feat: align with upstream 1.5.9.9

2026-09-12 18:21:11 +08:00
commit 34f0679117
805 changed files with 376275 additions and 0 deletions
@@ -0,0 +1,292 @@
+import { db, userIdentities, eq, and, users, systemSettings } from '~/drizzle/db'
+import { JWTEnhanced } from '~~/server/utils/jwt-enhanced'
+import { createAuthSession } from '~~/server/utils/auth-session'
+import { getClientIP } from '~~/server/utils/ip-utils'
+import { getServerTimestamp } from '~~/server/utils/serverTime'
+import { getBeijingTime } from '~/utils/timeUtils'
+import { verifyBindingToken } from '~~/server/utils/oauth-token'
+import { isSecureRequest } from '~~/server/utils/request-utils'
+import {
+  delStore,
+  delStoreIfValue,
+  getStore,
+  incrStore,
+  parseStoreJson,
+  verifyStateCode
+} from '~~/server/utils/captchaStore'
+import otplib from 'otplib'
+import { createApiError } from '~~/server/utils/apiError'
+import {
+  computeRequirePasswordChange,
+  resolveRequirePasswordChange
+} from '~~/server/utils/system-settings-helper'
+import { getPasswordSetupState } from '~~/server/utils/initial-password-policy'
+import { canBindOAuthIdentity } from '~~/server/utils/auth-route-policy'
+import { syncOAuthIdentityAvatar } from '~~/server/utils/oauth-identity'
+
+const { authenticator } = otplib
+const TOTP_FAILURE_LIMIT = 5
+const TOTP_FAILURE_WINDOW_SECONDS = 5 * 60
+
+export default defineEventHandler(async (event) => {
+  const body = await readBody<Record<string, unknown> | null>(event)
+  const code = typeof body?.code === 'string' ? body.code : ''
+  const type = typeof body?.type === 'string' ? body.type : ''
+  const bodyToken = typeof body?.token === 'string' ? body.token : ''
+  const token = bodyToken || getCookie(event, 'pre-auth-token')
+
+  if (!code || !type) {
+    throw createApiError(400, 'AUTH_MISSING_REQUIRED_PARAMS', '缺少必要参数')
+  }
+
+  // 验证预认证临时令牌
+  let targetUserId: number
+  let preAuthPayload: { tokenVersion?: unknown } | null = null
+
+  if (token) {
+    try {
+      const decoded = JWTEnhanced.verify(token) as any
+      if (decoded.type !== 'pre-auth' || decoded.scope !== '2fa_pending') {
+        throw new Error('无效的预认证令牌')
+      }
+      targetUserId = decoded.userId
+      preAuthPayload = decoded
+    } catch (e) {
+      deleteCookie(event, 'pre-auth-token')
+      throw createApiError(401, 'AUTH_SESSION_EXPIRED', '会话已失效，请重新登录')
+    }
+  } else {
+    // 强制要求 Token
+    throw createApiError(400, 'AUTH_MISSING_PRE_TOKEN_RELOGIN', '缺少预认证令牌，请重新登录')
+  }
+
+  // 获取用户信息
+  const userResult = await db.select().from(users).where(eq(users.id, targetUserId)).limit(1)
+  const user = userResult[0]
+  if (!user) {
+    throw createApiError(404, 'USER_NOT_FOUND', '用户不存在')
+  }
+
+  if (!JWTEnhanced.hasCurrentTokenVersion(preAuthPayload, user.tokenVersion)) {
+    deleteCookie(event, 'pre-auth-token')
