feat: align with upstream 1.5.9.9

2026-09-12 18:21:11 +08:00
commit 34f0679117
805 changed files with 376275 additions and 0 deletions
@@ -0,0 +1,121 @@
+import bcrypt from 'bcryptjs'
+import { db } from '~/drizzle/db'
+import { users } from '~/drizzle/schema'
+import { eq } from 'drizzle-orm'
+import { createApiError } from '~~/server/utils/apiError'
+import { updateUserPassword } from '~~/server/services/userService'
+import { JWTEnhanced } from '~~/server/utils/jwt-enhanced'
+import { isSecureRequest } from '~~/server/utils/request-utils'
+import { getInitialPasswordPolicyViolation } from '~/utils/password-policy'
+import { getClientIP } from '~~/server/utils/ip-utils'
+import { canSetInitialPassword } from '~~/server/utils/initial-password-policy'
+import {
+  PASSWORD_AUDIT_ACTIONS,
+  consumePasswordRateLimit,
+  getPasswordAuditContext,
+  recordPasswordAudit
+} from '~~/server/services/passwordSecurityService'
+
+export default defineEventHandler(async (event) => {
+  const user = event.context.user
+  if (!user) {
+    throw createApiError(401, 'AUTH_UNAUTHORIZED', '未授权')
+  }
+
+  const auditAction = PASSWORD_AUDIT_ACTIONS.INITIAL_PASSWORD
+  const body = await readBody<Record<string, unknown> | null>(event)
+  const newPassword = typeof body?.newPassword === 'string' ? body.newPassword : ''
+  if (!newPassword) {
+    await recordPasswordAudit(event, user.id, auditAction, false, '新密码为空')
+    throw createApiError(400, 'AUTH_NEW_PASSWORD_REQUIRED', '新密码不能为空')
+  }
+
+  const clientIp = getClientIP(event)
+  const rateLimit = await consumePasswordRateLimit(user.id, clientIp, auditAction, 5)
+  if (!rateLimit.allowed) {
+    await recordPasswordAudit(event, user.id, auditAction, false, '操作频率超过限制')
+    setResponseHeader(event, 'Retry-After', String(rateLimit.retryAfterSeconds))
+    const retryAfterMinutes = Math.max(1, Math.ceil(rateLimit.retryAfterSeconds / 60))
+    throw createApiError(
+      429,
+      'AUTH_RATE_LIMITED_MINUTES',
+      `初始密码设置尝试过于频繁，请 ${retryAfterMinutes} 分钟后再试`,
+      { params: [retryAfterMinutes] }
+    )
+  }
+
+  const policyViolation = getInitialPasswordPolicyViolation(newPassword)
+  if (policyViolation) {
+    await recordPasswordAudit(event, user.id, auditAction, false, policyViolation.message)
+    throw createApiError(400, policyViolation.code, policyViolation.message)
+  }
+
+  let passwordUpdated = false
+  try {
+    const currentUserResult = await db
+      .select({
+        password: users.password,
+        passwordChangedAt: users.passwordChangedAt,
+        tokenVersion: users.tokenVersion
+      })
+      .from(users)
+      .where(eq(users.id, user.id))
+      .limit(1)
+    const currentUser = currentUserResult[0]
+    if (!currentUser) {
+      throw createApiError(404, 'USER_NOT_FOUND', '用户不存在')
+    }
+
+    // 已完成初始设置的账号必须通过需要旧密码的修改流程。
+    if (currentUser.passwordChangedAt) {
+      throw createApiError(400, 'AUTH_PASSWORD_ALREADY_SET', '您已经设置过密码，请使用修改密码功能')
+    }
+
+    if (!canSetInitialPassword(user, currentUser)) {
+      throw createApiError(
+        403,
+        'AUTH_INITIAL_PASSWORD_NOT_REQUIRED',
+        '当前账号不需要设置初始密码，请使用修改密码功能'
+      )
+    }
+
+    // OAuth 账号可能没有可用于比对的旧密码，不能把 null 传给 bcrypt。
+    if (currentUser.password && (await bcrypt.compare(newPassword, currentUser.password))) {
+      throw createApiError(400, 'AUTH_NEW_PASSWORD_SAME_AS_CURRENT', '新密码不能与当前密码相同')
+    }
+
+    const { passwordChangedAt, tokenVersion } = await updateUserPassword(user.id, newPassword, {
+      expectedTokenVersion: currentUser.tokenVersion,
+      auditContext: { action: auditAction, ...getPasswordAuditContext(event) }
+    })
+    passwordUpdated = true
+
+    const newToken = JWTEnhanced.generateToken(user.id, user.role, tokenVersion, event.context.authSessionId)
+    setCookie(event, 'auth-token', newToken, {
+      httpOnly: true,
+      secure: isSecureRequest(event),
+      sameSite: 'lax',
+      maxAge: 60 * 60 * 24 * 7,
+      path: '/'
+    })
+
+    return {
+      success: true,
+      message: '初始密码设置成功',
+      passwordChangedAt
+    }
+  } catch (error: any) {
+    if (!passwordUpdated) {
+      await recordPasswordAudit(
+        event,
+        user.id,
+        auditAction,
+        false,
+        error.message || '初始密码设置失败'
+      )
+    }
+
+    if (error.statusCode) throw error
+    throw createApiError(500, 'AUTH_SYSTEM_ERROR', '初始密码设置失败，请稍后重试')
+  }
+})