feat: align with upstream 1.5.9.9

2026-09-12 18:21:11 +08:00
commit 34f0679117
805 changed files with 376275 additions and 0 deletions
@@ -0,0 +1,70 @@
+import { db } from '~/drizzle/db'
+import { users } from '~/drizzle/schema'
+import { eq } from 'drizzle-orm'
+import { createApiError } from '~~/server/utils/apiError'
+
+export default defineEventHandler(async (event) => {
+  // 检查请求方法
+  if (event.method !== 'POST') {
+    throw createApiError(405, 'HTTP_METHOD_NOT_ALLOWED', '方法不被允许')
+  }
+
+  // 检查用户认证
+  const user = event.context.user
+
+  if (!user) {
+    throw createApiError(401, 'AUTH_UNAUTHORIZED_ACCESS', '未授权访问')
+  }
+
+  try {
+    const body = await readBody(event)
+
+    // 验证邮箱格式
+    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
+    if (!body.email || !emailRegex.test(body.email)) {
+      throw createApiError(400, 'USER_INVALID_EMAIL', '请输入有效的邮箱地址')
+    }
+
+    const email = body.email.trim().toLowerCase()
+
+    // 检查邮箱是否已被其他用户绑定
+    const existingUser = await db.select().from(users).where(eq(users.email, email)).limit(1)
+
+    if (existingUser.length > 0 && existingUser[0].id !== user.id) {
+      throw createApiError(400, 'USER_EMAIL_TAKEN', '该邮箱已被其他用户绑定')
+    }
+
+    // 更新用户邮箱
+    await db
+      .update(users)
+      .set({
+        email: email,
+        emailVerified: false
+      })
+      .where(eq(users.id, user.id))
+
+    // 发送邮箱验证码
+    try {
+      const { sendEmailVerificationCode } = await import('~~/server/api/user/email/send-code.post')
+      const { getClientIP } = await import('~~/server/utils/ip-utils')
+      const clientIP = getClientIP(event)
+
+      await sendEmailVerificationCode(user.id, email, user.name, clientIP)
+    } catch (emailError) {
+      console.error('发送邮箱验证码失败:', emailError)
+    }
+
+    return {
+      success: true,
+      message: '验证码已发送，请查收邮箱并输入验证码完成验证'
+    }
+  } catch (error: any) {
+    console.error('绑定邮箱失败:', error)
+
+    if (error?.statusCode) {
+      throw error
+    }
+
+    throw createApiError(500, 'USER_EMAIL_BIND_FAILED', '绑定邮箱失败')
+  }
+})
@@ -0,0 +1,55 @@
+import { db } from '~/drizzle/db'
+import { users } from '~/drizzle/schema'
+import { eq } from 'drizzle-orm'
+import { getClientIP } from '~~/server/utils/ip-utils'
+import { createApiError } from '~~/server/utils/apiError'
+
+export default defineEventHandler(async (event) => {
+  // 检查请求方法
+  if (getMethod(event) !== 'POST') {
+    throw createApiError(405, 'HTTP_METHOD_NOT_ALLOWED', '方法不被允许')
+  }
+
+  // 检查用户认证
+  const user = event.context.user
+
+  if (!user) {
+    throw createApiError(401, 'AUTH_UNAUTHORIZED_ACCESS', '未授权访问')
+  }
+
+  try {
+    // 获取用户邮箱信息
+    const userResult = await db.select().from(users).where(eq(users.id, user.id)).limit(1)
+
+    const currentUser = userResult[0]
+
+    if (!currentUser?.email) {
+      throw createApiError(400, 'USER_BIND_EMAIL_FIRST', '请先绑定邮箱')
+    }
+
+    if (currentUser.emailVerified) {
+      throw createApiError(400, 'USER_EMAIL_ALREADY_VERIFIED', '邮箱已验证，无需重新发送')
+    }
+
+    // 发送邮箱验证码
+    try {
+      const { sendEmailVerificationCode } = await import('~~/server/api/user/email/send-code.post')
+      const clientIP = getClientIP(event)
+
+      await sendEmailVerificationCode(currentUser.id, currentUser.email, currentUser.name, clientIP)
+
+      return { success: true, message: '验证码已重新发送' }
+    } catch (emailError) {
+      console.error('发送邮箱验证码失败:', emailError)
