@allbluecn/web-app 0.11.0 → 0.11.2

package/src/server/serverFns/__tests__/auth-server-schemas.test.ts

@@ -0,0 +1,168 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => {
+    const api: any = {
+      _validator: undefined,
+      validator(schema: any) {
+        this._validator = schema
+        return this
+      },
+      handler(fn: Function) {
+        return async (args: any) => {
+          let data = args?.data
+          if (this._validator && data !== undefined) {
+            data = this._validator.parse(data)
+          }
+          return fn({ data })
+        }
+      },
+    }
+    return api
+  },
+}))
+
+const mockUserFindUnique = vi.fn()
+const mockUserUpdate = vi.fn().mockResolvedValue({})
+const mockTokenFindUnique = vi.fn()
+const mockTokenCreate = vi.fn().mockResolvedValue({})
+const mockTokenUpdate = vi.fn().mockResolvedValue({})
+const mockTxRun = vi.fn().mockResolvedValue([])
+const mockSendTemplateEmail = vi.fn().mockResolvedValue({ sent: true })
+const mockBcryptHash = vi.fn().mockResolvedValue('hashed')
+
+vi.mock('@allbluecn/database', () => ({
+  prisma: {
+    user: {
+      findUnique: (...a: unknown[]) => mockUserFindUnique(...a),
+      update: (...a: unknown[]) => mockUserUpdate(...a),
+    },
+    passwordResetToken: {
+      findUnique: (...a: unknown[]) => mockTokenFindUnique(...a),
+      create: (...a: unknown[]) => mockTokenCreate(...a),
+      update: (...a: unknown[]) => mockTokenUpdate(...a),
+    },
+    $transaction: (...a: unknown[]) => mockTxRun(...a),
+  },
+}))
+
+vi.mock('@/server/email', () => ({
+  sendTemplateEmail: (...a: unknown[]) => mockSendTemplateEmail(...a),
+}))
+
+vi.mock('@/server/middlewares/rate-limit', () => ({
+  checkAuthRateLimit: vi.fn().mockResolvedValue(undefined),
+}))
+
+vi.mock('crypto', () => ({
+  randomBytes: () => ({ toString: () => 'tok' }),
+  default: { randomBytes: () => ({ toString: () => 'tok' }) },
+}))
+
+vi.mock('bcryptjs', () => ({
+  default: { hash: (...a: unknown[]) => mockBcryptHash(...a) },
+}))
+
+import { forgotPasswordFn } from '../auth/forgot-password'
+import { resetPasswordFn } from '../auth/reset-password'
+
+const FUTURE = new Date('2027-01-01T00:00:00.000Z')
+
+describe('forgotPasswordFn 邮箱归一化', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockUserFindUnique.mockResolvedValue(null)
+    mockSendTemplateEmail.mockResolvedValue({ sent: true })
+  })
+
+  it('大写邮箱 + 首尾空格 → 查库用小写 trim 值', async () => {
+    await forgotPasswordFn({ data: { email: '  Alice@X.com ' } })
+    expect(mockUserFindUnique).toHaveBeenCalledWith({
+      where: { email: 'alice@x.com' },
