26 lines
1.0 KiB
TypeScript
26 lines
1.0 KiB
TypeScript
// GET /api/auth/login/oidc — OIDC SSO 重定向
|
||
import { NextResponse } from 'next/server'
|
||
import { generatePkce, generateState, buildAuthorizeUrl } from '@shared/lib/auth/oidc'
|
||
import { authConfig } from '@/lib/auth-config'
|
||
|
||
export async function GET() {
|
||
const { codeVerifier, codeChallenge } = generatePkce()
|
||
const state = generateState()
|
||
const nonce = generateState()
|
||
|
||
const url = buildAuthorizeUrl(
|
||
{ autheliaUrl: authConfig.autheliaUrl, clientId: authConfig.oidcClientId, clientSecret: authConfig.oidcClientSecret, redirectUri: authConfig.oidcRedirectUri },
|
||
{ codeChallenge, state, nonce },
|
||
)
|
||
|
||
const response = NextResponse.redirect(url)
|
||
|
||
// 存储 PKCE 参数到 httpOnly cookie（5 分钟过期）
|
||
const cookieOpts = { httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax' as const, maxAge: 300, path: '/' }
|
||
response.cookies.set('oidc_code_verifier', codeVerifier, cookieOpts)
|
||
response.cookies.set('oidc_state', state, cookieOpts)
|
||
response.cookies.set('oidc_nonce', nonce, cookieOpts)
|
||
|
||
return response
|
||
}
|