@oj-module/cli 0.1.21 → 0.2.1

package/templates/api/src/auth/_shared/session.ts

@@ -1,26 +1,171 @@
-// 会话与签发共享逻辑（移植 oj 官方 sample/src/auth/_shared/session.ts，
-// 对齐 devkit 手册 §8：access=jwt.sign，refresh=不透明随机串 + KV session）。
+// 会话与签发领域服务（设计 §3.1 + D14 + AC1-12/13/27）。
+// deps 注入：crypto/jwt/bcrypt 是 oj 运行时全局，Node 测试侧 crypto 只读不可 stub（设计 §9.1），
+// 随机/哈希/签名/口令原语全部经构造注入，默认实现回落运行时全局（runtimeDeps）。
+// B4：access JWT 仅载 sub（roles 走登录响应/资料接口，不进 claims）。
+// B3：refresh = 不透明随机串 + DB 存 SHA-256 哈希（sys_refresh_token，迁移 0008）；
+//     轮换作旧 + 滑动窗口（绝对 TTL 封顶 min(旧 exp, now+30d)）；reuse 检测全族吊销 + 审计。
+import { invalidateUser } from "../../_platform/_shared/service/access";
+import { recordOp } from "../../_platform/_shared/service/audit";
 
-export function nowSecs(): number {
-	return Math.floor(Date.now() / 1000);
+export interface SessionDeps {
+	randomHex: (bytes: number) => string
+	sha256Hex: (s: string) => string
+	signAccess: (sub: string) => string | Promise<string>
+	accessTtlSecs: number
+	refreshTtlSecs: number
+	bcryptHash: (pw: string) => Promise<string>
+	bcryptVerify: (pw: string, hash: string) => Promise<boolean>
+	now?: () => number
 }
 
-export function sessionKey(refreshToken: string): string {
-	return `AUTH-SESSION:${crypto.sha256Hex(refreshToken)}`;
+/** 默认实现：回落 oj 运行时全局（jwt.sign 仅收 {sub}——B4 roles 不进 claims 的语法级保证）。 */
+export function runtimeDeps(): SessionDeps {
+	const g = globalThis as any;
+	return {
+		randomHex: (n: number) => g.crypto.randomHex(n),
+		sha256Hex: (s: string) => g.crypto.sha256Hex(s),
+		signAccess: (sub: string) => g.jwt.sign({ sub }),
+		accessTtlSecs: g.jwt.accessDuration,
+		refreshTtlSecs: g.jwt.refreshDuration,
+		bcryptHash: (pw: string) => g.bcrypt.hash(pw),
+		bcryptVerify: (pw: string, h: string) => g.bcrypt.verify(pw, h),
+	};
 }
 
