feat: align with upstream 1.5.9.9

2026-09-12 18:21:11 +08:00
commit 34f0679117
805 changed files with 376275 additions and 0 deletions
@@ -0,0 +1,145 @@
+import bcrypt from 'bcryptjs'
+import { db } from '~/drizzle/db'
+import { users } from '~/drizzle/schema'
+import { eq } from 'drizzle-orm'
+import { recordLoginFailure, recordLoginSuccess } from '../../services/securityService'
+import { updateUserPassword } from '../../services/userService'
+import { getClientIP } from '~~/server/utils/ip-utils'
+import { createApiError } from '~~/server/utils/apiError'
+import { JWTEnhanced } from '~~/server/utils/jwt-enhanced'
+import { isSecureRequest } from '~~/server/utils/request-utils'
+import { getPasswordPolicyViolation } from '~/utils/password-policy'
+import {
+  PASSWORD_AUDIT_ACTIONS,
+  consumePasswordRateLimit,
+  getPasswordAuditContext,
+  recordPasswordAudit
+} from '~~/server/services/passwordSecurityService'
+
+export default defineEventHandler(async (event) => {
+  // 验证用户身份
+  const user = event.context.user
+  if (!user) {
+    throw createApiError(401, 'AUTH_UNAUTHORIZED', '未授权')
+  }
+
+  const auditAction = PASSWORD_AUDIT_ACTIONS.CHANGE_PASSWORD
+  const clientIp = getClientIP(event)
+
+  const body = await readBody<Record<string, unknown> | null>(event)
+  const currentPassword = typeof body?.currentPassword === 'string' ? body.currentPassword : ''
+  const newPassword = typeof body?.newPassword === 'string' ? body.newPassword : ''
+  if (!currentPassword || !newPassword) {
+    await recordPasswordAudit(event, user.id, auditAction, false, '缺少当前密码或新密码')
+    throw createApiError(
+      400,
+      'AUTH_CURRENT_AND_NEW_PASSWORD_REQUIRED',
+      '当前密码和新密码都是必需的'
+    )
+  }
+
+  const rateLimit = await consumePasswordRateLimit(user.id, clientIp, auditAction, 10)
+  if (!rateLimit.allowed) {
+    await recordPasswordAudit(event, user.id, auditAction, false, '操作频率超过限制')
+    setResponseHeader(event, 'Retry-After', String(rateLimit.retryAfterSeconds))
+    const retryAfterMinutes = Math.max(1, Math.ceil(rateLimit.retryAfterSeconds / 60))
+    throw createApiError(
+      429,
+      'AUTH_RATE_LIMITED_MINUTES',
+      `密码修改尝试过于频繁，请 ${retryAfterMinutes} 分钟后再试`,
+      { params: [retryAfterMinutes] }
+    )
+  }
+
+  const policyViolation = getPasswordPolicyViolation(newPassword)
+  if (policyViolation) {
+    await recordPasswordAudit(event, user.id, auditAction, false, policyViolation.message)
+    throw createApiError(400, policyViolation.code, policyViolation.message)
+  }
+
+  let passwordUpdated = false
+  try {
+    // 查询用户详细信息
+    const userDetailsResult = await db
+      .select({
+        id: users.id,
+        username: users.username,
+        password: users.password,
+        tokenVersion: users.tokenVersion
+      })
+      .from(users)
+      .where(eq(users.id, user.id))
+      .limit(1)
+
+    const userDetails = userDetailsResult[0]
+
+    if (!userDetails) {
+      throw createApiError(404, 'USER_NOT_FOUND', '用户不存在')
+    }
+
+    // 验证当前密码
+    if (!userDetails.password) {
+      throw createApiError(
+        400,
+        'AUTH_PASSWORD_NOT_SET',
+        '当前账号尚未设置密码，请使用初始密码设置功能'
+      )
+    }
+
+    const isPasswordValid = await bcrypt.compare(currentPassword, userDetails.password)
+
+    if (!isPasswordValid) {
+      // 记录安全事件
+      await recordLoginFailure(userDetails.username, clientIp)
+
+      throw createApiError(400, 'AUTH_CURRENT_PASSWORD_INCORRECT', '当前密码不正确')
+    }
+
+    // 检查新密码是否与当前密码相同
+    const isSamePassword = await bcrypt.compare(newPassword, userDetails.password)
+    if (isSamePassword) {
+      throw createApiError(400, 'AUTH_NEW_PASSWORD_SAME_AS_CURRENT', '新密码不能与当前密码相同')
+    }
+
+    // 更新密码
+    const { passwordChangedAt, tokenVersion } = await updateUserPassword(user.id, newPassword, {
+      expectedTokenVersion: userDetails.tokenVersion,
+      auditContext: { action: auditAction, ...getPasswordAuditContext(event) }
+    })
+    passwordUpdated = true
+
+    // 密码变更会让旧令牌失效，因此为当前已验证会话立即换发令牌。
+    const newToken = JWTEnhanced.generateToken(user.id, user.role, tokenVersion, event.context.authSessionId)
+    setCookie(event, 'auth-token', newToken, {
+      httpOnly: true,
+      secure: isSecureRequest(event),
+      sameSite: 'lax',
+      maxAge: 60 * 60 * 24 * 7,
+      path: '/'
+    })
+
+    // 记录成功的密码修改
+    await recordLoginSuccess(userDetails.username, clientIp)
+
+    return {
+      success: true,
+      message: '密码修改成功',
+      passwordChangedAt
+    }
+  } catch (error: any) {
+    if (!passwordUpdated) {
+      await recordPasswordAudit(event, user.id, auditAction, false, error.message || '密码修改失败')
+    }
+
+    // 已格式化的错误直接抛出
+    if (error.statusCode) {
+      throw error
+    }
+
+    // 记录错误信息
+    console.error('修改密码过程中发生未处理的错误:', error)
+
+    // 创建错误响应
+    throw createApiError(500, 'AUTH_SYSTEM_ERROR', '修改密码失败，请稍后重试')
+  }
+})