diff --git a/web/src/components/auth/OAuth2Callback.jsx b/web/src/components/auth/OAuth2Callback.jsx
index 55a85c6b14a5..68b793f0de50 100644
--- a/web/src/components/auth/OAuth2Callback.jsx
+++ b/web/src/components/auth/OAuth2Callback.jsx
@@ -35,17 +35,67 @@ const OAuth2Callback = (props) => {
const [searchParams] = useSearchParams();
const [, userDispatch] = useContext(UserContext);
const navigate = useNavigate();
-
+
// 防止 React 18 Strict Mode 下重复执行
const hasExecuted = useRef(false);
// 最大重试次数
const MAX_RETRIES = 3;
+ const getHashParams = () => {
+ const hash = window.location.hash.startsWith('#')
+ ? window.location.hash.slice(1)
+ : window.location.hash;
+ return new URLSearchParams(hash);
+ };
+
+ const getStoredCustomProvider = () => {
+ try {
+ const statusStr = localStorage.getItem('status');
+ if (!statusStr) return null;
+ const status = JSON.parse(statusStr);
+ const customProviders = Array.isArray(status.custom_oauth_providers)
+ ? status.custom_oauth_providers
+ : [];
+ return customProviders.find(
+ (provider) => provider.slug === props.type,
+ );
+ } catch (error) {
+ return null;
+ }
+ };
+
+ const pickFirstParamValue = (query, hash, keys) => {
+ for (const key of keys) {
+ const queryValue = query.get(key);
+ if (queryValue) return queryValue;
+ const hashValue = hash.get(key);
+ if (hashValue) return hashValue;
+ }
+ return '';
+ };
+
+ const handleCallbackSuccess = (data) => {
+ if (data?.action === 'bind') {
+ showSuccess(t('绑定成功！'));
+ navigate('/console/personal');
+ return;
+ }
+
+ userDispatch({ type: 'login', payload: data });
+ setUserData(data);
+ updateAPI();
+ showSuccess(t('登录成功！'));
+ navigate('/console/token');
+ };
+
const sendCode = async (code, state, retry = 0) => {
try {
const { data: resData } = await API.get(
`/api/oauth/${props.type}?code=${code}&state=${state}`,
+ {
+ skipErrorHandler: true,
+ },
);
const { success, message, data } = resData;
@@ -56,17 +106,7 @@ const OAuth2Callback = (props) => {
return;
}
- if (data?.action === 'bind') {
- showSuccess(t('绑定成功！'));
- navigate('/console/personal');
- } else {
- userDispatch({ type: 'login', payload: data });
- localStorage.setItem('user', JSON.stringify(data));
- setUserData(data);
- updateAPI();
- showSuccess(t('登录成功！'));
- navigate('/console/token');
- }
+ handleCallbackSuccess(data);
} catch (error) {
// 网络错误等可重试
if (retry < MAX_RETRIES) {
@@ -81,6 +121,35 @@ const OAuth2Callback = (props) => {
}
};
+ const submitJWTLogin = async (payload, retry = 0) => {
+ try {
+ const { data: resData } = await API.post(
+ `/api/auth/external/${props.type}/jwt/login`,
+ payload,
+ {
+ skipErrorHandler: true,
+ },
+ );
+
+ const { success, message, data } = resData;
+ if (!success) {
+ showError(message || t('授权失败'));
+ navigate('/console/personal');
+ return;
+ }
+
+ handleCallbackSuccess(data);
+ } catch (error) {
+ if (retry < MAX_RETRIES) {
+ await new Promise((resolve) => setTimeout(resolve, (retry + 1) * 2000));
