初次提交

2026-09-06 08:19:02 +08:00
commit 4ce4649aaf
1061 changed files with 337258 additions and 0 deletions
@@ -0,0 +1,36 @@
+import { db, userIdentities, eq, and, users } from '~/drizzle/db'
+import bcrypt from 'bcryptjs'
+
+export default defineEventHandler(async (event) => {
+  const user = event.context.user
+  if (!user) {
+    throw createError({ statusCode: 401, message: '未授权访问' })
+  }
+
+  const body = await readBody(event)
+  const { password } = body
+
+  if (!password) {
+    throw createError({ statusCode: 400, message: '请输入密码' })
+  }
+
+  // 验证密码
+  const dbUserResult = await db.select({ password: users.password }).from(users).where(eq(users.id, user.id)).limit(1)
+  const dbUser = dbUserResult[0]
+
+  if (!dbUser) {
+    throw createError({ statusCode: 404, message: '用户不存在' })
+  }
+
+  const isPasswordValid = await bcrypt.compare(password, dbUser.password)
+  if (!isPasswordValid) {
+    // 密码错误不应返回 401，否则会触发全局登出
+    throw createError({ statusCode: 403, message: '密码错误' })
+  }
+  
+  // 删除TOTP记录
+  await db.delete(userIdentities)
+    .where(and(eq(userIdentities.userId, user.id), eq(userIdentities.provider, 'totp')))
+
+  return { success: true }
+})
@@ -0,0 +1,43 @@
+import otplib from 'otplib'
+const { authenticator } = otplib
+import { db, userIdentities, eq, and } from '~/drizzle/db'
+
+export default defineEventHandler(async (event) => {
+  const user = event.context.user
+  if (!user) {
+    throw createError({ statusCode: 401, message: '未授权访问' })
+  }
+  const body = await readBody(event)
+  const { token, secret } = body
+
+  if (!token || !secret) {
+    throw createError({ statusCode: 400, message: '缺少验证码或密钥' })
+  }
+
+  const isValid = authenticator.check(token, secret)
+  if (!isValid) {
+    throw createError({ statusCode: 400, message: '验证码错误' })
+  }
+
+  // 检查是否已存在
+  const existing = await db.query.userIdentities.findFirst({
+    where: and(eq(userIdentities.userId, user.id), eq(userIdentities.provider, 'totp'))
+  })
+
+  if (existing) {
+     // 更新密钥
+     await db.update(userIdentities)
+       .set({ providerUserId: secret })
+       .where(eq(userIdentities.id, existing.id))
+  } else {
+    // 保存到数据库
+    await db.insert(userIdentities).values({
+      userId: user.id,
+      provider: 'totp',
+      providerUserId: secret,
+      createdAt: new Date()
+    })
+  }
+
+  return { success: true }
+})
@@ -0,0 +1,28 @@
+import otplib from 'otplib'
+const { authenticator } = otplib
+import QRCode from 'qrcode'
+import { db, userIdentities, eq, and } from '~/drizzle/db'
+
+export default defineEventHandler(async (event) => {
+  const user = event.context.user
+  if (!user) {
+    throw createError({ statusCode: 401, message: '未授权访问' })
+  }
+
+  // 检查是否已开启2FA
+  const existing = await db.query.userIdentities.findFirst({
+    where: and(eq(userIdentities.userId, user.id), eq(userIdentities.provider, 'totp'))
+  })
+
+  if (existing) {
+    throw createError({ statusCode: 400, message: '已开启双重认证' })
+  }
+
+  const secret = authenticator.generateSecret()
+  const otpauth = authenticator.keyuri(user.username, 'VoiceHub', secret)
+  
+  // 生成QR Code Data URL
+  const qrCode = await QRCode.toDataURL(otpauth)
+
+  return { secret, qrCode }
+})
@@ -0,0 +1,84 @@
+import { db } from '~/drizzle/db'
+import { users } from '~/drizzle/schema'
+import { eq } from 'drizzle-orm'
+
+export default defineEventHandler(async (event) => {
+  // 检查请求方法
+  if (event.method !== 'POST') {
+    throw createError({
+      statusCode: 405,
+      message: '方法不被允许'
+    })
+  }
+
+  // 检查用户认证
+  const user = event.context.user
+
+  if (!user) {
+    throw createError({
+      statusCode: 401,
+      message: '未授权访问'
+    })
+  }
+
+  try {
+    const body = await readBody(event)
+
