's'

app/api/auth/change-password/route.ts

@@ -3,6 +3,7 @@
  */
 import { NextRequest, NextResponse } from "next/server";
 import { getPocketBaseConfig } from "@/config/services.config";
+import { getAdminToken } from "@/app/lib/pocketbase/admin";
 
 const COOKIE_NAME = "pb_session";
 const COOKIE_NEEDS_PW = "meetup_needs_password_change";
@@ -38,24 +39,35 @@ export async function POST(request: NextRequest) {
     }
 
     const pb = getPocketBaseConfig();
-    const res = await fetch(`${pb.url}/api/collections/users/records/${auth.userId}`, {
+    const patchBody = { password: newPassword, passwordConfirm };
+
+    let res = await fetch(`${pb.url}/api/collections/users/records/${auth.userId}`, {
       method: "PATCH",
       headers: {
         "Content-Type": "application/json",
         Authorization: `Bearer ${auth.token}`,
       },
-      body: JSON.stringify({
-        password: newPassword,
-        passwordConfirm: passwordConfirm,
-      }),
+      body: JSON.stringify(patchBody),
     });
 
+    if (!res.ok) {
+      const adminToken = await getAdminToken();
+      if (adminToken) {
+        res = await fetch(`${pb.url}/api/collections/users/records/${auth.userId}`, {
+          method: "PATCH",
+          headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${adminToken}`,
+          },
+          body: JSON.stringify(patchBody),
+        });
+      }
+    }
+
     if (!res.ok) {
       const err = await res.json().catch(() => ({}));
-      return NextResponse.json(
-        { ok: false, error: err?.message || "修改失败" },
-        { status: 400 }
-      );
+      const msg = err?.message || (err?.data && typeof err.data === "object" && Object.values(err.data)[0] && (Object.values(err.data)[0] as { message?: string })?.message) || "修改失败";
+      return NextResponse.json({ ok: false, error: msg }, { status: 400 });
     }
 
     const r = NextResponse.json({ ok: true });

app/api/auth/logout/route.ts

@@ -1,15 +1,8 @@
 import { NextRequest, NextResponse } from "next/server";
-import { getAuthCookieDomain } from "@/config/domain.config";
-
-const COOKIE_NAME = "pb_session";
+import { COOKIE_NAME, getCookieOptions, getHostFromRequest } from "@/app/lib/auth-cookie";
 
 export async function POST(request: NextRequest) {
-  const domain = getAuthCookieDomain(request);
   const res = NextResponse.json({ ok: true });
-  res.cookies.set(COOKIE_NAME, "", {
-    ...(domain && { domain }),
-    path: "/",
-    maxAge: 0,
-  });
+  res.cookies.set(COOKIE_NAME, "", getCookieOptions(true, getHostFromRequest(request)) as Record<string, string | number | boolean>);
   return res;
 }

app/api/auth/me/route.ts

@@ -1,13 +1,35 @@
 import { NextRequest, NextResponse } from "next/server";
-import { getPocketBaseConfig } from "@/config/services.config";
-import { getAuthCookieDomain } from "@/config/domain.config";
+import { getPocketBaseConfig, SITE_ID } from "@/config/services.config";
+import { getAdminToken } from "@/app/lib/pocketbase/admin";
 
 const COOKIE_NAME = "pb_session";
 const COOKIE_MAX_AGE = 60 * 60 * 24 * 365;
 