+ return submitJWTLogin(payload, retry + 1);
+ }
+
+ showError(error.message || t('授权失败'));
+ navigate('/console/personal');
+ }
+ };
+
useEffect(() => {
// 防止 React 18 Strict Mode 下重复执行
if (hasExecuted.current) {
@@ -88,6 +157,54 @@ const OAuth2Callback = (props) => {
}
hasExecuted.current = true;
+ const hashParams = getHashParams();
+ const customProvider = getStoredCustomProvider();
+ const providerKind = customProvider?.kind || 'oauth_code';
+ const errorDescription =
+ pickFirstParamValue(searchParams, hashParams, ['error_description']) ||
+ pickFirstParamValue(searchParams, hashParams, ['error']);
+
+ if (errorDescription) {
+ showError(errorDescription);
+ navigate('/console/personal');
+ return;
+ }
+
+ if (providerKind === 'jwt_direct') {
+ const jwtAcquireMode = customProvider?.jwt_acquire_mode || 'direct_token';
+ const state = pickFirstParamValue(searchParams, hashParams, ['state']);
+
+ if (['ticket_exchange', 'ticket_validate'].includes(jwtAcquireMode)) {
+ const ticket = pickFirstParamValue(searchParams, hashParams, [
+ 'ticket',
+ 'st',
+ ]);
+ if (!ticket) {
+ showError(t('未获取到登录票据'));
+ navigate('/console/personal');
+ return;
+ }
+
+ submitJWTLogin({ state, ticket });
+ return;
+ }
+
+ const jwtToken = pickFirstParamValue(searchParams, hashParams, [
+ 'id_token',
+ 'token',
+ 'jwt',
+ 'access_token',
+ ]);
+ if (!jwtToken) {
+ showError(t('未获取到 JWT 令牌'));
+ navigate('/console/personal');
+ return;
+ }
+
+ submitJWTLogin({ state, id_token: jwtToken });
+ return;
+ }
+
const code = searchParams.get('code');
const state = searchParams.get('state');
diff --git a/web/src/components/auth/RegisterForm.jsx b/web/src/components/auth/RegisterForm.jsx
index 0a755b194431..462ad713f0e9 100644
--- a/web/src/components/auth/RegisterForm.jsx
+++ b/web/src/components/auth/RegisterForm.jsx
@@ -129,8 +129,13 @@ const RegisterForm = () => {
return {};
}
}, [statusState?.status]);
+ const customOAuthProviders = Array.isArray(status.custom_oauth_providers)
+ ? status.custom_oauth_providers
+ : [];
const hasCustomOAuthProviders =
- (status.custom_oauth_providers || []).length > 0;
+ customOAuthProviders.some(
+ (provider) => provider.browser_login_supported !== false,
+ );
const hasOAuthRegisterOptions = Boolean(
status.github_oauth ||
status.discord_oauth ||
@@ -494,22 +499,24 @@ const RegisterForm = () => {
)}
- {status.custom_oauth_providers &&
- status.custom_oauth_providers.map((provider) => (
-
- ))}
+ {customOAuthProviders.length > 0 &&
+ customOAuthProviders
+ .filter((provider) => provider.browser_login_supported !== false)
+ .map((provider) => (
+
+ ))}
{status.telegram_oauth && (
diff --git a/web/src/components/settings/CustomOAuthSetting.jsx b/web/src/components/settings/CustomOAuthSetting.jsx
index 0912160bee5d..7ff1d53bcfff 100644
--- a/web/src/components/settings/CustomOAuthSetting.jsx
+++ b/web/src/components/settings/CustomOAuthSetting.jsx
@@ -40,7 +40,12 @@ import {
