From 86258507815bd3ae4fa7802b96b28921ab0c125d Mon Sep 17 00:00:00 2001
From: aiyimickey <39365912+aiyimickey@users.noreply.github.com>
Date: Fri, 3 Jul 2026 13:24:01 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E5=AE=A1=E6=9F=A5=E9=97=AE=E9=A2=98?=
 =?UTF-8?q?=E4=BF=AE=E5=A4=8D?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- C1: checkPermission 使用 verifyJwt 验证 JWT 签名（不再仅 base64 解码）
- C2: 登录 cookie secure 改为 process.env.NODE_ENV === 'production'
- M1: switch=1 时清除旧 tlyq_session 和 session cookie
- H1: 用户管理 API role 字段白名单校验
---
 src/app/api/auth/login/oidc/route.ts |  6 ++++++
 src/app/api/auth/login/route.ts      |  2 +-
 src/lib/permissions.ts               | 15 +++++++--------
 3 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/src/app/api/auth/login/oidc/route.ts b/src/app/api/auth/login/oidc/route.ts
index 0c599fe..1c38397 100644
--- a/src/app/api/auth/login/oidc/route.ts
+++ b/src/app/api/auth/login/oidc/route.ts
@@ -18,6 +18,12 @@ export async function GET(request: Request) {
 
   const response = NextResponse.redirect(authorizeUrl)
 
+  // 切换账号时清除旧 session cookie
+  if (switchUser) {
+    response.cookies.set('tlyq_session', '', { maxAge: 0, path: '/' })
+    response.cookies.set('session', '', { maxAge: 0, path: '/' })
+  }
+
   // 存储 PKCE 参数到 httpOnly cookie（5 分钟过期）
   const cookieOpts = { httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax' as const, maxAge: 300, path: '/' }
   response.cookies.set('oidc_code_verifier', codeVerifier, cookieOpts)
diff --git a/src/app/api/auth/login/route.ts b/src/app/api/auth/login/route.ts
index 7496160..2366dd9 100644
--- a/src/app/api/auth/login/route.ts
+++ b/src/app/api/auth/login/route.ts
@@ -53,7 +53,7 @@ export async function POST(request: NextRequest) {
       user: { username: 'localadmin', role, displayName },
     })
     response.cookies.set('tlyq_session', token, {
-      httpOnly: true, secure: false, sameSite: 'lax', path: '/', maxAge: 604800,
+      httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax', path: '/', maxAge: 604800,
     })
     return response
   }
diff --git a/src/lib/permissions.ts b/src/lib/permissions.ts
index 1a12c13..a1f382b 100644
--- a/src/lib/permissions.ts
+++ b/src/lib/permissions.ts
@@ -1,4 +1,6 @@
 // src/lib/permissions.ts — RBAC 权限定义 + 检查函数
+import { verifyJwt } from '@shared/lib/auth/jwt'
+import { authConfig } from '@/lib/auth-config'
 export const PERMISSIONS = [
   { key: 'dashboard:view', name: '查看仪表盘' },
   { key: 'services:view', name: '查看服务列表' },
@@ -28,15 +30,12 @@ export function hasPermission(role: string, permissionKey: string): boolean {
   return perms ? perms.includes(permissionKey) : false
 }
 
-// API 服务端权限检查（从 cookie 中读取 role）
+// API 服务端权限检查（从 cookie 中读取 role，验证 JWT 签名）
 export function checkPermission(request: { cookies: { get(name: string): { value: string } | undefined } }, permissionKey: string): boolean {
   const token = request.cookies.get('tlyq_session')?.value
   if (!token) return false
-  try {
-    const payload = JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString())
-    const role = payload.role || 'viewer'
-    return hasPermission(role, permissionKey)
-  } catch {
-    return false
-  }
+  const payload = verifyJwt(token, authConfig.jwtSecret)
+  if (!payload) return false
+  const role = (payload.role as string) || 'viewer'
+  return hasPermission(role, permissionKey)
 }