gaoxiaopei
/
monitor-ai
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: callback 所有重定向使用 baseUrl（LESSONS-LEARNED #16）

This commit is contained in:
aiyimickey 2026-07-01 22:33:34 +08:00
parent e6712a1e99
commit 5cd300bee8
1 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/app/api/auth/callback/route.ts
View File

@ -13,24 +13,27 @@ export async function GET(request: NextRequest) {
const state = searchParams.get('state')
const error = searchParams.get('error')
// 使用 OIDC_REDIRECT_URI 构造公共 URL（LESSONS-LEARNED #16）
const baseUrl = authConfig.oidcRedirectUri?.replace(/\/api\/auth\/callback.*/, '') || 'http://localhost:6181'
if (error) {
return NextResponse.redirect(new URL(`/login?error=${encodeURIComponent(error)}`, request.url))
return NextResponse.redirect(new URL(`/login?error=${encodeURIComponent(error)}`, baseUrl))
}
if (!code || !state) {
return NextResponse.redirect(new URL('/login?error=missing_params', request.url))
return NextResponse.redirect(new URL('/login?error=missing_params', baseUrl))
}
// 验证 state
const savedState = request.cookies.get('oidc_state')?.value
if (!savedState || savedState !== state) {
return NextResponse.redirect(new URL('/login?error=state_mismatch', request.url))
return NextResponse.redirect(new URL('/login?error=state_mismatch', baseUrl))
}
// 取出 code_verifier
const codeVerifier = request.cookies.get('oidc_code_verifier')?.value
if (!codeVerifier) {
return NextResponse.redirect(new URL('/login?error=missing_verifier', request.url))
return NextResponse.redirect(new URL('/login?error=missing_verifier', baseUrl))
}
// 换取 token
@ -40,13 +43,13 @@ export async function GET(request: NextRequest) {
)
if (!tokenResult.success) {
return NextResponse.redirect(new URL(`/login?error=${encodeURIComponent(tokenResult.error || 'token_exchange_failed')}`, request.url))
return NextResponse.redirect(new URL(`/login?error=${encodeURIComponent(tokenResult.error || 'token_exchange_failed')}`, baseUrl))
}
// 验证 nonce
const savedNonce = request.cookies.get('oidc_nonce')?.value
if (savedNonce && tokenResult.nonce && savedNonce !== tokenResult.nonce) {
return NextResponse.redirect(new URL('/login?error=nonce_mismatch', request.url))
return NextResponse.redirect(new URL('/login?error=nonce_mismatch', baseUrl))
}
// 获取 userinfo
@ -74,9 +77,6 @@ export async function GET(request: NextRequest) {
payload: { username: userinfo.preferred_username, displayName: userinfo.name, role: user.role },
})
// 使用 OIDC_REDIRECT_URI 构造公共 URL（LESSONS-LEARNED #16）
const baseUrl = authConfig.oidcRedirectUri?.replace(/\/api\/auth\/callback.*/, '') || 'http://localhost:6181'
const response = NextResponse.redirect(new URL('/', baseUrl))
// 签发 tlyq_session cookie