feat: add authentication modal component and user authentication logic

- Implemented AuthModal.vue for user login and registration with form handling.
- Created useAuth composable for managing user state and authentication requests.
- Added admin route middleware to protect admin routes.
- Developed admin login page with authentication checks.
- Implemented API endpoints for user management (login, logout, fetch user, register).
- Created database migrations for users table and updated movies table.
- Added utility functions for password hashing and JWT token management.

server/api/admin/movies.get.ts

@@ -1,5 +1,5 @@
 import { movies } from '../../database/schema'
-import { desc, like, sql } from 'drizzle-orm'
+import { desc, eq, like, sql } from 'drizzle-orm'
 
 export default defineEventHandler(async (event) => {
   const db = useDb()
@@ -26,7 +26,7 @@ export default defineEventHandler(async (event) => {
       .select()
       .from(movies)
       .where(whereClause)
-      .orderBy(desc(movies.syncedAt))
+      .orderBy(desc(movies.apiUpdatedAt), desc(movies.year), desc(movies.syncedAt))
       .limit(limit)
       .offset(offset),
     db

server/api/admin/sync.post.ts

@@ -66,6 +66,7 @@ export default defineEventHandler(async (event) => {
           categories: movie.categories || null,
           countries: movie.countries || null,
           sources: movie.sources || null,
+          apiUpdatedAt: movie.updatedAt ? new Date(movie.updatedAt) : null,
           syncedAt: new Date(),
         })
         .where(eq(movies.id, existing[0].id))
@@ -88,6 +89,7 @@ export default defineEventHandler(async (event) => {
         categories: movie.categories || null,
         countries: movie.countries || null,
         sources: movie.sources || null,
+        apiUpdatedAt: movie.updatedAt ? new Date(movie.updatedAt) : null,
         active: false,
       })
       created++

server/api/admin/thanh-vien.get.ts

@@ -0,0 +1,38 @@
+import { users } from '../../database/schema'
+import { desc, like, sql } from 'drizzle-orm'
+
+export default defineEventHandler(async (event) => {
+  const db = useDb()
+  const query = getQuery(event)
+  const keyword = typeof query.keyword === 'string' ? query.keyword.trim() : ''
+
+  const whereClause = keyword
+    ? like(users.name, `%${keyword}%`)
+    : undefined
+
+  const [items, countResult] = await Promise.all([
+    db
+      .select({
+        id: users.id,
+        name: users.name,
+        email: users.email,
+        role: users.role,
+        avatar: users.avatar,
+        active: users.active,
+        createdAt: users.createdAt,
+      })
+      .from(users)
+      .where(whereClause)
+      .orderBy(desc(users.createdAt))
+      .limit(100),
+    db
+      .select({ count: sql<number>`count(*)` })
+      .from(users)
+      .where(whereClause),
+  ])
+
+  return {
+    items,
+    total: countResult[0]?.count ?? 0,
+  }
+})

server/api/admin/thanh-vien/[id].delete.ts

@@ -0,0 +1,25 @@
+import { users } from '../../../database/schema'
+import { eq } from 'drizzle-orm'
+
+export default defineEventHandler(async (event) => {
+  const db = useDb()
+  const id = Number(getRouterParam(event, 'id'))
+
+  if (!id) {
+    throw createError({ statusCode: 400, message: 'Thiếu ID thành viên' })
+  }
+
+  const existing = await db.select().from(users).where(eq(users.id, id)).limit(1)
+  if (!existing.length) {
+    throw createError({ statusCode: 404, message: 'Không tìm thấy thành viên' })
+  }
+
+  const currentUser = event.context.user
+  if (currentUser?.id === id) {
+    throw createError({ statusCode: 400, message: 'Không thể xoá chính mình' })
+  }
+
+  await db.delete(users).where(eq(users.id, id))
+
+  return { success: true, id }
+})