-// 签 access + 生成 refresh 并落 session（exp = now + refresh 时长，读取侧惰性判定）。
-export async function issueTokens(uid: string, roles: string[]) {
-	const accessToken = await jwt.sign({ sub: uid, roles });
-	const refreshToken = crypto.randomHex(32);
-	await kv.set(
-		sessionKey(refreshToken),
-		JSON.stringify({ uid, exp: nowSecs() + jwt.refreshDuration }),
-	);
+export interface SessionUser {
+	id: number
+	username: string
+	display_name: string | null
+	avatar_base64: string | null
+	must_change: boolean
+	roles: string[]
+}
+
+export interface TokenBundle {
+	access_token: string
+	refresh_token: string
+	expires_in: number
+	/** AC1-27：must_change 悬挂期签发的限权标记（改密成功才换发正式 token） */
+	restricted: boolean
+	user: SessionUser
+}
+
+function fail(status: number, message: string): never {
+	throw Object.assign(new Error(message), { status });
+}
+
+export function createSession(deps: SessionDeps = runtimeDeps()) {
+	const now = deps.now ?? (() => Math.floor(Date.now() / 1000));
+	const hashOf = (token: string) => deps.sha256Hex(token);
+
+	async function profileOf(uid: number): Promise<SessionUser> {
+		const rows = await db.query(
+			"select id, username, display_name, avatar_base64, must_change from users where id = ?",
+			[uid],
+		) as Array<Record<string, unknown>>;
+		if (!rows[0])
+			fail(404, "user not found");
+		const roleRows = await db.query("select role_name from sys_user_role where user_id = ?", [uid]) as Array<{ role_name: string }>;
+		return {
+			id: uid,
+			username: String(rows[0].username),
+			display_name: rows[0].display_name == null ? null : String(rows[0].display_name),
+			avatar_base64: rows[0].avatar_base64 == null ? null : String(rows[0].avatar_base64),
+			must_change: Number(rows[0].must_change) === 1,
+			roles: roleRows.map(r => r.role_name),
+		};
+	}
+
+	async function issueFor(uid: number): Promise<TokenBundle> {
+		const user = await profileOf(uid);
+		const refreshToken = deps.randomHex(32);
+		await db.exec(
+			"insert into sys_refresh_token (token_hash, user_id, expires_at, revoked, created_at) values (?, ?, ?, 0, ?)",
+			[hashOf(refreshToken), uid, now() + deps.refreshTtlSecs, now()],
+		);
+		return {
+			access_token: await deps.signAccess(String(uid)),
+			refresh_token: refreshToken,
+			expires_in: deps.accessTtlSecs,
+			restricted: user.must_change,
+			user,
+		};
+	}
+
+	/** 吊销联动（§3.1）：禁用/重置口令/改密 → 删该用户全部 refresh 记录。 */
+	async function revokeAll(uid: number): Promise<void> {
+		await db.exec("delete from sys_refresh_token where user_id = ?", [uid]);
+	}
+
 	return {
-		access_token: accessToken,
-		refresh_token: refreshToken,
-		expires_in: jwt.accessDuration,
-		user: { id: uid, roles },
+		/** B1+D14：本地登录——先验口令后查禁用；号不存在/口令错/禁用统一 401（不泄露账号状态）。 */
+		async localLogin(username: string, password: string): Promise<TokenBundle> {
+			const rows = await db.query("select id, password_hash, is_forbidden from users where username = ?", [String(username ?? "")]) as Array<Record<string, unknown>>;
+			const row = rows[0];
+			if (!row || !(await deps.bcryptVerify(String(password ?? ""), String(row.password_hash))))
+				fail(401, "invalid credentials");
+			if (Number(row.is_forbidden) === 1)
+				fail(401, "invalid credentials");
+			return issueFor(Number(row.id));
+		},
+
+		/** B3：刷新——轮换作旧；reuse 检测（已吊销串二次出现）全族吊销 + 审计。 */
+		async refresh(token: string): Promise<TokenBundle> {
+			const rows = await db.query("select * from sys_refresh_token where token_hash = ?", [hashOf(String(token ?? ""))]) as Array<Record<string, unknown>>;
+			const row = rows[0];
+			if (!row)
+				fail(401, "invalid or expired refresh token");
+			const uid = Number(row.user_id);
+			if (Number(row.revoked) === 1) {
+				await revokeAll(uid);
+				await recordOp({ action: "auth.refresh.reuse", module: "framework", target: `user:${uid}`, level: 4 });
+				fail(401, "invalid or expired refresh token");
+			}
+			if (Number(row.expires_at) <= now())
+				fail(401, "invalid or expired refresh token");
+			await db.exec("update sys_refresh_token set revoked = 1 where token_hash = ?", [row.token_hash]);
+			// 滑动窗口 + 绝对 30d 封顶（§3.1「绝对 TTL + 滑动」）
+			const newExp = Math.min(Number(row.expires_at), now() + deps.refreshTtlSecs);
+			const refreshToken = deps.randomHex(32);
+			await db.exec(
+				"insert into sys_refresh_token (token_hash, user_id, expires_at, revoked, created_at) values (?, ?, ?, 0, ?)",
+				[hashOf(refreshToken), uid, newExp, now()],
+			);
+			const user = await profileOf(uid);
+			return {
+				access_token: await deps.signAccess(String(uid)),
+				refresh_token: refreshToken,
+				expires_in: deps.accessTtlSecs,
+				restricted: user.must_change,
+				user,
+			};
+		},
+
+		/** AC1-27：自助改密——本人 + 旧口令校验；改密清 must_change、级联删 refresh、换发正式 token。 */
+		async changePassword(uid: number, oldPassword: string, newPassword: string): Promise<TokenBundle> {
+			const rows = await db.query("select password_hash from users where id = ?", [uid]) as Array<{ password_hash: string }>;
+			if (!rows[0])
+				fail(404, "user not found");
+			if (!(await deps.bcryptVerify(String(oldPassword ?? ""), String(rows[0].password_hash))))
+				fail(401, "invalid credentials");
+			if (!newPassword || String(newPassword).length < 6)
+				fail(400, "password too short (min 6)");
+			const hash = await deps.bcryptHash(String(newPassword));
+			await db.tx(async (t) => {
+				await t.exec("update users set password_hash = ?, must_change = 0 where id = ?", [hash, uid]);
+				await t.exec("delete from sys_refresh_token where user_id = ?", [uid]);
+			});
+			invalidateUser(uid);
+			return issueFor(uid);
+		},
+
+		revokeAll,
+
+		/** D1：外部登录（LDAP/未来 SSO）签发出口——JIT/禁号由登录链先行处理（D14：LDAP 先查号）。 */
+		async issueExternal(uid: number): Promise<TokenBundle> {
+			return issueFor(uid);
+		},
 	};
 }
+
+export type Session = ReturnType<typeof createSession>;