+      throw createApiError(500, 'USER_CODE_SEND_FAILED', '发送验证码失败，请稍后重试')
+    }
+  } catch (error: any) {
+    console.error('重新发送验证邮件失败:', error)
+
+    if (error?.statusCode) {
+      throw error
+    }
+
+    throw createApiError(500, 'USER_RESEND_EMAIL_FAILED', '重新发送验证邮件失败')
+  }
+})
@@ -0,0 +1,91 @@
+import { db } from '~/drizzle/db'
+import { users } from '~/drizzle/schema'
+import { eq } from 'drizzle-orm'
+import { SmtpService } from '~~/server/services/smtpService'
+import { getClientIP } from '~~/server/utils/ip-utils'
+import { getServerTimestamp } from '~~/server/utils/serverTime'
+import { delStoreIfValue, hashStateCode, setStore } from '~~/server/utils/captchaStore'
+import { randomInt } from 'node:crypto'
+import { createApiError } from '~~/server/utils/apiError'
+
+function generateCode(): string {
+  return randomInt(100000, 1000000).toString()
+}
+
+export async function sendEmailVerificationCode(
+  userId: number,
+  email: string,
+  name?: string,
+  ipAddress?: string
+) {
+  const code = generateCode()
+  const expiresAt = getServerTimestamp() + 5 * 60 * 1000
+  const stateKey = `email-verify:${userId}`
+  const storedValue = JSON.stringify({
+    email,
+    codeHash: hashStateCode(stateKey, code),
+    expiresAt
+  })
+  await setStore(stateKey, storedValue, 5 * 60)
+
+  const smtp = SmtpService.getInstance()
+  await smtp.initializeSmtpConfig()
+  let sent = false
+  try {
+    sent = await smtp.renderAndSend(
+      email,
+      'verification.code',
+      {
+        name: name || '用户',
+        email,
+        code,
+        expiresInMinutes: 5
+      },
+      ipAddress
+    )
+  } catch (error) {
+    await delStoreIfValue(stateKey, storedValue)
+    throw error
+  }
+  if (!sent) {
+    await delStoreIfValue(stateKey, storedValue)
+    throw createApiError(500, 'USER_CODE_SEND_FAILED', '验证码发送失败，请稍后重试')
+  }
+}
+
+export default defineEventHandler(async (event) => {
+  if (getMethod(event) !== 'POST') {
+    throw createApiError(405, 'HTTP_METHOD_NOT_ALLOWED', '方法不被允许')
+  }
+
+  const user = event.context.user
+  if (!user) {
+    throw createApiError(401, 'AUTH_UNAUTHORIZED_ACCESS', '未授权访问')
+  }
+
+  const body = await readBody(event)
+  const emailRaw = (body?.email || '').toString().trim().toLowerCase()
+  const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
+
+  if (!emailRaw || !emailRegex.test(emailRaw)) {
+    throw createApiError(400, 'USER_INVALID_EMAIL', '请输入有效的邮箱地址')
+  }
+
+  // 确认邮箱未被其他用户占用
+  const existing = await db.select().from(users).where(eq(users.email, emailRaw)).limit(1)
+  const existingUser = existing[0]
+  if (existingUser && existingUser.id !== user.id) {
+    throw createApiError(400, 'USER_EMAIL_TAKEN', '该邮箱已被其他用户绑定')
+  }
+
+  // 写入/更新邮箱，标记未验证
+  await db.update(users).set({ email: emailRaw, emailVerified: false }).where(eq(users.id, user.id))
+
+  // 获取客户端IP地址
+  const clientIP = getClientIP(event)
+
+  // 发送邮件验证码
+  await sendEmailVerificationCode(user.id, emailRaw, user.name, clientIP)
+
+  return { success: true, message: '验证码已发送，请查收邮箱' }
+})
@@ -0,0 +1,39 @@
+import { db } from '~/drizzle/db'
+import { users } from '~/drizzle/schema'
+import { eq } from 'drizzle-orm'
+import { createApiError } from '~~/server/utils/apiError'
+
+export default defineEventHandler(async (event) => {
+  // 检查请求方法
+  if (getMethod(event) !== 'POST') {
+    throw createApiError(405, 'HTTP_METHOD_NOT_ALLOWED', '方法不被允许')
+  }
+
+  // 检查用户认证
