⚠️ 应用类型约束:当前实现仅支持「钉钉登录-企业内部应用」(DingTalk 开放平台 internal_app 类型)。第三方个人应用、第三方企业应用类型暂不支持——OAuth 流程 相同但 corp 校验、跨企业行为不同。backend 通过 DingTalkAppKind 校验对非 internal_app 类型 fail-closed(硬约束)。 钉钉 OAuth 登录主链 - 4 步 OAuth 链:ExchangeCodeForUserToken / GetUnionIdByUserToken / GetUserIdByUnionId / GetStaffInfoByUserId;app token 缓存 - pending session 机制持久化 OAuth 中间态;cookie-only token 持久化 - 三种分流:bind_login_required / email_completion / choose_account_action - corp_restriction_policy 支持 none + internal_only;stale "whitelist" 在 加载层与写入层均静默 coerce 为 none + slog.Warn - bypass_registration 开关:企业内部模式豁免全局 REGISTRATION_DISABLED - isReservedEmail / signup_source / canUnbindProvider / OAuth pending flow 等横切点支持 dingtalk provider - migration 136:4 表 CHECK 约束加入 'dingtalk' provider 值 internal_only 模式同步企业邮箱/姓名/部门到用户属性 - SyncCorpEmail / SyncDisplayName / SyncDept 三个独立开关 + 对应 SyncXxxAttrKey 目标属性 key(默认 dingtalk_email / dingtalk_name / dingtalk_department);非 internal_only policy 在写入层与加载层均 coerce 为 false,admin handler 与 setting_service 双层兜底 - 同步语义:首次注册写 users.username(昵称优先 → 企业姓名 fallback), 之后每次登录刷新 3 个属性;空值也写入以覆盖旧值 - 邮箱三级 fallback:org_email > email > extension["企业邮箱"] (钉钉自定义字段 JSON) - 部门路径递归向上拼接,跳过 dept_id=1 选首个真实子部门,剥离根组织名 - GetUnionIdByUserToken 同时返回 OIDC /contact/users/me 的 nick 字段; 新增 GetDeptInfo 调用 OAPI /topapi/v2/department/get - AuthHandler 注入 UserAttributeService;OAuth pending flow 在 createPendingOAuthAccount / bindPendingOAuthLogin 分别派发到 AfterRegistration(syncUsername=true)/ AfterLogin - migration 137 seed dingtalk_email/name/department 三个用户属性定义 附带修复(同集成路径暴露的两个 OAuth 注册回归) - LoginOrRegisterOAuthWithTokenPair 新建用户分支用 inferLegacySignupSource 覆写 caller 显式传入的 signupSource,导致 dingtalk/linuxdo/oidc/wechat 渠道授权按 email 渠道读取;改为只在 caller 未显式传入时回退邮箱推断 - mergeProviderDefaultGrantSettings 把 parse fallback 默认值 (Concurrency=5 / Balance=0) 当作"未配置"哨兵,admin 显式设 5 时被误判 退回全局默认(复现:全局默认 1 + 渠道默认并发 5 + grant_on_signup → 新 用户实际 concurrency=1);去掉哨兵,admin 任何 >=0 值都覆盖 globalDefaults 前端 - DingTalk Login / Callback / EmailCompletion / ChoiceAccount / Error 视图;router + auth API client - admin SettingsView:corp policy radio(none / internal_only)+ bypass 注册开关 + i18n;internal_only 下展示三同步开关 + 目标 attr key 下拉 (拉取 user attribute definitions),展示 fieldEmail / qyapi_get_department_list 钉钉权限申请提示 - Profile:S1 主动绑定 / S5 解绑钉钉按钮 + 合成邮箱防自锁 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
112 lines
4.0 KiB
Vue
112 lines
4.0 KiB
Vue
<template>
|
|
<AppLayout>
|
|
<div
|
|
data-testid="profile-shell"
|
|
class="mx-auto max-w-[950px] space-y-6"
|
|
>
|
|
<ProfileInfoCard
|
|
:user="user"
|
|
:linuxdo-enabled="linuxdoOAuthEnabled"
|
|
:dingtalk-enabled="dingtalkOAuthEnabled"
|
|
:oidc-enabled="oidcOAuthEnabled"
|
|
:oidc-provider-name="oidcOAuthProviderName"
|
|
:wechat-enabled="wechatOAuthEnabled"
|
|
:wechat-open-enabled="wechatOAuthOpenEnabled"
|
|
:wechat-mp-enabled="wechatOAuthMPEnabled"
|
|
/>
|
|
|
|
<div
|
|
v-if="contactInfo"
|
|
class="card border-primary-200 bg-primary-50 p-6 dark:bg-primary-900/20"
|
|
>
|
|
<div class="flex items-center gap-4">
|
|
<div class="rounded-xl bg-primary-100 p-3 text-primary-600">
|
|
<Icon name="chat" size="lg" />
|
|
</div>
|
|
<div>
|
|
<h3 class="font-semibold text-primary-800 dark:text-primary-200">
|
|
