101 lines
2.5 KiB
TypeScript
101 lines
2.5 KiB
TypeScript
import { updateUserPassword } from '~~/server/services/userService'
|
|
import { db } from '~/drizzle/db'
|
|
import { users } from '~/drizzle/schema'
|
|
import { eq } from 'drizzle-orm'
|
|
import { canResetPasswordFor, getRoleLevel } from '~~/server/utils/permissions'
|
|
|
|
export default defineEventHandler(async (event) => {
|
|
const currentUser = event.context.user
|
|
if (!currentUser || !['ADMIN', 'SUPER_ADMIN'].includes(currentUser.role)) {
|
|
throw createError({
|
|
statusCode: 403,
|
|
message: '没有权限访问'
|
|
})
|
|
}
|
|
|
|
const params = event.context.params || {}
|
|
const id = parseInt(params.id || '')
|
|
|
|
if (isNaN(id)) {
|
|
throw createError({
|
|
statusCode: 400,
|
|
message: '无效的用户ID'
|
|
})
|
|
}
|
|
|
|
const body = await readBody(event)
|
|
|
|
if (!body.newPassword) {
|
|
throw createError({
|
|
statusCode: 400,
|
|
message: '新密码不能为空'
|
|
})
|
|
}
|
|
|
|
try {
|
|
if (id === currentUser.id) {
|
|
throw createError({
|
|
statusCode: 400,
|
|
message: '禁止在用户管理中重置自己的密码'
|
|
})
|
|
}
|
|
|
|
const targetUserResult = await db
|
|
.select({ id: users.id, role: users.role, username: users.username })
|
|
.from(users)
|
|
.where(eq(users.id, id))
|
|
.limit(1)
|
|
|
|
if (targetUserResult.length === 0) {
|
|
throw createError({
|
|
statusCode: 404,
|
|
message: '用户不存在'
|
|
})
|
|
}
|
|
|
|
const targetUser = targetUserResult[0]
|
|
|
|
if (targetUser.id === 1) {
|
|
throw createError({
|
|
statusCode: 403,
|
|
message: '无法重置系统初始超级管理员的密码'
|
|
})
|
|
}
|
|
|
|
const currentLevel = getRoleLevel(currentUser.role)
|
|
const targetLevel = getRoleLevel(targetUser.role)
|
|
|
|
if (currentUser.role !== 'SUPER_ADMIN') {
|
|
if (currentLevel <= targetLevel) {
|
|
throw createError({
|
|
statusCode: 403,
|
|
message: '权限不足：不能重置角色级别大于等于自己的用户密码'
|
|
})
|
|
}
|
|
}
|
|
|
|
if (!canResetPasswordFor(currentUser, targetUser)) {
|
|
throw createError({
|
|
statusCode: 403,
|
|
message: '权限不足：当前角色无法重置该用户的密码'
|
|
})
|
|
}
|
|
|
|
await updateUserPassword(id, body.newPassword, true)
|
|
|
|
return {
|
|
success: true,
|
|
message: '密码重置成功'
|
|
}
|
|
} catch (error) {
|
|
console.error('[ResetPassword] 失败:', error)
|
|
if (error.statusCode) {
|
|
throw error
|
|
}
|
|
throw createError({
|
|
statusCode: 500,
|
|
message: '重置密码失败'
|
|
})
|
|
}
|
|
})
|