+    // 验证邮箱格式
+    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
+    if (!body.email || !emailRegex.test(body.email)) {
+      throw createError({
+        statusCode: 400,
+        message: '请输入有效的邮箱地址'
+      })
+    }
+
+    const email = body.email.trim().toLowerCase()
+
+    // 检查邮箱是否已被其他用户绑定
+    const existingUser = await db.select().from(users).where(eq(users.email, email)).limit(1)
+
+    if (existingUser.length > 0 && existingUser[0].id !== user.id) {
+      throw createError({
+        statusCode: 400,
+        message: '该邮箱已被其他用户绑定'
+      })
+    }
+
+    // 更新用户邮箱
+    await db
+      .update(users)
+      .set({
+        email: email,
+        emailVerified: false
+      })
+      .where(eq(users.id, user.id))
+
+    // 发送邮箱验证码
+    try {
+      const { sendEmailVerificationCode } = await import('~~/server/api/user/email/send-code.post')
+      const { getClientIP } = await import('~~/server/utils/ip-utils')
+      const clientIP = getClientIP(event)
+
+      await sendEmailVerificationCode(user.id, email, user.name, clientIP)
+    } catch (emailError) {
+      console.error('发送邮箱验证码失败:', emailError)
+    }
+
+    return {
+      success: true,
+      message: '验证码已发送，请查收邮箱并输入验证码完成验证'
+    }
+  } catch (error: any) {
+    console.error('绑定邮箱失败:', error)
+
+    if (error?.statusCode) {
+      throw error
+    }
+
+    throw createError({
+      statusCode: 500,
+      message: '绑定邮箱失败'
+    })
+  }
+})
@@ -0,0 +1,69 @@
+import { db } from '~/drizzle/db'
+import { users } from '~/drizzle/schema'
+import { eq } from 'drizzle-orm'
+import { getClientIP } from '~~/server/utils/ip-utils'
+
+export default defineEventHandler(async (event) => {
+  // 检查请求方法
+  if (getMethod(event) !== 'POST') {
+    throw createError({
+      statusCode: 405,
+      message: '方法不被允许'
+    })
+  }
+
+  // 检查用户认证
+  const user = event.context.user
+
+  if (!user) {
+    throw createError({
+      statusCode: 401,
+      message: '未授权访问'
+    })
+  }
+
+  try {
+    // 获取用户邮箱信息
+    const userResult = await db.select().from(users).where(eq(users.id, user.id)).limit(1)
+
+    const currentUser = userResult[0]
+
+    if (!currentUser?.email) {
+      throw createError({
+        statusCode: 400,
+        message: '请先绑定邮箱'
+      })
+    }
+
+    if (currentUser.emailVerified) {
+      throw createError({
+        statusCode: 400,
+        message: '邮箱已验证，无需重新发送'
+      })
+    }
+
+    // 发送邮箱验证码
+    try {
+      const { sendEmailVerificationCode } = await import('~~/server/api/user/email/send-code.post')
+      const clientIP = getClientIP(event)
+
+      await sendEmailVerificationCode(currentUser.id, currentUser.email, currentUser.name, clientIP)
+
+      return { success: true, message: '验证码已重新发送' }
+    } catch (emailError) {
+      console.error('发送邮箱验证码失败:', emailError)
+      throw createError({ statusCode: 500, message: '发送验证码失败，请稍后重试' })
+    }
+  } catch (error: any) {
+    console.error('重新发送验证邮件失败:', error)
+
+    if (error?.statusCode) {
+      throw error
+    }
+
+    throw createError({
+      statusCode: 500,
+      message: '重新发送验证邮件失败'
+    })
+  }
+})
@@ -0,0 +1,78 @@
+import { db } from '~/drizzle/db'
+import { users } from '~/drizzle/schema'
+import { eq } from 'drizzle-orm'
+import { SmtpService } from '~~/server/services/smtpService'
+import { getClientIP } from '~~/server/utils/ip-utils'
+
+// 简易验证码存储（如需分布式/重启持久，建议迁移到Redis）
+const emailVerificationCodes = new Map<
+  string,
+  { code: string; userId: number | null; expiresAt: number }
+>()
+
+function generateCode(): string {
+  return Math.floor(100000 + Math.random() * 900000).toString()
+}
+
+export async function sendEmailVerificationCode(
+  userId: number | null,
+  email: string,
+  name?: string,
+  ipAddress?: string
