feat(avatar): support production H5 token SSO

digital-avatar-app/src/utils/uniapp-bridge.ts

@@ -1,9 +1,7 @@
 // 会会数字分身 H5 ↔ uniapp 原生壳 桥接工具
 // 协议详见 uniapp-avatar/README.md
 //
-// 引入方式：在 index.html 中加载 uniapp web-view bridge：
-//   <script src="https://unpkg.com/@dcloudio/uni-webview-js@0.0.10/index.js"></script>
-// 引入后全局会出现 window.uni.webView，H5 即可用 postMessage 与原生通信。
+// uni-webview bridge is bundled by main.ts; no external CDN is required.
 
 const BRIDGE_HANDLER = '__uniBridgeHandle__'
 
@@ -15,6 +13,16 @@ export interface UniLaunchParams {
   ts?: string
 }
 
+const PARAM_KEYS: (keyof UniLaunchParams)[] = ['token', 'userId', 'nickname', 'avatar', 'ts']
+
+function readParams(search: string, target: UniLaunchParams): void {
+  const sp = new URLSearchParams(search)
+  for (const key of PARAM_KEYS) {
+    const value = sp.get(key)
+    if (value) target[key] = value
+  }
+}
+
 // 是否运行在 uniapp web-view 环境中
 export function isInUniWebView(): boolean {
   return !!(window as any).uni?.webView
@@ -22,21 +30,33 @@ export function isInUniWebView(): boolean {
 
 // 解析 web-view 加载 URL 时原生注入的参数（token / 会会用户）
 export function getLaunchParams(): UniLaunchParams {
-  const sp = new URLSearchParams(window.location.search)
   const params: UniLaunchParams = {}
-  const token = sp.get('token')
-  const userId = sp.get('userId')
-  const nickname = sp.get('nickname')
-  const avatar = sp.get('avatar')
-  const ts = sp.get('ts')
-  if (token) params.token = token
-  if (userId) params.userId = userId
-  if (nickname) params.nickname = decodeURIComponent(nickname)
-  if (avatar) params.avatar = decodeURIComponent(avatar)
-  if (ts) params.ts = ts
+  readParams(window.location.search, params)
+  const hashQueryIndex = window.location.hash.indexOf('?')
+  if (hashQueryIndex >= 0) {
+    readParams(window.location.hash.slice(hashQueryIndex + 1), params)
+  }
   return params
 }
 
+// Remove the one-time login credential before any route is rendered or logged.
+export function stripLaunchToken(): void {
+  const url = new URL(window.location.href)
+  url.searchParams.delete('token')
+
+  const hash = url.hash.slice(1)
+  const queryIndex = hash.indexOf('?')
+  if (queryIndex >= 0) {
+    const path = hash.slice(0, queryIndex)
+    const hashParams = new URLSearchParams(hash.slice(queryIndex + 1))
+    hashParams.delete('token')
+    const query = hashParams.toString()
+    url.hash = `${path}${query ? `?${query}` : ''}`
+  }
+
+  window.history.replaceState(window.history.state, '', `${url.pathname}${url.search}${url.hash}`)
+}
+
 // H5 → 原生：发送事件（需引入 uniapp web-view bridge）
 export function postToNative(message: Record<string, any>): boolean {
   if (!isInUniWebView()) return false