BYW-VoiceHub/server/api/user/profile.put.ts

import { and, db, eq, sql, users } from '~/drizzle/db'
import { emailVerificationCodes } from '~~/server/api/user/email/send-code.post'
import { isValidPersonName, NAME_RULE_MESSAGE } from '~~/server/utils/username'

export default defineEventHandler(async (event) => {
  const user = event.context.user
  if (!user) {
    throw createError({
      statusCode: 401,
      message: '未登录'
    })
  }

  const body = await readBody(event)

  if (body.name) {
    // 姓名必须是纯中文；admin 账号例外（历史数据），规则见 utils/username.ts
    if (!isValidPersonName(body.name, user.username)) {
      throw createError({
        statusCode: 400,
        message: NAME_RULE_MESSAGE
      })
    }
  }

  const rawEmail = typeof body.email === 'string' ? body.email.trim() : ''
  const email = rawEmail ? rawEmail.toLowerCase() : null

  if (email) {
    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
    if (!emailRegex.test(email)) {
      throw createError({
        statusCode: 400,
        message: '邮箱格式不正确'
      })
    }

    const existingEmailUser = await db
      .select({ id: users.id })
      .from(users)
      .where(and(eq(users.email, email), sql`${users.id} != ${user.id}`))
      .limit(1)

    if (existingEmailUser.length > 0) {
      throw createError({
        statusCode: 409,
        message: '邮箱已被绑定'
      })
    }
  }

  try {
    const current = await db
      .select({ email: users.email })
      .from(users)
      .where(eq(users.id, user.id))
      .limit(1)
    const currentEmail = current[0]?.email || null

    if (email !== currentEmail && email) {
      if (!body.emailCode) {
        throw createError({ statusCode: 400, message: '请提供邮箱验证码' })
      }
      
      const storedData = emailVerificationCodes.get(email)
      
      if (!storedData) {
        throw createError({ statusCode: 400, message: '请先获取邮箱验证码' })
      }
      if (Date.now() > storedData.expiresAt) {
        emailVerificationCodes.delete(email)
        throw createError({ statusCode: 400, message: '验证码已过期，请重新获取' })
      }
      if (storedData.code !== body.emailCode.trim()) {
        throw createError({ statusCode: 400, message: '邮箱验证码不正确' })
      }
      
      // 验证通过，清理验证码
      emailVerificationCodes.delete(email)
    }

    const updateData: any = {
      name: body.name || null,
      grade: body.grade || null,
      class: body.class || null,
      studentId: body.studentId || null,
      updatedAt: new Date()
    }

    if (email !== currentEmail) {
      updateData.email = email
      updateData.emailVerified = !!email // 修改后，如果有email说明已经通过验证码验证
    } else {
      updateData.email = email
    }

    await db
      .update(users)
      .set(updateData)
      .where(eq(users.id, user.id))

    return { success: true }
  } catch (error: any) {
    throw createError({
      statusCode: 500,
      message: '更新个人信息失败'
    })
  }
})