42 lines
1.6 KiB
JavaScript
42 lines
1.6 KiB
JavaScript
|
const express = require('express');
|
||
|
|
const bcrypt = require('bcryptjs');
|
||
|
|
const db = require('../db');
|
||
|
|
require('dotenv').config();
|
||
|
|
|
||
|
|
const router = express.Router();
|
||
|
|
|
||
|
|
// Nur vom FiveM-Server erreichbar (interner Key)
|
||
|
|
function requireInternal(req, res, next) {
|
||
|
|
const key = req.headers['x-internal-key'];
|
||
|
|
if (!key || key !== process.env.INTERNAL_API_KEY) {
|
||
|
|
return res.status(403).json({ error: 'forbidden' });
|
||
|
|
}
|
||
|
|
next();
|
||
|
|
}
|
||
|
|
|
||
|
|
// POST /internal/set-password {charId, password}
|
||
|
|
// Wird ingame vom Spieler ausgeloest; Passwort wird hier gehasht gespeichert.
|
||
|
|
router.post('/set-password', requireInternal, async (req, res) => {
|
||
|
|
try {
|
||
|
|
const charId = String((req.body && req.body.charId) || '').trim();
|
||
|
|
const password = String((req.body && req.body.password) || '');
|
||
|
|
if (!charId) return res.status(400).json({ error: 'missing_char' });
|
||
|
|
if (password.length < 6) return res.status(400).json({ error: 'password_too_short' });
|
||
|
|
|
||
|
|
const account = await db.q1('SELECT id FROM bleeter_accounts WHERE char_id = ?', [charId]);
|
||
|
|
if (!account) return res.status(404).json({ error: 'no_account' });
|
||
|
|
|
||
|
|
const hash = await bcrypt.hash(password, 10);
|
||
|
|
await db.exec(
|
||
|
|
'UPDATE bleeter_accounts SET web_password_hash = ?, web_password_updated_at = NOW() WHERE id = ?',
|
||
|
|
[hash, account.id]
|
||
|
|
);
|
||
|
|
res.json({ ok: true });
|
||
|
|
} catch (err) {
|
||
|
|
console.error('[bleeter] set-password error', err.message);
|
||
|
|
res.status(500).json({ error: 'server_error' });
|
||
|
|
}
|
||
|
|
});
|
||
|
|
|
||
|
|
module.exports = router;
|