fix: 审查问题修复

- C1: checkPermission 使用 verifyJwt 验证 JWT 签名（不再仅 base64 解码）
- C2: 登录 cookie secure 改为 process.env.NODE_ENV === 'production'
- M1: switch=1 时清除旧 tlyq_session 和 session cookie
- H1: 用户管理 API role 字段白名单校验

src/app/api/auth/login/oidc/route.ts

@@ -18,6 +18,12 @@ export async function GET(request: Request) {
 
   const response = NextResponse.redirect(authorizeUrl)
 
+  // 切换账号时清除旧 session cookie
+  if (switchUser) {
+    response.cookies.set('tlyq_session', '', { maxAge: 0, path: '/' })
+    response.cookies.set('session', '', { maxAge: 0, path: '/' })
+  }
+
   // 存储 PKCE 参数到 httpOnly cookie（5 分钟过期）
   const cookieOpts = { httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax' as const, maxAge: 300, path: '/' }
   response.cookies.set('oidc_code_verifier', codeVerifier, cookieOpts)

src/app/api/auth/login/route.ts

@@ -53,7 +53,7 @@ export async function POST(request: NextRequest) {
       user: { username: 'localadmin', role, displayName },
     })
     response.cookies.set('tlyq_session', token, {
-      httpOnly: true, secure: false, sameSite: 'lax', path: '/', maxAge: 604800,
+      httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax', path: '/', maxAge: 604800,
     })
     return response
   }

src/lib/permissions.ts

@@ -1,4 +1,6 @@
 // src/lib/permissions.ts — RBAC 权限定义 + 检查函数
+import { verifyJwt } from '@shared/lib/auth/jwt'
+import { authConfig } from '@/lib/auth-config'
 export const PERMISSIONS = [
   { key: 'dashboard:view', name: '查看仪表盘' },
   { key: 'services:view', name: '查看服务列表' },
@@ -28,15 +30,12 @@ export function hasPermission(role: string, permissionKey: string): boolean {
   return perms ? perms.includes(permissionKey) : false
 }
 
-// API 服务端权限检查（从 cookie 中读取 role）
+// API 服务端权限检查（从 cookie 中读取 role，验证 JWT 签名）
 export function checkPermission(request: { cookies: { get(name: string): { value: string } | undefined } }, permissionKey: string): boolean {
   const token = request.cookies.get('tlyq_session')?.value
   if (!token) return false
-  try {
-    const payload = JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString())
-    const role = payload.role || 'viewer'
+  const payload = verifyJwt(token, authConfig.jwtSecret)
+  if (!payload) return false
+  const role = (payload.role as string) || 'viewer'
   return hasPermission(role, permissionKey)
-  } catch {
-    return false
-  }
 }