fix: stabilize review detail and collabora loading

app/api/login/auth.server.ts

@@ -77,6 +77,26 @@ export interface SsoUser {
   deleted_at?: string;
 }
 
+function compactUserInfoForSession(userInfo?: UserInfo, userRole?: string): UserInfo | undefined {
+  if (!userInfo) {
+    return undefined;
+  }
+
+  // Cookie Session 直接存整份 userInfo 很容易超过浏览器 4KB 限制；
+  // 服务端鉴权实际只依赖这几个核心字段，其余信息交给接口按需取回。
+  return {
+    user_id: userInfo.user_id,
+    sub: userInfo.sub,
+    username: userInfo.username,
+    nick_name: userInfo.nick_name || userInfo.nickname || userInfo.name,
+    ou_id: userInfo.ou_id,
+    ou_name: userInfo.ou_name,
+    is_leader: userInfo.is_leader,
+    area: userInfo.area,
+    user_role: userInfo.user_role || userRole,
+  };
+}
+
 /**
  * 会话存储配置
  * 
@@ -201,7 +221,14 @@ export async function getUserSession(request: Request) {
   const refreshToken = session.get("refreshToken");
   const tokenIssuedAt = session.get("tokenIssuedAt");
   let tokenExpiresIn = session.get("tokenExpiresIn");
-  const userInfo = session.get("userInfo");
+  const storedUserInfo = session.get("userInfo");
+  const userInfo = storedUserInfo
+    ? {
+        ...storedUserInfo,
+        role: storedUserInfo.role || storedUserInfo.user_role || userRole,
+        user_role: storedUserInfo.user_role || userRole,
+      }
+    : storedUserInfo;
   const frontendJWT = session.get("frontendJWT");
 
   // 🔑 检查是否是公共路径（不需要认证的路径）
@@ -369,7 +396,7 @@ export async function createUserSession(params: {
 
   // 用户信息和JWT
   if (params.userInfo) {
-    session.set("userInfo", params.userInfo);
+    session.set("userInfo", compactUserInfoForSession(params.userInfo, params.userRole));
   }
   if (params.frontendJWT) {
     session.set("frontendJWT", params.frontendJWT);
@@ -534,4 +561,4 @@ async function callIDaaSLogout(accessToken: string, appId: string): Promise<void
     console.error("❌ [callIDaaSLogout] 调用IDaaS登出接口失败（非HTTP错误）:", error);
     throw error;
   }
-}
+}