authenticate.js

const jwt = require("jsonwebtoken");
const { initDatabase, md5hash, generateSalt } = require("./database");
require("dotenv").config();
const jwtServerSecret = process.env.JWTSECRET || "XJA";
// 肯定不能是XJA啊

const db = initDatabase();
class Authenticate {
    static async register(username, email, password) {
        try {
            if (!username || !email || !password) {
                throw new Error("请提供用户名、邮箱、密码，缺一不可");
            }
            if (username.length < 3) {
                throw new Error("用户名至少3个字符");
            }
            if (password.length < 6) {
                throw new Error("密码至少6个字符");
            }
            const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
            if (!emailRegex.test(email)) {
                throw new Error("邮箱格式不正确");
            }
            const existingUser = await db.get(
                "SELECT id FROM user WHERE username = ? OR email = ?",
                [username, email]
            );
            if (existingUser) {
                throw new Error("用户名或邮箱重复");
            }
            const salt = generateSalt();
            const encryptedPassword = md5hash(password, salt);
            const result = await db.run(
                "INSERT INTO user (username, email, password, salt) VALUES (?, ?, ?, ?)",
                [username, email, encryptedPassword, salt]
            );
            return {
                success: true,
                id: db.type === "mysql" ? result.insertId : result.lastInsertRowid,
                username,
                email,
                message: "用户注册成功"
            };
        } catch (error) {
            return { // 不要说前面throw偷懒了，这样还可以规避db操作中的问题
                success: false,
                error: error.message
            };
        }
    }
    
    static async login(username, password) {
        try {
            if (!username || !password) {
                throw new Error("请提供用户名和密码");
            }
            const user = await db.get(
                "SELECT * FROM user WHERE username = ? OR email = ?",
                [username, username] // 用户可以输入邮箱来着，所以这样
            );
            if (!user) {
                throw new Error("用户不存在");
            }
            const encryptedInputPassword = md5hash(password, user.salt);
            if (encryptedInputPassword !== user.password) {
                throw new Error("密码错误");
            }
            const token = jwt.sign(
                {
                    id: user.id,
                    username: user.username,
                    email: user.email
                },
                jwtServerSecret,
                { expiresIn: "12h" }
            );
            return {
                success: true,
                id: user.id,
                username: user.username,
                email: user.email,
                token,
                message: "登录成功"
            };
        } catch (error) {
            return {
                success: false,
                error: error.message
            };
        }
    }
    
    static verifyToken(req, res, next) {
        // 用来验证JWT的middleware
        const authHeader = req.headers.authorization;
        if (!authHeader || !authHeader.startsWith("Bearer ")) {
            return res.status(401).json({
                success: false,
                error: "缺少令牌，访问拒绝"
            });
        }
        const token = authHeader.split(" ")[1];
        try {
            const verified = jwt.verify(token, jwtServerSecret);
            req.user = verified;
            next();
        } catch (error) {
            res.status(400).json({
                success: false,
                error: "无效令牌，访问拒绝"
            });
        }
    }
    
    static async checkUsernameAvailable(username) {
        // 其实在前面register的时候也有检查，不过单独查一遍也没事
        try {
            const user = await db.get(
                "SELECT id FROM user WHERE username = ?",
                [username]
            );
            return {
                success: true,
                available: !user
            };
        } catch (error) {
            return {
                success: false,
                error: error.message
            };
        }
    }
}

module.exports = Authenticate;