148 lines
4.1 KiB
TypeScript
148 lines
4.1 KiB
TypeScript
import NextAuth from "next-auth";
|
|
import Credentials from "next-auth/providers/credentials";
|
|
import { eq } from "drizzle-orm";
|
|
import { db } from "@/lib/db";
|
|
import { users, userAccounts } from "@/lib/db/schema";
|
|
import { verifyPassword } from "./password";
|
|
import { authConfig } from "./config";
|
|
import type { Provider } from "next-auth/providers";
|
|
|
|
// 动态构建 Providers 列表
|
|
const providers: Provider[] = [
|
|
Credentials({
|
|
name: "Credentials",
|
|
credentials: {
|
|
email: { label: "Email", type: "email" },
|
|
password: { label: "Password", type: "password" },
|
|
},
|
|
async authorize(credentials) {
|
|
if (!credentials?.email || !credentials?.password) {
|
|
return null;
|
|
}
|
|
|
|
const email = String(credentials.email).toLowerCase().trim();
|
|
const password = String(credentials.password);
|
|
|
|
const [user] = await db
|
|
.select()
|
|
.from(users)
|
|
.where(eq(users.email, email))
|
|
.limit(1);
|
|
|
|
if (!user || !user.passwordHash || !user.isActive) {
|
|
return null;
|
|
}
|
|
|
|
const isValid = await verifyPassword(password, user.passwordHash);
|
|
if (!isValid) {
|
|
return null;
|
|
}
|
|
|
|
return {
|
|
id: user.id,
|
|
name: user.name,
|
|
email: user.email,
|
|
image: user.avatar,
|
|
};
|
|
},
|
|
}),
|
|
];
|
|
|
|
// 如果配置了 OIDC，且 AUTH_OIDC_ENABLED 为 true，则动态注册通用 OIDC 提供商
|
|
const isOidcEnabled =
|
|
process.env.AUTH_OIDC_ENABLED === "true" &&
|
|
Boolean(process.env.AUTH_OIDC_ISSUER) &&
|
|
Boolean(process.env.AUTH_OIDC_CLIENT_ID);
|
|
|
|
if (isOidcEnabled) {
|
|
providers.push({
|
|
id: "oidc",
|
|
name: process.env.AUTH_OIDC_NAME || "SSO 统一身份认证",
|
|
// Laysense currently returns nonce: "" even when no nonce was requested,
|
|
// causing Auth.js to reject the ID Token. Keep the standard OIDC flow here
|
|
// and leave it disabled in .env.local until the identity provider is fixed.
|
|
type: "oidc",
|
|
issuer: process.env.AUTH_OIDC_ISSUER!.replace(/\/$/, ""),
|
|
clientId: process.env.AUTH_OIDC_CLIENT_ID,
|
|
clientSecret: process.env.AUTH_OIDC_CLIENT_SECRET,
|
|
// Laysense requires an OAuth state parameter to correlate the callback.
|
|
checks: ["state"],
|
|
authorization: {
|
|
params: {
|
|
scope: process.env.AUTH_OIDC_SCOPES || "openid profile email",
|
|
},
|
|
},
|
|
});
|
|
}
|
|
|
|
export const { handlers, signIn, signOut, auth } = NextAuth({
|
|
...authConfig,
|
|
providers,
|
|
session: {
|
|
strategy: "jwt",
|
|
maxAge: 30 * 24 * 60 * 60, // 30 天
|
|
},
|
|
callbacks: {
|
|
...authConfig.callbacks,
|
|
async signIn({ user, account }) {
|
|
if (!account || account.type === "credentials") {
|
|
return true;
|
|
}
|
|
|
|
// 处理 OIDC / OAuth 登录与本地用户的关联或新建
|
|
const email = user.email?.toLowerCase().trim();
|
|
if (!email) {
|
|
return false;
|
|
}
|
|
|
|
// 1. 查询用户是否已存在
|
|
let [existingUser] = await db
|
|
.select()
|
|
.from(users)
|
|
.where(eq(users.email, email))
|
|
.limit(1);
|
|
|
|
if (!existingUser) {
|
|
// 创建新用户
|
|
const [newUser] = await db
|
|
.insert(users)
|
|
.values({
|
|
name: user.name || email.split("@")[0],
|
|
email: email,
|
|
avatar: user.image || null,
|
|
isActive: true,
|
|
})
|
|
.returning();
|
|
existingUser = newUser;
|
|
}
|
|
|
|
user.id = existingUser.id;
|
|
|
|
// 2. 查询是否已记录该 provider 的账户绑定
|
|
const [existingAccount] = await db
|
|
.select()
|
|
.from(userAccounts)
|
|
.where(
|
|
eq(userAccounts.providerAccountId, account.providerAccountId)
|
|
)
|
|
.limit(1);
|
|
|
|
if (!existingAccount) {
|
|
await db.insert(userAccounts).values({
|
|
userId: existingUser.id,
|
|
provider: account.provider,
|
|
providerAccountId: account.providerAccountId,
|
|
refreshToken: account.refresh_token,
|
|
accessToken: account.access_token,
|
|
expiresAt: account.expires_at ? new Date(account.expires_at * 1000) : null,
|
|
tokenType: account.token_type,
|
|
scope: account.scope,
|
|
idToken: account.id_token,
|
|
});
|
|
}
|
|
|
|
return true;
|
|
},
|
|
},
|
|
});
|