diff --git a/src/app/api/internal/roles/route.ts b/src/app/api/internal/roles/route.ts
new file mode 100644
index 0000000..dec82f1
--- /dev/null
+++ b/src/app/api/internal/roles/route.ts
@@ -0,0 +1,17 @@
+// GET /api/internal/roles — 供 OA 查询 monitor 支持的角色列表
+import { NextResponse } from 'next/server'
+import { ROLE_DEFAULT_PERMISSIONS, PERMISSIONS } from '@/lib/permissions'
+
+const INTERNAL_KEY = process.env.INTERNAL_API_KEY || 'oa-internal-key-tlyq-2026'
+
+export async function GET(request: Request) {
+  const key = request.headers.get('x-internal-key')
+  if (key !== INTERNAL_KEY) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+
+  const roles = Object.keys(ROLE_DEFAULT_PERMISSIONS).map(name => ({
+    name,
+    permissions: ROLE_DEFAULT_PERMISSIONS[name].map(k => PERMISSIONS.find(p => p.key === k)?.name || k),
+  }))
+
+  return NextResponse.json({ roles })
+}
diff --git a/src/middleware.ts b/src/middleware.ts
index 08e5038..596796d 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -9,6 +9,7 @@ export const middleware = createMiddlewareV2({
   cookieDomain,
   allowedIssuers: ['*'],
   enableApiKey: false,
+  publicPaths: ['/login', '/api/auth', '/api/health', '/api/internal', '/_next', '/favicon.ico'],
 })
 
 export const config = { matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'] }