218 lines
8.4 KiB
TypeScript
218 lines
8.4 KiB
TypeScript
import bcrypt from 'bcryptjs'
|
|
import { db, users, userIdentities } from '~/drizzle/db'
|
|
import { verifyBindingToken } from '~~/server/utils/oauth-token'
|
|
import { getServerDate } from '~~/server/utils/serverTime'
|
|
import { validateOAuthRegisterCredentials } from '~/utils/oauth-register'
|
|
import { isSecureRequest } from '~~/server/utils/request-utils'
|
|
import { createApiError } from '~~/server/utils/apiError'
|
|
import { createAuthSession } from '~~/server/utils/auth-session'
|
|
import { SERVER_ERROR_CODES } from '~~/server/config/constants'
|
|
import { resolveGradeClassError, REMARK_MAX_LENGTH } from '~~/server/utils/register-validation'
|
|
import { isGradeClassValid } from '~~/server/utils/grade-class-options'
|
|
import { getIdentityAvatarUrl } from '~~/server/utils/user-avatar'
|
|
import { verifyEmailCode } from '~~/server/utils/email-verification'
|
|
import { notifyRegistration } from '~~/server/utils/registration-notify'
|
|
|
|
const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
|
|
|
|
export default defineEventHandler(async (event) => {
|
|
// 数据库连接检查（在读取配置前执行，DB 故障时返回明确的 503）
|
|
try {
|
|
await db.select().from(users).limit(1)
|
|
} catch (error) {
|
|
console.error('Database connection error:', error)
|
|
throw createApiError(503, SERVER_ERROR_CODES.AUTH_DATABASE_UNAVAILABLE, '数据库服务暂时不可用')
|
|
}
|
|
|
|
// 检查是否允许 OAuth 注册
|
|
const config = await db.query.systemSettings.findFirst()
|
|
if (!config?.allowOAuthRegistration) {
|
|
throw createApiError(403, SERVER_ERROR_CODES.AUTH_OAUTH_REGISTER_DISABLED_BIND, '系统已关闭第三方账号注册功能，请登录现有账号进行绑定')
|
|
}
|
|
|
|
const body = await readBody(event)
|
|
const { password, confirmPassword } = body
|
|
const username = typeof body.username === 'string' ? body.username.trim() : ''
|
|
const name = typeof body.name === 'string' ? body.name.trim() : ''
|
|
const selectedGrade = typeof body.grade === 'string' ? body.grade.trim() : ''
|
|
const selectedClass = typeof body.class === 'string' ? body.class.trim() : ''
|
|
const remark = typeof body.remark === 'string' ? body.remark.trim() : ''
|
|
const email = typeof body.email === 'string' ? body.email.trim().toLowerCase() : ''
|
|
const emailCode = typeof body.emailCode === 'string' ? body.emailCode.trim() : ''
|
|
const bindingToken = getCookie(event, 'binding-token')
|
|
|
|
// 邮箱必填由管理员开关控制（与本地注册同源）：开启时邮箱必填；验证码在用户名检查后消费
|
|
const emailRequired = Boolean(config?.registerEmailRequired)
|
|
if (emailRequired && !email) {
|
|
throw createApiError(400, SERVER_ERROR_CODES.COMMON_INVALID_PARAMS, '请填写邮箱地址')
|
|
}
|
|
if (email && !EMAIL_REGEX.test(email)) {
|
|
throw createApiError(400, SERVER_ERROR_CODES.COMMON_INVALID_PARAMS, '请输入有效的邮箱地址')
|
|
}
|
|
|
|
if (remark.length > REMARK_MAX_LENGTH) {
|
|
throw createApiError(400, SERVER_ERROR_CODES.COMMON_INVALID_PARAMS, `备注不能超过 ${REMARK_MAX_LENGTH} 个字符`)
|
|
}
|
|
if (!bindingToken) {
|
|
throw createApiError(400, SERVER_ERROR_CODES.AUTH_REGISTER_SESSION_EXPIRED, '注册会话已过期，请重新通过第三方登录发起')
|
|
}
|
|
|
|
let payload
|
|
try {
|
|
payload = verifyBindingToken(bindingToken)
|
|
} catch (e) {
|
|
deleteCookie(event, 'binding-token')
|
|
throw createApiError(400, SERVER_ERROR_CODES.AUTH_INVALID_REGISTER_TOKEN, '无效的注册令牌')
|
|
}
|
|
|
|
// 验证输入
|
|
if (!username || !name || !password || !confirmPassword) {
|
|
throw createApiError(400, SERVER_ERROR_CODES.AUTH_NAME_USERNAME_PASSWORD_REQUIRED, '姓名、用户名、密码不能为空')
|
|
}
|
|
|
|
const validationError = validateOAuthRegisterCredentials(username, password, confirmPassword)
|
|
if (validationError) {
|
|
throw createApiError(400, validationError.code, validationError.message)
|
|
}
|
|
|
|
const gradeClassError = resolveGradeClassError(
|
|
selectedGrade,
|
|
selectedClass,
|
|
Boolean(config?.registerRequiresGradeClass)
|
|
)
|
|
if (gradeClassError) {
|
|
