feat: 添加修改密码功能（当然整个账户功能目前仍然残缺）

server/api/user/updatePassword.ts

@@ -1,33 +1,64 @@
-// import { defineEventHandler, readBody, createError } from 'h3';
-import bcrypt from 'bcryptjs';
+// import bcrypt from 'bcryptjs';
 import BetterSqlite3 from 'better-sqlite3';
-
-// 暂未实现
+// import { defineEventHandler, createError, readBody } from 'h3';
+import jwt from 'jsonwebtoken';
 
 export default defineEventHandler(async (event) => {
     const body = await readBody(event);
     const { oldPassword, newPassword } = body;
-    const userId = event.context.user.id;
-
-    // 查询用户
-    const userDB = new BetterSqlite3('./userData/db/user.db');
-    const user: any = userDB.prepare('SELECT * FROM user WHERE id = ?').get(userId);
-    if (!user || !bcrypt.compareSync(oldPassword, user.password)) {
-        userDB.close();
-        throw createError({ statusCode: 401, statusMessage: 'Invalid old password' });
+    const jwtSecret = getKey();
+    const authHeader = event.headers.get('authorization');
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+        throw createError({ statusCode: 401, statusMessage: 'Unauthorized' })
     }
+    const token = authHeader.split('Bearer ')[1].trim()
 
-    // 哈希新密码
-    const salt = bcrypt.genSaltSync(10);
-    const hashedPassword = bcrypt.hashSync(newPassword, salt);
+    try {
+        // 验证 Token
+        const decoded = jwt.verify(token, jwtSecret) as any;
+        const username = decoded.username;
+        const userDB = BetterSqlite3('./userData/db/user.db');
 
-    // 更新密码
-    userDB.prepare('UPDATE user SET password = ? WHERE id = ?').run(hashedPassword, userId);
+        // 查找用户
+        const user: any = userDB.prepare('SELECT * FROM user WHERE username =?').get(username);
+        if (!user) {
+            userDB.close();
+            throw createError({ statusCode: 404, statusMessage: 'User not found' });
+        }
 
-    // 生成新的 JWT
-    const token = createToken({ userId, password: user.password, username: user.username });
+        // 验证旧密码是否正确
+        // const passwordMatch = bcrypt.compareSync(oldPassword, user.password);
+        const passwordMatch = oldPassword === user.password;
+        if (!passwordMatch) {
+            userDB.close();
+            throw createError({ statusCode: 401, statusMessage: 'Invalid old password' });
+        }
 
-    userDB.close();
+        // 哈希新密码
+        // const salt = bcrypt.genSaltSync(10);
+        // const hashedNewPassword = bcrypt.hashSync(newPassword, salt);
 
-    return { token , expiresIn: Date.now() + 168 * 60 * 60 * 1000 };
+        const hashedNewPassword = newPassword;
+
+        // 更新密码
+        const stmt = userDB.prepare('UPDATE user SET password =? WHERE username =?');
+        const result = stmt.run(hashedNewPassword, username);
+        if (result.changes === 0) {
+            userDB.close();
+            throw createError({ statusCode: 500, statusMessage: 'Failed to update password' });
+        }
+
+        // 重新生成 JWT
+        const newToken = jwt.sign({
+            username: decoded.username,
+            password: hashedNewPassword,
+            userId: decoded.userId,
+        }, jwtSecret, { expiresIn: '168h' });
+
+        userDB.close();
+
+        return { token: newToken, expiresIn: Date.now() + 168 * 60 * 60 * 1000 };
+    } catch (err) {
+        return { statusCode: 401, statusMessage: 'Token invalid or expired', data: { err, token } };
+    }
 });