server/api/admin/thanh-vien/[id].patch.ts

@@ -0,0 +1,35 @@
+import { users } from '../../../database/schema'
+import { eq } from 'drizzle-orm'
+
+export default defineEventHandler(async (event) => {
+  const db = useDb()
+  const id = Number(getRouterParam(event, 'id'))
+  const body = await readBody(event)
+
+  if (!id) {
+    throw createError({ statusCode: 400, message: 'Thiếu ID thành viên' })
+  }
+
+  const existing = await db.select().from(users).where(eq(users.id, id)).limit(1)
+  if (!existing.length) {
+    throw createError({ statusCode: 404, message: 'Không tìm thấy thành viên' })
+  }
+
+  const updates: Record<string, any> = {}
+
+  if ('role' in body && ['admin', 'moderator', 'user'].includes(body.role)) {
+    updates.role = body.role
+  }
+
+  if (typeof body.active === 'boolean') {
+    updates.active = body.active
+  }
+
+  if (!Object.keys(updates).length) {
+    throw createError({ statusCode: 400, message: 'Không có dữ liệu cập nhật' })
+  }
+
+  await db.update(users).set(updates).where(eq(users.id, id))
+
+  return { success: true, id, ...updates }
+})

server/api/auth/login.post.ts

@@ -0,0 +1,42 @@
+import { users } from '../../database/schema'
+import { eq, and } from 'drizzle-orm'
+import { verifyPassword, signToken } from '../../utils/auth'
+
+export default defineEventHandler(async (event) => {
+  const db = useDb()
+  const body = await readBody(event)
+
+  const email = typeof body.email === 'string' ? body.email.trim().toLowerCase() : ''
+  const password = typeof body.password === 'string' ? body.password : ''
+
+  if (!email || !password) {
+    throw createError({ statusCode: 400, message: 'Email và mật khẩu là bắt buộc' })
+  }
+
+  const result = await db.select().from(users).where(and(eq(users.email, email), eq(users.active, true))).limit(1)
+  if (!result.length) {
+    throw createError({ statusCode: 401, message: 'Email hoặc mật khẩu không đúng' })
+  }
+
+  const user = result[0]
+  const valid = await verifyPassword(password, user.password)
+  if (!valid) {
+    throw createError({ statusCode: 401, message: 'Email hoặc mật khẩu không đúng' })
+  }
+
+  const payload = { id: user.id, email: user.email, role: user.role }
+  const token = signToken(payload)
+
+  setCookie(event, 'token', token, {
+    httpOnly: true,
+    secure: false,
+    sameSite: 'lax',
+    maxAge: 60 * 60 * 24 * 7,
+    path: '/',
+  })
+
+  return {
+    user: { id: user.id, email: user.email, name: user.name, role: user.role, avatar: user.avatar },
+    token,
+  }
+})

server/api/auth/logout.post.ts

@@ -0,0 +1,4 @@
+export default defineEventHandler((event) => {
+  deleteCookie(event, 'token', { path: '/' })
+  return { success: true }
+})

server/api/auth/me.get.ts

@@ -0,0 +1,32 @@
+import { users } from '../../database/schema'
+import { eq } from 'drizzle-orm'
+import { getTokenFromEvent, verifyToken } from '../../utils/auth'
+
+export default defineEventHandler(async (event) => {
+  const token = getTokenFromEvent(event)
+  if (!token) {
+    throw createError({ statusCode: 401, message: 'Chưa đăng nhập' })
+  }
+
+  const payload = verifyToken(token)
+  if (!payload) {
+    deleteCookie(event, 'token', { path: '/' })
+    throw createError({ statusCode: 401, message: 'Phiên đăng nhập hết hạn' })
+  }
+
+  const db = useDb()
+  const result = await db.select().from(users).where(eq(users.id, payload.id)).limit(1)
+  if (!result.length || !result[0].active) {
+    deleteCookie(event, 'token', { path: '/' })
+    throw createError({ statusCode: 401, message: 'Tài khoản không tồn tại hoặc đã bị khóa' })
+  }
+
+  const user = result[0]
+  return {
+    id: user.id,
+    email: user.email,
+    name: user.name,
+    role: user.role,
+    avatar: user.avatar,
+  }
+})

