From 06657481a5ec4d6a37a12ae4ffba9ddde2dc69c7 Mon Sep 17 00:00:00 2001
From: Your Name <your.email@example.com>
Date: Mon, 23 Feb 2026 12:49:04 +0800
Subject: [PATCH] fix: disable caching for auth settings api responses

---
 app/api/auth-settings/route.ts | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/app/api/auth-settings/route.ts b/app/api/auth-settings/route.ts
index f5b8891c8..123ed1ce5 100644
--- a/app/api/auth-settings/route.ts
+++ b/app/api/auth-settings/route.ts
@@ -5,6 +5,15 @@ import { authSettings } from "@/lib/db/schema";
 import { eq } from "drizzle-orm";
 import { auth } from "@/app/(auth)/auth";
 
+function jsonNoStore(data: unknown, init?: ResponseInit) {
+  const response = NextResponse.json(data, init);
+  response.headers.set("Cache-Control", "no-store, no-cache, must-revalidate, proxy-revalidate");
+  response.headers.set("Pragma", "no-cache");
+  response.headers.set("Expires", "0");
+  response.headers.set("Vary", "Cookie, Authorization");
+  return response;
+}
+
 // GET /api/auth-settings - 获取认证配置
 export async function GET() {
   try {
@@ -23,7 +32,7 @@ export async function GET() {
     
     // 如果没有配置记录，返回默认值
     if (!settings) {
-      return NextResponse.json({
+      return jsonNoStore({
         dingTalkAppKey: "",
         dingTalkAppSecret: "", // 即使是空的，非管理员也不应该看到这个字段名，但因为是空字符串，问题不大
         dingTalkOrganizations: [],
@@ -43,7 +52,7 @@ export async function GET() {
     }
     
     if (isAdmin) {
-      return NextResponse.json({
+      return jsonNoStore({
         ...settings,
         googleClientId: resolvedGoogleClientId,
         googleClientSecret: resolvedGoogleClientSecret,
@@ -66,7 +75,7 @@ export async function GET() {
         name: org.name,
       })) ?? [];
 
-    return NextResponse.json({
+    return jsonNoStore({
       dingTalkAppKey: settings.dingTalkAppKey,
       isDingTalkEnabled: settings.isDingTalkEnabled,
       isGoogleEnabled: settings.isGoogleEnabled,
@@ -83,7 +92,7 @@ export async function GET() {
     });
   } catch (error) {
     console.error("[Auth Settings API] Get error:", error);
-    return NextResponse.json(
+    return jsonNoStore(
       { error: "Failed to fetch auth settings" },
       { status: 500 }
     );