fix: LDAP 登录 cookie secure 属性 + role 白名单校验

src/app/api/admin/users/[id]/route.ts

@@ -35,6 +35,11 @@ export async function PUT(request: NextRequest, { params }: { params: Promise<{
     if (existing[0].username === 'admin' || existing[0].username === 'localadmin') {
       return NextResponse.json({ error: '不能修改系统保留用户的角色' }, { status: 400 })
     }
+    // role 白名单校验
+    const validRoles = ['admin', 'editor', 'viewer']
+    if (!validRoles.includes(role)) {
+      return NextResponse.json({ error: `无效角色，允许值: ${validRoles.join(', ')}` }, { status: 400 })
+    }
     updates.push(`role = '${role.replace(/'/g, "''")}'`)
     details.role = role
   }

src/app/api/auth/login/route.ts

@@ -88,7 +88,7 @@ export async function POST(request: NextRequest) {
     user: { username, role, displayName: result.displayName || username },
   })
   response.cookies.set('tlyq_session', token, {
-    httpOnly: true, secure: false, sameSite: 'lax', domain: authConfig.cookieDomain, path: '/', maxAge: 604800,
+    httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax', domain: authConfig.cookieDomain, path: '/', maxAge: 604800,
   })
   return response
 }