7.1 使用者的註冊與登入#

// src/auth.ts
const enc = (s: string) => new TextEncoder().encode(s);

export async function hashPassword(pw: string, salt?: string): Promise<string> {
  const s = salt ?? crypto.randomUUID().replaceAll("-", "");
  const key = await crypto.subtle.importKey("raw", enc(pw), "PBKDF2", false, ["deriveBits"]);
  const bits = await crypto.subtle.deriveBits(
    { name: "PBKDF2", salt: enc(s), iterations: 250_000, hash: "SHA-256" },
    key, 256
  );
  const hex = [...new Uint8Array(bits)].map(b => b.toString(16).padStart(2, "0")).join("");
  return `pbkdf2$sha256$250000$${s}$${hex}`;   // 算法、參數都存進字串，方便日後升級
}

export async function verifyPassword(pw: string, stored: string): Promise<boolean> {
  const [, , iters, salt, hash] = stored.split("$");
  return hashPassword(pw, salt).then(v => v.endsWith(hash) === false ? false : v.split("$")[4] === hash);
}

// 簽名 cookie token：payload.userId.expiryTime.signature（HMAC-SHA256）
export async function signToken(userId: string, secret: string): Promise<string> {
  const body = `${userId}.${Date.now() + 7 * 86400_000}`;
  const sig = await hmac(body, secret);
  return btoa(body + "." + sig);
}

export async function hmac(msg: string, secret: string): Promise<string> {
  const key = await crypto.subtle.importKey("raw", enc(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
  return [...new Uint8Array(await crypto.subtle.sign("HMAC", key, enc(msg)))]
    .map(b => b.toString(16).padStart(2, "0")).join("");
}

// src/routes.ts（以 Hono 示範；任何框架皆同）
import { Hono } from "hono";

const app = new Hono<{ Bindings: Env }>();

function cookie(name: string, value: string, maxAge = 7 * 86400) {
  return `${name}=${value}; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=${maxAge}`;
}

app.post("/api/register", async (c) => {
  const { email, password, turnstile } = await c.req.json();
  const ok = await verifyTurnstile(turnstile!, c.env.TURNSTILE_SECRET, c.req.header("CF-Connecting-IP") ?? "");
  if (!ok) return c.json({ error: "人機驗證失敗" }, 400);
  if (password.length < 10) return c.json({ error: "密碼太短" }, 400);

  const exists = await c.env.DB.prepare("SELECT 1 FROM users WHERE email=?").bind(email).first();
  if (exists) return c.json({ error: "此信箱已註冊" }, 409);

  const userId = crypto.randomUUID();
  await c.env.DB.prepare("INSERT INTO users (id,email,password_hash,created_at) VALUES (?,?,?,?)")
    .bind(userId, email, await hashPassword(password), new Date().toISOString()).run();
  return c.json({ userId }, 201);
});

app.post("/api/login", async (c) => {
  const { email, password } = await c.req.json();
  const row: any = await c.env.DB.prepare("SELECT id,password_hash FROM users WHERE email=?")
    .bind(email).first();
  if (!row || !(await verifyPassword(password, row.password_hash)))
    return c.json({ error: "帳號或密碼錯誤" }, 401);   // 模糊訊息，避免信箱枚舉

  const token = await signToken(row.id, c.env.AUTH_SECRET);
  c.header("Set-Cookie", cookie("session", token));
  return c.json({ ok: true });
});

app.post("/api/logout", (c) => {
  c.header("Set-Cookie", cookie("session", "", 0));   // 清空的 Set-Cookie
  return c.json({ ok: true });
});

async function verifyTurnstile(token: string, secret: string, ip: string): Promise<boolean> {
  const res = await fetch("https://challenges.cloudflare.com/turnstile/v0/siteverify", {
    method: "POST",
    body: new URLSearchParams({ secret, response: token, remoteip: ip }),
  });
  const j: any = await res.json();
  return j.success;
}

export default app;