From 3b345cfd27c1ab22c5eef6a6d777f1d117818c91 Mon Sep 17 00:00:00 2001 From: CaIon Date: Wed, 17 Jun 2026 16:12:27 +0800 Subject: [PATCH] chore: remove legacy OAuth controllers --- controller/discord.go | 223 ----------------------------------- controller/github.go | 220 ---------------------------------- controller/linuxdo.go | 268 ------------------------------------------ controller/oidc.go | 228 ----------------------------------- 4 files changed, 939 deletions(-) delete mode 100644 controller/discord.go delete mode 100644 controller/github.go delete mode 100644 controller/linuxdo.go delete mode 100644 controller/oidc.go diff --git a/controller/discord.go b/controller/discord.go deleted file mode 100644 index a0865de5..00000000 --- a/controller/discord.go +++ /dev/null @@ -1,223 +0,0 @@ -package controller - -import ( - "encoding/json" - "errors" - "fmt" - "net/http" - "net/url" - "strconv" - "strings" - "time" - - "github.com/QuantumNous/new-api/common" - "github.com/QuantumNous/new-api/model" - "github.com/QuantumNous/new-api/setting/system_setting" - - "github.com/gin-contrib/sessions" - "github.com/gin-gonic/gin" -) - -type DiscordResponse struct { - AccessToken string `json:"access_token"` - IDToken string `json:"id_token"` - RefreshToken string `json:"refresh_token"` - TokenType string `json:"token_type"` - ExpiresIn int `json:"expires_in"` - Scope string `json:"scope"` -} - -type DiscordUser struct { - UID string `json:"id"` - ID string `json:"username"` - Name string `json:"global_name"` -} - -func getDiscordUserInfoByCode(code string) (*DiscordUser, error) { - if code == "" { - return nil, errors.New("无效的参数") - } - - values := url.Values{} - values.Set("client_id", system_setting.GetDiscordSettings().ClientId) - values.Set("client_secret", system_setting.GetDiscordSettings().ClientSecret) - values.Set("code", code) - values.Set("grant_type", "authorization_code") - values.Set("redirect_uri", fmt.Sprintf("%s/oauth/discord", system_setting.ServerAddress)) - formData := values.Encode() - req, err := http.NewRequest("POST", "https://discord.com/api/v10/oauth2/token", strings.NewReader(formData)) - if err != nil { - return nil, err - } - req.Header.Set("Content-Type", "application/x-www-form-urlencoded") - req.Header.Set("Accept", "application/json") - client := http.Client{ - Timeout: 5 * time.Second, - } - res, err := client.Do(req) - if err != nil { - common.SysLog(err.Error()) - return nil, errors.New("无法连接至 Discord 服务器，请稍后重试！") - } - defer res.Body.Close() - var discordResponse DiscordResponse - err = json.NewDecoder(res.Body).Decode(&discordResponse) - if err != nil { - return nil, err - } - - if discordResponse.AccessToken == "" { - common.SysError("Discord 获取 Token 失败，请检查设置！") - return nil, errors.New("Discord 获取 Token 失败，请检查设置！") - } - - req, err = http.NewRequest("GET", "https://discord.com/api/v10/users/@me", nil) - if err != nil { - return nil, err - } - req.Header.Set("Authorization", "Bearer "+discordResponse.AccessToken) - res2, err := client.Do(req) - if err != nil { - common.SysLog(err.Error()) - return nil, errors.New("无法连接至 Discord 服务器，请稍后重试！") - } - defer res2.Body.Close() - if res2.StatusCode != http.StatusOK { - common.SysError("Discord 获取用户信息失败！请检查设置！") - return nil, errors.New("Discord 获取用户信息失败！请检查设置！") - } - - var discordUser DiscordUser - err = json.NewDecoder(res2.Body).Decode(&discordUser) - if err != nil { - return nil, err - } - if discordUser.UID == "" || discordUser.ID == "" { - common.SysError("Discord 获取用户信息为空！请检查设置！") - return nil, errors.New("Discord 获取用户信息为空！请检查设置！") - } - return &discordUser, nil -} - -func DiscordOAuth(c *gin.Context) { - session := sessions.Default(c) - state := c.Query("state") - if state == "" || session.Get("oauth_state") == nil || state != session.Get("oauth_state").