初次提交

2026-09-06 08:19:02 +08:00
commit 4ce4649aaf
1061 changed files with 337258 additions and 0 deletions
@@ -0,0 +1,97 @@
+import bcrypt from 'bcrypt'
+import { db } from '~/drizzle/db'
+import { users } from '~/drizzle/schema'
+import { eq } from 'drizzle-orm'
+import { recordLoginFailure, recordLoginSuccess } from '../../services/securityService'
+import { updateUserPassword } from '../../services/userService'
+import { getClientIP } from '~~/server/utils/ip-utils'
+
+export default defineEventHandler(async (event) => {
+  // 验证用户身份
+  const user = event.context.user
+  if (!user) {
+    throw createError({
+      statusCode: 401,
+      statusMessage: '未授权'
+    })
+  }
+
+  const body = await readBody(event)
+  if (!body.currentPassword || !body.newPassword) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: '当前密码和新密码都是必需的'
+    })
+  }
+
+  try {
+    // 查询用户详细信息
+    const userDetailsResult = await db
+      .select({
+        id: users.id,
+        username: users.username,
+        password: users.password
+      })
+      .from(users)
+      .where(eq(users.id, user.id))
+      .limit(1)
+
+    const userDetails = userDetailsResult[0]
+
+    if (!userDetails) {
+      throw createError({
+        statusCode: 404,
+        statusMessage: '用户不存在'
+      })
+    }
+
+    // 验证当前密码
+    const isPasswordValid = await bcrypt.compare(body.currentPassword, userDetails.password)
+
+    if (!isPasswordValid) {
+      // 记录安全事件
+      const clientIp = getClientIP(event)
+      recordLoginFailure(userDetails.username, clientIp)
+
+      throw createError({
+        statusCode: 400,
+        statusMessage: '当前密码不正确'
+      })
+    }
+
+    // 检查新密码是否与当前密码相同
+    const isSamePassword = await bcrypt.compare(body.newPassword, userDetails.password)
+    if (isSamePassword) {
+      throw createError({
+        statusCode: 400,
+        statusMessage: '新密码不能与当前密码相同'
+      })
+    }
+
+    // 更新密码
+    await updateUserPassword(user.id, body.newPassword)
+
+    // 记录成功的密码修改
+    const clientIp = getClientIP(event)
+    recordLoginSuccess(userDetails.username, clientIp)
+
+    return {
+      success: true,
+      message: '密码修改成功'
+    }
+  } catch (error: any) {
+    // 已格式化的错误直接抛出
+    if (error.statusCode) {
+      throw error
+    }
+
+    // 记录错误信息
+    console.error('修改密码过程中发生未处理的错误:', error)
+
+    // 创建错误响应
+    throw createError({
+      statusCode: 500,
+      statusMessage: '修改密码失败: ' + (error.message || '未知错误')
+    })
+  }
+})