server/api/auth/register.post.ts

@@ -0,0 +1,56 @@
+import { users } from '../../database/schema'
+import { eq, sql } from 'drizzle-orm'
+import { hashPassword, signToken } from '../../utils/auth'
+
+export default defineEventHandler(async (event) => {
+  const db = useDb()
+  const body = await readBody(event)
+
+  const email = typeof body.email === 'string' ? body.email.trim().toLowerCase() : ''
+  const password = typeof body.password === 'string' ? body.password : ''
+  const name = typeof body.name === 'string' ? body.name.trim() : ''
+
+  if (!email || !password) {
+    throw createError({ statusCode: 400, message: 'Email và mật khẩu là bắt buộc' })
+  }
+
+  if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+    throw createError({ statusCode: 400, message: 'Email không hợp lệ' })
+  }
+
+  if (password.length < 6) {
+    throw createError({ statusCode: 400, message: 'Mật khẩu phải có ít nhất 6 ký tự' })
+  }
+
+  const existing = await db.select().from(users).where(eq(users.email, email)).limit(1)
+  if (existing.length) {
+    throw createError({ statusCode: 409, message: 'Email đã được sử dụng' })
+  }
+
+  const hashedPassword = await hashPassword(password)
+  const isAdmin = (await db.select({ count: sql<number>`count(*)` }).from(users))[0]?.count === 0
+
+  const result = await db.insert(users).values({
+    email,
+    password: hashedPassword,
+    name: name || email.split('@')[0],
+    role: isAdmin ? 'admin' : 'user',
+  })
+
+  const userId = result[0].insertId
+  const user = { id: userId, email, role: isAdmin ? 'admin' : 'user' }
+  const token = signToken(user)
+
+  setCookie(event, 'token', token, {
+    httpOnly: true,
+    secure: false,
+    sameSite: 'lax',
+    maxAge: 60 * 60 * 24 * 7,
+    path: '/',
+  })
+
+  return {
+    user: { id: userId, email, name: name || email.split('@')[0], role: user.role },
+    token,
+  }
+})

server/api/movies.get.ts

@@ -31,7 +31,7 @@ export default defineEventHandler(async (event) => {
       .select()
       .from(movies)
       .where(whereClause)
-      .orderBy(desc(movies.syncedAt))
+      .orderBy(desc(movies.apiUpdatedAt), desc(movies.year), desc(movies.syncedAt))
       .limit(limit)
       .offset(offset),
     db

server/database/migrations/0003_slow_masked_marvel.sql

@@ -0,0 +1,13 @@
+CREATE TABLE `users` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`name` varchar(200),
+	`email` varchar(255) NOT NULL,
+	`password` varchar(255) NOT NULL,
+	`role` varchar(50) NOT NULL DEFAULT 'user',
+	`avatar` text,
+	`active` boolean NOT NULL DEFAULT true,
+	`created_at` timestamp NOT NULL DEFAULT (now()),
+	`updated_at` timestamp NOT NULL DEFAULT (now()) ON UPDATE CURRENT_TIMESTAMP,
+	CONSTRAINT `users_id` PRIMARY KEY(`id`),
+	CONSTRAINT `users_email_unique` UNIQUE(`email`)
+);

server/database/migrations/0004_opposite_sasquatch.sql

@@ -0,0 +1 @@
+ALTER TABLE `movies` ADD `api_updated_at` timestamp;

