用户资料/重置密码/用户管理

server/api/auth/reset-password.post.ts

@@ -0,0 +1,34 @@
+import { createApiError } from '../../utils/api-error'
+import { createSession, hashPassword } from '../../utils/auth'
+import {
+  findUserByUsername,
+  isPasswordResetRequired,
+  setUserPassword
+} from '../../utils/db'
+import { logInfo } from '../../utils/logger'
+
+interface ResetBody {
+  username?: string
+  password?: string
+}
+
+export default defineEventHandler(async (event) => {
+  const body = await readBody<ResetBody>(event).catch((): ResetBody => ({}))
+  const username = body.username?.trim() ?? ''
+  const password = body.password ?? ''
+
+  if (!username || password.length < 6) {
+    createApiError(event, 'INVALID_REQUEST', '请输入用户名和至少 6 位的新密码', 400)
+  }
+
+  const user = findUserByUsername(username)
+  if (!user || !isPasswordResetRequired(user.id)) {
+    createApiError(event, 'UNAUTHORIZED', '该账号无需重置密码', 401)
+  }
+
+  setUserPassword(user.id, await hashPassword(password))
+  await createSession(event, user.id)
+  logInfo('password reset completed', { username })
+
+  return { success: true }
+})