NianAIGC/app/api/auth/password/route.ts

import { getAuthRuntimeConfig, safeNextPath } from "@/lib/auth/config";
import { createSessionCookieValue } from "@/lib/auth/session";
import { jsonError, jsonOk, readJsonBody } from "@/lib/server/api";
import { createSessionFromClaims, verifyAuthJwt } from "@/lib/server/auth/jwt";
import { prepareAuthPassword } from "@/lib/server/auth/password";
import { setSessionCookieValue } from "@/lib/server/auth/session-cookie";

export const runtime = "nodejs";

type PasswordTokenResponse = {
  access_token?: string;
  refresh_token?: string;
  expires_in?: string | number;
  token_type?: string;
  error?: string;
  error_description?: string;
  msg?: string;
  message?: string;
  [key: string]: unknown;
};

export async function POST(request: Request) {
  try {
    const body = await readJsonBody<{
      username?: string;
      password?: string;
      password_encrypted?: boolean;
      passwordEncrypted?: boolean;
      code?: string;
      randomStr?: string;
      next?: string;
      authMode?: string;
    }>(request);
    const config = getAuthRuntimeConfig({ clientMode: body.authMode === "admin" ? "admin" : "default" });
    if (!config.configured || !config.tokenUrl || !config.clientSecret || !config.sessionSecret) {
      throw new PasswordLoginError(`认证配置不完整：${config.missing.join(", ") || "未知配置"}`, 500);
    }
    const username = body.username?.trim();
    const password = body.password || "";
    const code = body.code?.trim();
    const randomStr = body.randomStr?.trim();
    if (!username || !password) throw new PasswordLoginError("账号和密码不能为空。");

    const token = await exchangePasswordToken({
      tokenUrl: config.tokenUrl,
      clientId: config.clientId,
      clientSecret: config.clientSecret,
      scope: config.scope,
      tenantId: config.tenantId,
      username,
      password: prepareAuthPassword(password, {
        passwordEncrypted: body.password_encrypted || body.passwordEncrypted,
        passwordEncryptionKey: config.passwordEncryptionKey
      }),
      code,
      randomStr
    });
    if (!token.access_token) throw new PasswordLoginError("认证中心没有返回 access_token。", 502);
    const claims = await verifyAuthJwt(token.access_token, config);
    const session = createSessionFromClaims(claims, config, parseExpiresIn(token.expires_in), {
      accessToken: token.access_token,
      tokenType: token.token_type
    });
    const response = jsonOk({
      ok: true,
      redirectTo: safeNextPath(body.next),
      user: session.user
    });
    setSessionCookieValue(
      response,
      request.url,
      await createSessionCookieValue(session, config.sessionSecret),
      new Date(session.expiresAt * 1000)
    );
    return response;
  } catch (error) {
    return jsonError(error, 401);
  }
}

async function exchangePasswordToken(input: {
  tokenUrl: string;
  clientId: string;
  clientSecret: string;
  scope: string;
  tenantId?: string;
  username: string;
  password: string;
  code?: string;
  randomStr?: string;
}): Promise<PasswordTokenResponse> {
  const form = new URLSearchParams();
  form.set("grant_type", "password");
  form.set("scope", input.scope);
  form.set("username", input.username);
  form.set("password", input.password);
  if (input.tenantId) form.set("tenantId", input.tenantId);
  if (input.code) form.set("code", input.code);
  if (input.randomStr) form.set("randomStr", input.randomStr);
  const headers: Record<string, string> = {
    Authorization: `Basic ${Buffer.from(`${input.clientId}:${input.clientSecret}`).toString("base64")}`,
    "Content-Type": "application/x-www-form-urlencoded"
  };
  if (input.tenantId) headers.tenantId = input.tenantId;
  const response = await fetch(input.tokenUrl, {
    method: "POST",
    headers,
    body: form
  });
  const payload = await response.json().catch(() => ({})) as PasswordTokenResponse;
  if (!response.ok) {
    throw new PasswordLoginError(payload.error_description || payload.msg || payload.message || payload.error || "登录失败。", response.status);
  }
  return payload;
}

function parseExpiresIn(value: string | number | undefined): number | undefined {
  if (typeof value === "number" && Number.isFinite(value)) return value;
  if (typeof value === "string" && value.trim()) {
    const parsed = Number(value);
    if (Number.isFinite(parsed)) return parsed;
  }
  return undefined;
}

class PasswordLoginError extends Error {
  status: number;

  constructor(message: string, status = 400) {
    super(message);
    this.name = "PasswordLoginError";
    this.status = status;
  }
}