diff --git a/src/app/api/admin/users/[id]/route.ts b/src/app/api/admin/users/[id]/route.ts
index a5d1499..557c328 100644
--- a/src/app/api/admin/users/[id]/route.ts
+++ b/src/app/api/admin/users/[id]/route.ts
@@ -65,7 +65,7 @@ export async function PUT(request: NextRequest, { params }: { params: Promise<{
     if (password.length < 8 || password.length > 128) {
       return NextResponse.json({ error: '密码长度需在 8-128 位之间' }, { status: 400 })
     }
-    const hash = bcrypt.hashSync(password, 12)
+    const hash = await bcrypt.hash(password, 12)
     setClauses.push('password_hash = ?')
     values.push(hash)
     details.password = '***'
diff --git a/src/app/api/auth/callback/route.ts b/src/app/api/auth/callback/route.ts
index 2894586..9179bda 100644
--- a/src/app/api/auth/callback/route.ts
+++ b/src/app/api/auth/callback/route.ts
@@ -5,7 +5,7 @@ import { signJwt } from '@shared/lib/auth/jwt'
 import { syncOidcUser } from '@shared/lib/auth/user-sync'
 import { authConfig } from '@/lib/auth-config'
 import { dbQueryParams, dbExec } from '@/lib/db'
-import { writeAuditLog } from '@shared/lib/audit/write-audit-log'
+import { writeAuditLog } from '@/lib/audit'
 
 export async function GET(request: NextRequest) {
   const { searchParams } = new URL(request.url)
@@ -97,7 +97,7 @@ export async function GET(request: NextRequest) {
   response.cookies.delete('oidc_nonce')
 
   // 审计日志
-  writeAuditLog({ exec: dbExec }, {
+  writeAuditLog({
     userId: user.id, username: userinfo.preferred_username, action: 'login',
     entityType: 'auth', details: { method: 'oidc', isNew: user.isNew },
     ipAddress: request.headers.get('x-forwarded-for') || '127.0.0.1',
diff --git a/src/app/api/auth/login/route.ts b/src/app/api/auth/login/route.ts
index bda9273..9044c47 100644
--- a/src/app/api/auth/login/route.ts
+++ b/src/app/api/auth/login/route.ts
@@ -4,7 +4,7 @@ import bcrypt from 'bcryptjs'
 import { signJwt } from '@shared/lib/auth/jwt'
 import { ldapAuth } from '@shared/lib/auth/ldap'
 import { authConfig } from '@/lib/auth-config'
-import { dbQuery, escapeSql } from '@/lib/db'
+import { dbQuery, dbQueryParams } from '@/lib/db'
 import { writeAuditLog } from '@/lib/audit'
 import { checkRateLimit, resetRateLimit } from '@/lib/rate-limit'
 
@@ -86,7 +86,7 @@ export async function POST(request: NextRequest) {
   resetRateLimit(rateLimitKey)
 
   // 签发 JWT
-  const users = dbQuery(`SELECT role FROM users WHERE username = ${escapeSql(username)}`)
+  const users = dbQueryParams<{ role: string }>(`SELECT role FROM users WHERE username = ?`, [username])
   const role = users.length > 0 ? users[0].role as string : 'viewer'
 
   writeAuditLog({