+) {
+  const code = generateCode()
+  const expiresAt = Date.now() + 5 * 60 * 1000
+  emailVerificationCodes.set(email, { code, userId, expiresAt })
+
+  const smtp = SmtpService.getInstance()
+  await smtp.initializeSmtpConfig()
+  const sent = await smtp.renderAndSend(
+    email,
+    'verification.code',
+    {
+      name: name || '用户',
+      email,
+      code,
+      expiresInMinutes: 5
+    },
+    ipAddress
+  )
+  if (!sent) {
+    throw createError({ statusCode: 500, message: '验证码发送失败，请稍后重试' })
+  }
+}
+
+export default defineEventHandler(async (event) => {
+  if (getMethod(event) !== 'POST') {
+    throw createError({ statusCode: 405, message: '方法不被允许' })
+  }
+
+  const user = event.context.user
+  if (!user) {
+    throw createError({ statusCode: 401, message: '未授权访问' })
+  }
+
+  const body = await readBody(event)
+  const emailRaw = (body?.email || '').toString().trim().toLowerCase()
+  const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
+
+  if (!emailRaw || !emailRegex.test(emailRaw)) {
+    throw createError({ statusCode: 400, message: '请输入有效的邮箱地址' })
+  }
+
+  // 确认邮箱未被其他用户占用
+  const existing = await db.select().from(users).where(eq(users.email, emailRaw)).limit(1)
+  if (existing.length > 0 && existing[0].id !== user.id) {
+    throw createError({ statusCode: 400, message: '该邮箱已被其他用户绑定' })
+  }
+
+  // 获取客户端IP地址
+  const clientIP = getClientIP(event)
+
+  // 发送邮件验证码
+  await sendEmailVerificationCode(user.id, emailRaw, user.name, clientIP)
+
+  return { success: true, message: '验证码已发送，请查收邮箱' }
+})
+
+export { emailVerificationCodes }
@@ -0,0 +1,47 @@
+import { db } from '~/drizzle/db'
+import { users } from '~/drizzle/schema'
+import { eq } from 'drizzle-orm'
+
+export default defineEventHandler(async (event) => {
+  // 检查请求方法
+  if (getMethod(event) !== 'POST') {
+    throw createError({
+      statusCode: 405,
+      message: '方法不被允许'
+    })
+  }
+
+  // 检查用户认证
+  const user = event.context.user
+
+  if (!user) {
+    throw createError({
+      statusCode: 401,
+      message: '未授权访问'
+    })
+  }
+
+  try {
+    // 解绑邮箱
+    await db
+      .update(users)
+      .set({
+        email: null,
+        emailVerified: false,
+        emailVerifiedAt: null
+      })
+      .where(eq(users.id, user.id))
+
+    return {
+      success: true,
+      message: '邮箱已解绑'
+    }
+  } catch (error) {
+    console.error('解绑邮箱失败:', error)
+
+    throw createError({
+      statusCode: 500,
+      message: '解绑邮箱失败'
+    })
+  }
+})
@@ -0,0 +1,42 @@
+import { db } from '~/drizzle/db'
+import { users } from '~/drizzle/schema'
+import { eq } from 'drizzle-orm'
+import { emailVerificationCodes } from './send-code.post'
+
+export default defineEventHandler(async (event) => {
+  if (getMethod(event) !== 'POST') {
+    throw createError({ statusCode: 405, message: '方法不被允许' })
+  }
+
+  const user = event.context.user
+  if (!user) {
+    throw createError({ statusCode: 401, message: '未授权访问' })
+  }
+
+  const body = await readBody(event)
+  const email = (body?.email || '').toString().trim().toLowerCase()
+  const code = (body?.code || '').toString().trim()
+
+  if (!email || !code) {
+    throw createError({ statusCode: 400, message: '邮箱与验证码不能为空' })
+  }
+
+  const record = emailVerificationCodes.get(email)
+  if (!record || record.userId !== user.id) {
+    throw createError({ statusCode: 400, message: '请先发送验证码' })
+  }
+  if (Date.now() > record.expiresAt) {
+    emailVerificationCodes.delete(email)
+    throw createError({ statusCode: 400, message: '验证码已过期，请重新发送' })
+  }
+  if (record.code !== code) {
+    throw createError({ statusCode: 400, message: '验证码错误' })
+  }
+
+  // 验证通过：设置邮箱并标记为已验证
+  await db.update(users).set({ email, emailVerified: true }).where(eq(users.id, user.id))
