BYW-VoiceHub/server/api/admin/users/[id]/reset-password.post.ts

import { updateUserPassword } from '~~/server/services/userService'
import { db } from '~/drizzle/db'
import { users } from '~/drizzle/schema'
import { eq } from 'drizzle-orm'
import { canResetPasswordFor, getRoleLevel } from '../../../utils/permissions.js'

export default defineEventHandler(async (event) => {
  const currentUser = event.context.user
  if (!currentUser || !['ADMIN', 'SUPER_ADMIN'].includes(currentUser.role)) {
    throw createError({
      statusCode: 403,
      message: '没有权限访问'
    })
  }

  const params = event.context.params || {}
  const id = parseInt(params.id || '')

  if (isNaN(id)) {
    throw createError({
      statusCode: 400,
      message: '无效的用户ID'
    })
  }

  const body = await readBody(event)

  if (!body.newPassword) {
    throw createError({
      statusCode: 400,
      message: '新密码不能为空'
    })
  }

  try {
    if (id === currentUser.id) {
      throw createError({
        statusCode: 400,
        message: '禁止在用户管理中重置自己的密码'
      })
    }

    const targetUserResult = await db
      .select({ id: users.id, role: users.role, username: users.username })
      .from(users)
      .where(eq(users.id, id))
      .limit(1)

    if (targetUserResult.length === 0) {
      throw createError({
        statusCode: 404,
        message: '用户不存在'
      })
    }

    const targetUser = targetUserResult[0]

    if (targetUser.id === 1) {
      throw createError({
        statusCode: 403,
        message: '无法重置系统初始超级管理员的密码'
      })
    }

    const currentLevel = getRoleLevel(currentUser.role)
    const targetLevel = getRoleLevel(targetUser.role)

    if (currentUser.role !== 'SUPER_ADMIN') {
      if (currentLevel <= targetLevel) {
        throw createError({
          statusCode: 403,
          message: '权限不足：不能重置角色级别大于等于自己的用户密码'
        })
      }
    }

    if (!canResetPasswordFor(currentUser, targetUser)) {
      throw createError({
        statusCode: 403,
        message: '权限不足：当前角色无法重置该用户的密码'
      })
    }

    await updateUserPassword(id, body.newPassword, true)

    return {
      success: true,
      message: '密码重置成功'
    }
  } catch (error) {
    console.error('[ResetPassword] 失败:', error)
    if (error.statusCode) {
      throw error
    }
    throw createError({
      statusCode: 500,
      message: '重置密码失败'
    })
  }
})