package/templates/api/src/auth/api.ts

@@ -1,66 +1,76 @@
-// oj v0.1.64 嵌套 handler 组：组名 = 路径段（login → POST /auth/login，路由不变）。
-// DDD 判据：同聚合（会话生命周期）多动词收进单文件；
-// 未来 register/reset/oauth 属新聚合、各自开目录。共享签发逻辑仍在 _shared/session.ts。
-import { issueTokens, nowSecs, sessionKey } from "./_shared/session";
+import { respond } from "../_platform/_shared/respond";
+// oj 嵌套 handler 组：组名 = 路径段（login → POST /api/auth/login，路由不变）。
+// 阶段 B 登录链（D14/AC1-12/13/27）：领域逻辑全在 _shared/session.ts（createSession 注入 deps），
+// handler 只编排：取参 → 调 service → json 信封；B5 限速收敛在 _shared/login-throttle.ts（与 ldap-login 共用）。
+// refresh 存 DB（sys_refresh_token，§3.1），logout = 吊销当前串。
+import { clientIp, guardLoginThrottle, noteLoginFailed, noteLoginSucceeded } from "./_shared/login-throttle";
+import { createSession } from "./_shared/session";
+
+// 模块级禁止 createSession()：oj build 的 introspect 在无 jwt 的空沙箱里评估模块（§9.4），
+// runtimeDeps() 读 g.jwt 会直接炸构建——session 在 handler 内按需构造（无状态，纯闭包）。
 
 const login = {
-	// POST /api/auth/login —— 登录（devkit 手册 §8：auth 端点是业务路由）。
-	// 用户不存在与密码错同报 invalid credentials（不泄露用户存在性）。
+	// POST /api/auth/login —— 本地登录（D14：先验口令后查禁用，三种失败统一 401）。
+	// B5/AC1-26：(IP, username) 连败阈值 → 429 + 指数 backoff；粗粒度 per-IP 窗口防撞库扫描。
 	async post() {
 		const body = http.body || {};
-		const rows = await db.query(
-			"select id, password_hash, roles from users where username = ?",
-			[String(body.username ?? "")],
-		);
-		const row = rows[0];
-		if (!row || !(await bcrypt.verify(String(body.password ?? ""), row.password_hash || ""))) {
-			json.fail(401, "invalid credentials");
-			return;
-		}
-		// roles 列按 JSON 数组串解析，失败回落空。
-		let roles: string[] = [];
-		try {
-			roles = JSON.parse(row.roles || "[]");
-		}
-		catch {
-			roles = [];
-		}
-		json.ok(await issueTokens(String(row.id), roles));
+		const username = String(body.username ?? "");
+		const ip = await clientIp();
+		await respond(async () => {
+			try {
+				await guardLoginThrottle(ip, username);
+				const r = await createSession().localLogin(username, String(body.password ?? ""));
+				await noteLoginSucceeded(ip, username);
+				return r;
+			}
+			catch (e) {
+				if ((e as Error & { status?: number }).status === 401)
+					await noteLoginFailed(ip, username);
+				throw e; // respond 收口：err.status/extra → json.fail 信封（oj 未捕获异常恒 500）
+			}
+		});
 	},
 };
 
 const logout = {
-	// POST /api/auth/logout —— 注销（删 refresh session；access 到期前仍有效）。
+	// POST /api/auth/logout —— 吊销当前 refresh 串（access 到期前仍有效，语义同旧版）。
 	async post() {
 		const token = String((http.body || {}).refresh_token ?? "");
-		await kv.del(sessionKey(token));
+		await db.exec("delete from sys_refresh_token where token_hash = ?", [crypto.sha256Hex(token)]);
 		json.ok(null);
 	},
 };
 
