feat: SSO 统一认证登录

- 更新 deploy-ai.sh 添加 OIDC 环境变量自动配置

deploy-ai.sh

@@ -352,6 +352,32 @@ build_on_server() {
 	    ssh txjp "grep -q 'AUTHELIA_URL' $REMOTE_DIR/.env 2>/dev/null \
 	        && sed -i 's|AUTHELIA_URL=.*|AUTHELIA_URL=https://sso.tlyq.ai|' $REMOTE_DIR/.env 2>/dev/null \
 	        || echo 'AUTHELIA_URL=https://sso.tlyq.ai' >> $REMOTE_DIR/.env"
+
+    # OIDC 环境变量配置（oa/assets/issue 站点）
+    if [[ "$SITE" == "oa" || "$SITE" == "assets" || "$SITE" == "issue" ]]; then
+        # 根据站点设置 OIDC 变量
+        case "$SITE" in
+            oa)     OIDC_ID="oa-oidc";     OIDC_URI="https://oa.tlyq.ai/api/auth/callback" ;;
+            assets) OIDC_ID="assets-oidc"; OIDC_URI="https://assets.tlyq.ai/api/auth/callback" ;;
+            issue)  OIDC_ID="issue-oidc";  OIDC_URI="https://issue.tlyq.ai/api/auth/callback" ;;
+        esac
+
+        # 确保 OIDC_CLIENT_ID 已设置
+        ssh txjp "grep -q 'OIDC_CLIENT_ID' $REMOTE_DIR/.env 2>/dev/null \
+            && sed -i 's|OIDC_CLIENT_ID=.*|OIDC_CLIENT_ID=${OIDC_ID}|' $REMOTE_DIR/.env 2>/dev/null \
+            || echo 'OIDC_CLIENT_ID=${OIDC_ID}' >> $REMOTE_DIR/.env"
+
+        # 确保 OIDC_REDIRECT_URI 已设置
+        ssh txjp "grep -q 'OIDC_REDIRECT_URI' $REMOTE_DIR/.env 2>/dev/null \
+            && sed -i 's|OIDC_REDIRECT_URI=.*|OIDC_REDIRECT_URI=${OIDC_URI}|' $REMOTE_DIR/.env 2>/dev/null \
+            || echo 'OIDC_REDIRECT_URI=${OIDC_URI}' >> $REMOTE_DIR/.env"
+
+        # 确保 OIDC_CLIENT_SECRET 已设置（从 Authelia 配置读取）
+        if ! ssh txjp "grep -q 'OIDC_CLIENT_SECRET' $REMOTE_DIR/.env 2>/dev/null"; then
+            warn "OIDC_CLIENT_SECRET 未设置，请手动配置"
+        fi
+    fi
+
 	    # 清理可能被上传的本地环境变量文件（.env.local 等会覆盖 .env 中的生产配置）
     ssh txjp "rm -f $REMOTE_DIR/.env.local $REMOTE_DIR/.env.development $REMOTE_DIR/.env.production 2>/dev/null; echo '已清理本地环境文件'"