+
+  emailVerificationCodes.delete(email)
+
+  return { success: true, message: '邮箱验证成功' }
+})
@@ -0,0 +1,108 @@
+import { and, db, eq, sql, users } from '~/drizzle/db'
+import { emailVerificationCodes } from '~~/server/api/user/email/send-code.post'
+
+export default defineEventHandler(async (event) => {
+  const user = event.context.user
+  if (!user) {
+    throw createError({
+      statusCode: 401,
+      message: '未登录'
+    })
+  }
+
+  const body = await readBody(event)
+
+  if (body.name) {
+    const chineseRegex = /^[\u4e00-\u9fa5]+$/
+    if (!chineseRegex.test(body.name)) {
+      throw createError({
+        statusCode: 400,
+        message: '姓名/昵称只能包含汉字'
+      })
+    }
+  }
+
+  const rawEmail = typeof body.email === 'string' ? body.email.trim() : ''
+  const email = rawEmail ? rawEmail.toLowerCase() : null
+
+  if (email) {
+    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
+    if (!emailRegex.test(email)) {
+      throw createError({
+        statusCode: 400,
+        message: '邮箱格式不正确'
+      })
+    }
+
+    const existingEmailUser = await db
+      .select({ id: users.id })
+      .from(users)
+      .where(and(eq(users.email, email), sql`${users.id} != ${user.id}`))
+      .limit(1)
+
+    if (existingEmailUser.length > 0) {
+      throw createError({
+        statusCode: 409,
+        message: '邮箱已被绑定'
+      })
+    }
+  }
+
+  try {
+    const current = await db
+      .select({ email: users.email })
+      .from(users)
+      .where(eq(users.id, user.id))
+      .limit(1)
+    const currentEmail = current[0]?.email || null
+
+    if (email !== currentEmail && email) {
+      if (!body.emailCode) {
+        throw createError({ statusCode: 400, message: '请提供邮箱验证码' })
+      }
+      
+      const storedData = emailVerificationCodes.get(email)
+      
+      if (!storedData) {
+        throw createError({ statusCode: 400, message: '请先获取邮箱验证码' })
+      }
+      if (Date.now() > storedData.expiresAt) {
+        emailVerificationCodes.delete(email)
+        throw createError({ statusCode: 400, message: '验证码已过期，请重新获取' })
+      }
+      if (storedData.code !== body.emailCode.trim()) {
+        throw createError({ statusCode: 400, message: '邮箱验证码不正确' })
+      }
+      
+      // 验证通过，清理验证码
+      emailVerificationCodes.delete(email)
+    }
+
+    const updateData: any = {
+      name: body.name || null,
+      grade: body.grade || null,
+      class: body.class || null,
+      studentId: body.studentId || null,
+      updatedAt: new Date()
+    }
+
+    if (email !== currentEmail) {
+      updateData.email = email
+      updateData.emailVerified = !!email // 修改后，如果有email说明已经通过验证码验证
+    } else {
+      updateData.email = email
+    }
+
+    await db
+      .update(users)
+      .set(updateData)
+      .where(eq(users.id, user.id))
+
+    return { success: true }
+  } catch (error: any) {
+    throw createError({
+      statusCode: 500,
+      message: '更新个人信息失败'
+    })
+  }
+})
@@ -0,0 +1,168 @@
+import { createError, defineEventHandler } from 'h3'
+import { db } from '~/drizzle/db'
+import { songs, votes } from '~/drizzle/schema'
+import { and, asc, count, desc, eq, gte, lt, sql } from 'drizzle-orm'
+
+export default defineEventHandler(async (event) => {
+  // 检查用户是否登录
+  const user = event.context.user
+  if (!user) {
+    throw createError({
+      statusCode: 401,
+      message: '请先登录'
+    })
+  }
+
+  const userId = user.id
+
+  // 筛选当前年份
+  const currentYear = 2025
+  const startOfYear = new Date(currentYear, 0, 1)
+  const endOfYear = new Date(currentYear + 1, 0, 1)
+
+  try {
+    // 1. 总投稿数
+    const totalRequestsResult = await db
+      .select({ count: count() })
+      .from(songs)
+      .where(
+        and(
+          eq(songs.requesterId, userId),
