feat: add local auth billing and usage management

app/api/auth/password/route.ts

@@ -1,134 +1,45 @@
 import { getAuthRuntimeConfig, safeNextPath } from "@/lib/auth/config";
-import { createSessionCookieValue } from "@/lib/auth/session";
 import { jsonError, jsonOk, readJsonBody } from "@/lib/server/api";
-import { createSessionFromClaims, verifyAuthJwt } from "@/lib/server/auth/jwt";
-import { prepareAuthPassword } from "@/lib/server/auth/password";
-import { setSessionCookieValue } from "@/lib/server/auth/session-cookie";
+import { authenticatePlatformUser } from "@/lib/server/account-store";
+import {
+  checkIpLoginRateLimit,
+  clearIpLoginRateLimit,
+  clientIpFromRequest,
+  createPlatformSession,
+  setPlatformSessionCookie
+} from "@/lib/server/auth/local";
 
 export const runtime = "nodejs";
-
-type PasswordTokenResponse = {
-  access_token?: string;
-  refresh_token?: string;
-  expires_in?: string | number;
-  token_type?: string;
-  error?: string;
-  error_description?: string;
-  msg?: string;
-  message?: string;
-  [key: string]: unknown;
-};
+export const dynamic = "force-dynamic";
 
 export async function POST(request: Request) {
+  const ip = clientIpFromRequest(request);
   try {
-    const body = await readJsonBody<{
-      username?: string;
-      password?: string;
-      password_encrypted?: boolean;
-      passwordEncrypted?: boolean;
-      code?: string;
-      randomStr?: string;
-      next?: string;
-      authMode?: string;
-    }>(request);
-    const config = getAuthRuntimeConfig({ clientMode: body.authMode === "admin" ? "admin" : "default" });
-    if (!config.configured || !config.tokenUrl || !config.clientSecret || !config.sessionSecret) {
-      throw new PasswordLoginError(`认证配置不完整：${config.missing.join(", ") || "未知配置"}`, 500);
+    const config = getAuthRuntimeConfig();
+    if (!config.configured || !config.sessionSecret) {
+      throw Object.assign(new Error(`账号认证配置不完整：${config.missing.join(", ") || "ZHINIAN_AUTH_SESSION_SECRET"}`), { status: 503 });
     }
-    const username = body.username?.trim();
-    const password = body.password || "";
-    const code = body.code?.trim();
-    const randomStr = body.randomStr?.trim();
-    if (!username || !password) throw new PasswordLoginError("账号和密码不能为空。");
-
-    const token = await exchangePasswordToken({
-      tokenUrl: config.tokenUrl,
-      clientId: config.clientId,
-      clientSecret: config.clientSecret,
-      scope: config.scope,
-      tenantId: config.tenantId,
-      username,
-      password: prepareAuthPassword(password, {
-        passwordEncrypted: body.password_encrypted || body.passwordEncrypted,
-        passwordEncryptionKey: config.passwordEncryptionKey
-      }),
-      code,
-      randomStr
-    });
-    if (!token.access_token) throw new PasswordLoginError("认证中心没有返回 access_token。", 502);
-    const claims = await verifyAuthJwt(token.access_token, config);
-    const session = createSessionFromClaims(claims, config, parseExpiresIn(token.expires_in), {
-      accessToken: token.access_token,
-      tokenType: token.token_type
-    });
+    checkIpLoginRateLimit(ip);
+    const body = await readJsonBody<Record<string, unknown>>(request);
+    const phone = stringValue(body.phone) || stringValue(body.username);
+    const password = stringValue(body.password);
+    if (!phone || !password) throw Object.assign(new Error("手机号和密码不能为空。"), { status: 400 });
+    const user = await authenticatePlatformUser(phone, password);
+    clearIpLoginRateLimit(ip);
+    const session = await createPlatformSession(user);
     const response = jsonOk({
       ok: true,
-      redirectTo: safeNextPath(body.next),
-      user: session.user
+      redirectTo: safeNextPath(stringValue(body.next)),
+      user: session.user,
+      authMode: session.authMode
     });
-    setSessionCookieValue(
-      response,
-      request.url,
-      await createSessionCookieValue(session, config.sessionSecret),
-      new Date(session.expiresAt * 1000)
-    );
+    await setPlatformSessionCookie(response, request.url, session);
     return response;
   } catch (error) {
-    return jsonError(error, 401);
+    return jsonError(error, 401, { request, source: "api.auth.password", logClientErrors: false });
   }
 }
 
-async function exchangePasswordToken(input: {
-  tokenUrl: string;
-  clientId: string;
-  clientSecret: string;
-  scope: string;
-  tenantId?: string;
-  username: string;
-  password: string;
-  code?: string;
-  randomStr?: string;
-}): Promise<PasswordTokenResponse> {
-  const form = new URLSearchParams();
-  form.set("grant_type", "password");
-  form.set("scope", input.scope);
-  form.set("username", input.username);
-  form.set("password", input.password);
-  if (input.tenantId) form.set("tenantId", input.tenantId);
-  if (input.code) form.set("code", input.code);
-  if (input.randomStr) form.set("randomStr", input.randomStr);
-  const headers: Record<string, string> = {
-    Authorization: `Basic ${Buffer.from(`${input.clientId}:${input.clientSecret}`).toString("base64")}`,
-    "Content-Type": "application/x-www-form-urlencoded"
-  };
-  if (input.tenantId) headers.tenantId = input.tenantId;
-  const response = await fetch(input.tokenUrl, {
-    method: "POST",
-    headers,
-    body: form
-  });
-  const payload = await response.json().catch(() => ({})) as PasswordTokenResponse;
-  if (!response.ok) {
-    throw new PasswordLoginError(payload.error_description || payload.msg || payload.message || payload.error || "登录失败。", response.status);
-  }
-  return payload;
-}
-
-function parseExpiresIn(value: string | number | undefined): number | undefined {
-  if (typeof value === "number" && Number.isFinite(value)) return value;
-  if (typeof value === "string" && value.trim()) {
-    const parsed = Number(value);
-    if (Number.isFinite(parsed)) return parsed;
-  }
-  return undefined;
-}
-
-class PasswordLoginError extends Error {
-  status: number;
-
-  constructor(message: string, status = 400) {
-    super(message);
-    this.name = "PasswordLoginError";
-    this.status = status;
-  }
+function stringValue(value: unknown): string | undefined {
+  return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }