75 lines
2.1 KiB
JavaScript
75 lines
2.1 KiB
JavaScript
import { readUsers, writeUsers, hashPassword } from '../../utils/auth.js'
|
|
import { sendRegistrationNotification } from '../../utils/email-service.js'
|
|
import { assertPasswordNotPwned } from '../../utils/hibp.js'
|
|
|
|
export default defineEventHandler(async (event) => {
|
|
try {
|
|
const body = await readBody(event)
|
|
const { name, email, phone, password } = body
|
|
|
|
if (!name || !email || !password) {
|
|
throw createError({
|
|
statusCode: 400,
|
|
message: 'Name, E-Mail und Passwort sind erforderlich'
|
|
})
|
|
}
|
|
|
|
// Validate password length
|
|
if (password.length < 8) {
|
|
throw createError({
|
|
statusCode: 400,
|
|
message: 'Das Passwort muss mindestens 8 Zeichen lang sein'
|
|
})
|
|
}
|
|
|
|
// Optional: Passwort gegen HIBP (k-Anonymity) prüfen
|
|
await assertPasswordNotPwned(password)
|
|
|
|
// Check if user already exists
|
|
const users = await readUsers()
|
|
const existingUser = users.find(u => u.email.toLowerCase() === email.toLowerCase())
|
|
|
|
if (existingUser) {
|
|
throw createError({
|
|
statusCode: 409,
|
|
message: 'Ein Benutzer mit dieser E-Mail-Adresse existiert bereits'
|
|
})
|
|
}
|
|
|
|
// Hash password
|
|
const hashedPassword = await hashPassword(password)
|
|
|
|
// Create new user (inactive until approved)
|
|
const newUser = {
|
|
id: Date.now().toString(),
|
|
email: email.toLowerCase(),
|
|
password: hashedPassword,
|
|
name,
|
|
phone: phone || '',
|
|
role: 'mitglied',
|
|
active: false, // Requires admin approval
|
|
created: new Date().toISOString(),
|
|
lastLogin: null
|
|
}
|
|
|
|
users.push(newUser)
|
|
await writeUsers(users)
|
|
|
|
// Send notification to Vorstand/admin via central email service
|
|
try {
|
|
await sendRegistrationNotification({ name, email, phone })
|
|
} catch (emailError) {
|
|
console.error('Registrierungs-Benachrichtigung fehlgeschlagen:', emailError)
|
|
}
|
|
|
|
return {
|
|
success: true,
|
|
message: 'Registrierung erfolgreich. Sie erhalten eine E-Mail, sobald Ihr Zugang freigeschaltet wurde.'
|
|
}
|
|
} catch (error) {
|
|
console.error('Registrierungs-Fehler:', error)
|
|
throw error
|
|
}
|
|
})
|
|
|