85 lines
2.3 KiB
TypeScript
85 lines
2.3 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { z } from "zod";
|
|
|
|
import { createAuditTrailSafe } from "@/lib/audit-trail";
|
|
import { hashPassword, verifyPassword } from "@/lib/auth";
|
|
import { requireApiAccess } from "@/lib/authorization";
|
|
import { prisma } from "@/lib/prisma";
|
|
|
|
const changePasswordSchema = z
|
|
.object({
|
|
current_password: z.string().min(1, "Password saat ini wajib diisi"),
|
|
password: z.string().min(8, "Password baru minimal 8 karakter"),
|
|
password_confirmation: z.string().min(8, "Konfirmasi password minimal 8 karakter")
|
|
})
|
|
.refine((value) => value.password === value.password_confirmation, {
|
|
message: "Konfirmasi password tidak sama",
|
|
path: ["password_confirmation"]
|
|
});
|
|
|
|
export async function POST(request: Request) {
|
|
const auth = requireApiAccess(request);
|
|
if (!auth.ok) return auth.response;
|
|
|
|
try {
|
|
const body = await request.json();
|
|
const parsed = changePasswordSchema.safeParse(body);
|
|
|
|
if (!parsed.success) {
|
|
return NextResponse.json(
|
|
{
|
|
message: "Validasi gagal",
|
|
errors: parsed.error.flatten().fieldErrors
|
|
},
|
|
{ status: 422 }
|
|
);
|
|
}
|
|
|
|
const user = await prisma.user.findUnique({
|
|
where: { id: BigInt(auth.user.id) }
|
|
});
|
|
|
|
if (!user || !user.passwordHash) {
|
|
return NextResponse.json({ message: "User tidak ditemukan" }, { status: 404 });
|
|
}
|
|
|
|
if (!verifyPassword(parsed.data.current_password, user.passwordHash)) {
|
|
return NextResponse.json(
|
|
{
|
|
message: "Password saat ini tidak valid"
|
|
},
|
|
{ status: 422 }
|
|
);
|
|
}
|
|
|
|
await prisma.user.update({
|
|
where: { id: user.id },
|
|
data: {
|
|
passwordHash: hashPassword(parsed.data.password)
|
|
}
|
|
});
|
|
|
|
await createAuditTrailSafe({
|
|
userId: user.id,
|
|
action: "PASSWORD_CHANGED",
|
|
entityType: "AUTH",
|
|
entityId: user.id,
|
|
method: request.method,
|
|
pathname: new URL(request.url).pathname,
|
|
statusCode: 200,
|
|
summary: "User mengganti password akun sendiri"
|
|
});
|
|
|
|
return NextResponse.json({
|
|
message: "Password berhasil diperbarui"
|
|
});
|
|
} catch (error) {
|
|
return NextResponse.json(
|
|
{
|
|
message: error instanceof Error ? error.message : "Gagal mengganti password"
|
|
},
|
|
{ status: 500 }
|
|
);
|
|
}
|
|
}
|