+    deleteCookie(event, 'binding-token')
+    throw createApiError(401, 'AUTH_SESSION_EXPIRED', '会话已失效，请重新登录')
+  }
+
+  if (user.status !== 'active') {
+    throw createApiError(403, 'AUTH_ACCOUNT_DISABLED_OR_RESTRICTED', '账号已被禁用或限制访问')
+  }
+
+  const clientIp = getClientIP(event)
+  const totpUserFailureKey = `2fa_totp_user:${targetUserId}`
+  const totpIpFailureKey = `2fa_totp_ip:${clientIp}`
+
+  if (type === 'totp') {
+    const identity = await db.query.userIdentities.findFirst({
+      where: and(eq(userIdentities.userId, targetUserId), eq(userIdentities.provider, 'totp'))
+    })
+    if (!identity) {
+      throw createApiError(400, 'AUTH_TOTP_NOT_ENABLED', '未开启TOTP验证')
+    }
+
+    // 先原子占用一次验证额度，防止并发请求同时绕过失败次数限制。
+    const [userFailureCount, ipFailureCount] = await Promise.all([
+      incrStore(totpUserFailureKey, TOTP_FAILURE_WINDOW_SECONDS),
+      incrStore(totpIpFailureKey, TOTP_FAILURE_WINDOW_SECONDS)
+    ])
+
+    if (userFailureCount > TOTP_FAILURE_LIMIT || ipFailureCount > TOTP_FAILURE_LIMIT) {
+      throw createApiError(
+        429,
+        'AUTH_TOTP_TOO_MANY_ATTEMPTS',
+        '动态验证码错误次数过多，请在 5 分钟后重试'
+      )
+    }
+
+    const totpValid = authenticator.check(code, identity.providerUserId)
+
+    if (!totpValid) {
+      throw createApiError(400, 'AUTH_TOTP_CODE_INVALID', '动态验证码错误')
+    }
+
+    await delStore(totpUserFailureKey)
+    await delStore(totpIpFailureKey)
+  } else if (type === 'email') {
+    const stateKey = `2fa-email:${targetUserId}`
+    const storedRaw = await getStore(stateKey)
+    const stored = parseStoreJson<{
+      codeHash: string
+      expiresAt: number
+    }>(storedRaw)
+
+    if (!stored || typeof stored.codeHash !== 'string' || !Number.isFinite(stored.expiresAt)) {
+      if (storedRaw) await delStoreIfValue(stateKey, storedRaw)
+      throw createApiError(400, 'AUTH_CODE_EXPIRED_OR_MISSING', '验证码已过期或不存在')
+    }
+
+    const now = getServerTimestamp()
+    if (stored.expiresAt <= now) {
+      await delStoreIfValue(stateKey, storedRaw!)
+      throw createApiError(400, 'AUTH_CODE_EXPIRED', '验证码已过期')
+    }
+
+    const remainingTtl = Math.max(1, Math.ceil((stored.expiresAt - now) / 1000))
+    const attemptKey = `${stateKey}:attempts:${stored.codeHash}`
+    const attemptCount = await incrStore(attemptKey, remainingTtl)
+
+    if (attemptCount > 5) {
+      await delStoreIfValue(stateKey, storedRaw!)
+      await delStore(attemptKey)
+      throw createApiError(400, 'AUTH_TOO_MANY_VERIFY_ATTEMPTS', '验证尝试次数过多，请重新获取')
+    }
+
+    if (verifyStateCode(stateKey, String(code), stored.codeHash)) {
+      if (!(await delStoreIfValue(stateKey, storedRaw!))) {
+        throw createApiError(400, 'AUTH_CODE_ALREADY_USED', '验证码已使用，请重新获取')
+      }
+      await delStore(attemptKey)
+    } else {
+      if (attemptCount >= 5) {
+        await delStoreIfValue(stateKey, storedRaw!)
