From aa53691dc73508365612c4711ea83b292cb3f41b Mon Sep 17 00:00:00 2001
From: Marcus <1922576605@qq.com>
Date: Fri, 24 Apr 2026 22:41:18 +0800
Subject: [PATCH] =?UTF-8?q?feat:=20=E6=B7=BB=E5=8A=A0=E8=AF=B7=E6=B1=82?=
 =?UTF-8?q?=E6=97=A5=E5=BF=97=E4=B8=AD=E9=97=B4=E4=BB=B6=E4=BB=A5=E8=AE=B0?=
 =?UTF-8?q?=E5=BD=95=E8=AF=B7=E6=B1=82=E4=BF=A1=E6=81=AF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Copilot <copilot@github.com>
---
 server/api/auth/login.post.ts | 10 +++++++---
 server/middleware/log.ts      | 26 ++++++++++++++++++++++++++
 2 files changed, 33 insertions(+), 3 deletions(-)
 create mode 100644 server/middleware/log.ts

diff --git a/server/api/auth/login.post.ts b/server/api/auth/login.post.ts
index 1548444..b9bfc19 100644
--- a/server/api/auth/login.post.ts
+++ b/server/api/auth/login.post.ts
@@ -1,4 +1,5 @@
 // server/api/auth/login.post.ts
+import { consola } from "consola";
 import type { IUserLoginData, IUserLoginRequest } from "#shared/types";
 import {
   clearNewApiAuthCookies,
@@ -78,10 +79,10 @@ export default defineEventHandler(async (event) => {
     if (!session) {
       // 没有 session 就不能恢复 NewAPI 登录态，必须让前端明确感知失败。
       clearNewApiAuthCookies(event);
-      return createErrorResponse(
-        500,
-        "登录成功但未收到 NewAPI session，请稍后重试"
+      consola.error(
+        "/api/auth/login 登录成功但未收到 NewAPI session，请稍后重试"
       );
+      return createErrorResponse(500, "服务器错误，请稍后重试");
     }
 
     setNewApiAuthCookies(
@@ -97,6 +98,7 @@ export default defineEventHandler(async (event) => {
     );
   } catch (error) {
     clearNewApiAuthCookies(event);
+    consola.error("/api/auth/login 登录失败", error);
     return createUpstreamErrorResponse(error, "登录失败");
   }
 });
@@ -113,6 +115,7 @@ const normalizeLoginResponse = (
   }
 
   if (!isRecord(response)) {
+    consola.error("/api/auth/login 登录失败：响应不是对象");
     return {
       message: "登录失败",
       user: null
@@ -124,6 +127,7 @@ const normalizeLoginResponse = (
     wrapped.message || (wrapped.success ? "登录成功" : "登录失败");
 
   if (wrapped.success !== true || !isUser(wrapped.data)) {
+    consola.error("/api/auth/login 登录失败：上游返回的数据格式不正确");
     return {
       message,
       user: null
diff --git a/server/middleware/log.ts b/server/middleware/log.ts
new file mode 100644
index 0000000..eaf9ba8
--- /dev/null
+++ b/server/middleware/log.ts
@@ -0,0 +1,26 @@
+import { consola } from "consola";
+
+/**
+ * 请求日志中间件：记录每次请求的 method、路径、状态码和耗时。
+ * 不记录请求体和响应体，避免密码、token 等敏感信息泄漏。
+ */
+export default defineEventHandler((event) => {
+  const start = Date.now();
+  const method = event.node.req.method ?? "UNKNOWN";
+  const path = getRequestURL(event).pathname;
+
+  // 响应发送完毕后记录结果
+  event.node.res.on("finish", () => {
+    const status = event.node.res.statusCode;
+    const elapsed = Date.now() - start;
+    const log = `[${method}] ${path} → ${status} (${elapsed}ms)`;
+
+    if (status >= 500) {
+      consola.error(log);
+    } else if (status >= 400) {
+      consola.warn(log);
+    } else {
+      consola.info(log);
+    }
+  });
+});