+      select: { id: true, email: true, locale: true },
+    })
+  })
+
+  it('小写邮箱用户存在 → 创建 token 并发送重置邮件', async () => {
+    mockUserFindUnique.mockResolvedValue({
+      id: 'u1',
+      email: 'alice@x.com',
+      locale: null,
+    })
+    await forgotPasswordFn({ data: { email: 'ALICE@X.COM' } })
+    expect(mockTokenCreate).toHaveBeenCalledWith({
+      data: expect.objectContaining({ token: 'tok', userId: 'u1' }),
+    })
+    expect(mockSendTemplateEmail).toHaveBeenCalledWith(
+      expect.objectContaining({
+        key: 'auth.reset-password',
+        to: 'alice@x.com',
+        locale: 'zh',
+        userId: 'u1',
+        vars: expect.objectContaining({
+          url: expect.stringContaining('/reset-password?token='),
+        }),
+      }),
+    )
+  })
+
+  it('非法邮箱格式 → schema 拒绝', async () => {
+    await expect(forgotPasswordFn({ data: { email: 'not-an-email' } })).rejects.toThrow()
+    expect(mockUserFindUnique).not.toHaveBeenCalled()
+  })
+
+  it('数据库写入失败 → 不发送重置邮件', async () => {
+    mockUserFindUnique.mockResolvedValue({
+      id: 'u1',
+      email: 'alice@x.com',
+      locale: null,
+    })
+    mockTokenCreate.mockRejectedValueOnce(new Error('db down'))
+    await forgotPasswordFn({ data: { email: 'alice@x.com' } })
+    expect(mockSendTemplateEmail).not.toHaveBeenCalled()
+  })
+})
+
+describe('resetPasswordFn 密码强度', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockTokenFindUnique.mockResolvedValue(null)
+    mockTxRun.mockResolvedValue([])
+    mockBcryptHash.mockResolvedValue('hashed')
+  })
+
+  it('纯字母密码（缺数字）→ schema 拒绝', async () => {
+    await expect(resetPasswordFn({ data: { token: 't', password: 'abcdefgh' } })).rejects.toThrow(
+      /数字/,
+    )
+    expect(mockTxRun).not.toHaveBeenCalled()
+  })
+
+  it('纯数字密码（缺字母）→ schema 拒绝', async () => {
+    await expect(resetPasswordFn({ data: { token: 't', password: '12345678' } })).rejects.toThrow(
+      /字母/,
+    )
+  })
+
+  it('字母+数字密码 → 通过校验并重置', async () => {
+    mockTokenFindUnique.mockResolvedValue({
+      id: 'rt1',
+      userId: 'u1',
+      usedAt: null,
+      expiresAt: FUTURE,
+    })
+    await expect(
+      resetPasswordFn({ data: { token: 't', password: 'abc12345' } }),
+    ).resolves.toEqual({ message: 'Password reset successfully' })
+    expect(mockBcryptHash).toHaveBeenCalledWith('abc12345', 12)
+    expect(mockTxRun).toHaveBeenCalledTimes(1)
+    expect(mockUserUpdate).toHaveBeenCalledWith({
+      where: { id: 'u1' },
+      data: { password: 'hashed' },
+    })
+    expect(mockTokenUpdate).toHaveBeenCalledWith({
+      where: { id: 'rt1' },
+      data: { usedAt: expect.any(Date) },
+    })
+  })
+})

