Fail closed without admin configuration and document SMTP operations

2026-10-29 16:39:09 +08:00
parent 134bc2c9cc
commit c27fa4fe22
4 changed files with 53 additions and 1 deletions
@@ -9,7 +9,10 @@ export function proxy(request: NextRequest) {
 if (path === '/brand-mark.svg' || path === '/login' || path === '/api/auth/login' || path === '/api/auth/logout' || path === '/api/health' || path === '/api/ready' || path.startsWith('/_next/static/')) return NextResponse.next({headers:responseHeaders});
 let config;
 try { config = authConfig(); } catch { return NextResponse.json({error:'登录服务配置不可用'}, {status:503,headers:responseHeaders}); }
- if (!config) return NextResponse.next();
+ if (!config) {
+  if (process.env.AUTH_DISABLED_FOR_TESTS === 'true' && process.env.AUTH_CONFIG_FILE === '') return NextResponse.next();
+  return NextResponse.json({error:'管理员登录服务尚未配置'}, {status:503,headers:responseHeaders});
+ }
 const bearer = request.headers.get('authorization');
 const token = bearer?.startsWith('Bearer ') ? bearer.slice(7) : request.cookies.get(SESSION_COOKIE)?.value;
 if (validSession(token,config)) {