release: PicHost v1.0.0

Multi-user image hosting with RBAC, upload preferences, and admin settings.

server/api/auth/password.patch.ts

@@ -0,0 +1,43 @@
+import { createApiError } from '../../utils/api-error'
+import { requireUserAuth } from '../../utils/access'
+import {
+  hashPassword,
+  isValidPassword,
+  verifyPassword
+} from '../../utils/auth'
+import { findUserById, updateUserPassword } from '../../utils/db'
+import { clientIp, logInfo } from '../../utils/logger'
+
+interface PasswordBody {
+  currentPassword?: string
+  newPassword?: string
+}
+
+export default defineEventHandler(async (event) => {
+  const authUser = await requireUserAuth(event)
+  const body = await readBody<PasswordBody>(event)
+  const currentPassword = body?.currentPassword ?? ''
+  const newPassword = body?.newPassword ?? ''
+
+  if (!currentPassword || !newPassword) {
+    createApiError(event, 'INVALID_REQUEST', '请填写当前密码和新密码', 400)
+  }
+
+  if (!isValidPassword(newPassword)) {
+    createApiError(event, 'INVALID_REQUEST', '新密码至少 8 位', 400)
+  }
+
+  if (currentPassword === newPassword) {
+    createApiError(event, 'INVALID_REQUEST', '新密码不能与当前密码相同', 400)
+  }
+
+  const user = findUserById(authUser.id)
+  if (!user || !verifyPassword(currentPassword, user.password_hash)) {
+    createApiError(event, 'UNAUTHORIZED', '当前密码错误', 401)
+  }
+
+  updateUserPassword(authUser.id, hashPassword(newPassword))
+  logInfo('password changed', { ip: clientIp(event), username: authUser.username })
+
+  return { success: true }
+})