{{ t('common.contactSupport') }}
|
|
</h3>
|
|
<p class="text-sm font-medium">{{ contactInfo }}</p>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<ProfilePasswordForm />
|
|
|
|
<ProfileBalanceNotifyCard
|
|
v-if="user && balanceLowNotifyEnabled"
|
|
:enabled="user.balance_notify_enabled ?? true"
|
|
:threshold="user.balance_notify_threshold"
|
|
:extra-emails="user.balance_notify_extra_emails ?? []"
|
|
:system-default-threshold="systemDefaultThreshold"
|
|
:user-email="user.email"
|
|
/>
|
|
|
|
<ProfileTotpCard />
|
|
</div>
|
|
</AppLayout>
|
|
</template>
|
|
|
|
<script setup lang="ts">
|
|
import { computed, onMounted, ref } from 'vue'
|
|
import { useI18n } from 'vue-i18n'
|
|
import { Icon } from '@/components/icons'
|
|
import AppLayout from '@/components/layout/AppLayout.vue'
|
|
import ProfileBalanceNotifyCard from '@/components/user/profile/ProfileBalanceNotifyCard.vue'
|
|
import ProfileInfoCard from '@/components/user/profile/ProfileInfoCard.vue'
|
|
import ProfilePasswordForm from '@/components/user/profile/ProfilePasswordForm.vue'
|
|
import ProfileTotpCard from '@/components/user/profile/ProfileTotpCard.vue'
|
|
import { isWeChatWebOAuthEnabled } from '@/api/auth'
|
|
import { useAppStore } from '@/stores/app'
|
|
import { useAuthStore } from '@/stores/auth'
|
|
|
|
const { t } = useI18n()
|
|
const appStore = useAppStore()
|
|
const authStore = useAuthStore()
|
|
const user = computed(() => authStore.user)
|
|
|
|
const contactInfo = ref('')
|
|
const balanceLowNotifyEnabled = ref(false)
|
|
const systemDefaultThreshold = ref(0)
|
|
const linuxdoOAuthEnabled = ref(false)
|
|
const dingtalkOAuthEnabled = ref(false)
|
|
const wechatOAuthEnabled = ref(false)
|
|
const wechatOAuthOpenEnabled = ref<boolean | undefined>(undefined)
|
|
const wechatOAuthMPEnabled = ref<boolean | undefined>(undefined)
|
|
const oidcOAuthEnabled = ref(false)
|
|
const oidcOAuthProviderName = ref('OIDC')
|
|
|
|
onMounted(async () => {
|
|
const profileRefresh = authStore.refreshUser().catch((error) => {
|
|
console.error('Failed to refresh profile:', error)
|
|
})
|
|
|
|
const settingsLoad = appStore.fetchPublicSettings()
|
|
.then((settings) => {
|
|
if (!settings) {
|
|
return
|
|
}
|
|
contactInfo.value = settings.contact_info || ''
|
|
balanceLowNotifyEnabled.value = settings.balance_low_notify_enabled ?? false
|
|
systemDefaultThreshold.value = settings.balance_low_notify_threshold ?? 0
|
|
linuxdoOAuthEnabled.value = settings.linuxdo_oauth_enabled ?? false
|
|
dingtalkOAuthEnabled.value = settings.dingtalk_oauth_enabled ?? false
|
|
wechatOAuthEnabled.value = isWeChatWebOAuthEnabled(settings)
|
|
wechatOAuthOpenEnabled.value = typeof settings.wechat_oauth_open_enabled === 'boolean'
|
|
? settings.wechat_oauth_open_enabled
|
|
: undefined
|
|
wechatOAuthMPEnabled.value = typeof settings.wechat_oauth_mp_enabled === 'boolean'
|
|
? settings.wechat_oauth_mp_enabled
|
|
: undefined
|
|
oidcOAuthEnabled.value = settings.oidc_oauth_enabled ?? false
|
|
oidcOAuthProviderName.value = settings.oidc_oauth_provider_name || 'OIDC'
|
|
})
|
|
.catch((error) => {
|
|
console.error('Failed to load settings:', error)
|
|
})
|
|
|
|
await Promise.all([profileRefresh, settingsLoad])
|
|
})
|
|
</script>
|