85 lines
2.4 KiB
TypeScript
85 lines
2.4 KiB
TypeScript
import { createError, defineEventHandler, getQuery, setHeader } from 'h3'
|
|
import { promises as fs } from 'fs'
|
|
import path from 'path'
|
|
|
|
export default defineEventHandler(async (event) => {
|
|
try {
|
|
// 验证管理员权限
|
|
const user = event.context.user
|
|
if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
|
|
throw createError({
|
|
statusCode: 403,
|
|
statusMessage: '权限不足'
|
|
})
|
|
}
|
|
|
|
const query = getQuery(event)
|
|
const { filename } = query
|
|
|
|
if (!filename || typeof filename !== 'string') {
|
|
throw createError({
|
|
statusCode: 400,
|
|
statusMessage: '缺少文件名参数'
|
|
})
|
|
}
|
|
|
|
// 安全检查：确保文件名不包含路径遍历字符
|
|
if (filename.includes('..') || filename.includes('/') || filename.includes('\\')) {
|
|
throw createError({
|
|
statusCode: 400,
|
|
statusMessage: '无效的文件名'
|
|
})
|
|
}
|
|
|
|
// 检查文件是否为备份文件
|
|
if (
|
|
!filename.endsWith('.json') ||
|
|
(!filename.startsWith('database-backup-') &&
|
|
!filename.startsWith('users-backup-') &&
|
|
!filename.startsWith('uploaded-'))
|
|
) {
|
|
throw createError({
|
|
statusCode: 400,
|
|
statusMessage: '无效的备份文件'
|
|
})
|
|
}
|
|
|
|
const backupDir = path.join(process.cwd(), 'backups')
|
|
const filepath = path.join(backupDir, filename)
|
|
|
|
try {
|
|
// 检查文件是否存在
|
|
await fs.access(filepath)
|
|
|
|
// 读取文件内容
|
|
const fileContent = await fs.readFile(filepath, 'utf8')
|
|
const fileStats = await fs.stat(filepath)
|
|
|
|
// 设置响应头
|
|
setHeader(event, 'Content-Type', 'application/json')
|
|
setHeader(event, 'Content-Disposition', `attachment; filename="${filename}"`)
|
|
setHeader(event, 'Content-Length', fileStats.size.toString())
|
|
setHeader(event, 'Cache-Control', 'no-cache')
|
|
|
|
return fileContent
|
|
} catch (error) {
|
|
if (error.code === 'ENOENT') {
|
|
throw createError({
|
|
statusCode: 404,
|
|
statusMessage: '备份文件不存在'
|
|
})
|
|
}
|
|
throw createError({
|
|
statusCode: 500,
|
|
statusMessage: '读取备份文件失败'
|
|
})
|
|
}
|
|
} catch (error) {
|
|
console.error('下载备份文件失败:', error)
|
|
throw createError({
|
|
statusCode: error.statusCode || 500,
|
|
statusMessage: error.statusMessage || '下载备份文件失败'
|
|
})
|
|
}
|
|
})
|