package/src/server/serverFns/__tests__/email-verification.test.ts

@@ -0,0 +1,149 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: (config: any) => {
+    const api: any = {
+      _validator: undefined,
+      validator(schema: any) {
+        this._validator = schema
+        return this
+      },
+      handler(fn: Function) {
+        const wrapped = async (args: any) => {
+          let data = args?.data
+          if (this._validator && data !== undefined) {
+            data = this._validator.parse ? this._validator.parse(data) : data
+          }
+          return fn({ data })
+        }
+        return wrapped
+      },
+    }
+    return api
+  },
+}))
+
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: vi.fn(),
+}))
+
+const mockFindUniqueToken = vi.fn()
+const mockTxTokenUpdateMany = vi.fn()
+const mockTxUserUpdate = vi.fn()
+const mockUserFindUnique = vi.fn()
+
+vi.mock('@allbluecn/database', () => ({
+  prisma: {
+    emailVerificationToken: {
+      findUnique: (...a: unknown[]) => mockFindUniqueToken(...a),
+      updateMany: (...a: unknown[]) => mockTxTokenUpdateMany(...a),
+    },
+    user: {
+      findUnique: (...a: unknown[]) => mockUserFindUnique(...a),
+      update: (...a: unknown[]) => mockTxUserUpdate(...a),
+    },
+    $transaction: (fn: (tx: unknown) => Promise<unknown>) =>
+      fn({
+        emailVerificationToken: {
+          updateMany: (...a: unknown[]) => mockTxTokenUpdateMany(...a),
+        },
+        user: { update: (...a: unknown[]) => mockTxUserUpdate(...a) },
+      }),
+  },
+}))
+
+vi.mock('@/server/email', () => ({
+  sendTemplateEmail: vi.fn().mockResolvedValue({ sent: true }),
+  generateEmailToken: vi.fn().mockReturnValue('tok-123'),
+}))
+
+vi.mock('@/server/middlewares/rate-limit', () => ({
+  checkAuthRateLimit: vi.fn().mockResolvedValue(undefined),
+}))
+
+vi.mock('@/lib/session', () => ({
+  getCurrentSession: vi.fn().mockResolvedValue(null),
+}))
+
+import { confirmEmailVerificationFn } from '../auth/email-verification'
+
+const NOW = new Date('2026-09-12T00:00:00.000Z')
+const FUTURE = new Date('2027-01-01T00:00:00.000Z')
+
+describe('confirmEmailVerificationFn', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockFindUniqueToken.mockImplementation(async () => null)
+    mockTxTokenUpdateMany.mockResolvedValue({ count: 0 })
+    mockTxUserUpdate.mockResolvedValue({})
+    mockUserFindUnique.mockResolvedValue(null)
+  })
+
+  it('token 不存在 → ok:false', async () => {
+    mockFindUniqueToken.mockResolvedValue(null)
+    await expect(
+      confirmEmailVerificationFn({ data: { token: 'nope' } }),
+    ).resolves.toEqual({ ok: false })
+    expect(mockTxUserUpdate).not.toHaveBeenCalled()
+  })
+
+  it('token 已使用 → ok:false', async () => {
+    mockFindUniqueToken.mockResolvedValue({
+      id: 't1',
+      userId: 'u1',
+      usedAt: NOW,
+      expiresAt: FUTURE,
+    })
+    await expect(
+      confirmEmailVerificationFn({ data: { token: 'used' } }),
+    ).resolves.toEqual({ ok: false })
+    expect(mockTxTokenUpdateMany).not.toHaveBeenCalled()
+  })
+
+  it('token 已过期 → ok:false', async () => {
+    mockFindUniqueToken.mockResolvedValue({
+      id: 't1',
+      userId: 'u1',
+      usedAt: null,
+      expiresAt: new Date('2020-01-01'),
+    })
+    await expect(
+      confirmEmailVerificationFn({ data: { token: 'exp' } }),
+    ).resolves.toEqual({ ok: false })
+  })
+
+  it('首次验证：抢占成功 → 标记已用 + 用户已验证 → ok:true', async () => {
+    mockFindUniqueToken.mockResolvedValue({
+      id: 't1',
+      userId: 'u1',
+      usedAt: null,
+      expiresAt: FUTURE,
+    })
+    mockTxTokenUpdateMany.mockResolvedValue({ count: 1 })
+    await expect(
+      confirmEmailVerificationFn({ data: { token: 'good' } }),
+    ).resolves.toEqual({ ok: true })
+    expect(mockTxTokenUpdateMany).toHaveBeenCalledWith({
+      where: { id: 't1', usedAt: null },
+      data: expect.objectContaining({ usedAt: expect.any(Date) }),
+    })
+    expect(mockTxUserUpdate).toHaveBeenCalledWith({
+      where: { id: 'u1' },
+      data: expect.objectContaining({ emailVerified: expect.any(Date) }),
+    })
+  })
+
+  it('并发第二个请求：抢占失败（count=0）→ ok:false 且不更新用户', async () => {
+    mockFindUniqueToken.mockResolvedValue({
+      id: 't1',
+      userId: 'u1',
+      usedAt: null,
+      expiresAt: FUTURE,
+    })
+    mockTxTokenUpdateMany.mockResolvedValue({ count: 0 })
+    await expect(
+      confirmEmailVerificationFn({ data: { token: 'race' } }),
+    ).resolves.toEqual({ ok: false })
+    expect(mockTxUserUpdate).not.toHaveBeenCalled()
+  })
+})

package/src/server/serverFns/__tests__/team-invitation.test.ts

@@ -59,8 +59,8 @@ vi.mock('@/server/audit', () => ({
   auditLog: vi.fn(),
 }))
 
