ysj7705andCursor
3fa4ae2b66
Reserved PUBLIC ACLs can grant unauthenticated pull while blocking login, deletion, and anonymous push/delete. Co-authored-by: Cursor <cursoragent@cursor.com>
39 lines
987 B
TypeScript
39 lines
987 B
TypeScript
import { z } from 'zod'
|
|
|
|
const bodySchema = z.object({
|
|
username: z.string().min(1),
|
|
password: z.string().min(1),
|
|
})
|
|
|
|
export default defineEventHandler(async (event) => {
|
|
await ensureBootstrap()
|
|
const body = bodySchema.parse(await readBody(event))
|
|
|
|
if (isEveryoneUsername(body.username)) {
|
|
throw createError({ statusCode: 401, statusMessage: 'Invalid credentials' })
|
|
}
|
|
|
|
const user = await prisma.user.findUnique({ where: { username: body.username } })
|
|
if (!user || !user.active) {
|
|
throw createError({ statusCode: 401, statusMessage: 'Invalid credentials' })
|
|
}
|
|
|
|
const ok = await verifyPassword(body.password, user.passwordHash)
|
|
if (!ok) {
|
|
throw createError({ statusCode: 401, statusMessage: 'Invalid credentials' })
|
|
}
|
|
|
|
const token = await createSessionToken({
|
|
id: user.id,
|
|
username: user.username,
|
|
role: user.role,
|
|
})
|
|
setSessionCookie(event, token)
|
|
|
|
return {
|
|
id: user.id,
|
|
username: user.username,
|
|
role: user.role,
|
|
}
|
|
})
|