From 1669047c1180825d5be588ec19740a39102cc692 Mon Sep 17 00:00:00 2001
From: Your Name <your.email@example.com>
Date: Sat, 14 Feb 2026 02:23:46 +0800
Subject: [PATCH] Remove auth sensitive logging in NextAuth routes

---
 app/(auth)/api/auth/[...nextauth]/route.ts | 13 ++---------
 app/(auth)/auth.ts                         | 27 ++++------------------
 2 files changed, 7 insertions(+), 33 deletions(-)

diff --git a/app/(auth)/api/auth/[...nextauth]/route.ts b/app/(auth)/api/auth/[...nextauth]/route.ts
index dd640c898..886a41c3e 100644
--- a/app/(auth)/api/auth/[...nextauth]/route.ts
+++ b/app/(auth)/api/auth/[...nextauth]/route.ts
@@ -1,18 +1,9 @@
 import { GET as AuthGET, POST as AuthPOST } from "@/app/(auth)/auth";
 
 export const GET = async (req: Request) => {
-  console.log("[Auth API] GET request:", req.url);
   return AuthGET(req);
-}
+};
 
 export const POST = async (req: Request) => {
-  console.log("[Auth API] POST request:", req.url);
-  try {
-    const clone = req.clone();
-    const text = await clone.text();
-    console.log("[Auth API] POST body:", text.substring(0, 500));
-  } catch (e) {
-    console.error("[Auth API] Error reading body:", e);
-  }
   return AuthPOST(req);
-}
+};
diff --git a/app/(auth)/auth.ts b/app/(auth)/auth.ts
index e3be1c5ba..ce2b00d7e 100644
--- a/app/(auth)/auth.ts
+++ b/app/(auth)/auth.ts
@@ -63,13 +63,10 @@ function createBaseProviders(googleClientId?: string, googleClientSecret?: strin
     Credentials({
       credentials: {},
       async authorize(credentials: any) {
-        console.log("[Auth] Authorize called with credentials:", Object.keys(credentials));
-        
         // 1. DingTalk Token 登录逻辑
         if (credentials.token) {
           const { token } = credentials;
-          console.log("[Auth] DingTalk logic triggered with token:", token ? token.substring(0, 8) + "..." : "null");
-          
+
           const now = new Date();
           const [validToken] = await db
             .select()
@@ -77,41 +74,27 @@ function createBaseProviders(googleClientId?: string, googleClientSecret?: strin
             .where(and(eq(loginToken.token, token), gt(loginToken.expiresAt, now)))
             .limit(1);
 
-          console.log("[Auth] Token lookup result:", validToken ? {
-            email: validToken.email,
-            expiresAt: validToken.expiresAt,
-            isExpired: validToken.expiresAt <= now
-          } : "not found");
-
           if (!validToken) {
-            console.log("[Auth] Token not found or expired, returning null");
             return null;
           }
 
           const users = await getUser(validToken.email);
-          console.log("[Auth] User lookup for", validToken.email, ":", users.length, "users found");
-          
+
           if (users.length === 0) {
-            console.log("[Auth] No user found for email, returning null");
             return null;
           }
 
           const user = users[0];
-          console.log("[Auth] User found:", { id: user.id, email: user.email, isActive: user.isActive, role: user.role });
-          
+
           // 检查用户是否被激活
           if (!user.isActive) {
-            console.log("[Auth] User is not active, returning null");
             return null;
           }
-          
+
           await db.delete(loginToken).where(eq(loginToken.id, validToken.id));
-          console.log("[Auth] Login token deleted");
 
           const userType: UserType = (user.role as UserType) || "regular";
-          const returnUser = { id: user.id, email: user.email, name: user.name, type: userType };
-          console.log("[Auth] Returning user object:", returnUser);
-          return returnUser;
+          return { id: user.id, email: user.email, name: user.name, type: userType };
         }
 
         // 2. 邮箱密码登录逻辑