✨ feat: impl accounts and channels

lib/auth/index.ts

@@ -0,0 +1,147 @@
+import NextAuth from "next-auth";
+import Credentials from "next-auth/providers/credentials";
+import { eq } from "drizzle-orm";
+import { db } from "@/lib/db";
+import { users, userAccounts } from "@/lib/db/schema";
+import { verifyPassword } from "./password";
+import { authConfig } from "./config";
+import type { Provider } from "next-auth/providers";
+
+// 动态构建 Providers 列表
+const providers: Provider[] = [
+  Credentials({
+    name: "Credentials",
+    credentials: {
+      email: { label: "Email", type: "email" },
+      password: { label: "Password", type: "password" },
+    },
+    async authorize(credentials) {
+      if (!credentials?.email || !credentials?.password) {
+        return null;
+      }
+
+      const email = String(credentials.email).toLowerCase().trim();
+      const password = String(credentials.password);
+
+      const [user] = await db
+        .select()
+        .from(users)
+        .where(eq(users.email, email))
+        .limit(1);
+
+      if (!user || !user.passwordHash || !user.isActive) {
+        return null;
+      }
+
+      const isValid = await verifyPassword(password, user.passwordHash);
+      if (!isValid) {
+        return null;
+      }
+
+      return {
+        id: user.id,
+        name: user.name,
+        email: user.email,
+        image: user.avatar,
+      };
+    },
+  }),
+];
+
+// 如果配置了 OIDC，且 AUTH_OIDC_ENABLED 为 true，则动态注册通用 OIDC 提供商
+const isOidcEnabled =
+  process.env.AUTH_OIDC_ENABLED === "true" &&
+  Boolean(process.env.AUTH_OIDC_ISSUER) &&
+  Boolean(process.env.AUTH_OIDC_CLIENT_ID);
+
+if (isOidcEnabled) {
+  providers.push({
+    id: "oidc",
+    name: process.env.AUTH_OIDC_NAME || "SSO 统一身份认证",
+    // Laysense currently returns nonce: "" even when no nonce was requested,
+    // causing Auth.js to reject the ID Token. Keep the standard OIDC flow here
+    // and leave it disabled in .env.local until the identity provider is fixed.
+    type: "oidc",
+    issuer: process.env.AUTH_OIDC_ISSUER!.replace(/\/$/, ""),
+    clientId: process.env.AUTH_OIDC_CLIENT_ID,
+    clientSecret: process.env.AUTH_OIDC_CLIENT_SECRET,
+    // Laysense requires an OAuth state parameter to correlate the callback.
+    checks: ["state"],
+    authorization: {
+      params: {
+        scope: process.env.AUTH_OIDC_SCOPES || "openid profile email",
+      },
+    },
+  });
+}
+
+export const { handlers, signIn, signOut, auth } = NextAuth({
+  ...authConfig,
+  providers,
+  session: {
+    strategy: "jwt",
+    maxAge: 30 * 24 * 60 * 60, // 30 天
+  },
+  callbacks: {
+    ...authConfig.callbacks,
+    async signIn({ user, account }) {
+      if (!account || account.type === "credentials") {
+        return true;
+      }
+
+      // 处理 OIDC / OAuth 登录与本地用户的关联或新建
+      const email = user.email?.toLowerCase().trim();
+      if (!email) {
+        return false;
+      }
+
+      // 1. 查询用户是否已存在
+      let [existingUser] = await db
+        .select()
+        .from(users)
+        .where(eq(users.email, email))
+        .limit(1);
+
+      if (!existingUser) {
+        // 创建新用户
+        const [newUser] = await db
+          .insert(users)
+          .values({
+            name: user.name || email.split("@")[0],
+            email: email,
+            avatar: user.image || null,
+            isActive: true,
+          })
+          .returning();
+        existingUser = newUser;
+      }
+
+      user.id = existingUser.id;
+
+      // 2. 查询是否已记录该 provider 的账户绑定
+      const [existingAccount] = await db
+        .select()
+        .from(userAccounts)
+        .where(
+          eq(userAccounts.providerAccountId, account.providerAccountId)
+        )
+        .limit(1);
+
+      if (!existingAccount) {
+        await db.insert(userAccounts).values({
+          userId: existingUser.id,
+          provider: account.provider,
+          providerAccountId: account.providerAccountId,
+          refreshToken: account.refresh_token,
+          accessToken: account.access_token,
+          expiresAt: account.expires_at ? new Date(account.expires_at * 1000) : null,
+          tokenType: account.token_type,
+          scope: account.scope,
+          idToken: account.id_token,
+        });
+      }
+
+      return true;
+    },
+  },
+});