From 8137e3aec7aeb594f05be6273d2b0590f5c9bc18 Mon Sep 17 00:00:00 2001
From: aiyimickey <39365912+aiyimickey@users.noreply.github.com>
Date: Fri, 3 Jul 2026 14:22:16 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BB=A3=E7=A0=81=E6=95=B4=E6=B4=81?=
 =?UTF-8?q?=E5=BA=A6=E4=BC=98=E5=8C=96=EF=BC=88M1/M2/M3=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- M1: login route LDAP 查询改为 dbQueryParams 参数化
- M2: callback 审计日志 import 统一为 @/lib/audit
- M3: users/[id] bcrypt.hash 改为异步版本
---
 src/app/api/admin/users/[id]/route.ts | 2 +-
 src/app/api/auth/callback/route.ts    | 4 ++--
 src/app/api/auth/login/route.ts       | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/app/api/admin/users/[id]/route.ts b/src/app/api/admin/users/[id]/route.ts
index a5d1499..557c328 100644
--- a/src/app/api/admin/users/[id]/route.ts
+++ b/src/app/api/admin/users/[id]/route.ts
@@ -65,7 +65,7 @@ export async function PUT(request: NextRequest, { params }: { params: Promise<{
     if (password.length < 8 || password.length > 128) {
       return NextResponse.json({ error: '密码长度需在 8-128 位之间' }, { status: 400 })
     }
-    const hash = bcrypt.hashSync(password, 12)
+    const hash = await bcrypt.hash(password, 12)
     setClauses.push('password_hash = ?')
     values.push(hash)
     details.password = '***'
diff --git a/src/app/api/auth/callback/route.ts b/src/app/api/auth/callback/route.ts
index 2894586..9179bda 100644
--- a/src/app/api/auth/callback/route.ts
+++ b/src/app/api/auth/callback/route.ts
@@ -5,7 +5,7 @@ import { signJwt } from '@shared/lib/auth/jwt'
 import { syncOidcUser } from '@shared/lib/auth/user-sync'
 import { authConfig } from '@/lib/auth-config'
 import { dbQueryParams, dbExec } from '@/lib/db'
-import { writeAuditLog } from '@shared/lib/audit/write-audit-log'
+import { writeAuditLog } from '@/lib/audit'
 
 export async function GET(request: NextRequest) {
   const { searchParams } = new URL(request.url)
@@ -97,7 +97,7 @@ export async function GET(request: NextRequest) {
   response.cookies.delete('oidc_nonce')
 
   // 审计日志
-  writeAuditLog({ exec: dbExec }, {
+  writeAuditLog({
     userId: user.id, username: userinfo.preferred_username, action: 'login',
     entityType: 'auth', details: { method: 'oidc', isNew: user.isNew },
     ipAddress: request.headers.get('x-forwarded-for') || '127.0.0.1',
diff --git a/src/app/api/auth/login/route.ts b/src/app/api/auth/login/route.ts
index bda9273..9044c47 100644
--- a/src/app/api/auth/login/route.ts
+++ b/src/app/api/auth/login/route.ts
@@ -4,7 +4,7 @@ import bcrypt from 'bcryptjs'
 import { signJwt } from '@shared/lib/auth/jwt'
 import { ldapAuth } from '@shared/lib/auth/ldap'
 import { authConfig } from '@/lib/auth-config'
-import { dbQuery, escapeSql } from '@/lib/db'
+import { dbQuery, dbQueryParams } from '@/lib/db'
 import { writeAuditLog } from '@/lib/audit'
 import { checkRateLimit, resetRateLimit } from '@/lib/rate-limit'
 
@@ -86,7 +86,7 @@ export async function POST(request: NextRequest) {
   resetRateLimit(rateLimitKey)
 
   // 签发 JWT
-  const users = dbQuery(`SELECT role FROM users WHERE username = ${escapeSql(username)}`)
+  const users = dbQueryParams<{ role: string }>(`SELECT role FROM users WHERE username = ?`, [username])
   const role = users.length > 0 ? users[0].role as string : 'viewer'
 
   writeAuditLog({