+        await delStore(attemptKey)
+        throw createApiError(400, 'AUTH_TOO_MANY_VERIFY_ATTEMPTS', '验证尝试次数过多，请重新获取')
+      }
+      throw createApiError(
+        400,
+        'AUTH_CODE_WRONG_ATTEMPTS_LEFT',
+        `验证码错误，剩余尝试次数：${5 - attemptCount}`,
+        { params: [5 - attemptCount] }
+      )
+    }
+  } else {
+    throw createApiError(400, 'AUTH_UNSUPPORTED_VERIFICATION_TYPE', '不支持的验证类型')
+  }
+
+  // 验证通过，更新登录信息
+  const bindingToken = getCookie(event, 'binding-token')
+  if (bindingToken) {
+    let bindingPayload
+    try {
+      bindingPayload = verifyBindingToken(bindingToken)
+    } catch (e) {
+      deleteCookie(event, 'binding-token')
+      deleteCookie(event, 'pre-auth-token')
+      throw createApiError(400, 'AUTH_BINDING_SESSION_INVALID', '绑定会话已失效，请重新发起绑定')
+    }
+
+    await db.transaction(async (tx) => {
+      const [currentUser] = await tx
+        .select({
+          id: users.id,
+          tokenVersion: users.tokenVersion,
+          forcePasswordChange: users.forcePasswordChange,
+          passwordChangedAt: users.passwordChangedAt,
+          avatarProvider: users.avatarProvider,
+          avatarProviderUserId: users.avatarProviderUserId
+        })
+        .from(users)
+        .where(eq(users.id, user.id))
+        .for('update')
+
+      if (
+        !currentUser ||
+        !JWTEnhanced.hasCurrentTokenVersion(preAuthPayload, currentUser.tokenVersion)
+      ) {
+        deleteCookie(event, 'binding-token')
+        deleteCookie(event, 'pre-auth-token')
+        throw createApiError(401, 'AUTH_SESSION_EXPIRED', '会话已失效，请重新登录')
+      }
+
+      const [currentSettings] = await tx
+        .select({
+          forcePasswordChangeOnFirstLogin: systemSettings.forcePasswordChangeOnFirstLogin
+        })
+        .from(systemSettings)
+        .limit(1)
+        .for('share')
+      const requirePasswordChange = computeRequirePasswordChange(
+        currentUser,
+        currentSettings?.forcePasswordChangeOnFirstLogin ?? false
+      )
+
+      if (!canBindOAuthIdentity(requirePasswordChange)) {
+        deleteCookie(event, 'binding-token')
+        deleteCookie(event, 'pre-auth-token')
+        throw createApiError(
+          403,
+          'AUTH_PASSWORD_CHANGE_REQUIRED',
+          '请先完成密码修改后再绑定第三方账号',
+          { requirePasswordChange: true }
+        )
+      }
+
+      const existing = await tx.query.userIdentities.findFirst({
+        where: (t, { eq, and }) =>
+          and(
+            eq(t.provider, bindingPayload.provider),
+            eq(t.providerUserId, bindingPayload.providerUserId)
+          )
+      })
+
+      if (existing && existing.userId !== user.id) {
+        throw createApiError(409, 'AUTH_OAUTH_BOUND_OTHER_USER', '该第三方账号已被其他用户绑定')
+      }
+
+      await syncOAuthIdentityAvatar(tx, currentUser, existing, {
+        provider: bindingPayload.provider,
+        providerUserId: bindingPayload.providerUserId,
+        providerUsername: bindingPayload.providerUsername,
+        avatar: bindingPayload.avatar
+      })
+    })
+  }
+
+  await db
+    .update(users)
+    .set({
+      lastLogin: getBeijingTime(),
+      lastLoginIp: clientIp
+    })
+    .where(eq(users.id, user.id))
+    .catch((err) => console.error('Error updating user login info:', err))
+
+  // 生成Token
+  const { token: authToken } = await createAuthSession(event, user, '2fa')
+
+  const isSecure = isSecureRequest(event)
+
+  setCookie(event, 'auth-token', authToken, {
+    httpOnly: true,
+    secure: isSecure,
+    sameSite: 'lax',
+    maxAge: 60 * 60 * 24 * 7,
+    path: '/'
+  })
+
+  deleteCookie(event, 'pre-auth-token')
+  deleteCookie(event, 'binding-token')
+
+  const requirePasswordChange = await resolveRequirePasswordChange(user)
+  const passwordSetupState = getPasswordSetupState(user, requirePasswordChange)
+
+  return {
+    success: true,
+    user: {
+      id: user.id,
+      username: user.username,
+      name: user.name,
+      grade: user.grade,
+      class: user.class,
+      role: user.role,
+      email: user.email,
+      emailVerified: user.emailVerified,
+      forcePasswordChange: user.forcePasswordChange,
+      passwordChangedAt: user.passwordChangedAt,
+      requirePasswordChange,
+      // 兼容旧客户端字段名
+      needsPasswordChange: requirePasswordChange,
+      ...passwordSetupState,
+      has2FA: true
+    }
+  }
+})