Token de seguridad y cambio de contraseña (páginas protegidas)

- lib/security-token.ts: requestSecurityToken (token de 6 chars, cooldown 7 días, guarda en home_securitytoken, email) + checkSecurityToken. - lib/change-password.ts: changePassword (valida token + contraseña actual con authenticate, re-deriva verifier SRP6 v2, actualiza battlenet_accounts). - Routes /api/account/security-token y /change-password (guard; el cambio hace logout de la sesión). Páginas /security-token y /change-password (protegidas) con sus forms cliente e i18n (SecurityToken, ChangePassword). Verificado: páginas redirigen a login sin sesión, APIs 401. Reutiliza home_securitytoken de Django y la crypto validada. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-12 23:36:05 +00:00
parent 548fca16e6
commit 1da7349373
10 changed files with 383 additions and 0 deletions
@@ -0,0 +1,76 @@
+'use client'
+
+import { useState } from 'react'
+import { useTranslations } from 'next-intl'
+import { useRouter } from '@/i18n/navigation'
+
+const ERROR_KEYS = [
+  'missingFields',
+  'passwordMismatch',
+  'passwordTooLong',
+  'invalidToken',
+  'wrongCurrentPassword',
+  'accountNotFound',
+] as const
+
+export function ChangePasswordForm() {
+  const t = useTranslations('ChangePassword')
+  const router = useRouter()
+  const [form, setForm] = useState({ currentPassword: '', newPassword: '', confPassword: '', token: '' })
+  const [busy, setBusy] = useState(false)
+  const [done, setDone] = useState(false)
+  const [message, setMessage] = useState<{ ok: boolean; text: string } | null>(null)
+
+  function upd(k: string, v: string) {
+    setForm((f) => ({ ...f, [k]: v }))
+  }
+
+  async function handleSubmit(e: React.FormEvent) {
+    e.preventDefault()
+    if (busy || done) return
+    setBusy(true)
+    setMessage(null)
+    try {
+      const res = await fetch('/api/account/change-password', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        credentials: 'same-origin',
+        body: JSON.stringify(form),
+      })
+      const data: { success?: boolean; error?: string } = await res.json()
+      if (data.success) {
+        setDone(true)
+        setMessage({ ok: true, text: t('success') })
+        setTimeout(() => {
+          router.push('/login')
+          router.refresh()
+        }, 2500)
+      } else {
+        const key = (ERROR_KEYS as readonly string[]).includes(data.error ?? '') ? data.error! : 'genericError'
+        setMessage({ ok: false, text: t(key) })
+      }
+    } catch {
+      setMessage({ ok: false, text: t('genericError') })
+    } finally {
+      if (!done) setBusy(false)
+    }
+  }
+
+  const field = 'w-full rounded border border-amber-900/60 bg-[#2c1e14] px-3 py-2'
+
+  return (
+    <div className="mx-auto max-w-sm">
+      <p className="mb-4 text-sm text-amber-200/70">{t('info')}</p>
+      <form onSubmit={handleSubmit} className="space-y-3">
+        <input type="password" maxLength={16} placeholder={t('currentPassword')} value={form.currentPassword} onChange={(e) => upd('currentPassword', e.target.value)} className={field} />
+        <input type="password" maxLength={16} placeholder={t('newPassword')} value={form.newPassword} onChange={(e) => upd('newPassword', e.target.value)} className={field} />
+        <input type="password" maxLength={16} placeholder={t('confPassword')} value={form.confPassword} onChange={(e) => upd('confPassword', e.target.value)} className={field} />
+        <input type="text" maxLength={6} placeholder={t('token')} value={form.token} onChange={(e) => upd('token', e.target.value)} className={field} />
+        <button type="submit" disabled={busy || done} className="w-full rounded bg-amber-600 px-4 py-2 font-semibold text-[#1b120b] disabled:opacity-60">
+          {busy ? t('changing') : t('submit')}
+        </button>
+      </form>
+      {message && <p className={`mt-3 text-center ${message.ok ? 'text-green-400' : 'text-red-400'}`}>{message.text}</p>}
+    </div>
+  )
+}
@@ -0,0 +1,22 @@
+import { getTranslations, setRequestLocale } from 'next-intl/server'