+async function checkVip(userId: string): Promise<boolean> {
+  try {
+    const token = await getAdminToken();
+    if (!token) return false;
+    const pb = getPocketBaseConfig();
+    const filter = `user_id = "${userId}" && site_id = "${SITE_ID}"`;
+    const res = await fetch(
+      `${pb.url}/api/collections/site_vip/records?filter=${encodeURIComponent(filter)}&perPage=1`,
+      { headers: { Authorization: `Bearer ${token}` }, cache: "no-store" }
+    );
+    if (!res.ok) return false;
+    const data = await res.json();
+    const items = data?.items ?? [];
+    const record = items[0];
+    if (!record) return false;
+    const now = new Date().toISOString();
+    const isExpired = record?.expires_at && record.expires_at < now;
+    return !isExpired;
+  } catch {
+    return false;
+  }
+}
+
 export async function GET(request: NextRequest) {
   const cookie = request.cookies.get(COOKIE_NAME)?.value;
-  const domain = getAuthCookieDomain(request);
   if (!cookie) {
     return NextResponse.json({ ok: true, user: null });
   }
@@ -17,12 +39,14 @@ export async function GET(request: NextRequest) {
     if (!token || !userId) return NextResponse.json({ ok: true, user: null });
 
     const pb = getPocketBaseConfig();
-    const res = await fetch(`${pb.url}/api/users/refresh`, {
+    const res = await fetch(`${pb.url}/api/collections/${pb.usersCollection}/auth-refresh`, {
+      method: "POST",
       headers: { Authorization: `Bearer ${token}` },
+      cache: "no-store",
     });
     if (!res.ok) {
       const r = NextResponse.json({ ok: true, user: null });
-      r.cookies.set(COOKIE_NAME, "", { ...(domain && { domain }), path: "/", maxAge: 0 });
+      r.cookies.set(COOKIE_NAME, "", { path: "/", maxAge: 0 });
       return r;
     }
     const data = await res.json();
@@ -35,13 +59,13 @@ export async function GET(request: NextRequest) {
         email: newRecord.email ?? email,
       });
       const encoded = Buffer.from(newPayload, "utf-8").toString("base64url");
+      const vip = await checkVip(newRecord.id);
       const r = NextResponse.json({
         ok: true,
-        user: { id: newRecord.id, email: newRecord.email ?? email },
+        user: { id: newRecord.id, email: newRecord.email ?? email, vip },
         token: newToken,
       });
       r.cookies.set(COOKIE_NAME, encoded, {
-        ...(domain && { domain }),
         path: "/",
         maxAge: COOKIE_MAX_AGE,
         secure: process.env.NODE_ENV === "production",
@@ -50,9 +74,11 @@ export async function GET(request: NextRequest) {
       });
       return r;
     }
+    const uid = data.record?.id ?? userId;
+    const vip = uid ? await checkVip(uid) : false;
     return NextResponse.json({
       ok: true,
-      user: { id: data.record?.id ?? userId, email: data.record?.email ?? email },
+      user: { id: uid, email: data.record?.email ?? email, vip },
       token: data.token,
     });
   } catch {

app/api/auth/sync-session/route.ts

@@ -1,8 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
-import { getAuthCookieDomain } from "@/config/domain.config";
-
-const COOKIE_NAME = "pb_session";
-const COOKIE_MAX_AGE = 60 * 60 * 24 * 365; // 365 天，登录态持续有效直至用户主动退出
+import { COOKIE_NAME, getCookieOptions, getHostFromRequest } from "@/app/lib/auth-cookie";
 
 export async function POST(request: NextRequest) {
   const body = await request.json().catch(() => ({}));
@@ -19,15 +16,7 @@ export async function POST(request: NextRequest) {
   });
   const encoded = Buffer.from(payload, "utf-8").toString("base64url");
 
-  const domain = getAuthCookieDomain(request);
   const res = NextResponse.json({ ok: true });
-  res.cookies.set(COOKIE_NAME, encoded, {
-    ...(domain && { domain }),
-    path: "/",
-    maxAge: COOKIE_MAX_AGE,
-    secure: process.env.NODE_ENV === "production",
-    sameSite: "lax",
-    httpOnly: true,
-  });
+  res.cookies.set(COOKIE_NAME, encoded, getCookieOptions(false, getHostFromRequest(request)) as Record<string, string | number | boolean>);
   return res;
 }