122 lines
4.4 KiB
TypeScript
122 lines
4.4 KiB
TypeScript
import bcrypt from 'bcryptjs'
|
|
import { db } from '~/drizzle/db'
|
|
import { users } from '~/drizzle/schema'
|
|
import { eq } from 'drizzle-orm'
|
|
import { createApiError } from '~~/server/utils/apiError'
|
|
import { updateUserPassword } from '~~/server/services/userService'
|
|
import { JWTEnhanced } from '~~/server/utils/jwt-enhanced'
|
|
import { isSecureRequest } from '~~/server/utils/request-utils'
|
|
import { getInitialPasswordPolicyViolation } from '~/utils/password-policy'
|
|
import { getClientIP } from '~~/server/utils/ip-utils'
|
|
import { canSetInitialPassword } from '~~/server/utils/initial-password-policy'
|
|
import {
|
|
PASSWORD_AUDIT_ACTIONS,
|
|
consumePasswordRateLimit,
|
|
getPasswordAuditContext,
|
|
recordPasswordAudit
|
|
} from '~~/server/services/passwordSecurityService'
|
|
|
|
export default defineEventHandler(async (event) => {
|
|
const user = event.context.user
|
|
if (!user) {
|
|
throw createApiError(401, 'AUTH_UNAUTHORIZED', '未授权')
|
|
}
|
|
|
|
const auditAction = PASSWORD_AUDIT_ACTIONS.INITIAL_PASSWORD
|
|
const body = await readBody<Record<string, unknown> | null>(event)
|
|
const newPassword = typeof body?.newPassword === 'string' ? body.newPassword : ''
|
|
if (!newPassword) {
|
|
await recordPasswordAudit(event, user.id, auditAction, false, '新密码为空')
|
|
throw createApiError(400, 'AUTH_NEW_PASSWORD_REQUIRED', '新密码不能为空')
|
|
}
|
|
|
|
const clientIp = getClientIP(event)
|
|
const rateLimit = await consumePasswordRateLimit(user.id, clientIp, auditAction, 5)
|
|
if (!rateLimit.allowed) {
|
|
await recordPasswordAudit(event, user.id, auditAction, false, '操作频率超过限制')
|
|
setResponseHeader(event, 'Retry-After', String(rateLimit.retryAfterSeconds))
|
|
const retryAfterMinutes = Math.max(1, Math.ceil(rateLimit.retryAfterSeconds / 60))
|
|
throw createApiError(
|
|
429,
|
|
'AUTH_RATE_LIMITED_MINUTES',
|
|
`初始密码设置尝试过于频繁，请 ${retryAfterMinutes} 分钟后再试`,
|
|
{ params: [retryAfterMinutes] }
|
|
)
|
|
}
|
|
|
|
const policyViolation = getInitialPasswordPolicyViolation(newPassword)
|
|
if (policyViolation) {
|
|
await recordPasswordAudit(event, user.id, auditAction, false, policyViolation.message)
|
|
throw createApiError(400, policyViolation.code, policyViolation.message)
|
|
}
|
|
|
|
let passwordUpdated = false
|
|
try {
|
|
const currentUserResult = await db
|
|
.select({
|
|
password: users.password,
|
|
passwordChangedAt: users.passwordChangedAt,
|
|
tokenVersion: users.tokenVersion
|
|
})
|
|
.from(users)
|
|
.where(eq(users.id, user.id))
|
|
.limit(1)
|
|
const currentUser = currentUserResult[0]
|
|
if (!currentUser) {
|
|
throw createApiError(404, 'USER_NOT_FOUND', '用户不存在')
|
|
}
|
|
|
|
// 已完成初始设置的账号必须通过需要旧密码的修改流程。
|
|
if (currentUser.passwordChangedAt) {
|
|
throw createApiError(400, 'AUTH_PASSWORD_ALREADY_SET', '您已经设置过密码，请使用修改密码功能')
|
|
}
|
|
|
|
if (!canSetInitialPassword(user, currentUser)) {
|
|
throw createApiError(
|
|
403,
|
|
'AUTH_INITIAL_PASSWORD_NOT_REQUIRED',
|
|
'当前账号不需要设置初始密码，请使用修改密码功能'
|
|
)
|
|
}
|
|
|
|
// OAuth 账号可能没有可用于比对的旧密码，不能把 null 传给 bcrypt。
|
|
if (currentUser.password && (await bcrypt.compare(newPassword, currentUser.password))) {
|
|
throw createApiError(400, 'AUTH_NEW_PASSWORD_SAME_AS_CURRENT', '新密码不能与当前密码相同')
|
|
}
|
|
|
|
const { passwordChangedAt, tokenVersion } = await updateUserPassword(user.id, newPassword, {
|
|
expectedTokenVersion: currentUser.tokenVersion,
|
|
auditContext: { action: auditAction, ...getPasswordAuditContext(event) }
|
|
})
|
|
passwordUpdated = true
|
|
|
|
const newToken = JWTEnhanced.generateToken(user.id, user.role, tokenVersion, event.context.authSessionId)
|
|
setCookie(event, 'auth-token', newToken, {
|
|
httpOnly: true,
|
|
secure: isSecureRequest(event),
|
|
sameSite: 'lax',
|
|
maxAge: 60 * 60 * 24 * 7,
|
|
path: '/'
|
|
})
|
|
|
|
return {
|
|
success: true,
|
|
message: '初始密码设置成功',
|
|
passwordChangedAt
|
|
}
|
|
} catch (error: any) {
|
|
if (!passwordUpdated) {
|
|
await recordPasswordAudit(
|
|
event,
|
|
user.id,
|
|
auditAction,
|
|
false,
|
|
error.message || '初始密码设置失败'
|
|
)
|
|
}
|
|
|
|
if (error.statusCode) throw error
|
|
throw createApiError(500, 'AUTH_SYSTEM_ERROR', '初始密码设置失败，请稍后重试')
|
|
}
|
|
})
|