安全修复：1.密码哈希验证 2.移除硬编码凭据 3.JWT强密钥 4.CORS白名单

backend/api-complete.js

@@ -5,6 +5,7 @@ const multer = require('multer');
 const xlsx = require('xlsx');
 require('dotenv').config();
 const db = require('./db-sqlite');
+const { verifyPassword, generateToken } = require('./utils/auth');
 
 // 文件上传配置
 const storage = multer.memoryStorage();
@@ -15,7 +16,13 @@ const app = express();
 const PORT = process.argv[2] || process.env.PORT || 3000;
 
 // 中间件
-app.use(cors());
+const corsOptions = {
+  origin: process.env.CORS_ORIGIN ? process.env.CORS_ORIGIN.split(',') : ['http://localhost:5173', 'http://localhost:3001'],
+  credentials: true,
+  methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'],
+  allowedHeaders: ['Content-Type', 'Authorization']
+};
+app.use(cors(corsOptions));
 app.use(express.json());
 app.use(express.urlencoded({ extended: true }));
 
@@ -61,17 +68,23 @@ app.post('/api/auth/login', [
   try {
     const { username, password } = req.body;
     const result = await db.query(
-      'SELECT id, username, role, name FROM users WHERE username = ? AND password = ?',
-      [username, password]
+      'SELECT id, username, role, name, password_hash FROM users WHERE username = ?',
+      [username]
     );
     
     if (result.rows.length === 0) {
       return res.status(401).json({ success: false, message: '用户名或密码错误' });
     }
     
-    res.json({ success: true, data: result.rows[0] });
+    const user = result.rows[0];
+    if (!user.password_hash || !verifyPassword(password, user.password_hash)) {
+      return res.status(401).json({ success: false, message: '用户名或密码错误' });
+    }
+    
+    const token = generateToken({ id: user.id, username: user.username, role: user.role });
+    res.json({ success: true, data: { id: user.id, username: user.username, role: user.role, name: user.name, token } });
   } catch (error) {
-    res.status(500).json({ success: false, message: error.message });
+    res.status(500).json({ success: false, message: '登录失败' });
   }
 });
 
@@ -81,28 +94,26 @@ app.post('/api/users/login', [
   body('password').notEmpty()
 ], validate, async (req, res) => {
   try {
-    console.log('收到登录请求:', req.body);
     const { username, password } = req.body;
     
     const result = await db.query(
-      'SELECT id, username, role, name FROM users WHERE username = ? AND password = ?',
-      [username, password]
+      'SELECT id, username, role, name, password_hash FROM users WHERE username = ?',
+      [username]
     );
     
-    console.log('查询结果:', result.rows);
-    
     if (result.rows.length === 0) {
-      console.log('登录失败: 用户不存在或密码错误');
       return res.status(401).json({ user: null, token: null, message: '用户名或密码错误' });
     }
     
-    // 返回前端期望的格式
-    const responseData = { user: result.rows[0], token: 'dummy-token-' + Date.now() };
-    console.log('登录成功，返回数据:', responseData);
-    res.json(responseData);
+    const user = result.rows[0];
+    if (!user.password_hash || !verifyPassword(password, user.password_hash)) {
+      return res.status(401).json({ user: null, token: null, message: '用户名或密码错误' });
+    }
+    
+    const token = generateToken({ id: user.id, username: user.username, role: user.role });
+    res.json({ user: { id: user.id, username: user.username, role: user.role, name: user.name }, token });
   } catch (error) {
-    console.error('登录错误:', error);
-    res.status(500).json({ user: null, token: null, message: error.message });
+    res.status(500).json({ user: null, token: null, message: '登录失败' });
   }
 });