+  const user = event.context.user
+
+  if (!user) {
+    throw createApiError(401, 'AUTH_UNAUTHORIZED_ACCESS', '未授权访问')
+  }
+
+  try {
+    // 解绑邮箱
+    await db
+      .update(users)
+      .set({
+        email: null,
+        emailVerified: false,
+        emailVerifiedAt: null
+      })
+      .where(eq(users.id, user.id))
+
+    return {
+      success: true,
+      message: '邮箱已解绑'
+    }
+  } catch (error) {
+    console.error('解绑邮箱失败:', error)
+
+    throw createApiError(500, 'USER_EMAIL_UNBIND_FAILED', '解绑邮箱失败')
+  }
+})
@@ -0,0 +1,86 @@
+import { db } from '~/drizzle/db'
+import { users } from '~/drizzle/schema'
+import { and, eq } from 'drizzle-orm'
+import { getServerTimestamp } from '~~/server/utils/serverTime'
+import {
+  delStore,
+  delStoreIfValue,
+  getStore,
+  incrStore,
+  parseStoreJson,
+  verifyStateCode
+} from '~~/server/utils/captchaStore'
+import { createApiError } from '~~/server/utils/apiError'
+
+export default defineEventHandler(async (event) => {
+  if (getMethod(event) !== 'POST') {
+    throw createApiError(405, 'HTTP_METHOD_NOT_ALLOWED', '方法不被允许')
+  }
+
+  const user = event.context.user
+  if (!user) {
+    throw createApiError(401, 'AUTH_UNAUTHORIZED_ACCESS', '未授权访问')
+  }
+
+  const body = await readBody(event)
+  const email = (body?.email || '').toString().trim().toLowerCase()
+  const code = (body?.code || '').toString().trim()
+
+  if (!email || !code) {
+    throw createApiError(400, 'USER_EMAIL_AND_CODE_REQUIRED', '邮箱与验证码不能为空')
+  }
+
+  const stateKey = `email-verify:${user.id}`
+  const recordRaw = await getStore(stateKey)
+  const record = parseStoreJson<{ email: string; codeHash: string; expiresAt: number }>(recordRaw)
+  if (
+    !record ||
+    record.email !== email ||
+    typeof record.codeHash !== 'string' ||
+    !Number.isFinite(record.expiresAt)
+  ) {
+    if (recordRaw) await delStoreIfValue(stateKey, recordRaw)
+    throw createApiError(400, 'USER_SEND_CODE_FIRST', '请先发送验证码')
+  }
+  if (getServerTimestamp() > record.expiresAt) {
+    await delStoreIfValue(stateKey, recordRaw!)
+    throw createApiError(400, 'USER_CODE_EXPIRED_RESEND', '验证码已过期，请重新发送')
+  }
+
+  const remainingTtl = Math.max(1, Math.ceil((record.expiresAt - getServerTimestamp()) / 1000))
+  const attemptKey = `${stateKey}:attempts:${record.codeHash}`
+  const attemptCount = await incrStore(attemptKey, remainingTtl)
+
+  if (attemptCount > 5) {
+    await delStoreIfValue(stateKey, recordRaw!)
+    await delStore(attemptKey)
+    throw createApiError(400, 'USER_CODE_TOO_MANY_ATTEMPTS', '验证码错误次数过多，请重新发送')
+  }
+
+  if (!verifyStateCode(stateKey, code, record.codeHash)) {
+    if (attemptCount >= 5) {
+      await delStoreIfValue(stateKey, recordRaw!)
+      await delStore(attemptKey)
+      throw createApiError(400, 'USER_CODE_TOO_MANY_ATTEMPTS', '验证码错误次数过多，请重新发送')
+    }
+    throw createApiError(400, 'USER_CODE_INVALID', '验证码错误')
+  }
+
+  if (!(await delStoreIfValue(stateKey, recordRaw!))) {
+    throw createApiError(400, 'USER_CODE_ALREADY_USED', '验证码已使用，请重新发送')
+  }
+  await delStore(attemptKey)
+
+  // 验证通过：设置邮箱为已验证
+  const updatedUsers = await db
+    .update(users)
+    .set({ emailVerified: true })
+    .where(and(eq(users.id, user.id), eq(users.email, email)))
+    .returning({ id: users.id })
+
+  if (updatedUsers.length === 0) {
+    throw createApiError(409, 'USER_EMAIL_CHANGED_RESEND', '邮箱已发生变化，请重新发送验证码')
+  }
+
+  return { success: true, message: '邮箱验证成功' }
+})