Refine auth, API proxy, and server routing

server/index.js

@@ -31,9 +31,6 @@ app.use(cors({
 }));
 
 app.use(express.json());
-app.use(express.static(path.join(__dirname, '../public')));
-app.use(express.static(path.join(__dirname, '../frontend/.next')));
-app.use(express.static(path.join(__dirname, '../frontend/.next/server/pages')));
 
 // 请求日志
 app.use((req, res, next) => {
@@ -55,6 +52,10 @@ app.get('/api/health', (req, res) => {
   res.json({ status: 'ok', timestamp: new Date().toISOString() });
 });
 
+app.use(express.static(path.join(__dirname, '../public')));
+app.use(express.static(path.join(__dirname, '../frontend/.next')));
+app.use(express.static(path.join(__dirname, '../frontend/.next/server/pages')));
+
 // 前端路由 - Next.js 静态文件
 app.get('/_next/static/:path(*)', (req, res) => {
   const filePath = path.join(__dirname, '../frontend/.next/static', req.params.path);

server/middleware/auth.js

@@ -1,7 +1,13 @@
 const jwt = require('jsonwebtoken');
 const { AppError } = require('./errorHandler');
 
-const JWT_SECRET = process.env.JWT_SECRET || 'accountbook_secret_key_2024';
+const JWT_SECRET = process.env.JWT_SECRET;
+
+if (!JWT_SECRET && process.env.NODE_ENV === 'production') {
+  throw new Error('JWT_SECRET must be set in production');
+}
+
+const tokenSecret = JWT_SECRET || 'accountbook_secret_key_2024';
 
 function authenticate(req, res, next) {
   const token = req.headers.authorization?.split(' ')[1];
@@ -10,7 +16,7 @@ function authenticate(req, res, next) {
   }
 
   try {
-    const decoded = jwt.verify(token, JWT_SECRET);
+    const decoded = jwt.verify(token, tokenSecret);
     req.userId = decoded.userId;
     next();
   } catch (err) {
@@ -19,11 +25,11 @@ function authenticate(req, res, next) {
 }
 
 function generateToken(userId) {
-  return jwt.sign({ userId }, JWT_SECRET, { expiresIn: '7d' });
+  return jwt.sign({ userId }, tokenSecret, { expiresIn: '7d' });
 }
 
 module.exports = {
   authenticate,
   generateToken,
-  JWT_SECRET,
+  JWT_SECRET: tokenSecret,
 };

server/routes/records.js

@@ -48,7 +48,10 @@ router.post('/', authenticate, asyncHandler(async (req, res) => {
   const result = stmt.run(req.userId, type, amount, category.trim(), date, normalizeNote(note));
   console.log(`Record created: user=${req.userId}, id=${result.lastInsertRowid}`);
 
-  res.json({ id: result.lastInsertRowid, message: '添加成功' });
+  const createdRecord = db.prepare('SELECT * FROM records WHERE id = ? AND user_id = ?')
+    .get(result.lastInsertRowid, req.userId);
+
+  res.json(createdRecord);
 }));
 
 // 更新账目