feat: 新增鉴权

server/api/user/refresh-token.post.ts

@@ -0,0 +1,37 @@
+// server/api/user/refresh-token.post.ts - 刷新当前登录用户的 apiToken
+// 鉴权后生成新 token 写入数据库，不对外暴露旧 token 或内部错误
+import { randomBytes } from "node:crypto";
+
+import { setResponseStatus } from "h3";
+
+import { getAuthSession } from "~~/server/utils/auth";
+import { prisma } from "~~/server/utils/db";
+import { createApiLogger } from "~~/server/utils/logging";
+
+export default defineEventHandler(async (event) => {
+  const logger = createApiLogger(event, "api.user.refresh-token");
+
+  const session = await getAuthSession(event);
+  if (!session) {
+    setResponseStatus(event, 401);
+    logger.warn("unauthorized");
+    return { success: false, msg: "未登录" };
+  }
+
+  const userId = session.user.id;
+  const newToken = randomBytes(16).toString("hex");
+
+  try {
+    await prisma.user.update({
+      where: { id: userId },
+      data: { apiToken: newToken }
+    });
+  } catch (err) {
+    logger.error("db_error", { userId, err: String(err) });
+    setResponseStatus(event, 500);
+    return { success: false, msg: "服务器内部错误" };
+  }
+
+  logger.info("finish_success", { userId });
+  return { success: true, msg: "刷新成功", apiToken: newToken };
+});