release: v1.2.7 — 登录人机验证（滑块 / Turnstile / Cap）

server/api/auth/login.post.ts

@@ -1,4 +1,3 @@
-import type { H3Event } from 'h3'
 import {
   checkAdminSecret,
   setLegacyAuthCookie
@@ -7,19 +6,18 @@ import { createApiError } from '../../utils/api-error'
 import {
   createSession,
   isInitialized,
+  rowToAuthUser,
   verifyPassword
 } from '../../utils/auth'
 import { findUserByUsername } from '../../utils/db'
 import { getAdminSecret } from '../../utils/env'
-import { verifyLoginCaptcha } from '../../utils/login-captcha'
+import { verifyLoginVerification, type VerificationBody } from '../../utils/login-verification'
 import { clientIp, logInfo, logWarn } from '../../utils/logger'
 
-interface LoginBody {
+interface LoginBody extends VerificationBody {
   username?: string
   password?: string
   secret?: string
-  captchaId?: string
-  captchaPosition?: number
 }
 
 const loginAttempts = new Map<string, { count: number, resetAt: number }>()
@@ -42,20 +40,12 @@ function checkRateLimit(ip: string): void {
   }
 }
 
-function verifyCaptchaOrFail(event: H3Event, body: LoginBody) {
-  const id = body.captchaId?.trim() ?? ''
-  const position = Number(body.captchaPosition)
-  if (!id || !verifyLoginCaptcha(id, position)) {
-    createApiError(event, 'INVALID_REQUEST', '请先完成滑块验证', 400)
-  }
-}
-
 export default defineEventHandler(async (event) => {
   const ip = clientIp(event)
   checkRateLimit(ip)
 
   const body = await readBody<LoginBody>(event)
-  verifyCaptchaOrFail(event, body ?? {})
+  await verifyLoginVerification(event, body ?? {})
   const initialized = isInitialized()
 
   if (!initialized) {
@@ -94,6 +84,6 @@ export default defineEventHandler(async (event) => {
 
   return {
     success: true,
-    user: { id: user.id, username: user.username, role: user.role }
+    user: rowToAuthUser(user)
   }
 })