87 lines
3.0 KiB
TypeScript
87 lines
3.0 KiB
TypeScript
import { db } from '~/drizzle/db'
|
|
import { users } from '~/drizzle/schema'
|
|
import { and, eq } from 'drizzle-orm'
|
|
import { getServerTimestamp } from '~~/server/utils/serverTime'
|
|
import {
|
|
delStore,
|
|
delStoreIfValue,
|
|
getStore,
|
|
incrStore,
|
|
parseStoreJson,
|
|
verifyStateCode
|
|
} from '~~/server/utils/captchaStore'
|
|
import { createApiError } from '~~/server/utils/apiError'
|
|
|
|
export default defineEventHandler(async (event) => {
|
|
if (getMethod(event) !== 'POST') {
|
|
throw createApiError(405, 'HTTP_METHOD_NOT_ALLOWED', '方法不被允许')
|
|
}
|
|
|
|
const user = event.context.user
|
|
if (!user) {
|
|
throw createApiError(401, 'AUTH_UNAUTHORIZED_ACCESS', '未授权访问')
|
|
}
|
|
|
|
const body = await readBody(event)
|
|
const email = (body?.email || '').toString().trim().toLowerCase()
|
|
const code = (body?.code || '').toString().trim()
|
|
|
|
if (!email || !code) {
|
|
throw createApiError(400, 'USER_EMAIL_AND_CODE_REQUIRED', '邮箱与验证码不能为空')
|
|
}
|
|
|
|
const stateKey = `email-verify:${user.id}`
|
|
const recordRaw = await getStore(stateKey)
|
|
const record = parseStoreJson<{ email: string; codeHash: string; expiresAt: number }>(recordRaw)
|
|
if (
|
|
!record ||
|
|
record.email !== email ||
|
|
typeof record.codeHash !== 'string' ||
|
|
!Number.isFinite(record.expiresAt)
|
|
) {
|
|
if (recordRaw) await delStoreIfValue(stateKey, recordRaw)
|
|
throw createApiError(400, 'USER_SEND_CODE_FIRST', '请先发送验证码')
|
|
}
|
|
if (getServerTimestamp() > record.expiresAt) {
|
|
await delStoreIfValue(stateKey, recordRaw!)
|
|
throw createApiError(400, 'USER_CODE_EXPIRED_RESEND', '验证码已过期，请重新发送')
|
|
}
|
|
|
|
const remainingTtl = Math.max(1, Math.ceil((record.expiresAt - getServerTimestamp()) / 1000))
|
|
const attemptKey = `${stateKey}:attempts:${record.codeHash}`
|
|
const attemptCount = await incrStore(attemptKey, remainingTtl)
|
|
|
|
if (attemptCount > 5) {
|
|
await delStoreIfValue(stateKey, recordRaw!)
|
|
await delStore(attemptKey)
|
|
throw createApiError(400, 'USER_CODE_TOO_MANY_ATTEMPTS', '验证码错误次数过多，请重新发送')
|
|
}
|
|
|
|
if (!verifyStateCode(stateKey, code, record.codeHash)) {
|
|
if (attemptCount >= 5) {
|
|
await delStoreIfValue(stateKey, recordRaw!)
|
|
await delStore(attemptKey)
|
|
throw createApiError(400, 'USER_CODE_TOO_MANY_ATTEMPTS', '验证码错误次数过多，请重新发送')
|
|
}
|
|
throw createApiError(400, 'USER_CODE_INVALID', '验证码错误')
|
|
}
|
|
|
|
if (!(await delStoreIfValue(stateKey, recordRaw!))) {
|
|
throw createApiError(400, 'USER_CODE_ALREADY_USED', '验证码已使用，请重新发送')
|
|
}
|
|
await delStore(attemptKey)
|
|
|
|
// 验证通过：设置邮箱为已验证
|
|
const updatedUsers = await db
|
|
.update(users)
|
|
.set({ emailVerified: true })
|
|
.where(and(eq(users.id, user.id), eq(users.email, email)))
|
|
.returning({ id: users.id })
|
|
|
|
if (updatedUsers.length === 0) {
|
|
throw createApiError(409, 'USER_EMAIL_CHANGED_RESEND', '邮箱已发生变化，请重新发送验证码')
|
|
}
|
|
|
|
return { success: true, message: '邮箱验证成功' }
|
|
})
|