feat: complete v0.5 operations foundation

2026-07-19 03:58:03 +08:00
parent ca3f706cc1
commit d285f3e275
35 changed files with 248 additions and 39 deletions
@@ -3,10 +3,11 @@ import { NextResponse } from "next/server";
 import { requireUser } from "@/lib/auth";
 import { db } from "@/lib/db";
 import { externalUrl } from "@/lib/http";
+import { requireSameOrigin } from "@/lib/security";

 export async function POST(req: Request) {
  try {
-    const user = await requireUser(); const form = await req.formData();
+    requireSameOrigin(req); const user = await requireUser(); const form = await req.formData();
    const currentPassword = String(form.get("currentPassword") || ""); const newPassword = String(form.get("newPassword") || ""); const confirmPassword = String(form.get("confirmPassword") || "");
    if (newPassword.length < 10) throw new Error("新密碼至少需要 10 個字元");
    if (newPassword !== confirmPassword) throw new Error("兩次新密碼不一致");