(string) { - c.JSON(http.StatusForbidden, gin.H{ - "success": false, - "message": "state is empty or not same", - }) - return - } - username := session.Get("username") - if username != nil { - DiscordBind(c) - return - } - if !system_setting.GetDiscordSettings().Enabled { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": "管理员未开启通过 Discord 登录以及注册", - }) - return - } - code := c.Query("code") - discordUser, err := getDiscordUserInfoByCode(code) - if err != nil { - common.ApiError(c, err) - return - } - user := model.User{ - DiscordId: discordUser.UID, - } - if model.IsDiscordIdAlreadyTaken(user.DiscordId) { - err := user.FillUserByDiscordId() - if err != nil { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": err.Error(), - }) - return - } - } else { - if common.RegisterEnabled { - if discordUser.ID != "" { - user.Username = discordUser.ID - } else { - user.Username = "discord_" + strconv.Itoa(model.GetMaxUserId()+1) - } - if discordUser.Name != "" { - user.DisplayName = discordUser.Name - } else { - user.DisplayName = "Discord User" - } - err := user.Insert(0) - if err != nil { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": err.Error(), - }) - return - } - } else { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": "管理员关闭了新用户注册", - }) - return - } - } - - if user.Status != common.UserStatusEnabled { - c.JSON(http.StatusOK, gin.H{ - "message": "用户已被封禁", - "success": false, - }) - return - } - setupLogin(&user, c) -} - -func DiscordBind(c *gin.Context) { - if !system_setting.GetDiscordSettings().Enabled { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": "管理员未开启通过 Discord 登录以及注册", - }) - return - } - code := c.Query("code") - discordUser, err := getDiscordUserInfoByCode(code) - if err != nil { - common.ApiError(c, err) - return - } - user := model.User{ - DiscordId: discordUser.UID, - } - if model.IsDiscordIdAlreadyTaken(user.DiscordId) { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": "该 Discord 账户已被绑定", - }) - return - } - session := sessions.Default(c) - id := session.Get("id") - user.Id = id.(int) - err = user.FillUserById() - if err != nil { - common.ApiError(c, err) - return - } - user.DiscordId = discordUser.UID - err = user.Update(false) - if err != nil { - common.ApiError(c, err) - return - } - c.JSON(http.StatusOK, gin.H{ - "success": true, - "message": "bind", - }) -} diff --git a/controller/github.go b/controller/github.go deleted file mode 100644 index 5d906136..00000000 --- a/controller/github.go +++ /dev/null @@ -1,220 +0,0 @@ -package controller - -import ( - "bytes" - "encoding/json" - "errors" - "fmt" - "net/http" - "strconv" - "time" - - "github.com/QuantumNous/new-api/common" - "github.com/QuantumNous/new-api/model" - - "github.com/gin-contrib/sessions" - "github.com/gin-gonic/gin" -) - -type GitHubOAuthResponse struct { - AccessToken string `json:"access_token"` - Scope string `json:"scope"` - TokenType string `json:"token_type"` -} - -type GitHubUser struct { - Login string `json:"login"` - Name string `json:"name"` - Email string `json:"email"` -} - -func getGitHubUserInfoByCode(code string) (*GitHubUser, error) { - if code == "" { - return nil, errors.New("无效的参数") - } - values := map[string]string{"client_id": common.GitHubClientId, "client_secret": common.GitHubClientSecret, "code": code} - jsonData, err := json.Marshal(values) - if err != nil { - return nil, err - } - req, err := http.NewRequest("POST", "https://github.com/login/oauth/access_token", bytes.NewBuffer(jsonData)) - if err != nil { - return nil, err - } - req.Header.Set("Content-Type", "application/json") - req.Header.Set("Accept", "application/json") - client := http.Client{ - Timeout: 20 * time.Second, - } - res, err := client.Do(req) - if err != nil { - common.SysLog(err.Error()) - return nil, errors.New("无法连接至 GitHub 服务器，请稍后重试！") - } - defer res.Body.Close() - var oAuthResponse GitHubOAuthResponse - err = json.NewDecoder(res.Body).Decode(&oAuthResponse) - if err != nil { - return nil, err - } - req, err = http.NewRequest("GET", "https://api.github.com/user", nil) - if err != nil { - return nil, err - } - req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", oAuthResponse.AccessToken)) - res2, err := client.Do(req) - if err != nil { - common.SysLog(err.Error()) - return nil, errors.New("无法连接至 GitHub 服务器，请稍后重试！") - } - defer res2.Body.Close() - var githubUser GitHubUser - err = json.NewDecoder(res2.Body).Decode(&githubUser) - if err != nil { - return nil, err - } - if githubUser.Login == "" { - return nil, errors.New("返回值非法，用户字段为空，请稍后重试！") - } - return &githubUser, nil -} - -func GitHubOAuth(c *gin.Context) { - session := sessions.Default(c) - state := c.Query("state") - if state == "" || session.Get("oauth_state") == nil || state != session.Get("oauth_state").(string) { - c.JSON(http.StatusForbidden, gin.H{ - "success": false, - "message": "state is empty or not same", - }) - return - } - username := session.Get("username") - if username != nil { - GitHubBind(c) - return - } - - if !common.GitHubOAuthEnabled { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": "管理员未开启通过 GitHub 登录以及注册", - }) - return - } - code := c.Query("code") - githubUser, err := getGitHubUserInfoByCode(code) - if err != nil { - common.ApiError(c, err) - return - } - user := model.User{ - GitHubId: githubUser.Login, - } - // IsGitHubIdAlreadyTaken is unscoped - if model.IsGitHubIdAlreadyTaken(user.GitHubId) { - // FillUserByGitHubId is scoped - err := user.FillUserByGitHubId() - if err != nil { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": err.Error(), - }) - return - } - // if user.Id == 0 , user has been deleted - if user.Id == 0 { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": "用户已注销", - }) - return - } - } else { - if common.RegisterEnabled { - user.Username = "github_" + strconv.Itoa(model.GetMaxUserId()+1) - if githubUser.Name != "" { - user.DisplayName = githubUser.Name - } else { - user.DisplayName = "GitHub User" - } - user.Email = githubUser.Email - user.Role = common.RoleCommonUser - user.Status = common.UserStatusEnabled - affCode := session.Get("aff") - inviterId := 0 - if affCode != nil { - inviterId, _ = model.GetUserIdByAffCode(affCode.(string)) - } - - if err := user.Insert(inviterId); err != nil { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": err.Error(), - }) - return - } - } else { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": "管理员关闭了新用户注册", - }) - return - } - } - - if user.Status != common.UserStatusEnabled { - c.JSON(http.StatusOK, gin.H{ - "message": "用户已被封禁", - "success": false, - }) - return - } - setupLogin(&user, c) -} - -func GitHubBind(c *gin.Context) { - if !common.GitHubOAuthEnabled { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": "管理员未开启通过 GitHub 登录以及注册", - }) - return - } - code := c.Query("code") - githubUser, err := getGitHubUserInfoByCode(code) - if err != nil { - common.ApiError(c, err) - return - } - user := model.User{ - GitHubId: githubUser.Login, - } - if model.IsGitHubIdAlreadyTaken(user.GitHubId) { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": "该 GitHub 账户已被绑定", - }) - return - } - session := sessions.Default(c) - id := session.Get("id") - // id := c.GetInt("id") // critical bug! - user.Id = id.(int) - err = user.FillUserById() - if err != nil { - common.ApiError(c, err) - return - } - user.GitHubId = githubUser.Login - err = user.Update(false) - if err != nil { - common.ApiError(c, err) - return - } - c.JSON(http.StatusOK, gin.H{ - "success": true, - "message": "bind", - }) - return -} diff --git a/controller/linuxdo.go b/controller/linuxdo.go deleted file mode 100644 index 5457c9a4..00000000 --- a/controller/linuxdo.go +++ /dev/null @@ -1,268 +0,0 @@ -package controller - -import ( - "encoding/base64" - "encoding/json" - "errors" - "fmt" - "net/http" - "net/url" - "strconv" - "strings" - "time" - - "github.com/QuantumNous/new-api/common" - "github.com/QuantumNous/new-api/model" - - "github.com/gin-contrib/sessions" - "github.com/gin-gonic/gin" -) - -type LinuxdoUser struct { - Id int `json:"id"` - Username string `json:"username"` - Name string `json:"name"` - Active bool `json:"active"` - TrustLevel int `json:"trust_level"` - Silenced bool `json:"silenced"` -} - -func LinuxDoBind(c *gin.Context) { - if !common.LinuxDOOAuthEnabled { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": "管理员未开启通过 Linux DO 登录以及注册", - }) - return - } - - code := c.Query("code") - linuxdoUser, err := getLinuxdoUserInfoByCode(code, c) - if err != nil { - common.ApiError(c, err) - return - } - - user := model.User{ - LinuxDOId: strconv.Itoa(linuxdoUser.Id), - } - - if model.IsLinuxDOIdAlreadyTaken(user.LinuxDOId) { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": "该 Linux DO 账户已被绑定", - }) - return - } - - session := sessions.Default(c) - id := session.Get("id") - user.Id = id.(int) - - err = user.FillUserById() - if err != nil { - common.ApiError(c, err) - return - } - - user.LinuxDOId = strconv.Itoa(linuxdoUser.Id) - err = user.Update(false) - if err != nil { - common.ApiError(c, err) - return - } - - c.JSON(http.StatusOK, gin.H{ - "success": true, - "message": "bind", - }) -} - -func getLinuxdoUserInfoByCode(code string, c *gin.Context) (*LinuxdoUser, error) { - if code == "" { - return nil, errors.New("invalid code") - } - - // Get access token using Basic auth - tokenEndpoint := common.GetEnvOrDefaultString("LINUX_DO_TOKEN_ENDPOINT", "https://connect.linux.do/oauth2/token") - credentials := common.LinuxDOClientId + ":" + common.LinuxDOClientSecret - basicAuth := "Basic " + base64.StdEncoding.EncodeToString([]byte(credentials)) - - // Get redirect URI from request - scheme := "http" - if c.Request.TLS != nil { - scheme = "https" - } - redirectURI := fmt.Sprintf("%s://%s/api/oauth/linuxdo", scheme, c.Request.Host) - - data := url.Values{} - data.Set("grant_type", "authorization_code") - data.Set("code", code) - data.Set("redirect_uri", redirectURI) - - req, err := http.NewRequest("POST", tokenEndpoint, strings.NewReader(data.Encode())) - if err != nil { - return nil, err - } - - req.Header.Set("Authorization", basicAuth) - req.Header.Set("Content-Type", "application/x-www-form-urlencoded") - req.Header.Set("Accept", "application/json") - - client := http.Client{Timeout: 5 * time.Second} - res, err := client.Do(req) - if err != nil { - return nil, errors.New("failed to connect to Linux DO server") - } - defer res.Body.Close() - - var tokenRes struct { - AccessToken string `json:"access_token"` - Message string `json:"message"` - } - if err := json.NewDecoder(res.Body).Decode(&tokenRes); err != nil { - return nil, err - } - - if tokenRes.AccessToken == "" { - return nil, fmt.Errorf("failed to get access token: %s", tokenRes.Message) - } - - // Get user info - userEndpoint := common.GetEnvOrDefaultString("LINUX_DO_USER_ENDPOINT", "https://connect.linux.do/api/user") - req, err = http.NewRequest("GET", userEndpoint, nil) - if err != nil { - return nil, err - } - req.Header.Set("Authorization", "Bearer "+tokenRes.AccessToken) - req.Header.Set("Accept", "application/json") - - res2, err := client.Do(req) - if err != nil { - return nil, errors.New("failed to get user info from Linux DO") - } - defer res2.Body.Close() - - var linuxdoUser LinuxdoUser - if err := json.NewDecoder(res2.Body).Decode(&linuxdoUser); err != nil { - return nil, err - } - - if linuxdoUser.Id == 0 { - return nil, errors.New("invalid user info returned") - } - - return &linuxdoUser, nil -} - -func LinuxdoOAuth(c *gin.Context) { - session := sessions.Default(c) - - errorCode := c.Query("error") - if errorCode != "" { - errorDescription := c.Query("error_description") - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": errorDescription, - }) - return - } - - state := c.Query("state") - if state == "" || session.Get("oauth_state") == nil || state != session.Get("oauth_state").