feat: 完成登录session处理

Co-authored-by: Copilot <copilot@github.com>
2026-04-24 22:22:21 +08:00
parent 5294528148
commit 81965595f0
15 changed files with 804 additions and 240 deletions
@@ -1,21 +1,31 @@
 // server/api/auth/login.post.ts
 import type { IUserLoginData, IUserLoginRequest } from "#shared/types";
 import {
+  clearNewApiAuthCookies,
  createErrorResponse,
  createSuccessResponse,
  createUpstreamErrorResponse,
-  newApiFetch
+  extractCookieMetaFromSetCookie,
+  extractCookieValueFromSetCookie,
+  newApiFetchRaw,
+  setNewApiAuthCookies
 } from "~~/server/utils";

-interface INewApiLoginResponse {
+interface INewApiWrappedLoginResponse {
  /** 登录成功时上游返回的用户信息 */
-  data?: IUserLoginData | null;
+  data?: INewApiLoginUserData | null;
  /** 上游提示信息 */
  message?: string;
  /** 上游业务成功状态 */
  success?: boolean;
 }

+type NewApiLoginResponse = INewApiLoginUserData | INewApiWrappedLoginResponse;
+
+interface INewApiLoginUserData extends IUserLoginData {
+  /** NewAPI 登录结果如果返回额外字段，服务端会在返回前裁剪掉 */
+  [key: string]: unknown;
+}
 /**
 * 允许从请求体透传给上游的字段列表。
 * 只有在这里声明过的字段才会被转发，其余字段一律丢弃，防止参数污染。
@@ -30,7 +40,9 @@ const LOGIN_FIELDS = ["username", "password"] as const satisfies ReadonlyArray<
 export default defineEventHandler(async (event) => {
  const requestBody = await readBody<Partial<IUserLoginRequest> | null>(event);

+  // 只接受 JSON 对象或 null，避免数组/字符串等无效 body 被透传到上游。
  if (requestBody !== null && typeof requestBody !== "object") {
+    clearNewApiAuthCookies(event);
    return createErrorResponse(400, "请求体必须是 JSON 对象");
  }

@@ -43,23 +55,111 @@ export default defineEventHandler(async (event) => {
  }

  try {
-    const result = await newApiFetch<INewApiLoginResponse>("/api/user/login", {
-      method: "POST",
-      body: payload,
-      headers: {
-        "Content-Type": "application/json"
+    // 登录必须读取上游 Set-Cookie，因此这里使用 raw fetch 保留响应头。
+    const result = await newApiFetchRaw<NewApiLoginResponse>(
+      "/api/user/login",
+      {
+        method: "POST",
+        body: payload,
+        headers: {
+          "Content-Type": "application/json"
+        }
      }
-    });
+    );

-    const message =
-      result.message || (result.success ? "登录成功" : "登录失败");
-
-    if (result.success !== true) {
-      return createErrorResponse(1, message, result.data ?? null);
+    const normalized = normalizeLoginResponse(result._data);
+    if (!normalized.user) {
+      // 上游业务失败时同步清理本地旧登录态，避免继续携带坏 cookie。
+      clearNewApiAuthCookies(event);
+      return createErrorResponse(1, normalized.message, result._data ?? null);
    }

-    return createSuccessResponse<IUserLoginData>(result.data ?? null, message);
+    const session = extractCookieValueFromSetCookie(result.headers, "session");
+    if (!session) {
+      // 没有 session 就不能恢复 NewAPI 登录态，必须让前端明确感知失败。
+      clearNewApiAuthCookies(event);
+      return createErrorResponse(
+        500,
+        "登录成功但未收到 NewAPI session，请稍后重试"
+      );
+    }
+
+    setNewApiAuthCookies(
+      event,
+      session,
+      normalized.user.id,
+      extractCookieMetaFromSetCookie(result.headers, "session")
+    );
+
+    return createSuccessResponse<IUserLoginData>(
+      normalized.user,
+      normalized.message
+    );
  } catch (error) {
+    clearNewApiAuthCookies(event);
    return createUpstreamErrorResponse(error, "登录失败");
  }
 });
+
+/** 兼容上游直接返回用户对象和 { success, message, data } 包装结构 */
+const normalizeLoginResponse = (
+  response: NewApiLoginResponse | undefined
+): { message: string; user: IUserLoginData | null } => {
+  if (isUser(response)) {
+    return {
+      message: "登录成功",
+      user: pickUserBasicData(response)
+    };
+  }
+
+  if (!isRecord(response)) {
+    return {
+      message: "登录失败",
+      user: null
+    };
+  }
+
+  const wrapped = response as INewApiWrappedLoginResponse;
+  const message =
+    wrapped.message || (wrapped.success ? "登录成功" : "登录失败");
+
+  if (wrapped.success !== true || !isUser(wrapped.data)) {
+    return {
+      message,
+      user: null
+    };
+  }
+
+  return {
+    message,
+    user: pickUserBasicData(wrapped.data)
+  };
+};
+
+/** 只返回前端需要的基础用户字段，避免上游额外字段透出 */
+const pickUserBasicData = (user: INewApiLoginUserData): IUserLoginData => {
+  return {
+    id: user.id,
+    username: user.username,
+    display_name: user.display_name,
+    group: user.group,
+    role: user.role,
+    status: user.status
+  };
+};
+
+const isUser = (value: unknown): value is INewApiLoginUserData => {
+  return (
+    isRecord(value) &&
+    typeof value.id === "number" &&
+    typeof value.username === "string" &&
+    typeof value.display_name === "string" &&
+    typeof value.group === "string" &&
+    typeof value.role === "number" &&
+    typeof value.status === "number"
+  );
+};
+
+const isRecord = (value: unknown): value is Record<string, unknown> => {
+  return value !== null && typeof value === "object";
+};
@@ -1,22 +1,21 @@
-// server/api/auth/logout.get.ts
 import type { IUserLogoutData } from "#shared/types";
 import {
+  clearNewApiAuthCookies,
  createSuccessResponse,
-  createUpstreamErrorResponse,
-  newApiFetch
+  newApiAuthedFetch
 } from "~~/server/utils";