throw createApiError(400, gradeClassError.code, gradeClassError.message)
|
|
}
|
|
|
|
if (selectedGrade && selectedClass) {
|
|
const valid = await isGradeClassValid(selectedGrade, selectedClass)
|
|
|
|
if (!valid) {
|
|
throw createApiError(400, SERVER_ERROR_CODES.AUTH_GRADE_CLASS_MUST_EXIST, '请选择系统内已存在的年级和班级')
|
|
}
|
|
}
|
|
|
|
// 检查用户名是否已存在
|
|
const existingUser = await db.query.users.findFirst({
|
|
where: (t, { eq }) => eq(t.username, username)
|
|
})
|
|
|
|
if (existingUser) {
|
|
throw createApiError(409, SERVER_ERROR_CODES.AUTH_USERNAME_TAKEN, '用户名已存在，请使用其他用户名')
|
|
}
|
|
|
|
// 检查OAuth身份是否已被绑定
|
|
const existingIdentity = await db.query.userIdentities.findFirst({
|
|
where: (t, { eq, and }) =>
|
|
and(eq(t.provider, payload.provider), eq(t.providerUserId, payload.providerUserId))
|
|
})
|
|
|
|
if (existingIdentity) {
|
|
throw createApiError(409, SERVER_ERROR_CODES.AUTH_OAUTH_ALREADY_BOUND, '该第三方账号已被绑定，请直接登录或绑定到现有账户')
|
|
}
|
|
|
|
// 邮箱验证码在最后校验（前置校验通过后消费）
|
|
if (email && !(await verifyEmailCode(email, emailCode))) {
|
|
throw createApiError(400, SERVER_ERROR_CODES.AUTH_EMAIL_CODE_INVALID, '邮箱验证码无效或已过期，请重新获取')
|
|
}
|
|
|
|
try {
|
|
// 开事务创建用户和关联身份
|
|
const result = await db.transaction(async (tx) => {
|
|
// 加密密码
|
|
const hashedPassword = await bcrypt.hash(password, 10)
|
|
const now = getServerDate()
|
|
const avatarUrl = getIdentityAvatarUrl({
|
|
provider: payload.provider,
|
|
providerUserId: payload.providerUserId,
|
|
providerUsername: payload.providerUsername,
|
|
avatar: payload.avatar
|
|
})
|
|
|
|
// 创建用户（onConflictDoNothing 兜底并发用户名竞态）
|
|
const insertedUser = (await tx
|
|
.insert(users)
|
|
.values({
|
|
username,
|
|
name,
|
|
grade: selectedGrade || null,
|
|
class: selectedClass || null,
|
|
password: hashedPassword,
|
|
role: 'USER',
|
|
status: config?.oauthRegisterRequiresApproval ? 'pending' : 'active',
|
|
remark: remark || null,
|
|
email: email || null,
|
|
emailVerified: email ? true : null,
|
|
createdAt: now,
|
|
updatedAt: now,
|
|
passwordChangedAt: now,
|
|
lastLogin: now,
|
|
forcePasswordChange: false,
|
|
avatarProvider: avatarUrl ? payload.provider : null,
|
|
avatarProviderUserId: avatarUrl ? payload.providerUserId : null
|
|
})
|
|
.onConflictDoNothing()
|
|
.returning({ id: users.id, tokenVersion: users.tokenVersion }))[0]
|
|
|
|
if (!insertedUser) {
|
|
throw createApiError(409, SERVER_ERROR_CODES.AUTH_USERNAME_TAKEN, '用户名已存在，请使用其他用户名')
|
|
}
|
|
|
|
// 关联OAuth身份
|
|
await tx.insert(userIdentities).values({
|
|
userId: insertedUser.id,
|
|
provider: payload.provider,
|
|
providerUserId: payload.providerUserId,
|
|
providerUsername: payload.providerUsername,
|
|
avatar: payload.avatar || null,
|
|
createdAt: now,
|
|
})
|
|
|
|
return insertedUser
|
|
})
|
|
|
|
// 清除绑定令牌
|
|
deleteCookie(event, 'binding-token')
|
|
|
|
// 注册通知（站内通知管理员 + 邮件；异步，失败不影响主流程）
|
|
void notifyRegistration(result.id, username, name, email, Boolean(config?.oauthRegisterRequiresApproval))
|
|
|
|
// 需要审核时：不签发登录态，等待管理员审核
|
|
if (config?.oauthRegisterRequiresApproval) {
|
|
return {
|
|
success: true,
|
|
pendingApproval: true
|
|
}
|
|
}
|
|
|
|
// 生成JWT令牌
|
|
const { token } = await createAuthSession(event, { id: result.id, role: 'USER', tokenVersion: result.tokenVersion }, payload.provider || 'oauth')
|
|
|
|
// 自动判断是否需要secure
|
|
const isSecure = isSecureRequest(event)
|
|
|
|
// 设置cookie
|
|
setCookie(event, 'auth-token', token, {
|
|
httpOnly: true,
|
|
secure: isSecure,
|
|
sameSite: 'lax',
|
|
maxAge: 60 * 60 * 24 * 7, // 7天
|
|
path: '/'
|
|
})
|
|
|
|
return {
|
|
success: true,
|
|
user: {
|
|
id: result.id,
|
|
username: username,
|
|
role: 'USER'
|
|
}
|
|
}
|
|
} catch (e: any) {
|
|
// 业务错误码（如用户名冲突 409）直接透传
|
|
if (e?.statusCode) throw e
|
|
console.error('OAuth register error:', e)
|
|
throw createApiError(500, SERVER_ERROR_CODES.AUTH_SYSTEM_ERROR, e.message || '注册失败，请稍后重试')
|
|
}
|
|
})
|