestInit & { timeoutMs?: number; skipAuthHandling?: boolean } = {},
 ): Promise<T> {
   // 修复: 正确拼接 API_BASE
   const url = path.startsWith('http')
@@ -34,7 +34,7 @@ async function request<T>(
       ? path  // 已经是绝对路径(如 /health)
       : `${API_BASE}${path}`
 
-  const { timeoutMs = TIMEOUT_MS, ...fetchOptions } = options
+  const { timeoutMs = TIMEOUT_MS, skipAuthHandling, ...fetchOptions } = options
   const controller = new AbortController()
   const timer = setTimeout(() => controller.abort(), timeoutMs)
 
@@ -59,7 +59,8 @@ async function request<T>(
         detail && typeof detail === 'object' && 'detail' in detail
           ? String((detail as { detail: unknown }).detail)
           : `HTTP ${res.status}: ${res.statusText}`
-      if (res.status === 401) {
+      // 401 仅在没有显式跳过时广播未登录事件(改密接口的 401 表示当前密码错误,非会话过期)
+      if (res.status === 401 && !skipAuthHandling) {
         message += '\n登录已过期,请重新登录。'
         window.dispatchEvent(new CustomEvent(UNAUTHORIZED_EVENT))
       }
@@ -88,9 +89,9 @@ async function request<T>(
 
 export const api = {
   get: <T>(path: string) => request<T>(path),
-  post: <T>(path: string, body?: unknown, opts?: { timeoutMs?: number }) =>
+  post: <T>(path: string, body?: unknown, opts?: { timeoutMs?: number; skipAuthHandling?: boolean }) =>
     request<T>(path, { method: 'POST', body: body ? JSON.stringify(body) : undefined, ...opts }),
-  put: <T>(path: string, body?: unknown, opts?: { timeoutMs?: number }) =>
+  put: <T>(path: string, body?: unknown, opts?: { timeoutMs?: number; skipAuthHandling?: boolean }) =>
     request<T>(path, { method: 'PUT', body: body ? JSON.stringify(body) : undefined, ...opts }),
   delete: <T>(path: string) => request<T>(path, { method: 'DELETE' }),
 }
@@ -118,10 +119,12 @@ export function fetchAuthState(): Promise<{
 
 /** 修改管理员密码(成功后所有会话失效,需重新登录) */
 export function changePassword(currentPassword: string, newPassword: string): Promise<{ ok: boolean; message: string }> {
-  return api.post(`${API_BASE}/auth/change-password`, {
-    current_password: currentPassword,
-    new_password: newPassword,
-  })
+  // skipAuthHandling: 改密接口的 401 表示「当前密码错误」,非会话过期,不要触发登出
+  return api.post(
+    `${API_BASE}/auth/change-password`,
+    { current_password: currentPassword, new_password: newPassword },
+    { skipAuthHandling: true },
+  )
 }
 
 export { API_BASE }