feat: 迁移自定义功能至 1.5.9.9 版本

包含音乐源限制、CI 防 OOM 优化、数据库连接池优化、管理端权限及 UI 细节定制等功能

server/api/admin/users/[id]/reset-password.post.ts

@@ -1,26 +1,18 @@
-import { eq } from 'drizzle-orm'
+import { updateUserPassword } from '~~/server/services/userService'
 import { db } from '~/drizzle/db'
 import { users } from '~/drizzle/schema'
-import { updateUserPassword } from '~~/server/services/userService'
-import {
-  PASSWORD_AUDIT_ACTIONS,
-  getPasswordAuditContext,
-  recordPasswordAudit
-} from '~~/server/services/passwordSecurityService'
-import { createApiError } from '~~/server/utils/apiError'
-import { getAdminPasswordViolation } from '~~/server/utils/admin-password-policy'
+import { eq } from 'drizzle-orm'
+import { canResetPasswordFor, getRoleLevel } from '~~/server/utils/permissions'
 
 export default defineEventHandler(async (event) => {
-  // 检查认证和权限
-  const user = event.context.user
-  if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
+  const currentUser = event.context.user
+  if (!currentUser || !['ADMIN', 'SUPER_ADMIN'].includes(currentUser.role)) {
     throw createError({
       statusCode: 403,
       message: '没有权限访问'
     })
   }
 
-  // 安全获取ID参数
   const params = event.context.params || {}
   const id = parseInt(params.id || '')
 
@@ -31,39 +23,38 @@ export default defineEventHandler(async (event) => {
     })
   }
 
-  const body = await readBody<Record<string, unknown> | null>(event)
-  const newPassword = typeof body?.newPassword === 'string' ? body.newPassword.trim() : ''
+  const body = await readBody(event)
 
-  // 管理员重置为临时密码且 forceReset 强制用户登录后修改，仅做基础校验不要求完整复杂度
-  const violation = getAdminPasswordViolation(newPassword)
-  if (violation) {
-    throw createApiError(400, violation.code, violation.message)
+  if (!body.newPassword) {
+    throw createError({
+      statusCode: 400,
+      message: '新密码不能为空'
+    })
   }
 
   try {
-    // 查询目标用户用于越级保护
-    const targetUsers = await db
-      .select({ id: users.id, role: users.role })
-      .from(users)
-      .where(eq(users.id, id))
-      .limit(1)
-    const targetUser = targetUsers[0]
-    if (!targetUser) {
-      throw createError({
-        statusCode: 404,
-        message: '用户不存在'
-      })
-    }
-
-    // 禁止对自身进行密码重置（通过用户管理界面）
-    if (id === user.id) {
+    if (id === currentUser.id) {
       throw createError({
         statusCode: 400,
         message: '禁止在用户管理中重置自己的密码'
       })
     }
 
-    // 禁止重置系统初始超级管理员 (ID: 1)
+    const targetUserResult = await db
+      .select({ id: users.id, role: users.role, username: users.username })
+      .from(users)
+      .where(eq(users.id, id))
+      .limit(1)
+
+    if (targetUserResult.length === 0) {
+      throw createError({
+        statusCode: 404,
+        message: '用户不存在'
+      })
+    }
+
+    const targetUser = targetUserResult[0]
+
     if (targetUser.id === 1) {
       throw createError({
         statusCode: 403,
@@ -71,39 +62,36 @@ export default defineEventHandler(async (event) => {
       })
     }
 
-    // 越级保护：目标用户是 SUPER_ADMIN 时，操作者必须是 SUPER_ADMIN
-    if (targetUser.role === 'SUPER_ADMIN' && user.role !== 'SUPER_ADMIN') {
+    const currentLevel = getRoleLevel(currentUser.role)
+    const targetLevel = getRoleLevel(targetUser.role)
+
+    if (currentUser.role !== 'SUPER_ADMIN') {
+      if (currentLevel <= targetLevel) {
+        throw createError({
+          statusCode: 403,
+          message: '权限不足：不能重置角色级别大于等于自己的用户密码'
+        })
+      }
+    }
+
+    if (!canResetPasswordFor(currentUser, targetUser)) {
       throw createError({
         statusCode: 403,
-        message: '权限不足：普通管理员无法重置超级管理员密码'
+        message: '权限不足：当前角色无法重置该用户的密码'
       })
     }
 
-    // 使用统一服务重置密码 (forceReset = true)
-    await updateUserPassword(id, newPassword, {
-      forceReset: true,
-      auditContext: {
-        action: PASSWORD_AUDIT_ACTIONS.RESET_PASSWORD,
-        actorId: user.id,
-        ...getPasswordAuditContext(event)
-      }
-    })
+    await updateUserPassword(id, body.newPassword, true)
 
     return {
       success: true,
       message: '密码重置成功'
     }
   } catch (error) {
-    await recordPasswordAudit(
-      event,
-      id,
-      PASSWORD_AUDIT_ACTIONS.RESET_PASSWORD,
-      false,
-      error instanceof Error ? error.message : '管理员重置密码失败',
-      user.id
-    )
-    console.error('重置密码失败:', error)
-    if (error && typeof error === 'object' && 'statusCode' in error) throw error
+    console.error('[ResetPassword] 失败:', error)
+    if (error.statusCode) {
+      throw error
+    }
     throw createError({
       statusCode: 500,
       message: '重置密码失败'