+          gte(songs.createdAt, startOfYear),
+          lt(songs.createdAt, endOfYear)
+        )
+      )
+    const totalRequests = Number(totalRequestsResult[0].count)
+
+    // 2. 已播放投稿数
+    const playedRequestsResult = await db
+      .select({ count: count() })
+      .from(songs)
+      .where(
+        and(
+          eq(songs.requesterId, userId),
+          eq(songs.played, true),
+          gte(songs.createdAt, startOfYear),
+          lt(songs.createdAt, endOfYear)
+        )
+      )
+    const playedRequests = Number(playedRequestsResult[0].count)
+
+    // 3. 最喜欢的歌手
+    const topArtistResult = await db
+      .select({
+        artist: songs.artist,
+        count: count(songs.id)
+      })
+      .from(songs)
+      .where(
+        and(
+          eq(songs.requesterId, userId),
+          gte(songs.createdAt, startOfYear),
+          lt(songs.createdAt, endOfYear)
+        )
+      )
+      .groupBy(songs.artist)
+      .orderBy(desc(count(songs.id)))
+      .limit(1)
+    const topArtist = topArtistResult.length > 0 ? topArtistResult[0].artist : null
+
+    // 4. 最常用的音乐平台
+    const topPlatformResult = await db
+      .select({
+        platform: songs.musicPlatform,
+        count: count(songs.id)
+      })
+      .from(songs)
+      .where(
+        and(
+          eq(songs.requesterId, userId),
+          gte(songs.createdAt, startOfYear),
+          lt(songs.createdAt, endOfYear)
+        )
+      )
+      .groupBy(songs.musicPlatform)
+      .orderBy(desc(count(songs.id)))
+      .limit(1)
+    const topPlatform = topPlatformResult.length > 0 ? topPlatformResult[0].platform : null
+
+    // 5. 总投票数
+    const totalVotesResult = await db
+      .select({ count: count() })
+      .from(votes)
+      .where(
+        and(
+          eq(votes.userId, userId),
+          gte(votes.createdAt, startOfYear),
+          lt(votes.createdAt, endOfYear)
+        )
+      )
+    const totalVotes = Number(totalVotesResult[0].count)
+
+    // 6. 最活跃月份
+    let activeMonth = null
+    try {
+      const activeMonthResult = await db.execute(sql`
+                SELECT EXTRACT(MONTH FROM "createdAt") as month, COUNT(*) as count
+                FROM "Song"
+                WHERE "requesterId" = ${userId}
+                AND "createdAt" >= ${startOfYear.toISOString()}
+                AND "createdAt" < ${endOfYear.toISOString()}
+                GROUP BY month
+                ORDER BY count DESC
+                LIMIT 1
+            `)
+
+      if (activeMonthResult.length > 0) {
+        activeMonth = Number(activeMonthResult[0].month)
+      }
+    } catch (e) {
+      console.error('[YearReview] Failed to get active month:', e)
+    }
+
+    // 7. 年度第一首歌
+    const firstSongResult = await db
+      .select()
+      .from(songs)
+      .where(
+        and(
+          eq(songs.requesterId, userId),
+          gte(songs.createdAt, startOfYear),
+          lt(songs.createdAt, endOfYear)
+        )
+      )
+      .orderBy(asc(songs.createdAt))
+      .limit(1)
+    const firstSong =
+      firstSongResult.length > 0
+        ? {
+            title: firstSongResult[0].title,
+            artist: firstSongResult[0].artist,
+            cover: firstSongResult[0].cover,
+            createdAt: firstSongResult[0].createdAt
+          }
+        : null
+
+    const resultData = {
+      year: currentYear,
+      totalRequests,
+      playedRequests,
+      topArtist,
+      topPlatform,
+      totalVotes,
+      activeMonth,
+      firstSong
+    }
+
+    return {
+      success: true,
+      data: resultData
+    }
+  } catch (error) {
+    console.error('Error fetching year review:', error)
+    throw createError({
+      statusCode: 500,
+      message: '获取年度总结失败'
+    })
+  }
+})