server/database/migrations/meta/0003_snapshot.json

@@ -0,0 +1,314 @@
+{
+  "version": "5",
+  "dialect": "mysql",
+  "id": "ddff729d-56d9-4793-8d58-51855f8f3839",
+  "prevId": "b3692b95-4029-4e2c-bab4-ffd0696fa2a1",
+  "tables": {
+    "movies": {
+      "name": "movies",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "int",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": true
+        },
+        "source": {
+          "name": "source",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "slug": {
+          "name": "slug",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "origin_name": {
+          "name": "origin_name",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "thumb": {
+          "name": "thumb",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "poster": {
+          "name": "poster",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "year": {
+          "name": "year",
+          "type": "int",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "time": {
+          "name": "time",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "episode": {
+          "name": "episode",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "quality": {
+          "name": "quality",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "lang": {
+          "name": "lang",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "type": {
+          "name": "type",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "rating": {
+          "name": "rating",
+          "type": "int",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "categories": {
+          "name": "categories",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "countries": {
+          "name": "countries",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "sources": {
+          "name": "sources",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "custom_poster": {
+          "name": "custom_poster",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "custom_thumb": {
+          "name": "custom_thumb",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "custom_content": {
+          "name": "custom_content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "custom_episodes": {
+          "name": "custom_episodes",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "active": {
+          "name": "active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "synced_at": {
+          "name": "synced_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "onUpdate": true,
+          "default": "(now())"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "movies_id": {
+          "name": "movies_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "users": {
+      "name": "users",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "int",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": true
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(200)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "email": {
+          "name": "email",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "password": {
+          "name": "password",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "role": {
+          "name": "role",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'user'"
+        },
+        "avatar": {
+          "name": "avatar",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "active": {
+          "name": "active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "onUpdate": true,
+          "default": "(now())"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "users_id": {
+          "name": "users_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {
+        "users_email_unique": {
+          "name": "users_email_unique",
+          "columns": [
+            "email"
+          ]
+        }
+      },
+      "checkConstraint": {}
+    }
+  },
+  "views": {},
+  "_meta": {
+    "schemas": {},
+    "tables": {},
+    "columns": {}
+  },
+  "internal": {
+    "tables": {},
+    "indexes": {}
+  }
+}

server/database/migrations/meta/0004_snapshot.json

@@ -0,0 +1,321 @@
+{
+  "version": "5",
+  "dialect": "mysql",
+  "id": "39aa52ed-af36-43ed-ab3e-2222785d1c00",
+  "prevId": "ddff729d-56d9-4793-8d58-51855f8f3839",
+  "tables": {
+    "movies": {
+      "name": "movies",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "int",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": true
+        },
+        "source": {
+          "name": "source",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "slug": {
+          "name": "slug",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "origin_name": {
+          "name": "origin_name",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "thumb": {
+          "name": "thumb",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "poster": {
+          "name": "poster",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "year": {
+          "name": "year",
+          "type": "int",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "time": {
+          "name": "time",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "episode": {
+          "name": "episode",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "quality": {
+          "name": "quality",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "lang": {
+          "name": "lang",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "type": {
+          "name": "type",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "rating": {
+          "name": "rating",
+          "type": "int",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "categories": {
+          "name": "categories",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "countries": {
+          "name": "countries",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "sources": {
+          "name": "sources",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "custom_poster": {
+          "name": "custom_poster",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "custom_thumb": {
+          "name": "custom_thumb",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "custom_content": {
+          "name": "custom_content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "custom_episodes": {
+          "name": "custom_episodes",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "active": {
+          "name": "active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "api_updated_at": {
+          "name": "api_updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "synced_at": {
+          "name": "synced_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "onUpdate": true,
+          "default": "(now())"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "movies_id": {
+          "name": "movies_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraint": {}
+    },
+    "users": {
+      "name": "users",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "int",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": true
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(200)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "email": {
+          "name": "email",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "password": {
+          "name": "password",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "role": {
+          "name": "role",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'user'"
+        },
+        "avatar": {
+          "name": "avatar",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "active": {
+          "name": "active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(now())"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "onUpdate": true,
+          "default": "(now())"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "users_id": {
+          "name": "users_id",
+          "columns": [
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {
+        "users_email_unique": {
+          "name": "users_email_unique",
+          "columns": [
+            "email"
+          ]
+        }
+      },
+      "checkConstraint": {}
+    }
+  },
+  "views": {},
+  "_meta": {
+    "schemas": {},
+    "tables": {},
+    "columns": {}
+  },
+  "internal": {
+    "tables": {},
+    "indexes": {}
+  }
+}

server/database/migrations/meta/_journal.json

@@ -22,6 +22,20 @@
       "when": 1784694350192,
       "tag": "0002_small_black_panther",
       "breakpoints": true
+    },
+    {
+      "idx": 3,
+      "version": "5",
+      "when": 1784704595989,
+      "tag": "0003_slow_masked_marvel",
+      "breakpoints": true
+    },
+    {
+      "idx": 4,
+      "version": "5",
+      "when": 1784707891329,
+      "tag": "0004_opposite_sasquatch",
+      "breakpoints": true
     }
   ]
 }

server/database/schema.ts

@@ -1,5 +1,17 @@
 import { mysqlTable, varchar, text, int, boolean, timestamp, json } from 'drizzle-orm/mysql-core'
 
