fix: disable caching for auth settings api responses

app/api/auth-settings/route.ts

@@ -5,6 +5,15 @@ import { authSettings } from "@/lib/db/schema";
 import { eq } from "drizzle-orm";
 import { auth } from "@/app/(auth)/auth";
 
+function jsonNoStore(data: unknown, init?: ResponseInit) {
+  const response = NextResponse.json(data, init);
+  response.headers.set("Cache-Control", "no-store, no-cache, must-revalidate, proxy-revalidate");
+  response.headers.set("Pragma", "no-cache");
+  response.headers.set("Expires", "0");
+  response.headers.set("Vary", "Cookie, Authorization");
+  return response;
+}
+
 // GET /api/auth-settings - 获取认证配置
 export async function GET() {
   try {
@@ -23,7 +32,7 @@ export async function GET() {
     
     // 如果没有配置记录，返回默认值
     if (!settings) {
-      return NextResponse.json({
+      return jsonNoStore({
         dingTalkAppKey: "",
         dingTalkAppSecret: "", // 即使是空的，非管理员也不应该看到这个字段名，但因为是空字符串，问题不大
         dingTalkOrganizations: [],
@@ -43,7 +52,7 @@ export async function GET() {
     }
     
     if (isAdmin) {
-      return NextResponse.json({
+      return jsonNoStore({
         ...settings,
         googleClientId: resolvedGoogleClientId,
         googleClientSecret: resolvedGoogleClientSecret,
@@ -66,7 +75,7 @@ export async function GET() {
         name: org.name,
       })) ?? [];
 
-    return NextResponse.json({
+    return jsonNoStore({
       dingTalkAppKey: settings.dingTalkAppKey,
       isDingTalkEnabled: settings.isDingTalkEnabled,
       isGoogleEnabled: settings.isGoogleEnabled,
@@ -83,7 +92,7 @@ export async function GET() {
     });
   } catch (error) {
     console.error("[Auth Settings API] Get error:", error);
-    return NextResponse.json(
+    return jsonNoStore(
       { error: "Failed to fetch auth settings" },
       { status: 500 }
     );