-vi.mock('@/server/email/sender', () => ({
-  getEmailSender: () => ({ send: vi.fn() }),
+vi.mock('@/server/email', () => ({
+  sendTemplateEmail: vi.fn().mockResolvedValue({ sent: true }),
 }))
 
 import { prisma } from '@allbluecn/database'

package/src/server/serverFns/auth/email-verification.ts

@@ -0,0 +1,132 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createServerFn } from '@tanstack/react-start'
+import { getRequest } from '@tanstack/react-start/server'
+import { z } from 'zod'
+import { prisma } from '@allbluecn/database'
+import { getCurrentSession } from '@/lib/session'
+import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
+import { sendTemplateEmail, generateEmailToken } from '@/server/email'
+
+const VERIFY_TOKEN_TTL_MS = 24 * 60 * 60 * 1000
+
+const appUrl = () => process.env.VITE_APP_URL ?? 'http://localhost:3000'
+
+export const confirmEmailVerificationFn = createServerFn({ method: 'GET' })
+  .validator(z.object({ token: z.string().min(1) }))
+  .handler(async ({ data }) => {
+    const row = await prisma.emailVerificationToken.findUnique({
+      where: { token: data.token },
+    })
+    if (!row || row.usedAt || new Date() > row.expiresAt) {
+      return { ok: false as const }
+    }
+
+    const claimed = await prisma.$transaction(async (tx) => {
+      const claim = await tx.emailVerificationToken.updateMany({
+        where: { id: row.id, usedAt: null },
+        data: { usedAt: new Date() },
+      })
+      if (claim.count === 0) return false
+      await tx.user.update({
+        where: { id: row.userId },
+        data: { emailVerified: new Date() },
+      })
+      return true
+    })
+    if (!claimed) return { ok: false as const }
+
+    const user = await prisma.user.findUnique({
+      where: { id: row.userId },
+      select: { email: true, locale: true },
+    })
+    if (user) {
+      await sendTemplateEmail({
+        key: 'auth.welcome',
+        to: user.email,
+        locale: user.locale ?? 'zh',
+        userId: row.userId,
+        vars: { dashboardUrl: `${appUrl()}/dashboard` },
+      }).catch((err) => {
+        console.error('welcome email failed', {
+          userId: row.userId,
+          templateKey: 'auth.welcome',
+          reason: err instanceof Error ? err.message : String(err),
+        })
+      })
+    }
+
+    return { ok: true as const }
+  })
+
+export const resendVerificationEmailFn = createServerFn({ method: 'POST' })
+  .validator(z.object({}))
+  .handler(async () => {
+    const request = getRequest()
+    const session = await getCurrentSession(request)
+    const userId = session?.user?.id
+    if (!userId) throw new Error('请先登录')
+
+    await checkAuthRateLimit('resendVerify', 5, 15 * 60 * 1000)
+
+    const user = await prisma.user.findUnique({
+      where: { id: userId },
+      select: { email: true, username: true, emailVerified: true, locale: true },
+    })
+    if (!user) throw new Error('用户不存在')
+    if (user.emailVerified) return { alreadyVerified: true }
+
+    const token = generateEmailToken()
+    await prisma.emailVerificationToken.create({
+      data: {
+        token,
+        userId,
+        expiresAt: new Date(Date.now() + VERIFY_TOKEN_TTL_MS),
+      },
+    })
+
+    await sendTemplateEmail({
+      key: 'auth.verify-email',
+      to: user.email,
+      locale: user.locale ?? 'zh',
+      userId,
+      vars: { url: `${appUrl()}/verify-email?token=${token}`, username: user.username },
+    }).catch((err) => {
+      console.error('resend verification email failed', {
+        userId,
+        templateKey: 'auth.verify-email',
+        reason: err instanceof Error ? err.message : String(err),
+      })
+    })
+
+    return { alreadyVerified: false }
+  })
+
+export const getEmailVerifiedStatusFn = createServerFn({ method: 'GET' })
+  .validator(z.object({}))
+  .handler(async () => {
+    const request = getRequest()
+    const session = await getCurrentSession(request)
+    if (!session?.user?.id) return { verified: null as boolean | null }
+
+    const user = await prisma.user.findUnique({
+      where: { id: session.user.id },
+      select: { emailVerified: true },
+    })
+    return { verified: !!user?.emailVerified }
+  })