 const refresh = {
-	// POST /api/auth/refresh —— 刷新（轮换：旧 refresh 立即失效，一次一用）。
+	// POST /api/auth/refresh —— 轮换（旧串立即失效；reuse 检测在 service 内全族吊销+审计）。
 	async post() {
 		const token = String((http.body || {}).refresh_token ?? "");
-		const key = sessionKey(token);
-		const raw = await kv.get(key);
-		const sess = raw ? JSON.parse(raw) : null;
-		if (!sess || !(sess.exp > nowSecs())) {
-			json.fail(401, "invalid or expired refresh token");
+		await respond(async () => createSession().refresh(token));
+	},
+};
+
+const password = {
+	// PUT /api/auth/password —— 自助改密（AC1-27：本人+旧口令；悬挂期唯一可用写端）。
+	async put() {
+		const uid = http.user?.id;
+		if (!uid) {
+			json.fail(401, "unauthorized");
 			return;
 		}
-		// session 只存 uid——roles 重查库取最新。
-		const rows = await db.query("select roles from users where id = ?", [sess.uid]);
-		let roles: string[] = [];
-		try {
-			roles = JSON.parse((rows[0] || {}).roles || "[]");
-		}
-		catch {
-			roles = [];
-		}
-		await kv.del(key);
-		json.ok(await issueTokens(String(sess.uid), roles));
+		const body = http.body || {};
+		await respond(async () => createSession().changePassword(Number(uid), String(body.old_password ?? ""), String(body.new_password ?? "")));
+	},
+};
+// must_change 悬挂期唯一可用写端（AC1-27）；契约供 login/system 模板的改密 UI 使用
+password.put.schema = {
+	body: {
+		type: "object",
+		required: ["old_password", "new_password"],
+		properties: {
+			old_password: { type: "string", minLength: 1 },
+			new_password: { type: "string", minLength: 6 },
+		},
 	},
 };
 
-export default { login, logout, refresh };
+export default { login, logout, refresh, password };

package/templates/api/src/auth/ldap-login/api.ts

@@ -0,0 +1,29 @@
+// POST /api/auth/ldap-login —— LDAP 目录登录（D1/AC1-12；匿名端点，E6：anonymous_paths 写 /auth/ldap-login）。
+// 编排：B5 限速守卫（与 auth/login 同维度）→ ldapLogin 九步 → respond 统一异常出口（§9.3-1）。
+import { respond } from "../../_platform/_shared/respond";
+import { createLdapLogin, runtimeLdapGateway } from "../_shared/ldap-login";
+import { clientIp, guardLoginThrottle, noteLoginFailed, noteLoginSucceeded } from "../_shared/login-throttle";
+import { createSession } from "../_shared/session";
+
+// 模块级禁止 createSession()/runtimeLdapGateway()：oj build introspect 的空沙箱无 jwt/axis（§9.4）。
+
+export default {
+	async post() {
+		const body = http.body || {};
+		const username = String(body.username ?? "");
+		const ip = await clientIp();
+		await respond(async () => {
+			try {
+				await guardLoginThrottle(ip, username);
+				const r = await createLdapLogin(createSession(), runtimeLdapGateway())(username, String(body.password ?? ""));
+				await noteLoginSucceeded(ip, username);
+				return r;
+			}
+			catch (e) {
+				if ((e as Error & { status?: number }).status === 401)
+					await noteLoginFailed(ip, username);
+				throw e; // respond 收口：err.status/extra → json.fail 信封
+			}
+		});
+	},
+};

package/templates/api/src/system/login-methods/api.ts

@@ -0,0 +1,19 @@
+import { respond } from "../../_platform/_shared/respond";
+// GET /api/system/login-methods —— 登录方式发现（C5/D2；匿名端点：登录前无 token，
+// 项目 config.yaml auth.anonymous_paths 必须列 /system/login-methods，漏列则握手 401 登录页必坏）。
+import { listLoginMethods } from "../../_platform/_shared/service/settings";
+
+async function get() {
+	await respond(async () => {
+		return listLoginMethods();
+	});
+}
+get.response = {
+	type: "object",
+	required: ["methods"],
+	properties: {
+		methods: { type: "array", items: { type: "string" } },
+	},
+};
+
+export default { get };