IconDelete,
IconRefresh,
} from '@douyinfe/semi-icons';
-import { API, showError, showSuccess, getOAuthProviderIcon } from '../../helpers';
+import {
+ API,
+ showError,
+ showSuccess,
+ getOAuthProviderIcon,
+} from '../../helpers';
import { useTranslation } from 'react-i18next';
const { Text } = Typography;
@@ -156,15 +161,65 @@ const PRESET_RESET_VALUES = {
access_denied_message: '',
};
+const CUSTOM_OAUTH_KIND_OPTIONS = [
+ { value: 'oauth_code', label: 'OAuth 2.0 / OIDC 授权码模式' },
+ { value: 'jwt_direct', label: 'JWT 直连登录' },
+];
+
+const JWT_SOURCE_OPTIONS = [
+ { value: 'query', label: '查询参数' },
+ { value: 'fragment', label: 'URL 片段' },
+ { value: 'body', label: '请求体（仅 API）' },
+];
+
+const JWT_ACQUIRE_MODE_OPTIONS = [
+ { value: 'direct_token', label: '直接回调 JWT' },
+ { value: 'ticket_exchange', label: '票据换取 JWT' },
+ { value: 'ticket_validate', label: '票据校验（CAS serviceValidate）' },
+];
+
+const JWT_IDENTITY_MODE_OPTIONS = [
+ { value: 'claims', label: '本地验签并解析 JWT Claims' },
+ { value: 'userinfo', label: '通过用户信息端点解析身份' },
+];
+
+const TICKET_EXCHANGE_METHOD_OPTIONS = [
+ { value: 'GET', label: 'GET' },
+ { value: 'POST', label: 'POST' },
+];
+
+const TICKET_EXCHANGE_PAYLOAD_MODE_OPTIONS = [
+ { value: 'query', label: '查询字符串' },
+ { value: 'form', label: '表单 URL 编码' },
+ { value: 'json', label: 'JSON 请求体' },
+ { value: 'multipart', label: 'Multipart 表单' },
+];
+
+const JWT_MAPPING_MODE_OPTIONS = [
+ { value: 'explicit_only', label: '仅显式映射' },
+ { value: 'mapping_first', label: '映射优先，其次透传' },
+];
+
const DISCOVERY_FIELD_LABELS = {
- authorization_endpoint: 'Authorization Endpoint',
- token_endpoint: 'Token Endpoint',
- user_info_endpoint: 'User Info Endpoint',
- scopes: 'Scopes',
- user_id_field: 'User ID Field',
- username_field: 'Username Field',
- display_name_field: 'Display Name Field',
- email_field: 'Email Field',
+ authorization_endpoint: '授权端点',
+ token_endpoint: '令牌端点',
+ user_info_endpoint: '用户信息端点',
+ scopes: '作用域',
+ user_id_field: '用户 ID 字段',
+ username_field: '用户名字段',
+ display_name_field: '显示名称字段',
+ email_field: '邮箱字段',
+};
+
+const REQUIRED_FIELD_LABELS = {
+ name: '显示名称',
+ slug: 'Slug',
+ client_id: '客户端 ID',
+ client_secret: '客户端密钥',
+ authorization_endpoint: '授权端点',
+ token_endpoint: '令牌端点',
+ user_info_endpoint: '用户信息端点',
+ issuer: '发行者',
};
const ACCESS_POLICY_TEMPLATES = {
@@ -185,8 +240,17 @@ const ACCESS_POLICY_TEMPLATES = {
};
const ACCESS_DENIED_TEMPLATES = {
- level_hint: '需要等级 {{required}}，你当前等级 {{current}}（字段：{{field}}）',
- org_hint: '仅限指定组织或角色访问。组织={{current.org}}，角色={{current.roles}}',
+ level_hint:
+ '需要等级 {{required}}，你当前等级 {{current}}（字段：{{field}}）',
+ org_hint:
+ '仅限指定组织或角色访问。组织={{current.org}}，角色={{current.roles}}',
+};
+
+const TICKET_VALIDATE_SUGGESTED_FIELDS = {
+ user_id_field: 'authenticationSuccess.user',
+ username_field: 'authenticationSuccess.attributes.loginid',
+ display_name_field: 'authenticationSuccess.attributes.userName',