package/src/server/serverFns/auth/forgot-password.ts

@@ -20,9 +20,10 @@ import { z } from 'zod'
 import { prisma } from '@allbluecn/database'
 import { randomBytes } from 'crypto'
 import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
+import { sendTemplateEmail } from '@/server/email'
 
 const forgotPasswordSchema = z.object({
-  email: z.string().email('请输入有效邮箱'),
+  email: z.string().transform((v) => v.toLowerCase().trim()).pipe(z.string().email('请输入有效邮箱')),
 })
 
 function generateToken(): string {
@@ -35,20 +36,39 @@ export const forgotPasswordFn = createServerFn({ method: 'POST' })
     await checkAuthRateLimit('forgotPassword', 5, 15 * 60 * 1000)
     const user = await prisma.user.findUnique({
       where: { email: data.email },
-      select: { id: true },
+      select: { id: true, email: true, locale: true },
     })
 
     if (user) {
       const token = generateToken()
       const expiresAt = new Date(Date.now() + 15 * 60 * 1000)
 
+      let created = false
       try {
         await prisma.passwordResetToken.create({
           data: { token, userId: user.id, expiresAt },
         })
+        created = true
       } catch (dbError) {
         console.error('Database error:', dbError instanceof Error ? dbError.message : String(dbError))
       }
+
+      if (created) {
+        const appUrl = process.env.VITE_APP_URL ?? 'http://localhost:3000'
+        await sendTemplateEmail({
+          key: 'auth.reset-password',
+          to: user.email,
+          locale: user.locale ?? 'zh',
+          userId: user.id,
+          vars: { url: `${appUrl}/reset-password?token=${token}` },
+        }).catch((err) => {
+          console.error('reset password email failed', {
+            userId: user.id,
+            templateKey: 'auth.reset-password',
+            reason: err instanceof Error ? err.message : String(err),
+          })
+        })
+      }
     }
 
     return {

package/src/server/serverFns/auth/providers.ts

@@ -16,12 +16,13 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createServerFn } from '@tanstack/react-start'
+import { getResolvedOAuthProviders } from '@/server/oauth-config'
 
 export interface AuthProvidersInfo {
   googleEnabled: boolean
 }
 
 export const getAuthProviders = createServerFn({ method: 'GET' }).handler(async (): Promise<AuthProvidersInfo> => {
-  const googleEnabled = !!(process.env.AUTH_GOOGLE_ID && process.env.AUTH_GOOGLE_SECRET)
-  return { googleEnabled }
-})
+  const providers = await getResolvedOAuthProviders()
+  return { googleEnabled: providers.some((p) => p.provider === 'google') }
+})

package/src/server/serverFns/auth/register.ts

@@ -17,22 +17,26 @@
 
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
-import { prisma } from '@allbluecn/database'
+import { prisma, Prisma } from '@allbluecn/database'
 import bcrypt from 'bcryptjs'
 import { getRandomConfig, presetBgColors } from '@/components/settings/personal-team/account/avatar/avatar-config'
 import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
+import { getRegistrationMode, consumeInvitationCode } from '@/server/auth-registration'
+import { sendTemplateEmail, generateEmailToken } from '@/server/email'
 
