From df27929294090a83dfd064147ac5b8685fd5e740 Mon Sep 17 00:00:00 2001
From: aiyimickey <39365912+aiyimickey@users.noreply.github.com>
Date: Tue, 30 Jun 2026 17:09:31 +0800
Subject: [PATCH] =?UTF-8?q?feat:=20SSO=20=E7=BB=9F=E4=B8=80=E8=AE=A4?=
 =?UTF-8?q?=E8=AF=81=E7=99=BB=E5=BD=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 更新 deploy-ai.sh 添加 OIDC 环境变量自动配置
---
 deploy-ai.sh | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/deploy-ai.sh b/deploy-ai.sh
index 72a13ba..9af5dd8 100755
--- a/deploy-ai.sh
+++ b/deploy-ai.sh
@@ -352,6 +352,32 @@ build_on_server() {
 	    ssh txjp "grep -q 'AUTHELIA_URL' $REMOTE_DIR/.env 2>/dev/null \
 	        && sed -i 's|AUTHELIA_URL=.*|AUTHELIA_URL=https://sso.tlyq.ai|' $REMOTE_DIR/.env 2>/dev/null \
 	        || echo 'AUTHELIA_URL=https://sso.tlyq.ai' >> $REMOTE_DIR/.env"
+
+    # OIDC 环境变量配置（oa/assets/issue 站点）
+    if [[ "$SITE" == "oa" || "$SITE" == "assets" || "$SITE" == "issue" ]]; then
+        # 根据站点设置 OIDC 变量
+        case "$SITE" in
+            oa)     OIDC_ID="oa-oidc";     OIDC_URI="https://oa.tlyq.ai/api/auth/callback" ;;
+            assets) OIDC_ID="assets-oidc"; OIDC_URI="https://assets.tlyq.ai/api/auth/callback" ;;
+            issue)  OIDC_ID="issue-oidc";  OIDC_URI="https://issue.tlyq.ai/api/auth/callback" ;;
+        esac
+
+        # 确保 OIDC_CLIENT_ID 已设置
+        ssh txjp "grep -q 'OIDC_CLIENT_ID' $REMOTE_DIR/.env 2>/dev/null \
+            && sed -i 's|OIDC_CLIENT_ID=.*|OIDC_CLIENT_ID=${OIDC_ID}|' $REMOTE_DIR/.env 2>/dev/null \
+            || echo 'OIDC_CLIENT_ID=${OIDC_ID}' >> $REMOTE_DIR/.env"
+
+        # 确保 OIDC_REDIRECT_URI 已设置
+        ssh txjp "grep -q 'OIDC_REDIRECT_URI' $REMOTE_DIR/.env 2>/dev/null \
+            && sed -i 's|OIDC_REDIRECT_URI=.*|OIDC_REDIRECT_URI=${OIDC_URI}|' $REMOTE_DIR/.env 2>/dev/null \
+            || echo 'OIDC_REDIRECT_URI=${OIDC_URI}' >> $REMOTE_DIR/.env"
+
+        # 确保 OIDC_CLIENT_SECRET 已设置（从 Authelia 配置读取）
+        if ! ssh txjp "grep -q 'OIDC_CLIENT_SECRET' $REMOTE_DIR/.env 2>/dev/null"; then
+            warn "OIDC_CLIENT_SECRET 未设置，请手动配置"
+        fi
+    fi
+
 	    # 清理可能被上传的本地环境变量文件（.env.local 等会覆盖 .env 中的生产配置）
     ssh txjp "rm -f $REMOTE_DIR/.env.local $REMOTE_DIR/.env.development $REMOTE_DIR/.env.production 2>/dev/null; echo '已清理本地环境文件'"