+ email_field: 'authenticationSuccess.attributes.mailbox',
};
const CustomOAuthSetting = ({ serverAddress }) => {
@@ -201,7 +265,57 @@ const CustomOAuthSetting = ({ serverAddress }) => {
const [discoveryLoading, setDiscoveryLoading] = useState(false);
const [discoveryInfo, setDiscoveryInfo] = useState(null);
const [advancedActiveKeys, setAdvancedActiveKeys] = useState([]);
+ const [clientSecretDirty, setClientSecretDirty] = useState(false);
+ const [clearClientSecret, setClearClientSecret] = useState(false);
const formApiRef = React.useRef(null);
+ const customOAuthKindOptions = CUSTOM_OAUTH_KIND_OPTIONS.map((option) => ({
+ ...option,
+ label: t(option.label),
+ }));
+ const jwtSourceOptions = JWT_SOURCE_OPTIONS.map((option) => ({
+ ...option,
+ label: t(option.label),
+ }));
+ const jwtAcquireModeOptions = JWT_ACQUIRE_MODE_OPTIONS.map((option) => ({
+ ...option,
+ label: t(option.label),
+ }));
+ const jwtIdentityModeOptions = JWT_IDENTITY_MODE_OPTIONS.map((option) => ({
+ ...option,
+ label: t(option.label),
+ }));
+ const ticketExchangeMethodOptions = TICKET_EXCHANGE_METHOD_OPTIONS.map(
+ (option) => ({
+ ...option,
+ label: t(option.label),
+ }),
+ );
+ const ticketExchangePayloadModeOptions =
+ TICKET_EXCHANGE_PAYLOAD_MODE_OPTIONS.map((option) => ({
+ ...option,
+ label: t(option.label),
+ }));
+ const jwtMappingModeOptions = JWT_MAPPING_MODE_OPTIONS.map((option) => ({
+ ...option,
+ label: t(option.label),
+ }));
+ const discoveryFieldLabels = Object.fromEntries(
+ Object.entries(DISCOVERY_FIELD_LABELS).map(([field, label]) => [
+ field,
+ t(label),
+ ]),
+ );
+ const currentProviderKind = formValues.kind || 'oauth_code';
+ const isJWTDirect = currentProviderKind === 'jwt_direct';
+ const currentJWTIdentityMode = formValues.jwt_identity_mode || 'claims';
+ const currentJWTAcquireMode = formValues.jwt_acquire_mode || 'direct_token';
+ const isJWTTicketExchange =
+ isJWTDirect && currentJWTAcquireMode === 'ticket_exchange';
+ const isJWTTicketValidateMode =
+ isJWTDirect && currentJWTAcquireMode === 'ticket_validate';
+ const isJWTTicketBasedMode = isJWTTicketExchange || isJWTTicketValidateMode;
+ const isJWTUserInfoMode =
+ isJWTDirect && currentJWTIdentityMode === 'userinfo';
const mergeFormValues = (newValues) => {
setFormValues((prev) => ({ ...prev, ...newValues }));
@@ -216,10 +330,27 @@ const CustomOAuthSetting = ({ serverAddress }) => {
return values && typeof values === 'object' ? values : formValues;
};
+ const applyTicketValidateSuggestions = (values = {}) => {
+ const nextValues = {};
+ Object.entries(TICKET_VALIDATE_SUGGESTED_FIELDS).forEach(
+ ([field, suggestedValue]) => {
+ const currentValue = (values[field] ?? formValues[field] ?? '').trim();
+ if (
+ !currentValue ||
+ ['sub', 'preferred_username', 'name', 'email'].includes(currentValue)
+ ) {
+ nextValues[field] = suggestedValue;
+ }
+ },
+ );
+ return nextValues;
+ };
+
const normalizeBaseUrl = (url) => (url || '').trim().replace(/\/+$/, '');
