fix 打开 ota 授权

server/cron.js

@@ -49,7 +49,7 @@ function scheduleOilHistory() {
       const list = sched.schedule || []
       // 待定 且 日期 <= 昨天 (用 Asia/Shanghai 时区推导, 与 cron 触发时区对齐)
       const todayStr = new Date().toLocaleDateString('en-CA', { timeZone: 'Asia/Shanghai' })
-      const today = new Date(todayStr + 'T00:00:00')
+      const today = new Date(todayStr + 'T00:00:00+08:00')
       const yesterdayMs = today.getTime() - 86400000
       const pendingPast = list.filter((it) => {
         if (it.status !== '待定') return false

server/index.js

@@ -25,11 +25,13 @@ app.get('/api/health', (_req, res) => res.json({ ok: true, ts: Date.now() }))
 
 // 业务路由
 app.use('/api/auth', authRouter)
+// OTA 接口是公开的 (检查/下载更新不需要登录), 必须挂载在带 authRequired 的 router 之前,
+// 否则 /api/ota/* 请求会先进入 dataRouter 等并被 authRequired 以 401 拦截
+app.use('/api', otaRouter)
 app.use('/api', dataRouter)
 app.use('/api', newsRouter)
 app.use('/api', alertsRouter)
 app.use('/api', articlesRouter)
-app.use('/api', otaRouter)
 app.use('/api', apizeroRouter)
 app.use('/api', monitorsRouter)
 

server/routes/ota.js

@@ -97,14 +97,6 @@ router.get('/ota/manifest-web', (_req, res) => {
   })
 })
 
-// GET /api/ota/info - 诊断/自检
-router.get('/ota/info', (_req, res) => {
-  const dir = resolveOtaDir()
-  const latest = readLatest()
-  res.json({
-    ota_dir: dir,
-    latest,
-  })
-})
+// GET /api/ota/info 已删除: 诊断接口会暴露服务器路径与签名, 且无调用方
 
 export default router