From 0fd59feca70eebaaeb938b7d7247ffc35d5be3f4 Mon Sep 17 00:00:00 2001
From: dongmucat <1127093059@qq.com>
Date: Tue, 7 Apr 2026 15:22:29 +0800
Subject: [PATCH] fix(auth): avoid extra session rotation after oauth success

---
 .../skillhub/auth/oauth/OAuth2LoginSuccessHandler.java   | 2 +-
 .../skillhub/auth/oauth/OAuth2LoginHandlersTest.java     | 9 +++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/oauth/OAuth2LoginSuccessHandler.java b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/oauth/OAuth2LoginSuccessHandler.java
index b87c0018..0a27e6bd 100644
--- a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/oauth/OAuth2LoginSuccessHandler.java
+++ b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/oauth/OAuth2LoginSuccessHandler.java
@@ -35,7 +35,7 @@ public class OAuth2LoginSuccessHandler extends SavedRequestAwareAuthenticationSu
         if (authentication.getPrincipal() instanceof OAuth2User oAuth2User) {
             PlatformPrincipal principal = (PlatformPrincipal) oAuth2User.getAttributes().get("platformPrincipal");
             if (principal != null) {
-                platformSessionService.attachToAuthenticatedSession(principal, authentication, request, true);
+                platformSessionService.attachToAuthenticatedSession(principal, authentication, request);
             }
         }
         String returnTo = oauthLoginFlowService.consumeReturnTo(request.getSession(false));
diff --git a/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/oauth/OAuth2LoginHandlersTest.java b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/oauth/OAuth2LoginHandlersTest.java
index 592151fa..6bf8c098 100644
--- a/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/oauth/OAuth2LoginHandlersTest.java
+++ b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/oauth/OAuth2LoginHandlersTest.java
@@ -6,6 +6,7 @@ import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
 import org.springframework.security.oauth2.core.OAuth2Error;
 import org.springframework.security.oauth2.core.user.DefaultOAuth2User;
@@ -52,11 +53,15 @@ class OAuth2LoginHandlersTest {
 
         handler.onAuthenticationSuccess(request, response, authentication);
 
+        SecurityContext securityContext = (SecurityContext) session.getAttribute(
+                HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY
+        );
         assertThat(response.getRedirectedUrl()).isEqualTo("/dashboard/publish");
-        assertThat(request.getSession(false).getId()).isNotEqualTo(originalSessionId);
+        assertThat(request.getSession(false).getId()).isEqualTo(originalSessionId);
         assertThat(session.getAttribute(OAuthLoginRedirectSupport.SESSION_RETURN_TO_ATTRIBUTE)).isNull();
         assertThat(session.getAttribute("platformPrincipal")).isEqualTo(principal);
-        assertThat(session.getAttribute(HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY)).isNotNull();
+        assertThat(securityContext).isNotNull();
+        assertThat(securityContext.getAuthentication()).isSameAs(authentication);
     }
 
     @Test