Token de seguridad y cambio de contraseña (páginas protegidas)

- lib/security-token.ts: requestSecurityToken (token de 6 chars, cooldown 7 días, guarda en home_securitytoken, email) + checkSecurityToken. - lib/change-password.ts: changePassword (valida token + contraseña actual con authenticate, re-deriva verifier SRP6 v2, actualiza battlenet_accounts). - Routes /api/account/security-token y /change-password (guard; el cambio hace logout de la sesión). Páginas /security-token y /change-password (protegidas) con sus forms cliente e i18n (SecurityToken, ChangePassword). Verificado: páginas redirigen a login sin sesión, APIs 401. Reutiliza home_securitytoken de Django y la crypto validada. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-12 23:36:05 +00:00
parent 548fca16e6
commit 1da7349373
10 changed files with 383 additions and 0 deletions
@@ -0,0 +1,53 @@
+'use client'
+
+import { useState } from 'react'
+import { useTranslations, useLocale } from 'next-intl'
+
+const ERROR_KEYS = ['cooldown', 'noEmail'] as const
+
+export function SecurityTokenForm({ initialDate }: { initialDate: string | null }) {
+  const t = useTranslations('SecurityToken')
+  const locale = useLocale()
+  const [date, setDate] = useState(initialDate)
+  const [busy, setBusy] = useState(false)
+  const [message, setMessage] = useState<{ ok: boolean; text: string } | null>(null)
+
+  async function request() {
+    if (busy) return
+    setBusy(true)
+    setMessage(null)
+    try {
+      const res = await fetch('/api/account/security-token', { method: 'POST', credentials: 'same-origin' })
+      const data: { success?: boolean; error?: string; tokenDate?: string } = await res.json()
+      if (data.success) {
+        setMessage({ ok: true, text: t('success') })
+        if (data.tokenDate) setDate(data.tokenDate)
+      } else {
+        const key = (ERROR_KEYS as readonly string[]).includes(data.error ?? '') ? data.error! : 'genericError'
+        setMessage({ ok: false, text: t(key) })
+      }
+    } catch {
+      setMessage({ ok: false, text: t('genericError') })
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  return (
+    <div className="mx-auto max-w-md text-center">
+      <p className="mb-4 text-sm text-amber-200/70">{t('info')}</p>
+      <p className="mb-4">
+        {t('lastRequest')}:{' '}
+        <span className="text-amber-400">{date ? new Date(date).toLocaleString(locale) : t('never')}</span>
+      </p>
+      <button
+        onClick={request}
+        disabled={busy}
+        className="rounded bg-amber-600 px-4 py-2 font-semibold text-[#1b120b] disabled:opacity-60"
+      >
+        {busy ? t('requesting') : t('request')}
+      </button>
+      {message && <p className={`mt-3 ${message.ok ? 'text-green-400' : 'text-red-400'}`}>{message.text}</p>}
+    </div>
+  )
+}