From 586fd2583490fa8d7d08a113a5e0936c29a4b35a Mon Sep 17 00:00:00 2001
From: anghunk <anghunk@gmail.com>
Date: Tue, 20 Jan 2026 16:48:59 +0800
Subject: [PATCH] =?UTF-8?q?fix(comments-api):=20=E4=BB=8E=E9=85=8D?=
 =?UTF-8?q?=E7=BD=AE=E6=8E=A5=E5=8F=A3=E5=93=8D=E5=BA=94=E4=B8=AD=E7=A7=BB?=
 =?UTF-8?q?=E9=99=A4=E6=95=8F=E6=84=9F=E7=9A=84=E7=AE=A1=E7=90=86=E5=91=98?=
 =?UTF-8?q?=E5=AF=86=E9=92=A5=E4=BF=A1=E6=81=AF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

确保公共配置接口不会泄露敏感的管理员密钥信息，只返回公开的配置设置
---
 cwd-comments-api/src/index.ts | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/cwd-comments-api/src/index.ts b/cwd-comments-api/src/index.ts
index 3f67957..15a056a 100644
--- a/cwd-comments-api/src/index.ts
+++ b/cwd-comments-api/src/index.ts
@@ -173,7 +173,13 @@ app.post('/api/verify-admin', verifyAdminKey);
 app.get('/api/config/comments', async (c) => {
 	try {
 		const settings = await loadCommentSettings(c.env);
-		return c.json(settings);
+		const {
+			adminKey,
+			adminKeySet,
+			...publicSettings
+		} = settings as any;
+
+		return c.json(publicSettings);
 	} catch (e: any) {
 		return c.json({ message: e.message || '加载评论配置失败' }, 500);
 	}