's'

app/api/auth/link-email/route.ts

@@ -1,148 +1,138 @@
 import { NextRequest, NextResponse } from "next/server";
-import { getPocketBaseConfig, SITE_ID } from "@/config/services.config";
+import { getPocketBaseConfig } from "@/config/services.config";
+import {
+  ensureSiteVipForUser,
+  getAdminToken,
+  isAnonymousUserId,
+  upsertVipEmailLink,
+} from "@/app/api/vip/_helpers";
 
-async function getAdminToken(): Promise<string | null> {
-  const email = process.env.POCKETBASE_EMAIL;
-  const password = process.env.POCKETBASE_PASSWORD;
-  if (!email || !password) return null;
+const DEFAULT_PASSWORD = "12345678";
+
+type PBAuthRecord = {
+  id: string;
+  email?: string;
+};
+
+async function registerOrLoginUser(
+  email: string,
+  password: string
+): Promise<{ token: string; record: PBAuthRecord } | null> {
   const pb = getPocketBaseConfig();
-  const res = await fetch(`${pb.url}/api/admins/auth-with-password`, {
+
+  await fetch(`${pb.url}/api/collections/users/records`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ identity: email, password }),
-  });
-  if (!res.ok) return null;
-  const data = await res.json();
-  return data?.token ?? null;
-}
+    body: JSON.stringify({
+      email,
+      password,
+      passwordConfirm: password,
+    }),
+    cache: "no-store",
+  }).catch(() => null);
 
-/** 将匿名 user_id 的支付记录关联到新创建的 PB 用户 */
-async function linkPaymentsToUser(
-  adminToken: string,
-  fromUserId: string,
-  toUserId: string
-): Promise<void> {
-  const pb = getPocketBaseConfig();
-  const filter = `user_id = "${fromUserId}"`;
-  const res = await fetch(
-    `${pb.url}/api/collections/payments/records?filter=${encodeURIComponent(filter)}&perPage=500`,
-    { headers: { Authorization: `Bearer ${adminToken}` } }
+  const loginRes = await fetch(
+    `${pb.url}/api/collections/users/auth-with-password`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ identity: email, password }),
+      cache: "no-store",
+    }
   );
-  if (!res.ok) return;
-  const data = await res.json();
-  const items = data?.items ?? [];
-  for (const item of items) {
-    await fetch(`${pb.url}/api/collections/payments/records/${item.id}`, {
-      method: "PATCH",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${adminToken}`,
-      },
-      body: JSON.stringify({ user_id: toUserId }),
-    });
-  }
-}
 
-async function linkSiteVipToUser(
-  adminToken: string,
-  fromUserId: string,
-  toUserId: string
-): Promise<void> {
-  const pb = getPocketBaseConfig();
-  const filter = `user_id = "${fromUserId}" && site_id = "${SITE_ID}"`;
-  const res = await fetch(
-    `${pb.url}/api/collections/site_vip/records?filter=${encodeURIComponent(filter)}&perPage=500`,
-    { headers: { Authorization: `Bearer ${adminToken}` } }
-  );
-  if (!res.ok) return;
-  const data = await res.json();
-  const items = data?.items ?? [];
-  for (const item of items) {
-    await fetch(`${pb.url}/api/collections/site_vip/records/${item.id}`, {
-      method: "PATCH",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${adminToken}`,
-      },
-      body: JSON.stringify({ user_id: toUserId }),
-    });
+  if (!loginRes.ok) {
+    const error = await loginRes.json().catch(() => ({}));
+    throw new Error(error?.message || "邮箱或密码错误");
   }
+
+  const loginData = await loginRes.json().catch(() => ({}));
+  if (!loginData?.token || !loginData?.record?.id) {
+    throw new Error("邮箱绑定失败");
+  }
+
+  return {
+    token: loginData.token,
+    record: loginData.record,
+  };
 }
 
 export async function POST(request: NextRequest) {
   const body = await request.json().catch(() => ({}));
-  const email = String(body?.email ?? "").trim();
-  const password = String(body?.password ?? "").trim();
+  const email = String(body?.email ?? "").trim().toLowerCase();
+  const password = String(body?.password ?? "").trim() || DEFAULT_PASSWORD;
   const anonymousUserId = String(body?.anonymousUserId ?? "").trim();
 
