From 7a3c47f1d42db441baf57ad68d27751405b04c55 Mon Sep 17 00:00:00 2001
From: luorijun <luorijun@outlook.com>
Date: Thu, 26 Feb 2026 14:47:36 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E5=AF=BC=E8=87=B4=E9=A6=96?=
 =?UTF-8?q?=E6=AC=A1=E7=99=BB=E5=BD=95=E6=97=B6=E6=B3=A8=E5=86=8C=E5=A4=B1?=
 =?UTF-8?q?=E8=B4=A5=E7=9A=84=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 web/auth/endpoints.go | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/web/auth/endpoints.go b/web/auth/endpoints.go
index 3cb12e5..9b11f4e 100644
--- a/web/auth/endpoints.go
+++ b/web/auth/endpoints.go
@@ -353,6 +353,9 @@ func authPassword(c *fiber.Ctx, auth *AuthCtx, req *TokenReq, now time.Time) (*m
 		admin.LastLogin = u.P(time.Now())
 		admin.LastLoginIP = ip
 		admin.LastLoginUA = ua
+
+	default:
+		return nil, ErrAuthorizeInvalidRequest
 	}
 
 	// 生成会话
@@ -364,12 +367,7 @@ func authPassword(c *fiber.Ctx, auth *AuthCtx, req *TokenReq, now time.Time) (*m
 		AccessToken:        uuid.NewString(),
 		AccessTokenExpires: now.Add(time.Duration(env.SessionAccessExpire) * time.Second),
 	}
-	if user != nil {
-		session.UserID = &user.ID
-	}
-	if admin != nil {
-		session.AdminID = &admin.ID
-	}
+
 	if req.Remember {
 		session.RefreshToken = u.P(uuid.NewString())
 		session.RefreshTokenExpires = u.P(now.Add(time.Duration(env.SessionRefreshExpire) * time.Second))
@@ -377,18 +375,20 @@ func authPassword(c *fiber.Ctx, auth *AuthCtx, req *TokenReq, now time.Time) (*m
 
 	// 保存用户更新和会话
 	err = q.Q.Transaction(func(tx *q.Query) error {
-		if err := SaveSession(tx, session); err != nil {
-			return err
-		}
 		if user != nil {
 			if err := tx.User.Save(user); err != nil {
 				return err
 			}
+			session.UserID = &user.ID
 		}
 		if admin != nil {
 			if err := tx.Admin.Save(admin); err != nil {
 				return err
 			}
+			session.AdminID = &admin.ID
+		}
+		if err := SaveSession(tx, session); err != nil {
+			return err
 		}
 		return nil
 	})