-const registerSchema = z.object({
-  username: z.string().min(3).max(20),
-  email: z.string().email(),
-  password: z.string().min(8),
-  invitationCode: z.string().optional(),
+const registerServerSchema = z.object({
+  username: z.string().regex(/^[a-zA-Z0-9_-]{3,20}$/),
+  email: z.string().transform((v) => v.toLowerCase().trim()).pipe(z.string().email()),
+  password: z.string().min(8).max(32).regex(/[a-zA-Z]/).regex(/[0-9]/),
+  invitationCode: z.string().optional().default(''),
 })
 
 export const registerFn = createServerFn({ method: 'POST' })
-  .validator(registerSchema)
+  .validator(registerServerSchema)
   .handler(async ({ data }) => {
     await checkAuthRateLimit('register', 5, 15 * 60 * 1000)
+    const mode = await getRegistrationMode()
+
     const exists = await prisma.user.findFirst({
       where: { OR: [{ email: data.email }, { username: data.username }] },
       select: { id: true },
@@ -43,16 +47,56 @@ export const registerFn = createServerFn({ method: 'POST' })
     const hash = data.username.split('').reduce((h, c) => c.charCodeAt(0) + ((h << 5) - h), 0)
     const bgColor = presetBgColors[Math.abs(hash) % presetBgColors.length]
 
-    const user = await prisma.user.create({
-      data: {
-        username: data.username,
-        email: data.email,
-        password: hashedPassword,
-        avatarConfig: getRandomConfig() as object,
-        bgShape: 'square',
-        bgColor,
-        status: 'ACTIVE',
-      },
-    })
-    return { id: user.id, email: user.email, username: user.username }
+    try {
+      const user = await prisma.$transaction(async (tx) => {
+        let codeId: string | null = null
+        if (mode === 'invite') {
+          if (!data.invitationCode) throw new Error('请输入邀请码')
+          const consumed = await consumeInvitationCode(tx, data.invitationCode)
+          if (!consumed.ok) throw new Error(consumed.error)
+          codeId = consumed.codeId
+        }
+        const created = await tx.user.create({
+          data: {
+            username: data.username,
+            email: data.email,
+            password: hashedPassword,
+            avatarConfig: getRandomConfig() as object,
+            bgShape: 'square',
+            bgColor,
+            status: 'ACTIVE',
+          },
+        })
+        if (codeId) {
+          await tx.invitationUse.create({ data: { codeId, userId: created.id } })
+        }
+        return created
+      })
+
+      const token = generateEmailToken()
+      await prisma.emailVerificationToken.create({
+        data: { token, userId: user.id, expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000) },
+      })
+      const appUrl = process.env.VITE_APP_URL ?? 'http://localhost:3000'
+      await sendTemplateEmail({
+        key: 'auth.verify-email',
+        to: user.email,
+        locale: 'zh',
+        userId: user.id,
+        vars: { url: `${appUrl}/verify-email?token=${token}`, username: user.username },
+      }).catch((err) => {
+        console.error('verification email failed', {
+          userId: user.id,
+          templateKey: 'auth.verify-email',
+          reason: err instanceof Error ? err.message : String(err),
+        })
+      })
+
+      return { id: user.id, email: user.email, username: user.username }
+    } catch (err) {
+      if (err instanceof Prisma.PrismaClientKnownRequestError && err.code === 'P2002') {
+        throw new Error('用户名或邮箱已存在')
+      }
+      throw new Error(err instanceof Error ? err.message : '注册失败')
+    }
   })

package/src/server/serverFns/auth/registration-mode.ts

@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createServerFn } from '@tanstack/react-start'
+import { getRegistrationMode } from '@/server/auth-registration'
+
+export const getRegistrationModeFn = createServerFn({ method: 'GET' }).handler(
+  async () => ({ mode: await getRegistrationMode() }),
+)

package/src/server/serverFns/auth/reset-password.ts

@@ -23,7 +23,7 @@ import { checkAuthRateLimit } from '@/server/middlewares/rate-limit'
 
 const resetPasswordSchema = z.object({
   token: z.string().min(1, 'Token is required'),
-  password: z.string().min(8, '密码至少 8 位').max(32),
+  password: z.string().min(8, '密码至少 8 位').max(32).regex(/[a-zA-Z]/, '密码需包含字母').regex(/[0-9]/, '密码需包含数字'),
 })
 
 export const validateResetTokenFn = createServerFn({ method: 'GET' })