From 5cd300bee85906953b230751cc4810a11e51a80d Mon Sep 17 00:00:00 2001
From: aiyimickey <39365912+aiyimickey@users.noreply.github.com>
Date: Wed, 1 Jul 2026 22:33:34 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20callback=20=E6=89=80=E6=9C=89=E9=87=8D?=
 =?UTF-8?q?=E5=AE=9A=E5=90=91=E4=BD=BF=E7=94=A8=20baseUrl=EF=BC=88LESSONS-?=
 =?UTF-8?q?LEARNED=20#16=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/app/api/auth/callback/route.ts | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/src/app/api/auth/callback/route.ts b/src/app/api/auth/callback/route.ts
index a4edcbd..dfd99d2 100644
--- a/src/app/api/auth/callback/route.ts
+++ b/src/app/api/auth/callback/route.ts
@@ -13,24 +13,27 @@ export async function GET(request: NextRequest) {
   const state = searchParams.get('state')
   const error = searchParams.get('error')
 
+  // 使用 OIDC_REDIRECT_URI 构造公共 URL（LESSONS-LEARNED #16）
+  const baseUrl = authConfig.oidcRedirectUri?.replace(/\/api\/auth\/callback.*/, '') || 'http://localhost:6181'
+
   if (error) {
-    return NextResponse.redirect(new URL(`/login?error=${encodeURIComponent(error)}`, request.url))
+    return NextResponse.redirect(new URL(`/login?error=${encodeURIComponent(error)}`, baseUrl))
   }
 
   if (!code || !state) {
-    return NextResponse.redirect(new URL('/login?error=missing_params', request.url))
+    return NextResponse.redirect(new URL('/login?error=missing_params', baseUrl))
   }
 
   // 验证 state
   const savedState = request.cookies.get('oidc_state')?.value
   if (!savedState || savedState !== state) {
-    return NextResponse.redirect(new URL('/login?error=state_mismatch', request.url))
+    return NextResponse.redirect(new URL('/login?error=state_mismatch', baseUrl))
   }
 
   // 取出 code_verifier
   const codeVerifier = request.cookies.get('oidc_code_verifier')?.value
   if (!codeVerifier) {
-    return NextResponse.redirect(new URL('/login?error=missing_verifier', request.url))
+    return NextResponse.redirect(new URL('/login?error=missing_verifier', baseUrl))
   }
 
   // 换取 token
@@ -40,13 +43,13 @@ export async function GET(request: NextRequest) {
   )
 
   if (!tokenResult.success) {
-    return NextResponse.redirect(new URL(`/login?error=${encodeURIComponent(tokenResult.error || 'token_exchange_failed')}`, request.url))
+    return NextResponse.redirect(new URL(`/login?error=${encodeURIComponent(tokenResult.error || 'token_exchange_failed')}`, baseUrl))
   }
 
   // 验证 nonce
   const savedNonce = request.cookies.get('oidc_nonce')?.value
   if (savedNonce && tokenResult.nonce && savedNonce !== tokenResult.nonce) {
-    return NextResponse.redirect(new URL('/login?error=nonce_mismatch', request.url))
+    return NextResponse.redirect(new URL('/login?error=nonce_mismatch', baseUrl))
   }
 
   // 获取 userinfo
@@ -74,9 +77,6 @@ export async function GET(request: NextRequest) {
     payload: { username: userinfo.preferred_username, displayName: userinfo.name, role: user.role },
   })
 
-  // 使用 OIDC_REDIRECT_URI 构造公共 URL（LESSONS-LEARNED #16）
-  const baseUrl = authConfig.oidcRedirectUri?.replace(/\/api\/auth\/callback.*/, '') || 'http://localhost:6181'
-
   const response = NextResponse.redirect(new URL('/', baseUrl))
 
   // 签发 tlyq_session cookie