多租户隔离 + 权限深度话题

async function switchTenant(newTenantId) {
  // 1. 更新当前租户
  userStore.setTenant(newTenantId)

  // 2. 重置业务 state(清旧租户数据)
  const stores = [taskStore, reportStore, indicatorStore]
  stores.forEach(s => s.$reset())

  // 3. 重新拉新租户的权限 + 重新生成路由
  const perms = await fetchPermissions(newTenantId)
  await router.rebuildRoutes(perms)  // 先移除旧动态路由,再加新的

  // 4. 跳首页(旧路由可能没权限了)
  router.push('/dashboard')
}

// main.js 注册全局指令
app.directive('permission', {
  mounted(el, binding) {
    const requiredPerm = binding.value  // 'report:edit'
    const userPerms = useUserStore().permissions

    // 没权限,直接从 DOM 移除
    if (!userPerms.includes(requiredPerm)) {
      el.parentNode?.removeChild(el)
    }
  }
})

// 模板里用
<el-button v-permission="'report:edit'">编辑报告</el-button>
<el-button v-permission="'report:delete'">删除</el-button>

let isRefreshing = false
let requestsQueue = []  // 排队等刷新的请求

axios.interceptors.response.use(null, async (error) => {
  const { config, response } = error

  if (response?.status === 401 && !config._retry) {
    if (isRefreshing) {
      // 已经在刷新了,排队等
      return new Promise(resolve => {
        requestsQueue.push((newToken) => {
          config.headers.Authorization = `Bearer ${newToken}`
          resolve(axios.request(config))
        })
      })
    }

    // 第一个 401,开始刷新
    isRefreshing = true
    config._retry = true
    try {
      const newToken = await refreshToken()
      // 刷新成功,执行排队的请求
      requestsQueue.forEach(cb => cb(newToken))
      requestsQueue = []
      // 重发当前请求
      config.headers.Authorization = `Bearer ${newToken}`
      return axios.request(config)
    } catch (e) {
      // 刷新失败,refresh token 也过期,跳登录
      router.push('/login')
      throw e
    } finally {
      isRefreshing = false
    }
  }
  throw error
})