first commit

server/api/auth/login.post.ts

@@ -0,0 +1,25 @@
+import { ADMIN_COOKIE, signAdminToken } from '../../utils/jwt'
+
+export default defineEventHandler(async (event) => {
+  const body = await readBody<{ username?: string; password?: string }>(event)
+  const config = useRuntimeConfig()
+
+  if (!body?.username || !body?.password) {
+    throw createError({ statusCode: 400, statusMessage: 'Username and password required' })
+  }
+
+  if (body.username !== config.adminUsername || body.password !== config.adminPassword) {
+    throw createError({ statusCode: 401, statusMessage: 'Invalid credentials' })
+  }
+
+  const token = await signAdminToken(body.username)
+  setCookie(event, ADMIN_COOKIE, token, {
+    httpOnly: true,
+    sameSite: 'lax',
+    secure: process.env.NODE_ENV === 'production',
+    path: '/',
+    maxAge: 60 * 60 * 24 * 7,
+  })
+
+  return { ok: true, username: body.username }
+})

server/api/auth/logout.post.ts

@@ -0,0 +1,6 @@
+import { ADMIN_COOKIE } from '../../utils/jwt'
+
+export default defineEventHandler(async (event) => {
+  deleteCookie(event, ADMIN_COOKIE, { path: '/' })
+  return { ok: true }
+})

server/api/auth/me.get.ts

@@ -0,0 +1,18 @@
+import { ADMIN_COOKIE, verifyAdminToken } from '../../utils/jwt'
+
+export default defineEventHandler(async (event) => {
+  const token =
+    getCookie(event, ADMIN_COOKIE) ||
+    getHeader(event, 'authorization')?.replace(/^Bearer\s+/i, '')
+
+  if (!token) {
+    throw createError({ statusCode: 401, statusMessage: 'Unauthorized' })
+  }
+
+  try {
+    const payload = await verifyAdminToken(token)
+    return { ok: true, username: payload.username }
+  } catch {
+    throw createError({ statusCode: 401, statusMessage: 'Unauthorized' })
+  }
+})