release: v1.2.1 — login captcha, docs site, and bug fixes

Add slider captcha for web login, VitePress documentation on GitHub Pages,
and fixes for gallery delete refresh, pagination jump, and copy-format persistence.

server/api/auth/captcha.get.ts

@@ -0,0 +1,6 @@
+import { createLoginCaptchaChallenge } from '../../utils/login-captcha'
+
+export default defineEventHandler(() => {
+  const { id, svg } = createLoginCaptchaChallenge()
+  return { id, svg }
+})

server/api/auth/captcha/confirm.post.ts

@@ -0,0 +1,19 @@
+import { createApiError } from '../../../utils/api-error'
+import { confirmLoginCaptcha } from '../../../utils/login-captcha'
+
+interface ConfirmBody {
+  id?: string
+  captchaPosition?: number
+}
+
+export default defineEventHandler(async (event) => {
+  const body = await readBody<ConfirmBody>(event)
+  const id = body?.id?.trim() ?? ''
+  const position = Number(body?.captchaPosition)
+
+  if (!id || !confirmLoginCaptcha(id, position)) {
+    createApiError(event, 'INVALID_REQUEST', '滑块未对齐，请重试', 400)
+  }
+
+  return { success: true }
+})

server/api/auth/login.post.ts

@@ -1,3 +1,4 @@
+import type { H3Event } from 'h3'
 import {
   checkAdminSecret,
   setLegacyAuthCookie
@@ -10,12 +11,15 @@ import {
 } from '../../utils/auth'
 import { findUserByUsername } from '../../utils/db'
 import { getAdminSecret } from '../../utils/env'
+import { verifyLoginCaptcha } from '../../utils/login-captcha'
 import { clientIp, logInfo, logWarn } from '../../utils/logger'
 
 interface LoginBody {
   username?: string
   password?: string
   secret?: string
+  captchaId?: string
+  captchaPosition?: number
 }
 
 const loginAttempts = new Map<string, { count: number, resetAt: number }>()
@@ -38,11 +42,20 @@ function checkRateLimit(ip: string): void {
   }
 }
 
+function verifyCaptchaOrFail(event: H3Event, body: LoginBody) {
+  const id = body.captchaId?.trim() ?? ''
+  const position = Number(body.captchaPosition)
+  if (!id || !verifyLoginCaptcha(id, position)) {
+    createApiError(event, 'INVALID_REQUEST', '请先完成滑块验证', 400)
+  }
+}
+
 export default defineEventHandler(async (event) => {
   const ip = clientIp(event)
   checkRateLimit(ip)
 
   const body = await readBody<LoginBody>(event)
+  verifyCaptchaOrFail(event, body ?? {})
   const initialized = isInitialized()
 
   if (!initialized) {