(string) { - c.JSON(http.StatusForbidden, gin.H{ - "success": false, - "message": "state is empty or not same", - }) - return - } - - username := session.Get("username") - if username != nil { - LinuxDoBind(c) - return - } - - if !common.LinuxDOOAuthEnabled { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": "管理员未开启通过 Linux DO 登录以及注册", - }) - return - } - - code := c.Query("code") - linuxdoUser, err := getLinuxdoUserInfoByCode(code, c) - if err != nil { - common.ApiError(c, err) - return - } - - user := model.User{ - LinuxDOId: strconv.Itoa(linuxdoUser.Id), - } - - // Check if user exists - if model.IsLinuxDOIdAlreadyTaken(user.LinuxDOId) { - err := user.FillUserByLinuxDOId() - if err != nil { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": err.Error(), - }) - return - } - if user.Id == 0 { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": "用户已注销", - }) - return - } - } else { - if common.RegisterEnabled { - if linuxdoUser.TrustLevel >= common.LinuxDOMinimumTrustLevel { - user.Username = "linuxdo_" + strconv.Itoa(model.GetMaxUserId()+1) - user.DisplayName = linuxdoUser.Name - user.Role = common.RoleCommonUser - user.Status = common.UserStatusEnabled - - affCode := session.Get("aff") - inviterId := 0 - if affCode != nil { - inviterId, _ = model.GetUserIdByAffCode(affCode.(string)) - } - - if err := user.Insert(inviterId); err != nil { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": err.Error(), - }) - return - } - } else { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": "Linux DO 信任等级未达到管理员设置的最低信任等级", - }) - return - } - } else { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": "管理员关闭了新用户注册", - }) - return - } - } - - if user.Status != common.UserStatusEnabled { - c.JSON(http.StatusOK, gin.H{ - "message": "用户已被封禁", - "success": false, - }) - return - } - - setupLogin(&user, c) -} diff --git a/controller/oidc.go b/controller/oidc.go deleted file mode 100644 index ac49f84e..00000000 --- a/controller/oidc.go +++ /dev/null @@ -1,228 +0,0 @@ -package controller - -import ( - "encoding/json" - "errors" - "fmt" - "net/http" - "net/url" - "strconv" - "strings" - "time" - - "github.com/QuantumNous/new-api/common" - "github.com/QuantumNous/new-api/model" - "github.com/QuantumNous/new-api/setting/system_setting" - - "github.com/gin-contrib/sessions" - "github.com/gin-gonic/gin" -) - -type OidcResponse struct { - AccessToken string `json:"access_token"` - IDToken string `json:"id_token"` - RefreshToken string `json:"refresh_token"` - TokenType string `json:"token_type"` - ExpiresIn int `json:"expires_in"` - Scope string `json:"scope"` -} - -type OidcUser struct { - OpenID string `json:"sub"` - Email string `json:"email"` - Name string `json:"name"` - PreferredUsername string `json:"preferred_username"` - Picture string `json:"picture"` -} - -func getOidcUserInfoByCode(code string) (*OidcUser, error) { - if code == "" { - return nil, errors.New("无效的参数") - } - - values := url.Values{} - values.Set("client_id", system_setting.GetOIDCSettings().ClientId) - values.Set("client_secret", system_setting.GetOIDCSettings().ClientSecret) - values.Set("code", code) - values.Set("grant_type", "authorization_code") - values.Set("redirect_uri", fmt.Sprintf("%s/oauth/oidc", system_setting.ServerAddress)) - formData := values.Encode() - req, err := http.NewRequest("POST", system_setting.GetOIDCSettings().TokenEndpoint, strings.NewReader(formData)) - if err != nil { - return nil, err - } - req.Header.Set("Content-Type", "application/x-www-form-urlencoded") - req.Header.Set("Accept", "application/json") - client := http.Client{ - Timeout: 5 * time.Second, - } - res, err := client.Do(req) - if err != nil { - common.SysLog(err.Error()) - return nil, errors.New("无法连接至 OIDC 服务器，请稍后重试！") - } - defer res.Body.Close() - var oidcResponse OidcResponse - err = json.NewDecoder(res.Body).Decode(&oidcResponse) - if err != nil { - return nil, err - } - - if oidcResponse.AccessToken == "" { - common.SysLog("OIDC 获取 Token 失败，请检查设置！") - return nil, errors.New("OIDC 获取 Token 失败，请检查设置！") - } - - req, err = http.NewRequest("GET", system_setting.GetOIDCSettings().UserInfoEndpoint, nil) - if err != nil { - return nil, err - } - req.Header.Set("Authorization", "Bearer "+oidcResponse.AccessToken) - res2, err := client.Do(req) - if err != nil { - common.SysLog(err.Error()) - return nil, errors.New("无法连接至 OIDC 服务器，请稍后重试！") - } - defer res2.Body.Close() - if res2.StatusCode != http.StatusOK { - common.SysLog("OIDC 获取用户信息失败！请检查设置！") - return nil, errors.New("OIDC 获取用户信息失败！请检查设置！") - } - - var oidcUser OidcUser - err = json.NewDecoder(res2.Body).Decode(&oidcUser) - if err != nil { - return nil, err - } - if oidcUser.OpenID == "" || oidcUser.Email == "" { - common.SysLog("OIDC 获取用户信息为空！请检查设置！") - return nil, errors.New("OIDC 获取用户信息为空！请检查设置！") - } - return &oidcUser, nil -} - -func OidcAuth(c *gin.Context) { - session := sessions.Default(c) - state := c.Query("state") - if state == "" || session.Get("oauth_state") == nil || state != session.Get("oauth_state").(string) { - c.JSON(http.StatusForbidden, gin.H{ - "success": false, - "message": "state is empty or not same", - }) - return - } - username := session.Get("username") - if username != nil { - OidcBind(c) - return - } - if !system_setting.GetOIDCSettings().Enabled { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": "管理员未开启通过 OIDC 登录以及注册", - }) - return - } - code := c.Query("code") - oidcUser, err := getOidcUserInfoByCode(code) - if err != nil { - common.ApiError(c, err) - return - } - user := model.User{ - OidcId: oidcUser.OpenID, - } - if model.IsOidcIdAlreadyTaken(user.OidcId) { - err := user.FillUserByOidcId() - if err != nil { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": err.Error(), - }) - return - } - } else { - if common.RegisterEnabled { - user.Email = oidcUser.Email - if oidcUser.PreferredUsername != "" { - user.Username = oidcUser.PreferredUsername - } else { - user.Username = "oidc_" + strconv.Itoa(model.GetMaxUserId()+1) - } - if oidcUser.Name != "" { - user.DisplayName = oidcUser.Name - } else { - user.DisplayName = "OIDC User" - } - err := user.Insert(0) - if err != nil { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": err.Error(), - }) - return - } - } else { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": "管理员关闭了新用户注册", - }) - return - } - } - - if user.Status != common.UserStatusEnabled { - c.JSON(http.StatusOK, gin.H{ - "message": "用户已被封禁", - "success": false, - }) - return - } - setupLogin(&user, c) -} - -func OidcBind(c *gin.Context) { - if !system_setting.GetOIDCSettings().Enabled { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": "管理员未开启通过 OIDC 登录以及注册", - }) - return - } - code := c.Query("code") - oidcUser, err := getOidcUserInfoByCode(code) - if err != nil { - common.ApiError(c, err) - return - } - user := model.User{ - OidcId: oidcUser.OpenID, - } - if model.IsOidcIdAlreadyTaken(user.OidcId) { - c.JSON(http.StatusOK, gin.H{ - "success": false, - "message": "该 OIDC 账户已被绑定", - }) - return - } - session := sessions.Default(c) - id := session.Get("id") - // id := c.GetInt("id") // critical bug! - user.Id = id.(int) - err = user.FillUserById() - if err != nil { - common.ApiError(c, err) - return - } - user.OidcId = oidcUser.OpenID - err = user.Update(false) - if err != nil { - common.ApiError(c, err) - return - } - c.JSON(http.StatusOK, gin.H{ - "success": true, - "message": "bind", - }) - return -}