From 2afb98ff1dcc4f6e8f204f167e02e1fa4445253f Mon Sep 17 00:00:00 2001
From: aiyimickey <39365912+aiyimickey@users.noreply.github.com>
Date: Fri, 3 Jul 2026 13:32:00 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20LDAP=20=E7=99=BB=E5=BD=95=20cookie=20sec?=
 =?UTF-8?q?ure=20=E5=B1=9E=E6=80=A7=20+=20role=20=E7=99=BD=E5=90=8D?=
 =?UTF-8?q?=E5=8D=95=E6=A0=A1=E9=AA=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/app/api/admin/users/[id]/route.ts | 5 +++++
 src/app/api/auth/login/route.ts       | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/app/api/admin/users/[id]/route.ts b/src/app/api/admin/users/[id]/route.ts
index ff9e0ab..01e3fa5 100644
--- a/src/app/api/admin/users/[id]/route.ts
+++ b/src/app/api/admin/users/[id]/route.ts
@@ -35,6 +35,11 @@ export async function PUT(request: NextRequest, { params }: { params: Promise<{
     if (existing[0].username === 'admin' || existing[0].username === 'localadmin') {
       return NextResponse.json({ error: '不能修改系统保留用户的角色' }, { status: 400 })
     }
+    // role 白名单校验
+    const validRoles = ['admin', 'editor', 'viewer']
+    if (!validRoles.includes(role)) {
+      return NextResponse.json({ error: `无效角色，允许值: ${validRoles.join(', ')}` }, { status: 400 })
+    }
     updates.push(`role = '${role.replace(/'/g, "''")}'`)
     details.role = role
   }
diff --git a/src/app/api/auth/login/route.ts b/src/app/api/auth/login/route.ts
index 2366dd9..e57f03f 100644
--- a/src/app/api/auth/login/route.ts
+++ b/src/app/api/auth/login/route.ts
@@ -88,7 +88,7 @@ export async function POST(request: NextRequest) {
     user: { username, role, displayName: result.displayName || username },
   })
   response.cookies.set('tlyq_session', token, {
-    httpOnly: true, secure: false, sameSite: 'lax', domain: authConfig.cookieDomain, path: '/', maxAge: 604800,
+    httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax', domain: authConfig.cookieDomain, path: '/', maxAge: 604800,
   })
   return response
 }