-  if (!email || !password) {
-    return NextResponse.json({ ok: false, error: "请填写邮箱和密码" }, { status: 400 });
-  }
-  if (!anonymousUserId || !anonymousUserId.startsWith("user")) {
-    return NextResponse.json({ ok: false, error: "无效的匿名用户ID" }, { status: 400 });
-  }
-  if (password.length < 8) {
-    return NextResponse.json({ ok: false, error: "密码至少 8 位" }, { status: 400 });
-  }
+  console.log(
+    "[link-email] request email=%s anonymousUserId=%s",
+    email || "(empty)",
+    anonymousUserId || "(empty)"
+  );
 
-  const pb = getPocketBaseConfig();
-
-  // 1. 尝试注册，若已存在则登录
-  let token: string;
-  let record: { id: string; email?: string };
-  try {
-    const registerRes = await fetch(`${pb.url}/api/collections/users/records`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ email, password, passwordConfirm: password }),
-    });
-    if (registerRes.ok) {
-      const regData = await registerRes.json();
-      const loginRes = await fetch(`${pb.url}/api/collections/users/auth-with-password`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ identity: email, password }),
-      });
-      if (!loginRes.ok) throw new Error("登录失败");
-      const loginData = await loginRes.json();
-      token = loginData.token;
-      record = loginData.record;
-    } else {
-      const loginRes = await fetch(`${pb.url}/api/collections/users/auth-with-password`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ identity: email, password }),
-      });
-      if (!loginRes.ok) {
-        const err = await loginRes.json().catch(() => ({}));
-        return NextResponse.json(
-          { ok: false, error: err?.message || "邮箱或密码错误" },
-          { status: 401 }
-        );
-      }
-      const loginData = await loginRes.json();
-      token = loginData.token;
-      record = loginData.record;
-    }
-  } catch (e) {
+  if (!email) {
     return NextResponse.json(
-      { ok: false, error: e instanceof Error ? e.message : "注册/登录失败" },
-      { status: 500 }
+      { ok: false, error: "请填写邮箱" },
+      { status: 400 }
     );
   }
 
-  const newUserId = record.id;
-
-  // 2. 用管理员 token 将 payments、site_vip 的 user_id 从匿名改为新用户
-  const adminToken = await getAdminToken();
-  if (adminToken) {
-    await linkPaymentsToUser(adminToken, anonymousUserId, newUserId);
-    await linkSiteVipToUser(adminToken, anonymousUserId, newUserId);
+  if (!isAnonymousUserId(anonymousUserId)) {
+    return NextResponse.json(
+      { ok: false, error: "无效的匿名 user_id" },
+      { status: 400 }
+    );
   }
 
-  return NextResponse.json({
-    ok: true,
-    token,
-    record: { id: record.id, email: record.email },
-  });
+  try {
+    const authData = await registerOrLoginUser(email, password);
+    if (!authData) {
+      return NextResponse.json(
+        { ok: false, error: "邮箱绑定失败" },
+        { status: 500 }
+      );
+    }
+
+    const adminToken = await getAdminToken();
+    if (!adminToken) {
+      return NextResponse.json(
+        { ok: false, error: "PocketBase 管理员认证失败" },
+        { status: 500 }
+      );
+    }
+
+    await ensureSiteVipForUser(adminToken, anonymousUserId, authData.record.id);
+    await upsertVipEmailLink(
+      adminToken,
+      email,
+      authData.record.id,
+      anonymousUserId
+    );
+
+    console.log(
+      "[link-email] success email=%s pbUserId=%s anonymousUserId=%s",
+      email,
+      authData.record.id,
+      anonymousUserId
+    );
+
+    return NextResponse.json({
+      ok: true,
+      token: authData.token,
+      record: {
+        id: authData.record.id,
+        email: authData.record.email ?? email,
+      },
+    });
+  } catch (error) {
+    console.error("[link-email] failed:", error);
+    const message = error instanceof Error ? error.message : "邮箱绑定失败";
+    const status = message.includes("密码") || message.includes("邮箱") ? 401 : 500;
+    return NextResponse.json(
+      {
+        ok: false,
+        error: message,
+      },
+      { status }
+    );
+  }
 }