From 1ff489971bfbf55daacaa49a661f6e3ece876d9b Mon Sep 17 00:00:00 2001
From: Admin <admin@viaeon.com>
Date: Thu, 16 Jul 2026 23:41:09 +0000
Subject: [PATCH] fix: register API routes before NoRoute to prevent route
 hijacking

---
 cmd/server/main.go | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/cmd/server/main.go b/cmd/server/main.go
index 482be25..a871247 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -48,13 +48,7 @@ func main() {
 		AllowCredentials: true,
 	}))
 
-	// 静态文件服务（前端）
-	r.Static("/assets", "./web/dist/assets")
-	r.NoRoute(func(c *gin.Context) {
-		c.File("./web/dist/index.html")
-	})
-
-	// API 路由
+	// API 路由（必须在 NoRoute 之前注册）
 	captchaHandler := handler.NewCaptchaHandler(captcha.NewHandler("./models"))
 	captchaHandler.RegisterRoutes(r.Group(""), true)
 
@@ -64,6 +58,12 @@ func main() {
 		c.JSON(200, gin.H{"installed": config.IsInstalled()})
 	})
 
+	// 静态文件服务（前端）- 必须在 API 路由之后
+	r.Static("/assets", "./web/dist/assets")
+	r.NoRoute(func(c *gin.Context) {
+		c.File("./web/dist/index.html")
+	})
+
 	// 健康检查
 	r.GET("/health", func(c *gin.Context) {
 		c.JSON(200, gin.H{"status": "ok"})