Initial Commit

server/api/auth/login.post.ts

@@ -0,0 +1,22 @@
+import { eq } from 'drizzle-orm'
+import { z } from 'zod'
+import { users } from '../../db/schema'
+
+const bodySchema = z.object({
+  name: z.string().trim().min(1),
+  password: z.string().min(1),
+})
+
+export default defineEventHandler(async (event) => {
+  const body = await readValidatedBody(event, bodySchema.parse)
+  const db = useDb()
+
+  const rows = await db.select().from(users).where(eq(users.name, body.name)).limit(1)
+  const user = rows[0]
+  if (!user || !verifyPassword(body.password, user.passwordHash)) {
+    throw createError({ statusCode: 401, statusMessage: 'Name oder Passwort falsch' })
+  }
+
+  await createSession(event, user.id)
+  return { user: { id: user.id, name: user.name, email: user.email, color: user.color, cardEffect: user.cardEffect, cardEffectColor: user.cardEffectColor, cardVignette: user.cardVignette, cardBorderEffect: user.cardBorderEffect, cardBorderEffectColor: user.cardBorderEffectColor, avatarUrl: avatarUrl(user.avatar), roles: await getUserRoles(user.id), permissions: await getUserPermissions(user.id) } }
+})

server/api/auth/logout.post.ts

@@ -0,0 +1,4 @@
+export default defineEventHandler(async (event) => {
+  await destroySession(event)
+  return { ok: true }
+})

server/api/auth/me.get.ts

@@ -0,0 +1,6 @@
+export default defineEventHandler(async (event) => {
+  const user = await getSessionUser(event)
+  return {
+    user: user ? { id: user.id, name: user.name, email: user.email, color: user.color, cardEffect: user.cardEffect, cardEffectColor: user.cardEffectColor, cardVignette: user.cardVignette, cardBorderEffect: user.cardBorderEffect, cardBorderEffectColor: user.cardBorderEffectColor, avatarUrl: avatarUrl(user.avatar), roles: user.roles, permissions: user.permissions } : null,
+  }
+})

server/api/auth/register.post.ts

@@ -0,0 +1,51 @@
+import { count, eq } from 'drizzle-orm'
+import { z } from 'zod'
+import { users } from '../../db/schema'
+
+const bodySchema = z.object({
+  name: z.string().trim().min(3, 'Mindestens 3 Zeichen').max(50),
+  password: z.string().min(6, 'Mindestens 6 Zeichen').max(128),
+  email: z.union([z.literal(''), z.email().max(255)]).optional(),
+})
+
+export default defineEventHandler(async (event) => {
+  const body = await readValidatedBody(event, bodySchema.parse)
+  const db = useDb()
+
+  const existing = await db
+    .select({ id: users.id })
+    .from(users)
+    .where(eq(users.name, body.name))
+    .limit(1)
+  if (existing.length) {
+    throw createError({ statusCode: 409, statusMessage: 'Name ist bereits vergeben' })
+  }
+
+  try {
+    const color = randomUserColor()
+    const [result] = await db.insert(users).values({
+      name: body.name,
+      email: body.email || null,
+      passwordHash: hashPassword(body.password),
+      color,
+    })
+    const userId = Number(result.insertId)
+
+    const [{ value: userCount }] = await db.select({ value: count() }).from(users)
+    let roleNames: string[] = []
+    if (userCount === 1) {
+      const adminRoleId = await ensureRole('admin')
+      await assignRole(userId, adminRoleId)
+      roleNames = ['admin']
+    }
+
+    await createSession(event, userId)
+    return { user: { id: userId, name: body.name, email: body.email || null, color, cardEffect: null, cardEffectColor: null, cardVignette: false, cardBorderEffect: null, cardBorderEffectColor: null, avatarUrl: null, roles: roleNames, permissions: await getUserPermissions(userId) } }
+  }
+  catch (err: unknown) {
+    if (typeof err === 'object' && err !== null && (err as { errno?: number }).errno === 1062) {
+      throw createError({ statusCode: 409, statusMessage: 'Name oder E-Mail ist bereits vergeben' })
+    }
+    throw err
+  }
+})