const inferBaseUrlFromProvider = (provider) => {
- const endpoint = provider?.authorization_endpoint || provider?.token_endpoint;
+ const endpoint =
+ provider?.authorization_endpoint || provider?.token_endpoint;
if (!endpoint) return '';
try {
const url = new URL(endpoint);
@@ -237,6 +368,8 @@ const CustomOAuthSetting = ({ serverAddress }) => {
setModalVisible(false);
resetDiscoveryState();
setAdvancedActiveKeys([]);
+ setClientSecretDirty(false);
+ setClearClientSecret(false);
};
const fetchProviders = async () => {
@@ -261,13 +394,32 @@ const CustomOAuthSetting = ({ serverAddress }) => {
const handleAdd = () => {
setEditingProvider(null);
setFormValues({
+ kind: 'oauth_code',
enabled: false,
icon: '',
scopes: 'openid profile email',
+ jwt_source: 'query',
+ jwt_identity_mode: 'claims',
+ jwt_acquire_mode: 'direct_token',
+ jwt_header: 'Authorization',
+ authorization_service_field: 'service',
+ ticket_exchange_method: 'GET',
+ ticket_exchange_payload_mode: 'query',
+ ticket_exchange_ticket_field: 'ticket',
+ ticket_exchange_token_field: '',
+ ticket_exchange_service_field: '',
+ ticket_exchange_extra_params: '',
+ ticket_exchange_headers: '',
user_id_field: 'sub',
username_field: 'preferred_username',
display_name_field: 'name',
email_field: 'email',
+ auto_register: false,
+ auto_merge_by_email: false,
+ sync_group_on_login: false,
+ sync_role_on_login: false,
+ group_mapping_mode: 'explicit_only',
+ role_mapping_mode: 'explicit_only',
auth_style: 0,
access_policy: '',
access_denied_message: '',
@@ -276,16 +428,43 @@ const CustomOAuthSetting = ({ serverAddress }) => {
setBaseUrl('');
resetDiscoveryState();
setAdvancedActiveKeys([]);
+ setClientSecretDirty(false);
+ setClearClientSecret(false);
setModalVisible(true);
};
const handleEdit = (provider) => {
setEditingProvider(provider);
- setFormValues({ ...provider });
+ setFormValues({
+ ...provider,
+ kind: provider.kind || 'oauth_code',
+ jwt_source: provider.jwt_source || 'query',
+ jwt_header: provider.jwt_header || 'Authorization',
+ jwt_identity_mode: provider.jwt_identity_mode || 'claims',
+ jwt_acquire_mode: provider.jwt_acquire_mode || 'direct_token',
+ authorization_service_field:
+ provider.authorization_service_field || 'service',
+ ticket_exchange_method: provider.ticket_exchange_method || 'GET',
+ ticket_exchange_payload_mode:
+ provider.ticket_exchange_payload_mode || 'query',
+ ticket_exchange_ticket_field:
+ provider.ticket_exchange_ticket_field || 'ticket',
+ ticket_exchange_token_field: provider.ticket_exchange_token_field || '',
+ ticket_exchange_service_field:
+ provider.ticket_exchange_service_field || '',
+ ticket_exchange_extra_params: provider.ticket_exchange_extra_params || '',
+ ticket_exchange_headers: provider.ticket_exchange_headers || '',
+ sync_group_on_login: !!provider.sync_group_on_login,
+ sync_role_on_login: !!provider.sync_role_on_login,
+ group_mapping_mode: provider.group_mapping_mode || 'explicit_only',
