fast fertig

src/lib/auth.ts

@@ -52,7 +52,7 @@ export async function getSessionUser(): Promise<SessionUser | null> {
     const payload = result.payload as unknown as SessionPayload;
     initDatabase();
     const user = db
-      .prepare("SELECT id, name, email, role FROM users WHERE id = ?")
+      .prepare("SELECT id, name, email, role FROM users WHERE id = ? AND active = 1")
       .get(Number(payload.id)) as
       | { id: number; name: string; email: string; role: UserRole }
       | undefined;
@@ -74,13 +74,15 @@ export async function requireAdminUser() {
   return user;
 }
 
-export function authenticateUser(email: string, password: string): SessionUser | null {
+export function authenticateUser(username: string, password: string): SessionUser | null {
   initDatabase();
-  const user = db
-    .prepare("SELECT id, name, email, role, password_hash FROM users WHERE email = ?")
-    .get(email.trim().toLowerCase()) as
-    | (SessionUser & { password_hash: string })
-    | undefined;
+  const users = db
+    .prepare(
+      "SELECT id, name, email, role, password_hash FROM users WHERE name = ? COLLATE NOCASE AND active = 1 ORDER BY id ASC",
+    )
+    .all(username.trim()) as (SessionUser & { password_hash: string })[];
+  if (users.length !== 1) return null;
+  const user = users[0];
 
   if (!user || !compareSync(password, user.password_hash)) return null;
   return { id: user.id, name: user.name, email: user.email, role: user.role };