From cc02041b619452f580586cec76db9bf0d735a6b1 Mon Sep 17 00:00:00 2001
From: canglan <admin@sea-studio.top>
Date: Sun, 16 Aug 2026 23:03:03 +0800
Subject: [PATCH] fix: api key cache invalidated by config mtime - server picks
 up new key after reinstall

---
 backend/middleware/security.js | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/backend/middleware/security.js b/backend/middleware/security.js
index 89d612b..c9f77c6 100644
--- a/backend/middleware/security.js
+++ b/backend/middleware/security.js
@@ -15,11 +15,20 @@ function readApiKey() {
 }
 
 let cachedApiKey = null;
+let cachedApiKeyMtime = 0;
 function getApiKey() {
-  if (cachedApiKey === null) cachedApiKey = readApiKey();
+  try {
+    const stat = fs.statSync(CONFIG_PATH);
+    if (cachedApiKeyMtime === stat.mtimeMs) return cachedApiKey;
+    cachedApiKey = readApiKey();
+    cachedApiKeyMtime = stat.mtimeMs;
+  } catch {
+    cachedApiKey = null;
+    cachedApiKeyMtime = 0;
+  }
   return cachedApiKey;
 }
-function clearApiKeyCache() { cachedApiKey = null; }
+function clearApiKeyCache() { cachedApiKey = null; cachedApiKeyMtime = 0; }
 
 const xssOptions = {
   whiteList: {