+ role_mapping_mode: provider.role_mapping_mode || 'explicit_only',
+ });
setSelectedPreset(OAUTH_PRESETS[provider.slug] ? provider.slug : '');
setBaseUrl(inferBaseUrlFromProvider(provider));
resetDiscoveryState();
setAdvancedActiveKeys([]);
+ setClientSecretDirty(false);
+ setClearClientSecret(false);
setModalVisible(true);
};
@@ -305,38 +484,93 @@ const CustomOAuthSetting = ({ serverAddress }) => {
const handleSubmit = async () => {
const currentValues = getLatestFormValues();
+ const providerKind = currentValues.kind || 'oauth_code';
+
+ const requiredFields = ['name', 'slug'];
+ if (providerKind === 'oauth_code') {
+ requiredFields.push(
+ 'client_id',
+ 'authorization_endpoint',
+ 'token_endpoint',
+ 'user_info_endpoint',
+ );
- // Validate required fields
- const requiredFields = [
- 'name',
- 'slug',
- 'client_id',
- 'authorization_endpoint',
- 'token_endpoint',
- 'user_info_endpoint',
- ];
-
- if (!editingProvider) {
- requiredFields.push('client_secret');
+ if (!editingProvider) {
+ requiredFields.push('client_secret');
+ }
+ } else {
+ const acquireMode = currentValues.jwt_acquire_mode || 'direct_token';
+ const identityMode = currentValues.jwt_identity_mode || 'claims';
+ if (acquireMode === 'ticket_validate' && identityMode !== 'claims') {
+ showError(
+ t('Ticket Validation 模式仅支持 claims 身份解析方式'),
+ );
+ return;
+ }
+ if (identityMode === 'userinfo') {
+ requiredFields.push('user_info_endpoint');
+ } else if (acquireMode !== 'ticket_validate') {
+ requiredFields.push('issuer');
+ if (!currentValues.jwks_url && !currentValues.public_key) {
+ showError(t('JWT 直连至少需要配置 JWKS URL 或公钥'));
+ return;
+ }
+ }
+ if (
+ ['ticket_exchange', 'ticket_validate'].includes(acquireMode) &&
+ !currentValues.ticket_exchange_url
+ ) {
+ showError(t('票据处理模式必须填写 Ticket Processing URL'));
+ return;
+ }
+ if (
+ ['ticket_exchange', 'ticket_validate'].includes(acquireMode) &&
+ currentValues.ticket_exchange_url &&
+ !currentValues.ticket_exchange_url.startsWith('http://') &&
+ !currentValues.ticket_exchange_url.startsWith('https://')
+ ) {
+ showError(t('票据处理模式必须填写有效的 Ticket Processing URL'));
+ return;
+ }
}
for (const field of requiredFields) {
if (!currentValues[field]) {
- showError(t(`请填写 ${field}`));
+ const fieldLabel = REQUIRED_FIELD_LABELS[field] || field;
+ showError(
+ t('请填写 {{fieldLabel}}', {
+ fieldLabel: t(fieldLabel),
+ }),
+ );
return;
}
}
- // Validate endpoint URLs must be full URLs
- const endpointFields = ['authorization_endpoint', 'token_endpoint', 'user_info_endpoint'];
+ const endpointFields =
+ providerKind === 'oauth_code'
+ ? ['authorization_endpoint', 'token_endpoint', 'user_info_endpoint']
+ : [
+ 'authorization_endpoint',
+ ...(currentValues.jwt_identity_mode === 'userinfo'
+ ? ['user_info_endpoint']
+ : currentValues.jwt_acquire_mode === 'ticket_validate'
+ ? []
+ : ['issuer', 'jwks_url']),
+ ];
for (const field of endpointFields) {
