fix(thunder): tolerate refresh responses without rotated refresh token

After completing the review flow, saving the driver works but a restart
still prompts for verification: when Init falls back to username/password
login, risk control triggers the review flow again.

RefreshToken() treated a refresh response without a refresh_token field
as failure (EmptyToken), which sent Init back to login even when the
refresh succeeded without rotating the token.

- judge refresh success by access token presence, keep the old refresh
  token when the server does not rotate it
- add diagnostics logs distinguishing: no saved refresh token, session
  restored via refresh token, refresh failed with fallback to login
- add test for refresh response without rotated refresh token

Author: alist-dev

drivers/thunder/driver.go

@@ -20,6 +20,7 @@ import (
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/s3/s3manager"
 	"github.com/go-resty/resty/v2"
+	log "github.com/sirupsen/logrus"
 )
 
 type Thunder struct {
@@ -121,16 +122,26 @@ func (x *Thunder) Init(ctx context.Context) (err error) {
 		// 优先使用已保存的 RefreshToken 恢复登录态，避免每次重启都触发风控验证
 		if x.Addition.RefreshToken != "" {
 			token, err := x.XunLeiCommon.RefreshToken(x.Addition.RefreshToken)
-			if err == nil && token != nil && token.RefreshToken != "" {
+			if err == nil && token != nil && token.AccessToken != "" {
 				x.SetTokenResp(token)
-				// 更新并持久化最新的 refresh token
-				x.Addition.RefreshToken = token.RefreshToken
+				// 更新并持久化最新的 refresh token（服务端未轮换时保留旧值）
+				if token.RefreshToken != "" {
+					x.Addition.RefreshToken = token.RefreshToken
+				}
 				// 清空已消费的信任密钥并落库
 				x.Addition.CreditKey = ""
 				op.MustSaveDriverStorage(x)
+				log.Infof("thunder: session restored via refresh token for %s", x.MountPath)
 				return nil
 			}
 			// 刷新失败，回退到账号密码登录
+			if err != nil {
+				log.Warnf("thunder: refresh token failed for %s: %v, fallback to login", x.MountPath, err)
+			} else {
+				log.Warnf("thunder: refresh token response has no access token for %s, fallback to login", x.MountPath)
+			}
+		} else {
+			log.Infof("thunder: no saved refresh token for %s, login with username/password", x.MountPath)
 		}
 		// 登录
 		token, err := x.Login(x.Username, x.Password)
@@ -142,6 +153,7 @@ func (x *Thunder) Init(ctx context.Context) (err error) {
 		x.SetTokenResp(token)
 		x.Addition.RefreshToken = token.RefreshToken
 		op.MustSaveDriverStorage(x)
+		log.Infof("thunder: logged in for %s", x.MountPath)
 	}
 	return nil
 }
@@ -544,7 +556,9 @@ func (xc *XunLeiCommon) RefreshToken(refreshToken string) (*TokenResp, error) {
 		return nil, err
 	}
 
-	if resp.RefreshToken == "" {
+	// 以 access token 是否有效作为刷新成功的判据：
+	// 部分场景下服务端不轮换 refresh token（响应里该字段为空），此时保留旧值即可
+	if resp.AccessToken == "" {
 		return nil, errs.EmptyToken
 	}
 	return &resp, nil

drivers/thunder/driver_test.go

@@ -118,6 +118,41 @@ func TestThunderInitRestoresSessionWithRefreshToken(t *testing.T) {
 	}
 }
 
+func TestThunderInitRestoresSessionWithoutRotatedRefreshToken(t *testing.T) {
+	ms := newMockServer()
+	ms.handler = func(path string, w http.ResponseWriter, r *http.Request) {
+		switch path {
+		case "/v1/auth/token":
+			// 服务端刷新成功但未轮换 refresh token（响应里该字段为空）
+			writeJSON(w, TokenResp{
+				TokenType: "Bearer", AccessToken: "at-1",
+				ExpiresIn: 7200, UserID: "u1",
+			})
+		default:
+			http.NotFound(w, r)
+		}
+	}
+	defer ms.Close()
+
+	x := newTestThunder("thunder-test-no-rotate")
+	x.Addition.RefreshToken = "rt-old"
+
+	if err := x.Init(nil); err != nil {
+		t.Fatalf("Init: %v", err)
+	}
+	// 刷新成功：不应回退到账号密码登录
+	if got := ms.Paths(); !reflect.DeepEqual(got, []string{"/v1/auth/token"}) {
+		t.Fatalf("unexpected requests: %v", got)
+	}
+	// refresh token 未轮换时应保留旧值
+	if x.Addition.RefreshToken != "rt-old" {
+		t.Fatalf("RefreshToken = %q, want preserved %q", x.Addition.RefreshToken, "rt-old")
+	}
+	if x.Token() != "Bearer at-1" {
+		t.Fatalf("Token() = %q, want %q", x.Token(), "Bearer at-1")
+	}
+}
+
 func TestThunderInitFallsBackToLoginAndPersists(t *testing.T) {
 	ms := newMockServer()
 	ms.handler = func(path string, w http.ResponseWriter, r *http.Request) {