+import { redirect } from '@/i18n/navigation'
+import { getSession } from '@/lib/session'
+import { ChangePasswordForm } from './ChangePasswordForm'
+
+export const dynamic = 'force-dynamic'
+
+export default async function ChangePasswordPage({ params }: { params: Promise<{ locale: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+  const t = await getTranslations('ChangePassword')
+  const session = await getSession()
+  if (!session.bnetId) redirect({ href: '/login', locale })
+  if (!session.username) redirect({ href: '/select-account', locale })
+
+  return (
+    <main className="mx-auto max-w-3xl px-4 py-8">
+      <h1 className="mb-6 text-center text-2xl font-bold text-amber-500">{t('title')}</h1>
+      <ChangePasswordForm />
+    </main>
+  )
+}
@@ -0,0 +1,53 @@
+'use client'
+
+import { useState } from 'react'
+import { useTranslations, useLocale } from 'next-intl'
+
+const ERROR_KEYS = ['cooldown', 'noEmail'] as const
+
+export function SecurityTokenForm({ initialDate }: { initialDate: string | null }) {
+  const t = useTranslations('SecurityToken')
+  const locale = useLocale()
+  const [date, setDate] = useState(initialDate)
+  const [busy, setBusy] = useState(false)
+  const [message, setMessage] = useState<{ ok: boolean; text: string } | null>(null)
+
+  async function request() {
+    if (busy) return
+    setBusy(true)
+    setMessage(null)
+    try {
+      const res = await fetch('/api/account/security-token', { method: 'POST', credentials: 'same-origin' })
+      const data: { success?: boolean; error?: string; tokenDate?: string } = await res.json()
+      if (data.success) {
+        setMessage({ ok: true, text: t('success') })
+        if (data.tokenDate) setDate(data.tokenDate)
+      } else {
+        const key = (ERROR_KEYS as readonly string[]).includes(data.error ?? '') ? data.error! : 'genericError'
+        setMessage({ ok: false, text: t(key) })
+      }
+    } catch {
+      setMessage({ ok: false, text: t('genericError') })
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  return (
+    <div className="mx-auto max-w-md text-center">
+      <p className="mb-4 text-sm text-amber-200/70">{t('info')}</p>
+      <p className="mb-4">
+        {t('lastRequest')}:{' '}
+        <span className="text-amber-400">{date ? new Date(date).toLocaleString(locale) : t('never')}</span>
+      </p>
+      <button
+        onClick={request}
+        disabled={busy}
+        className="rounded bg-amber-600 px-4 py-2 font-semibold text-[#1b120b] disabled:opacity-60"
+      >
+        {busy ? t('requesting') : t('request')}
+      </button>
+      {message && <p className={`mt-3 ${message.ok ? 'text-green-400' : 'text-red-400'}`}>{message.text}</p>}
+    </div>
+  )
+}
@@ -0,0 +1,35 @@
+import type { RowDataPacket } from 'mysql2'
+import { getTranslations, setRequestLocale } from 'next-intl/server'
+import { redirect } from '@/i18n/navigation'
+import { getSession } from '@/lib/session'
+import { db, DB } from '@/lib/db'
+import { SecurityTokenForm } from './SecurityTokenForm'
+
+export const dynamic = 'force-dynamic'
+
+export default async function SecurityTokenPage({ params }: { params: Promise<{ locale: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+  const t = await getTranslations('SecurityToken')
+  const session = await getSession()
+  if (!session.bnetId) redirect({ href: '/login', locale })
+  if (!session.username) redirect({ href: '/select-account', locale })
+
+  let tokenDate: string | null = null
+  try {
+    const [rows] = await db(DB.default).query<RowDataPacket[]>(
+      'SELECT created_at FROM home_securitytoken WHERE user_id = ? ORDER BY created_at DESC LIMIT 1',
+      [session.accountId ?? 0],
+    )
+    if (rows[0]) tokenDate = new Date(rows[0].created_at).toISOString()
+  } catch {
+    /* ignore */
+  }
+
+  return (
+    <main className="mx-auto max-w-3xl px-4 py-8">
+      <h1 className="mb-6 text-center text-2xl font-bold text-amber-500">{t('title')}</h1>
+      <SecurityTokenForm initialDate={tokenDate} />
+    </main>
+  )
+}