fix: HIGH+MEDIUM bugs from full audit - listen error, JWT, upload, mailer, webhook

backend/routes/external.js

@@ -1,7 +1,7 @@
 const express = require('express');
 const bcrypt = require('bcryptjs');
 const { v4: uuid } = require('uuid');
-const { query, getRow, getConfig } = require('../db');
+const { query, getRow, getConfig, getPool } = require('../db');
 const { generateToken, authenticate } = require('../middleware/auth');
 const { sendEmail } = require('../mailer');
 
@@ -47,7 +47,7 @@ router.post('/auth/login', async (req, res) => {
     const { username, password } = req.body;
     if (!username || !password) return res.status(400).json({ error: '请输入用户名和密码' });
     const user = await getRow('SELECT * FROM users WHERE username = ?', [username]);
-    if (!user || !bcrypt.compareSync(password, user.password)) return res.status(401).json({ error: '用户名或密码错误' });
+    if (!user || !(await bcrypt.compare(password, user.password))) return res.status(401).json({ error: '用户名或密码错误' });
     if (!user.active) return res.status(403).json({ error: '账号未激活' });
     const token = generateToken(user);
     res.json({ token, user: { id:user.id, username:user.username, game_name:user.game_name, game_uid:user.game_uid, role:user.role } });