feat: MongoDB 仅保留连接状态 + 站点级密码门禁(WEBPASSWORD)

server/api/unlock.post.ts

@@ -0,0 +1,17 @@
+// 校验站点访问密码（来自环境变量 WEBPASSWORD），成功后写入 HTTP-only cookie
+export default defineEventHandler(async (event) => {
+  const password = process.env.WEBPASSWORD
+  if (!password) return { enabled: false }
+
+  const body = await readBody<{ password?: string }>(event)
+  if (body.password === password) {
+    setCookie(event, 'web_unlock', '1', {
+      httpOnly: true,
+      sameSite: 'lax',
+      path: '/',
+      maxAge: 60 * 60 * 24 * 30
+    })
+    return { ok: true }
+  }
+  throw createError({ statusCode: 401, statusMessage: 'invalid password' })
+})

server/middleware/auth.ts

@@ -0,0 +1,30 @@
+// 站点级访问门禁：仅当配置了 WEBPASSWORD 时启用。
+// 验证通过后由 /api/unlock 写入 HTTP-only cookie，后续请求凭此放行。
+export default defineEventHandler((event) => {
+  const password = process.env.WEBPASSWORD
+  // 未配置密码则站点完全开放
+  if (!password) return
+
+  const url = (event.node.req.url || '').split('?')[0]
+
+  // 解锁接口、门禁页与 Nuxt 运行所需资源始终放行
+  if (
+    url === '/api/unlock' ||
+    url === '/gate' ||
+    url.startsWith('/_nuxt') ||
+    url.startsWith('/__nuxt') ||
+    url.startsWith('/@vite') ||
+    url.startsWith('/@fs') ||
+    url === '/favicon.ico' ||
+    url.startsWith('/favicon')
+  ) {
+    return
+  }
+
+  if (getCookie(event, 'web_unlock') === '1') return
+
+  if (url.startsWith('/api/')) {
+    throw createError({ statusCode: 401, statusMessage: 'unauthorized' })
+  }
+  return sendRedirect(event, '/gate')
+})

server/utils/mongo.ts

@@ -8,9 +8,6 @@ let indexState: 'pending' | 'done' = 'pending'
 export const mongoUri = () => process.env.MONGODB_URI || 'mongodb://127.0.0.1:27017'
 export const mongoDbName = () => process.env.MONGODB_DB || 'torrent_console'
 
-/** 最近一次连接失败信息，用于在 UI 上提示用户去装 / 启 MongoDB */
-let lastError: { message: string; at: Date } | null = null
-
 export async function getClient(): Promise<MongoClient> {
   if (client) return client
   if (!connecting) {
@@ -25,12 +22,10 @@ export async function getClient(): Promise<MongoClient> {
       .then((cli) => {
         client = cli
         connecting = null
-        lastError = null
         return cli
       })
       .catch((err: unknown) => {
         connecting = null
-        lastError = { message: err instanceof Error ? err.message : String(err), at: new Date() }
         next.close().catch(() => {})
         throw err
       })
@@ -68,24 +63,14 @@ export async function downloadsCol(): Promise<Collection<DownloadDoc>> {
   return (await getDb()).collection<DownloadDoc>('downloads')
 }
 
-/** 把驱动错误里的连接串 / 主机名脱敏，避免泄露凭证与数据库地址 */
-function sanitizeMongoError(raw: string): string {
-  return raw
-    .replace(/mongodb(\+srv)?:\/\/[^\s'"]+/gi, '***')
-    .replace(/[a-z0-9.-]+\.mongodb\.net(?::\d+)?/gi, '***')
-}
-
-/** 供 /api/health 使用：探测 MongoDB 是否可用（不返回任何连接串 / 库名） */
+/** 供 /api/health 使用：探测 MongoDB 是否可用（只返回 ok，不暴露任何连接信息） */
 export async function mongoStatus() {
   try {
     const db = await getDb()
     await db.command({ ping: 1 })
-    return { ok: true, error: null as string | null }
-  } catch (err) {
-    return {
-      ok: false,
-      error: sanitizeMongoError(lastError?.message || (err instanceof Error ? err.message : String(err)))
-    }
+    return { ok: true }
+  } catch {
+    return { ok: false }
   }
 }