初次提交

server/api/admin/backup/delete/[filename].delete.ts

@@ -0,0 +1,71 @@
+import { createError, defineEventHandler, getRouterParam } from 'h3'
+import { promises as fs } from 'fs'
+import path from 'path'
+
+export default defineEventHandler(async (event) => {
+  try {
+    // 验证管理员权限
+    const user = event.context.user
+    if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
+      throw createError({
+        statusCode: 403,
+        statusMessage: '权限不足'
+      })
+    }
+
+    const filename = getRouterParam(event, 'filename')
+
+    if (!filename) {
+      throw createError({
+        statusCode: 400,
+        statusMessage: '请指定文件名'
+      })
+    }
+
+    // 验证文件名安全性
+    if (filename.includes('..') || filename.includes('/') || filename.includes('\\')) {
+      throw createError({
+        statusCode: 400,
+        statusMessage: '无效的文件名'
+      })
+    }
+
+    // 验证文件扩展名
+    if (!filename.endsWith('.json')) {
+      throw createError({
+        statusCode: 400,
+        statusMessage: '只能删除JSON格式的备份文件'
+      })
+    }
+
+    const backupDir = path.join(process.cwd(), 'backups')
+    const filepath = path.join(backupDir, filename)
+
+    // 检查文件是否存在
+    try {
+      await fs.access(filepath)
+    } catch {
+      throw createError({
+        statusCode: 404,
+        statusMessage: '备份文件不存在'
+      })
+    }
+
+    // 删除文件
+    await fs.unlink(filepath)
+
+    console.log(`管理员 ${user.username} 删除了备份文件: ${filename}`)
+
+    return {
+      success: true,
+      message: '备份文件删除成功',
+      filename
+    }
+  } catch (error) {
+    console.error('删除备份文件失败:', error)
+    throw createError({
+      statusCode: error.statusCode || 500,
+      statusMessage: error.statusMessage || '删除备份文件失败'
+    })
+  }
+})