+export const users = mysqlTable('users', {
+  id: int('id').primaryKey().autoincrement(),
+  name: varchar('name', { length: 200 }),
+  email: varchar('email', { length: 255 }).notNull().unique(),
+  password: varchar('password', { length: 255 }).notNull(),
+  role: varchar('role', { length: 50 }).notNull().default('user'),
+  avatar: text('avatar'),
+  active: boolean('active').notNull().default(true),
+  createdAt: timestamp('created_at').notNull().defaultNow(),
+  updatedAt: timestamp('updated_at').notNull().defaultNow().onUpdateNow(),
+})
+
 export const movies = mysqlTable('movies', {
   id: int('id').primaryKey().autoincrement(),
   source: varchar('source', { length: 50 }).notNull(),
@@ -24,10 +36,13 @@ export const movies = mysqlTable('movies', {
   customContent: text('custom_content'),
   customEpisodes: json('custom_episodes').$type<{ name: string, linkEmbed?: string, linkM3u8?: string }[]>(),
   active: boolean('active').notNull().default(false),
+  apiUpdatedAt: timestamp('api_updated_at'),
   syncedAt: timestamp('synced_at').notNull().defaultNow(),
   createdAt: timestamp('created_at').notNull().defaultNow(),
   updatedAt: timestamp('updated_at').notNull().defaultNow().onUpdateNow(),
 })
 
+export type User = typeof users.$inferSelect
+export type NewUser = typeof users.$inferInsert
 export type Movie = typeof movies.$inferSelect
 export type NewMovie = typeof movies.$inferInsert

server/middleware/auth.ts

@@ -0,0 +1,23 @@
+import { getTokenFromEvent, verifyToken } from '../utils/auth'
+
+export default defineEventHandler((event) => {
+  const path = event.path || event.node?.req?.url || ''
+
+  if (!path.startsWith('/api/admin')) return
+
+  const token = getTokenFromEvent(event)
+  if (!token) {
+    throw createError({ statusCode: 401, message: 'Chưa đăng nhập' })
+  }
+
+  const payload = verifyToken(token)
+  if (!payload) {
+    throw createError({ statusCode: 401, message: 'Phiên đăng nhập hết hạn' })
+  }
+
+  if (payload.role !== 'admin') {
+    throw createError({ statusCode: 403, message: 'Không có quyền truy cập' })
+  }
+
+  event.context.user = payload
+})

server/utils/auth.ts

@@ -0,0 +1,46 @@
+import bcrypt from 'bcryptjs'
+import jwt from 'jsonwebtoken'
+
+const JWT_SECRET = process.env.JWT_SECRET || 'cinek-secret-key-change-in-production-2024'
+const JWT_EXPIRES = '7d'
+const SALT_ROUNDS = 10
+
+export async function hashPassword(password: string): Promise<string> {
+  return bcrypt.hash(password, SALT_ROUNDS)
+}
+
+export async function verifyPassword(password: string, hash: string): Promise<boolean> {
+  return bcrypt.compare(password, hash)
+}
+
+export function signToken(payload: { id: number, email: string, role: string }): string {
+  return jwt.sign(payload, JWT_SECRET, { expiresIn: JWT_EXPIRES })
+}
+
+export function verifyToken(token: string): { id: number, email: string, role: string } | null {
+  try {
+    return jwt.verify(token, JWT_SECRET) as { id: number, email: string, role: string }
+  } catch {
+    return null
+  }
+}
+
+export function getTokenFromEvent(event: any): string | null {
+  const authHeader = getHeader(event, 'authorization')
+  if (authHeader?.startsWith('Bearer ')) {
+    return authHeader.slice(7)
+  }
+
+  const cookies = parseCookies(event)
+  return cookies.token || null
+}
+
+function parseCookies(event: any): Record<string, string> {
+  const cookieHeader = getHeader(event, 'cookie') || ''
+  const cookies: Record<string, string> = {}
+  cookieHeader.split(';').forEach((pair: string) => {
+    const [key, ...vals] = pair.trim().split('=')
+    if (key) cookies[key] = decodeURIComponent(vals.join('='))
+  })
+  return cookies
+}