初次提交

server/api/auth/register.post.ts

@@ -0,0 +1,134 @@
+import bcrypt from 'bcryptjs'
+import { db, eq, users } from '~/drizzle/db'
+import { JWTEnhanced } from '~~/server/utils/jwt-enhanced'
+import { emailVerificationCodes } from '~~/server/api/user/email/send-code.post'
+
+export default defineEventHandler(async (event) => {
+  const body = await readBody(event)
+
+  if (!body.username || !body.password) {
+    throw createError({
+      statusCode: 400,
+      message: '姓名/用户名和密码不能为空'
+    })
+  }
+
+  // 验证姓名/用户名只能包含汉字
+  const chineseRegex = /^[\u4e00-\u9fa5]+$/
+  if (!chineseRegex.test(body.username)) {
+    throw createError({
+      statusCode: 400,
+      message: '姓名/用户名只能包含汉字'
+    })
+  }
+
+  const rawEmail = typeof body.email === 'string' ? body.email.trim() : ''
+  const email = rawEmail ? rawEmail.toLowerCase() : null
+  
+  if (email) {
+    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
+    if (!emailRegex.test(email)) {
+      throw createError({
+        statusCode: 400,
+        message: '邮箱格式不正确'
+      })
+    }
+
+    const existingEmailUser = await db
+      .select({ id: users.id })
+      .from(users)
+      .where(eq(users.email, email))
+      .limit(1)
+
+    if (existingEmailUser.length > 0) {
+      throw createError({
+        statusCode: 409,
+        message: '邮箱已被绑定'
+      })
+    }
+
+    // 验证验证码
+    if (!body.emailCode) {
+      throw createError({
+        statusCode: 400,
+        message: '请提供邮箱验证码'
+      })
+    }
+
+    const storedData = emailVerificationCodes.get(email)
+    if (!storedData) {
+      throw createError({ statusCode: 400, message: '请先获取邮箱验证码' })
+    }
+    if (Date.now() > storedData.expiresAt) {
+      emailVerificationCodes.delete(email)
+      throw createError({ statusCode: 400, message: '验证码已过期，请重新获取' })
+    }
+    if (storedData.code !== body.emailCode.trim()) {
+      throw createError({ statusCode: 400, message: '邮箱验证码不正确' })
+    }
+  }
+
+  // 验证用户名唯一性
+  const existingUser = await db
+    .select({ id: users.id })
+    .from(users)
+    .where(eq(users.username, body.username))
+    .limit(1)
+
+  if (existingUser.length > 0) {
+    throw createError({
+      statusCode: 409,
+      message: '用户名已被注册'
+    })
+  }
+
+  // 加密密码
+  const saltRounds = 10
+  const hashedPassword = await bcrypt.hash(body.password, saltRounds)
+
+  // 插入新用户
+  const [newUser] = await db.insert(users).values({
+    username: body.username,
+    name: body.username, // 默认将昵称设置为账号名
+    password: hashedPassword,
+    email,
+    emailVerified: !!email, // 邮箱存在则表示已验证
+    grade: body.grade || null,
+    class: body.class || null,
+    studentId: body.studentId || null,
+    role: 'USER',
+    status: 'active'
+  }).returning({
+    id: users.id,
+    username: users.username,
+    role: users.role
+  })
+
+  if (email) {
+    emailVerificationCodes.delete(email)
+  }
+
+  // 签发 JWT Token
+  const token = JWTEnhanced.generateToken(newUser.id, newUser.role)
+
+  const isSecure =
+    getRequestURL(event).protocol === 'https:' ||
+    getRequestHeader(event, 'x-forwarded-proto') === 'https'
+
+  setCookie(event, 'auth-token', token, {
+    httpOnly: true,
+    secure: isSecure,
+    sameSite: 'lax',
+    maxAge: 60 * 60 * 24 * 7, // 7天
+    path: '/'
+  })
+
+  return {
+    success: true,
+    user: {
+      id: newUser.id,
+      username: newUser.username,
+      role: newUser.role
+    }
+  }
+})