From edf561729ff92c8ed17fc0e953e71ee18a099899 Mon Sep 17 00:00:00 2001
From: canglan <admin@sea-studio.top>
Date: Fri, 21 Aug 2026 20:57:25 +0800
Subject: [PATCH] fix: backend pages redirect loop - wrong /me path + init()
 clearing auth

Root causes (both in app.js):
1. validateAuth() called API.get('/me') = /api/me, but the route is
   mounted at /auth/me (businessRouter.use('/auth', authRoutes)).
   /api/me returned 404 -> non-auth error was re-thrown -> outer
   .catch() unconditionally Auth.reset() + redirect to #/login.
   Fixed: call /auth/me; non-auth errors (network/404/500) now return
   true (allow routing) instead of throwing.
2. init() fetched /api/settings/settings WITHOUT token, but that route
   requires authenticate+requireRole. Always 401 -> __SITE_NAME__ never
   set -> 'Auth.logged() && !window.__SITE_NAME__' always true ->
   Auth.reset() on EVERY page load, wiping valid login.
   Fixed: removed the fetch and the reset line - site_name is already
   injected server-side as window.__SITE_NAME__ (getHtmlWithKey).
---
 public/js/app.js | 18 +++++-------------
 1 file changed, 5 insertions(+), 13 deletions(-)

diff --git a/public/js/app.js b/public/js/app.js
index e6931cd..b4ccad4 100644
--- a/public/js/app.js
+++ b/public/js/app.js
@@ -37,7 +37,8 @@ const App = {
   ],
 
   async init() {
-    // 获取站点名称:先尝试带 token 的请求,失败则降级(安装阶段无需登录)
+    // 站点名称由服务端注入 window.__SITE_NAME__(server.js getHtmlWithKey),
+    // 无需前端再请求(settings 接口需登录,未登录时 fetch 会 401 且无 token)
     try {
       const r = await API.get('/install/status');
       if (!r.installed) { location.hash = '#/install'; return; }
@@ -46,16 +47,6 @@ const App = {
       location.hash = '#/install';
       return;
     }
-    // 安装完成后获取站点名称(需要 token,若未登录则忽略名称设置)
-    try {
-      const nameRes = await fetch('/api/settings/settings');
-      if (nameRes.ok) {
-        const settings = await nameRes.json();
-        if (settings.site_name && settings.site_name.value) window.__SITE_NAME__ = settings.site_name.value;
-      }
-    } catch {}
-    // 确保登录态与服务器同步:若本地有 token 但 site_name 未加载(可能 token 已过期)
-    if (Auth.logged() && !window.__SITE_NAME__) Auth.reset();
     if (window.__SITE_NAME__) {
       document.getElementById('site-title').textContent = window.__SITE_NAME__;
       document.getElementById('sidebar-title').textContent = window.__SITE_NAME__ || '举报系统';
@@ -103,7 +94,7 @@ const App = {
     this._validating = true;
     if (!Auth.logged()) { this._validating = false; return false; }
     try {
-      await API.get('/me');
+      await API.get('/auth/me');
       this._validating = false;
       return true;
     } catch (e) {
@@ -112,7 +103,8 @@ const App = {
         Auth.reset();
         return false;
       }
-      throw e;
+      // 非登录错误(网络/404/500)不视为登录失效,放行路由
+      return true;
     }
   },