package/templates/api/src/system/manifest.yaml

@@ -0,0 +1,5 @@
+name: system
+desc: 框架管理域端点（/api/system/*）：角色/权限点管理（assertSystemAdmin 判权，H2）
+version: 0.1.0
+deps: # roles/bindings/permissions 读写 _platform 的 sys_* 表（ownership_guard: deny 下必须声明）
+  _platform: ^0.1.0

package/templates/api/src/system/oplog/api.ts

@@ -0,0 +1,53 @@
+import { respond } from "../../_platform/_shared/respond";
+// GET /api/system/oplog?action=&username=&module=&limit= —— 操作日志查询（AC1-29；D13 admin 可查）。
+import { assertSystemAdmin } from "../../_platform/_shared/service/access";
+import { searchOplog } from "../../_platform/_shared/service/oplog";
+
+async function get() {
+	await respond(async () => {
+		await assertSystemAdmin();
+		return searchOplog(http.query as Record<string, unknown>);
+	});
+}
+get.schema = {
+	query: {
+		type: "object",
+		properties: {
+			action: { type: "string" },
+			// username 前缀匹配（service likePattern），非精确
+			username: { type: "string" },
+			module: { type: "string" },
+			// 分页大小，service paged 钳 200
+			limit: { type: "number", minimum: 1, maximum: 200 },
+		},
+	},
+};
+get.response = {
+	type: "object",
+	required: ["list", "total", "truncated"],
+	properties: {
+		list: {
+			type: "array",
+			items: {
+				type: "object",
+				required: ["id", "create_time", "user_id", "username", "action", "module", "version", "target", "detail", "level"],
+				properties: {
+					id: { type: "number" },
+					create_time: { type: "number" },
+					user_id: { type: "number" },
+					username: { type: "string" },
+					action: { type: "string" },
+					module: { type: "string" },
+					version: { type: ["string", "null"] },
+					target: { type: ["string", "null"] },
+					detail: { type: ["string", "null"] },
+					level: { type: "number" },
+				},
+			},
+		},
+		total: { type: "number" },
+		truncated: { type: "boolean" },
+	},
+};
+
+export default { get };

package/templates/api/src/system/permissions/api.ts

@@ -0,0 +1,26 @@
+import { respond } from "../../_platform/_shared/respond";
+// GET /api/system/permissions —— 权限点全量（C2 绑定编辑器数据源，deprecated 标灰）。
+import { assertSystemAdmin } from "../../_platform/_shared/service/access";
+import { listPermissions } from "../../_platform/_shared/service/roles";
+
+async function get() {
+	await respond(async () => {
+		await assertSystemAdmin();
+		return listPermissions();
+	});
+}
+get.response = {
+	type: "array",
+	items: {
+		type: "object",
+		required: ["code", "module", "title_key", "deprecated"],
+		properties: {
+			code: { type: "string" },
+			module: { type: "string" },
+			title_key: { type: ["string", "null"] },
+			deprecated: { type: "boolean" },
+		},
+	},
+};
+
+export default { get };

package/templates/api/src/system/roles/api.ts

@@ -0,0 +1,75 @@
+import { respond } from "../../_platform/_shared/respond";
+// 管理域端点 /api/system/roles（设计文档 D207：/api/system/* = 管理域，assertSystemAdmin 判权）。
+// handler 层只编排：守卫 → service → json 信封；name 走 query（wiki 先例：静态段 + http.query）。
+import { assertSystemAdmin } from "../../_platform/_shared/service/access";
+import { createRole, deleteRole, listRoles } from "../../_platform/_shared/service/roles";
+
+async function guard(): Promise<void> {
+	await assertSystemAdmin();
+}
+
+// GET /api/system/roles —— 角色列表（含持有计数与绑定，C2 页面数据源）。
+async function get() {
+	await respond(async () => {
+		await guard();
+		return listRoles();
+	});
+}
+get.response = {
+	type: "array",
+	items: {
+		type: "object",
+		required: ["name", "module", "title", "description", "builtin", "deprecated", "holders", "permissions"],
+		properties: {
+			name: { type: "string" },
+			module: { type: "string" },
+			title: { type: ["string", "null"] },
+			description: { type: ["string", "null"] },
+			builtin: { type: "boolean" },
+			deprecated: { type: "boolean" },
+			holders: { type: "number" },
+			permissions: { type: "array", items: { type: "string" } },
+		},
+	},
+};
+
+// POST /api/system/roles —— 建角色（AC1-16：custom.<slug> 机器名 + 勾选绑定）。
+async function post() {
+	await respond(async () => {
+		await guard();
+		return createRole(http.body || {});
+	});
+}
+post.schema = {
+	body: {
+		type: "object",
+		required: ["name", "title"],
+		properties: {
+			name: { type: "string", pattern: "^custom\\.[a-z0-9][a-z0-9-]*$" },
+			title: { type: "string", minLength: 1 },
+			permissions: { type: "array", items: { type: "string" } },
+		},
+	},
+};
+post.response = {
+	type: "object",
+	required: ["name", "module"],
+	properties: { name: { type: "string" }, module: { type: "string" } },
+};
+
+// DELETE /api/system/roles?name=xxx —— 删角色（AC1-20 占用禁删，409 带 holders）。
+async function del() {
+	await respond(async () => {
+		await guard();
+		return deleteRole(String((http.query as Record<string, unknown>).name ?? ""));
+	});
+}
+del.schema = {
+	query: {
+		type: "object",
+		required: ["name"],
+		properties: { name: { type: "string", minLength: 1 } },
+	},
+};
+
+export default { get, post, del };

