28 lines
1.1 KiB
TypeScript
28 lines
1.1 KiB
TypeScript
// GET /api/auth/callback — OIDC callback（V2：OA 签发 tlyq_session）
|
||
import { NextRequest } from 'next/server'
|
||
import { handleOidcCallback } from '@shared/lib/auth/handle-callback'
|
||
import { ldapUserExists } from '@/lib/ldap'
|
||
|
||
const autheliaUrl = process.env.AUTHELIA_URL || 'https://sso.tlyq.ai'
|
||
const oidcClientId = process.env.OIDC_CLIENT_ID || 'oa-oidc'
|
||
const oidcClientSecret = process.env.OIDC_CLIENT_SECRET || ''
|
||
const oidcRedirectUri = process.env.OIDC_REDIRECT_URI || 'https://oa.tlyq.ai/api/auth/callback'
|
||
const jwtSecret = process.env.JWT_SECRET || 'oa-shared-jwt-secret-tlyq-2026'
|
||
const cookieDomain = process.env.COOKIE_DOMAIN || '.tlyq.ai'
|
||
|
||
export async function GET(request: NextRequest) {
|
||
return handleOidcCallback(request, {
|
||
oidc: { autheliaUrl, clientId: oidcClientId, clientSecret: oidcClientSecret, redirectUri: oidcRedirectUri },
|
||
jwtSecret,
|
||
cookieDomain,
|
||
|
||
// 强制验证 LLDAP 存在性（违反 §2.3 的旧行为已修正）
|
||
getUser: async (username) => {
|
||
const exists = await ldapUserExists(username)
|
||
return exists ? { id: -1, role: 'admin' } : null
|
||
},
|
||
|
||
// OA 不通过 OIDC 创建/更新用户
|
||
})
|
||
}
|