From 0f721bcc093e9a63ffc47330a15e4da185459fdf Mon Sep 17 00:00:00 2001
From: li <ljf@com>
Date: Sat, 14 Mar 2026 17:57:27 +0800
Subject: [PATCH] fix: return JSON 401 for unauthenticated API requests instead
 of redirecting to login route

---
 backend/bootstrap/app.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/backend/bootstrap/app.php b/backend/bootstrap/app.php
index fe8cf5d..30d5b54 100644
--- a/backend/bootstrap/app.php
+++ b/backend/bootstrap/app.php
@@ -22,5 +22,9 @@ return Application::configure(basePath: dirname(__DIR__))
         // Removed statefulApi() — app uses Bearer token auth, not cookie SPA auth
     })
     ->withExceptions(function (Exceptions $exceptions): void {
-        //
+        $exceptions->render(function (\Illuminate\Auth\AuthenticationException $e, $request) {
+            if ($request->expectsJson() || $request->is('api/*')) {
+                return response()->json(['message' => '未认证，请先登录'], 401);
+            }
+        });
     })->create();