初次提交

server/api/user/2fa/disable.post.ts

@@ -0,0 +1,36 @@
+import { db, userIdentities, eq, and, users } from '~/drizzle/db'
+import bcrypt from 'bcryptjs'
+
+export default defineEventHandler(async (event) => {
+  const user = event.context.user
+  if (!user) {
+    throw createError({ statusCode: 401, message: '未授权访问' })
+  }
+
+  const body = await readBody(event)
+  const { password } = body
+
+  if (!password) {
+    throw createError({ statusCode: 400, message: '请输入密码' })
+  }
+
+  // 验证密码
+  const dbUserResult = await db.select({ password: users.password }).from(users).where(eq(users.id, user.id)).limit(1)
+  const dbUser = dbUserResult[0]
+
+  if (!dbUser) {
+    throw createError({ statusCode: 404, message: '用户不存在' })
+  }
+
+  const isPasswordValid = await bcrypt.compare(password, dbUser.password)
+  if (!isPasswordValid) {
+    // 密码错误不应返回 401，否则会触发全局登出
+    throw createError({ statusCode: 403, message: '密码错误' })
+  }
+  
+  // 删除TOTP记录
+  await db.delete(userIdentities)
+    .where(and(eq(userIdentities.userId, user.id), eq(userIdentities.provider, 'totp')))
+
+  return { success: true }
+})

server/api/user/2fa/enable.post.ts

@@ -0,0 +1,43 @@
+import otplib from 'otplib'
+const { authenticator } = otplib
+import { db, userIdentities, eq, and } from '~/drizzle/db'
+
+export default defineEventHandler(async (event) => {
+  const user = event.context.user
+  if (!user) {
+    throw createError({ statusCode: 401, message: '未授权访问' })
+  }
+  const body = await readBody(event)
+  const { token, secret } = body
+
+  if (!token || !secret) {
+    throw createError({ statusCode: 400, message: '缺少验证码或密钥' })
+  }
+
+  const isValid = authenticator.check(token, secret)
+  if (!isValid) {
+    throw createError({ statusCode: 400, message: '验证码错误' })
+  }
+
+  // 检查是否已存在
+  const existing = await db.query.userIdentities.findFirst({
+    where: and(eq(userIdentities.userId, user.id), eq(userIdentities.provider, 'totp'))
+  })
+
+  if (existing) {
+     // 更新密钥
+     await db.update(userIdentities)
+       .set({ providerUserId: secret })
+       .where(eq(userIdentities.id, existing.id))
+  } else {
+    // 保存到数据库
+    await db.insert(userIdentities).values({
+      userId: user.id,
+      provider: 'totp',
+      providerUserId: secret,
+      createdAt: new Date()
+    })
+  }
+
+  return { success: true }
+})

server/api/user/2fa/generate.post.ts

@@ -0,0 +1,28 @@
+import otplib from 'otplib'
+const { authenticator } = otplib
+import QRCode from 'qrcode'
+import { db, userIdentities, eq, and } from '~/drizzle/db'
+
+export default defineEventHandler(async (event) => {
+  const user = event.context.user
+  if (!user) {
+    throw createError({ statusCode: 401, message: '未授权访问' })
+  }
+
+  // 检查是否已开启2FA
+  const existing = await db.query.userIdentities.findFirst({
+    where: and(eq(userIdentities.userId, user.id), eq(userIdentities.provider, 'totp'))
+  })
+
+  if (existing) {
+    throw createError({ statusCode: 400, message: '已开启双重认证' })
+  }
+
+  const secret = authenticator.generateSecret()
+  const otpauth = authenticator.keyuri(user.username, 'VoiceHub', secret)
+  
+  // 生成QR Code Data URL
+  const qrCode = await QRCode.toDataURL(otpauth)
+
+  return { secret, qrCode }
+})