const value = currentValues[field];
- if (value && !value.startsWith('http://') && !value.startsWith('https://')) {
+ if (
+ value &&
+ !value.startsWith('http://') &&
+ !value.startsWith('https://')
+ ) {
// Check if user selected a preset but forgot to fill issuer URL
- if (selectedPreset && !baseUrl) {
- showError(t('请先填写 Issuer URL，以自动生成完整的端点 URL'));
+ if (providerKind === 'oauth_code' && selectedPreset && !baseUrl) {
+ showError(t('请先填写发行者 URL，以自动生成完整的端点 URL'));
} else {
- showError(t('端点 URL 必须是完整地址（以 http:// 或 https:// 开头）'));
+ showError(
+ t('端点 URL 必须是完整地址（以 http:// 或 https:// 开头）'),
+ );
}
return;
}
@@ -346,12 +580,46 @@ const CustomOAuthSetting = ({ serverAddress }) => {
const payload = { ...currentValues, enabled: !!currentValues.enabled };
delete payload.preset;
delete payload.base_url;
+ if (editingProvider) {
+ if (clearClientSecret) {
+ payload.client_secret = '';
+ } else if (!clientSecretDirty || payload.client_secret === '') {
+ delete payload.client_secret;
+ }
+ }
+ if (editingProvider) {
+ const hiddenJWTSecretFields = [
+ 'ticket_exchange_extra_params',
+ 'ticket_exchange_headers',
+ ];
+ hiddenJWTSecretFields.forEach((field) => {
+ if (
+ editingProvider[field] === undefined &&
+ payload[field] === ''
+ ) {
+ delete payload[field];
+ }
+ });
+ }
+ if (providerKind !== 'jwt_direct') {
+ delete payload.jwt_identity_mode;
+ delete payload.jwt_acquire_mode;
+ delete payload.authorization_service_field;
+ delete payload.ticket_exchange_url;
+ delete payload.ticket_exchange_method;
+ delete payload.ticket_exchange_payload_mode;
+ delete payload.ticket_exchange_ticket_field;
+ delete payload.ticket_exchange_token_field;
+ delete payload.ticket_exchange_service_field;
+ delete payload.ticket_exchange_extra_params;
+ delete payload.ticket_exchange_headers;
+ }
let res;
if (editingProvider) {
res = await API.put(
`/api/custom-oauth-provider/${editingProvider.id}`,
- payload
+ payload,
);
} else {
res = await API.post('/api/custom-oauth-provider/', payload);
@@ -372,6 +640,11 @@ const CustomOAuthSetting = ({ serverAddress }) => {
}
};
+ const issuerRules =
+ isJWTUserInfoMode || isJWTTicketValidateMode
+ ? []
+ : [{ required: true, message: t('请输入发行者') }];
+
const handleFetchFromDiscovery = async () => {
const cleanBaseUrl = normalizeBaseUrl(baseUrl);
const configuredWellKnown = (formValues.well_known || '').trim();
@@ -380,7 +653,7 @@ const CustomOAuthSetting = ({ serverAddress }) => {
(cleanBaseUrl ? `${cleanBaseUrl}/.well-known/openid-configuration` : '');
if (!wellKnownUrl) {
- showError(t('请先填写 Discovery URL 或 Issuer URL'));
+ showError(t('请先填写 Discovery URL 或发行者 URL'));
return;
}
@@ -542,7 +815,17 @@ const CustomOAuthSetting = ({ serverAddress }) => {
key: 'name',
},
{
- title: 'Slug',
+ title: t('类型'),
+ dataIndex: 'kind',
+ key: 'kind',
+ render: (kind) => (
+
+ {kind === 'jwt_direct' ? t('JWT 直连') : t('OAuth 授权码')}
+
+ ),
+ },
+ {
+ title: t('标识符 (Slug)'),
dataIndex: 'slug',