package/templates/api/src/system/roles/bindings/api.ts

@@ -0,0 +1,29 @@
+import { respond } from "../../../_platform/_shared/respond";
+// PUT /api/system/roles/bindings?name=xxx —— 整集替换角色绑定。
+// AC1-18 声明角色绑定可调整；AC1-19 builtin 硬拒（service 层）；AC1-30 摘绑定 = 紧急吊销出口
+// （service 内写后按持有者失效判权缓存）。
+import { assertSystemAdmin } from "../../../_platform/_shared/service/access";
+import { updateBindings } from "../../../_platform/_shared/service/roles";
+
+async function put() {
+	await respond(async () => {
+		await assertSystemAdmin();
+		const name = String((http.query as Record<string, unknown>).name ?? "");
+		const codes = Array.isArray(http.body?.permissions) ? http.body.permissions.map(String) : [];
+		return updateBindings(name, codes);
+	});
+}
+put.schema = {
+	query: {
+		type: "object",
+		required: ["name"],
+		properties: { name: { type: "string", minLength: 1 } },
+	},
+	body: {
+		type: "object",
+		required: ["permissions"],
+		properties: { permissions: { type: "array", items: { type: "string" } } },
+	},
+};
+
+export default { put };

package/templates/api/src/system/settings/api.ts

@@ -0,0 +1,60 @@
+import { respond } from "../../_platform/_shared/respond";
+// /api/system/settings —— 系统设置（PRD §4.3）：GET 按组列出（secret 掩码），PUT 写值（写审计）。
+import { assertSystemAdmin } from "../../_platform/_shared/service/access";
+import { listSettings, updateSetting } from "../../_platform/_shared/service/settings";
+
+const settingItemSchema = {
+	type: "object",
+	required: ["key", "module", "group", "type", "value", "default_value", "label_key", "options", "secret", "update_time"],
+	properties: {
+		key: { type: "string" },
+		module: { type: "string" },
+		group: { type: "string" },
+		type: { type: "string" },
+		// secret 项读取面恒为 "***"
+		value: { type: ["string", "null"] },
+		default_value: { type: ["string", "null"] },
+		label_key: { type: ["string", "null"] },
+		options: { type: ["string", "null"] },
+		secret: { type: "boolean" },
+		update_time: { type: "number" },
+	},
+} as const;
+
+async function get() {
+	await respond(async () => {
+		await assertSystemAdmin();
+		return listSettings();
+	});
+}
+get.response = {
+	type: "array",
+	items: {
+		type: "object",
+		required: ["group", "items"],
+		properties: {
+			group: { type: "string" },
+			items: { type: "array", items: settingItemSchema },
+		},
+	},
+};
+
+async function put() {
+	await respond(async () => {
+		await assertSystemAdmin();
+		const body = http.body || {};
+		return updateSetting(Number(http.user?.id), String(body.key ?? ""), String(body.value ?? ""));
+	});
+}
+put.schema = {
+	body: {
+		type: "object",
+		required: ["key", "value"],
+		properties: {
+			key: { type: "string", minLength: 1 },
+			value: { type: "string" },
+		},
+	},
+};
+
+export default { get, put };