feat: 初始化慧遇书院官网一期

server/api/auth/password.put.ts

@@ -0,0 +1,20 @@
+import { compareSync, hashSync } from 'bcryptjs'
+import { z } from 'zod'
+import { requireAdmin } from '../../utils/auth'
+import { useDatabase } from '../../utils/db'
+
+const passwordSchema = z.object({
+  currentPassword: z.string().min(8).max(200),
+  newPassword: z.string().min(12).max(200).regex(/[a-z]/, '新密码需包含小写字母').regex(/[A-Z]/, '新密码需包含大写字母').regex(/\d/, '新密码需包含数字').regex(/[^A-Za-z0-9]/, '新密码需包含特殊字符'),
+}).refine(input => input.currentPassword !== input.newPassword, { message: '新密码不能与当前密码相同', path: ['newPassword'] })
+
+export default defineEventHandler(async (event) => {
+  const user = await requireAdmin(event)
+  const input = passwordSchema.parse(await readBody(event))
+  const db = useDatabase()
+  const row = db.prepare('SELECT password_hash FROM admin_users WHERE id = ?').get(user.id) as { password_hash: string } | undefined
+  if (!row || !compareSync(input.currentPassword, row.password_hash)) throw createError({ statusCode: 400, statusMessage: '当前密码不正确' })
+  db.prepare('UPDATE admin_users SET password_hash = ?, updated_at = ? WHERE id = ?').run(hashSync(input.newPassword, 12), new Date().toISOString(), user.id)
+  writeAuditLog(event, { operatorId: user.id, action: 'password.change', entityType: 'admin_user', entityKey: String(user.id) })
+  return { success: true }
+})