-/**
- * GET /api/auth/logout
- */
-export default defineEventHandler(async () => {
+export default defineEventHandler(async (event) => {
  try {
-    await newApiFetch<IUserLogoutData>("/api/user/logout", {
+    // 带上本站 httpOnly cookie 中的 NewAPI 登录态，请求上游销毁 session。
+    await newApiAuthedFetch<IUserLogoutData>(event, "/api/user/logout", {
      method: "GET"
    });
-
-    return createSuccessResponse<IUserLogoutData>(null, "登出成功");
-  } catch (error) {
-    return createUpstreamErrorResponse(error, "登出失败");
+  } catch {
+    // 上游 session 可能已失效，本地仍然必须清理，避免残留坏登录态。
+  } finally {
+    clearNewApiAuthCookies(event);
  }
+
+  return createSuccessResponse<IUserLogoutData>(null, "登出成功");
 });
@@ -0,0 +1,115 @@
+import type { IUserMeData } from "#shared/types";
+import {
+  clearNewApiAuthCookies,
+  createErrorResponse,
+  createSuccessResponse,
+  newApiAuthedFetch
+} from "~~/server/utils";
+
+interface INewApiWrappedUserResponse {
+  /** 获取成功时上游返回的当前用户信息 */
+  data?: INewApiSelfUserData | null;
+  /** 上游提示信息，失败时优先返回给前端 */
+  message?: string;
+  /** 上游业务成功状态 */
+  success?: boolean;
+}
+
+type NewApiUserResponse = INewApiSelfUserData | INewApiWrappedUserResponse;
+
+interface INewApiSelfUserData extends IUserMeData {
+  /** NewAPI /api/user/self 可能返回配额、设置、第三方绑定等额外字段 */
+  [key: string]: unknown;
+}
+
+export default defineEventHandler(async (event) => {
+  try {
+    // 从本站 httpOnly cookie 读取登录态，并转发给 NewAPI 查询当前用户。
+    const result = await newApiAuthedFetch<NewApiUserResponse>(
+      event,
+      "/api/user/self",
+      {
+        method: "GET"
+      }
+    );
+    const normalized = normalizeUserResponse(result);
+
+    if (!normalized.user) {
+      // 上游业务失败代表当前 cookie 不再可靠，清理后返回统一 401。
+      clearNewApiAuthCookies(event);
+      return createErrorResponse(401, normalized.message);
+    }
+
+    return createSuccessResponse<IUserMeData>(
+      normalized.user,
+      normalized.message
+    );
+  } catch {
+    // cookie 缺失或上游鉴权异常时统一视为未登录。
+    clearNewApiAuthCookies(event);
+    return createErrorResponse(401, "未登录");
+  }
+});
+
+/** 兼容上游直接返回用户对象和 { success, message, data } 包装结构 */
+const normalizeUserResponse = (
+  response: NewApiUserResponse
+): { message: string; user: IUserMeData | null } => {
+  if (isUser(response)) {
+    return {
+      message: "获取用户信息成功",
+      user: pickUserBasicData(response)
+    };
+  }
+
+  if (!isRecord(response)) {
+    return {
+      message: "未登录",
+      user: null
+    };
+  }
+
+  const wrapped = response as INewApiWrappedUserResponse;
+  const message =
+    wrapped.message || (wrapped.success ? "获取用户信息成功" : "未登录");
+
+  if (wrapped.success !== true || !isUser(wrapped.data)) {
+    return {
+      message,
+      user: null
+    };
+  }
+
+  return {
+    message,
+    user: pickUserBasicData(wrapped.data)
+  };
+};
+
+/** 只返回前端需要的基础用户字段，避免泄露上游完整 self 信息 */
+const pickUserBasicData = (user: INewApiSelfUserData): IUserMeData => {
+  return {
+    id: user.id,
+    username: user.username,
+    display_name: user.display_name,
+    group: user.group,
+    role: user.role,
+    status: user.status
+  };
+};
+
+const isUser = (value: unknown): value is INewApiSelfUserData => {
+  return (
+    isRecord(value) &&
+    typeof value.id === "number" &&
+    typeof value.username === "string" &&
+    typeof value.display_name === "string" &&
+    typeof value.group === "string" &&
+    typeof value.role === "number" &&
+    typeof value.status === "number"
+  );
+};
+
+const isRecord = (value: unknown): value is Record<string, unknown> => {
+  return value !== null && typeof value === "object";
+};