Finally, I found the solution after struggling for the whole day:
just make sure
app.extensionSettings['HERE-IS-YOUR-EXTENSION-ID']
you can find your EXTENSION-ID in the extensions_enabled column of your settings table.
in my extension's composer.json, the package name is "riverlet/flarum-ext-sso" , but the EXTENSION-ID is riverlet-sso in flarum. a little weird.