fix: 加固 LinuxDo OAuth 登录安全与配置校验

frontend/src/stores/app.ts

@@ -30,6 +30,7 @@ export const useAppStore = defineStore('app', () => {
   const contactInfo = ref<string>('')
   const apiBaseUrl = ref<string>('')
   const docUrl = ref<string>('')
+  const cachedPublicSettings = ref<PublicSettings | null>(null)
 
   // Version cache state
   const versionLoaded = ref<boolean>(false)
@@ -282,24 +283,27 @@ export const useAppStore = defineStore('app', () => {
    * Fetch public settings (uses cache unless force=true)
    * @param force - Force refresh from API
    */
-	  async function fetchPublicSettings(force = false): Promise<PublicSettings | null> {
-	    // Return cached data if available and not forcing refresh
-	    if (publicSettingsLoaded.value && !force) {
-	      return {
-	        registration_enabled: false,
-	        email_verify_enabled: false,
-	        turnstile_enabled: false,
-	        turnstile_site_key: '',
-	        site_name: siteName.value,
-	        site_logo: siteLogo.value,
-	        site_subtitle: '',
-	        api_base_url: apiBaseUrl.value,
-	        contact_info: contactInfo.value,
-	        doc_url: docUrl.value,
-	        linuxdo_oauth_enabled: false,
-	        version: siteVersion.value
-	      }
-	    }
+  async function fetchPublicSettings(force = false): Promise<PublicSettings | null> {
+    // Return cached data if available and not forcing refresh
+    if (publicSettingsLoaded.value && !force) {
+      if (cachedPublicSettings.value) {
+        return { ...cachedPublicSettings.value }
+      }
+      return {
+        registration_enabled: false,
+        email_verify_enabled: false,
+        turnstile_enabled: false,
+        turnstile_site_key: '',
+        site_name: siteName.value,
+        site_logo: siteLogo.value,
+        site_subtitle: '',
+        api_base_url: apiBaseUrl.value,
+        contact_info: contactInfo.value,
+        doc_url: docUrl.value,
+        linuxdo_oauth_enabled: false,
+        version: siteVersion.value
+      }
+    }
 
     // Prevent duplicate requests
     if (publicSettingsLoading.value) {
@@ -309,6 +313,7 @@ export const useAppStore = defineStore('app', () => {
     publicSettingsLoading.value = true
     try {
       const data = await fetchPublicSettingsAPI()
+      cachedPublicSettings.value = data
       siteName.value = data.site_name || 'Sub2API'
       siteLogo.value = data.site_logo || ''
       siteVersion.value = data.version || ''
@@ -330,6 +335,7 @@ export const useAppStore = defineStore('app', () => {
    */
   function clearPublicSettingsCache(): void {
     publicSettingsLoaded.value = false
+    cachedPublicSettings.value = null
   }
 
   // ==================== Return Store API ====================

frontend/src/stores/auth.ts

@@ -160,8 +160,8 @@ export const useAuthStore = defineStore('auth', () => {
   }
 
   /**
-   * Set token directly (OAuth/SSO callback) and load current user profile.
-   * @param newToken - JWT access token issued by backend
+   * 直接设置 token（用于 OAuth/SSO 回调），并加载当前用户信息。
+   * @param newToken - 后端签发的 JWT access token
    */
   async function setToken(newToken: string): Promise<User> {
     // Clear any previous state first (avoid mixing sessions)