key: 'slug',
render: (slug) =>
{slug},
@@ -558,7 +841,7 @@ const CustomOAuthSetting = ({ serverAddress }) => {
),
},
{
- title: t('Client ID'),
+ title: t('客户端 ID'),
dataIndex: 'client_id',
key: 'client_id',
render: (id) => {
@@ -573,7 +856,7 @@ const CustomOAuthSetting = ({ serverAddress }) => {
}
- size="small"
+ size='small'
onClick={() => handleEdit(record)}
>
{t('编辑')}
@@ -582,7 +865,7 @@ const CustomOAuthSetting = ({ serverAddress }) => {
title={t('确定要删除此 OAuth 提供商吗？')}
onConfirm={() => handleDelete(record.id)}
>
- } size="small" type="danger">
+ } size='small' type='danger'>
{t('删除')}
@@ -592,22 +875,27 @@ const CustomOAuthSetting = ({ serverAddress }) => {
];
const discoveryAutoFilledLabels = (discoveryInfo?.autoFilledFields || [])
- .map((field) => DISCOVERY_FIELD_LABELS[field] || field)
+ .map((field) => discoveryFieldLabels[field] || field)
.join(', ');
return (
{t(
- '配置自定义 OAuth 提供商，支持 GitHub Enterprise、GitLab、Gitea、Nextcloud、Keycloak、ORY 等兼容 OAuth 2.0 协议的身份提供商'
+ '配置自定义外部身份提供商，支持 OAuth Code Flow 和 JWT Direct 两种接入模式',
)}
- {t('回调 URL 格式')}: {serverAddress || t('网站地址')}/oauth/
+ {t('浏览器回调 URL')}: {serverAddress || t('网站地址')}/oauth/
{'{slug}'}
+
+ {t('说明')}:{' '}
+ {t(
+ 'JWT Direct 支持 direct_token、ticket_exchange、ticket_validate 三种获取模式，并支持 claims 或 userinfo 两类身份解析方式',
+ )}
}
style={{ marginBottom: 20 }}
@@ -615,24 +903,24 @@ const CustomOAuthSetting = ({ serverAddress }) => {
}
- theme="solid"
+ theme='solid'
onClick={handleAdd}
style={{ marginBottom: 16 }}
>
- {t('添加 OAuth 提供商')}
+ {t('添加身份提供商')}
{
mergeFormValues({ enabled: !!checked })}
+ onChange={(checked) =>
+ mergeFormValues({ enabled: !!checked })
+ }
+ id='components-settings-customoauthsetting-switch-1'
/>
{formValues.enabled ? t('已启用') : t('已禁用')}
@@ -674,12 +965,33 @@ const CustomOAuthSetting = ({ serverAddress }) => {
getFormApi={(api) => (formApiRef.current = api)}
>
- {t('Configuration')}
+ {t('配置')}
-
- {t('先填写配置，再自动填充 OAuth 端点，能显著减少手工输入')}
+
+ {isJWTTicketExchange
+ ? t(
+ '浏览器回调页先接收 ticket，后端再向票据交换接口换取 JWT，并继续复用现有验签、映射、建号和绑定链路',
+ )
+ : isJWTTicketValidateMode
+ ? t(
+ '浏览器回调页先接收 ticket，后端再向票据校验接口取回身份声明，直接复用现有字段映射、建号和绑定链路',
+ )
+ : isJWTUserInfoMode
+ ? t(
+ 'JWT Direct 使用前端回调页接收 token，再由后端调用用户信息接口验证 token 并提取身份',
+ )
+ : isJWTDirect
+ ? t(
+ 'JWT Direct 使用前端回调页接收 JWT，再由后端完成验签、建号、绑定与登录',
+ )
+ : t(
+ '先填写配置，再自动填充 OAuth 端点，能显著减少手工输入',
+ )}
- {discoveryInfo && (
+ {!isJWTDirect && discoveryInfo && (
{
- {t('自动填充字段')}:
- {' '}
- {discoveryAutoFilledLabels}
+ {t('自动填充字段')}: {discoveryAutoFilledLabels}
) : null}
{discoveryInfo.scopesSupported?.length ? (
- {t('Discovery scopes')}:
- {' '}
+ {t('Discovery 建议 scopes')}:{' '}
{discoveryInfo.scopesSupported.join(', ')}
) : null}
{discoveryInfo.claimsSupported?.length ? (
- {t('Discovery claims')}:
- {' '}
+ {t('Discovery 建议 claims')}:{' '}
{discoveryInfo.claimsSupported.join(', ')}
) : null}
@@ -718,62 +1026,109 @@ const CustomOAuthSetting = ({ serverAddress }) => {