feat: 初始化慧遇书院官网一期

server/api/auth/login.post.ts

@@ -0,0 +1,51 @@
+import { compareSync } from 'bcryptjs'
+import { z } from 'zod'
+import { getAdminSession } from '../../utils/auth'
+import { useDatabase } from '../../utils/db'
+import { writeAuditLog } from '../../utils/audit'
+
+const loginSchema = z.object({
+  username: z.string().trim().min(1).max(80),
+  password: z.string().min(8).max(200),
+})
+
+export default defineEventHandler(async (event) => {
+  const body = loginSchema.parse(await readBody(event))
+  const db = useDatabase()
+  const user = db.prepare(`
+    SELECT id, username, password_hash, display_name, status, failed_login_count, locked_until
+    FROM admin_users WHERE username = ?
+  `).get(body.username) as {
+    id: number
+    username: string
+    password_hash: string
+    display_name: string
+    status: string
+    failed_login_count: number
+    locked_until: string | null
+  } | undefined
+
+  const locked = user?.locked_until && new Date(user.locked_until) > new Date()
+  const valid = user && user.status === 'active' && !locked && compareSync(body.password, user.password_hash)
+
+  if (!valid) {
+    if (user && user.status === 'active') {
+      const failures = user.failed_login_count + 1
+      const lockedUntil = failures >= 5 ? new Date(Date.now() + 10 * 60_000).toISOString() : null
+      db.prepare('UPDATE admin_users SET failed_login_count = ?, locked_until = ?, updated_at = ? WHERE id = ?')
+        .run(failures, lockedUntil, new Date().toISOString(), user.id)
+    }
+    writeAuditLog(event, { operatorId: user?.id, action: 'login_failed', entityType: 'admin_user', entityKey: body.username })
+    throw createError({ statusCode: 401, statusMessage: '账号、密码或验证码错误' })
+  }
+
+  const timestamp = new Date().toISOString()
+  db.prepare('UPDATE admin_users SET failed_login_count = 0, locked_until = NULL, last_login_at = ?, updated_at = ? WHERE id = ?')
+    .run(timestamp, timestamp, user.id)
+
+  const session = await getAdminSession(event)
+  await session.update({ user: { id: user.id, username: user.username, displayName: user.display_name } })
+  writeAuditLog(event, { operatorId: user.id, action: 'login_success', entityType: 'admin_user', entityKey: String(user.id) })
+
+  return { user: session.data.user }
+})