feat: 后端用户密码哈希存储

server/middleware/auth.ts

@@ -1,5 +1,4 @@
 import serverConfig from "../server.config"
-// import { verify } from 'jsonwebtoken'
 import jwt from 'jsonwebtoken'
 import getKey from "../utils/getKey"
 
@@ -17,10 +16,13 @@ export default defineEventHandler(async (event) => {
         const token = authHeader.split('Bearer ')[1].trim()
         try {
             const decoded = jwt.verify(token, key) as { userId: number, password: string, username: string, exp: number }
+            const authRes = await authUser(decoded.username, decoded.password)
+            if (!authRes) {
+                throw createError({ statusCode: 401, statusMessage: 'Token invalid or expired', data: { err: 'auth failed', token } }) 
+            }
             if (decoded.exp > Date.now()) {
                 throw createError({ statusCode: 401, statusMessage: 'Token invalid or expired', data: { err: 'token expired', token } })
             }
-            // console.log(decoded)
             // 将用户ID挂载到事件对象，供后续使用
             // event.context.userId = decoded.userId
         } catch (err) {