nuxt-app/server/api/auth/login.post.ts

import { getRequestIP } from "h3";
import { loginUser } from "#server/service/auth";
import { toPublicAuthError } from "#server/service/auth/errors";
import { setSessionCookie } from "#server/service/auth/cookie";
import { captchaConsume } from "#server/service/captcha/store";
import { assertLoginRegisterCaptchaFieldsPresent } from "#server/service/captcha/validate-body";
import { assertUnderRateLimit } from "#server/utils/simple-rate-limit";
import log4js from "logger";

const logger = log4js.getLogger("AUTH");

export default defineWrappedResponseHandler(async (event) => {
    const ip = getRequestIP(event, { xForwardedFor: true }) ?? "unknown";
    assertUnderRateLimit(`auth-login:${ip}`, 30, 60_000);

    const body = await readBody(event);
    assertLoginRegisterCaptchaFieldsPresent(body);
    if (!captchaConsume(body.captchaId, body.captchaAnswer)) {
        logger.warn("[LOGIN-FAIL] ip=%s username=%s — 验证码错误或已过期", ip, body?.username ?? "?");
        throw createError({
            statusCode: 400,
            statusMessage: "验证码错误或已过期，请重试",
        });
    }

    try {
        const result = await loginUser({
            username: body.username,
            password: body.password,
        });
        setSessionCookie(event, result.sessionId);
        logger.info("[LOGIN-OK] ip=%s username=%s userId=%d", ip, body.username, result.user.id);
        return R.success({
            user: result.user,
        });
    } catch (err) {
        logger.warn("[LOGIN-FAIL] ip=%s username=%s — %s", ip, body?.username ?? "?", err instanceof Error ? err.message : String(err));
        throw toPublicAuthError(err);
    }
});