Inna
1da7349373
- lib/security-token.ts: requestSecurityToken (token de 6 chars, cooldown 7 días, guarda en home_securitytoken, email) + checkSecurityToken. - lib/change-password.ts: changePassword (valida token + contraseña actual con authenticate, re-deriva verifier SRP6 v2, actualiza battlenet_accounts). - Routes /api/account/security-token y /change-password (guard; el cambio hace logout de la sesión). Páginas /security-token y /change-password (protegidas) con sus forms cliente e i18n (SecurityToken, ChangePassword). Verificado: páginas redirigen a login sin sesión, APIs 401. Reutiliza home_securitytoken de Django y la crypto validada. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
25 lines
765 B
TypeScript
25 lines
765 B
TypeScript
import { getSession } from '@/lib/session'
|
|
import { changePassword } from '@/lib/change-password'
|
|
|
|
export async function POST(request: Request) {
|
|
const session = await getSession()
|
|
if (!session.accountId) return Response.json({ success: false, error: 'notAuthenticated' }, { status: 401 })
|
|
let b: Record<string, string> = {}
|
|
try {
|
|
b = await request.json()
|
|
} catch {
|
|
return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })
|
|
}
|
|
const result = await changePassword(
|
|
session,
|
|
String(b.currentPassword ?? ''),
|
|
String(b.newPassword ?? ''),
|
|
String(b.confPassword ?? ''),
|
|
String(b.token ?? ''),
|
|
)
|
|
if (result.success) {
|
|
session.destroy() // logout por seguridad
|
|
}
|
|
return Response.json(result)
|
|
}
|