使用openai进行了代码review

src/app/api/settings/init/route.ts

@@ -1,16 +1,43 @@
-import { NextResponse } from "next/server";
+import { NextResponse } from "next/server";
 import { prisma } from "@/lib/prisma";
 import { hashPassword } from "@/lib/auth";
 
-export async function POST() {
+export async function POST(req: Request) {
     try {
         const count = await prisma.globalSettings.count();
         if (count > 0) {
             return NextResponse.json({ message: "Settings already initialized" }, { status: 200 });
         }
 
-        // Default password: "admin"
-        const hashedPassword = await hashPassword("admin");
+        const body = await req.json().catch(() => ({}));
+        const passwordFromBody = typeof body?.password === "string" ? body.password : "";
+        const passwordFromEnv = process.env.INIT_DEFAULT_PASSWORD || "";
+        const initPassword = passwordFromBody || passwordFromEnv;
+
+        if (!initPassword || initPassword.length < 6) {
+            return NextResponse.json(
+                { error: "Missing init password. Provide body.password or INIT_DEFAULT_PASSWORD (min 6 chars)." },
+                { status: 400 }
+            );
+        }
+
+        const initToken = process.env.INIT_SETUP_TOKEN;
+        const isProduction = process.env.NODE_ENV === "production";
+        if (isProduction && !initToken) {
+            return NextResponse.json(
+                { error: "Server misconfigured: INIT_SETUP_TOKEN is required in production." },
+                { status: 500 }
+            );
+        }
+
+        if (initToken) {
+            const providedToken = req.headers.get("x-init-token");
+            if (providedToken !== initToken) {
+                return NextResponse.json({ error: "Invalid init token" }, { status: 401 });
+            }
+        }
+
+        const hashedPassword = await hashPassword(initPassword);
         await prisma.globalSettings.create({
             data: {
                 id: "default",