xz
398 lines
24 KiB
JavaScript
398 lines
24 KiB
JavaScript
import {
|
|
createCipheriv,
|
|
createDecipheriv,
|
|
createHash,
|
|
createPublicKey,
|
|
createVerify,
|
|
constants,
|
|
randomBytes,
|
|
scryptSync
|
|
} from "node:crypto";
|
|
import { createPasswordRecord, dbAll, dbGet, dbRun } from "./db.mjs";
|
|
import { createMfaChallenge, createMfaEnrollmentChallenge, createSession, mfaRequiredForUser, mfaStatus, safeUser } from "./auth.mjs";
|
|
|
|
const LOGIN_STATE_TTL_MS = 10 * 60 * 1000;
|
|
const TICKET_TTL_MS = 60 * 1000;
|
|
const CLOCK_SKEW_MS = 60 * 1000;
|
|
const OIDC_STORAGE_KEY = scryptSync(process.env.AI_DRAMA_OIDC_STORAGE_KEY || process.env.AI_DRAMA_SESSION_SECRET || "ai-drama-local-oidc-key-v1", "ai-drama-oidc-storage", 32);
|
|
const OIDC_JWKS_CACHE = new Map();
|
|
const { RSA_PKCS1_PSS_PADDING, RSA_PSS_SALTLEN_DIGEST } = constants;
|
|
|
|
function oidcError(status, code, message, details = {}) {
|
|
const error = new Error(message);
|
|
error.status = status;
|
|
error.code = code;
|
|
error.details = details;
|
|
return error;
|
|
}
|
|
|
|
function nowIso() {
|
|
return new Date().toISOString();
|
|
}
|
|
|
|
function hashValue(value) {
|
|
return createHash("sha256").update(String(value || "")).digest("hex");
|
|
}
|
|
|
|
function base64url(buffer) {
|
|
return Buffer.from(buffer).toString("base64url");
|
|
}
|
|
|
|
function decodeBase64url(value) {
|
|
return Buffer.from(String(value || ""), "base64url");
|
|
}
|
|
|
|
function encryptOpaque(value) {
|
|
const iv = randomBytes(12);
|
|
const cipher = createCipheriv("aes-256-gcm", OIDC_STORAGE_KEY, iv);
|
|
const encrypted = Buffer.concat([cipher.update(String(value), "utf8"), cipher.final()]);
|
|
return [iv, cipher.getAuthTag(), encrypted].map((part) => part.toString("base64url")).join(".");
|
|
}
|
|
|
|
function decryptOpaque(payload) {
|
|
const [ivValue, tagValue, encryptedValue] = String(payload || "").split(".");
|
|
if (!ivValue || !tagValue || !encryptedValue) throw oidcError(500, "oidc_state_invalid", "OIDC 登录状态存储记录无效");
|
|
const decipher = createDecipheriv("aes-256-gcm", OIDC_STORAGE_KEY, decodeBase64url(ivValue));
|
|
decipher.setAuthTag(decodeBase64url(tagValue));
|
|
return Buffer.concat([decipher.update(decodeBase64url(encryptedValue)), decipher.final()]).toString("utf8");
|
|
}
|
|
|
|
function parseJson(value, fallback) {
|
|
try { return JSON.parse(value); } catch { return fallback; }
|
|
}
|
|
|
|
function normalizeIssuer(value) {
|
|
try {
|
|
return new URL(String(value || "")).toString().replace(/\/+$/, "");
|
|
} catch {
|
|
return String(value || "").replace(/\/+$/, "");
|
|
}
|
|
}
|
|
|
|
function claimValue(claims, path) {
|
|
const keys = String(path || "").split(".").filter(Boolean);
|
|
let current = claims;
|
|
for (const key of keys) {
|
|
if (!current || typeof current !== "object") return "";
|
|
current = current[key];
|
|
}
|
|
return Array.isArray(current) ? current[0] : current;
|
|
}
|
|
|
|
function providerRow(providerId) {
|
|
const provider = dbGet("SELECT * FROM identity_providers WHERE id = ? AND enabled = 1", [providerId]);
|
|
if (!provider) throw oidcError(404, "sso_provider_not_found", "企业身份提供商不存在或未启用");
|
|
if (provider.kind !== "oidc") throw oidcError(400, "sso_provider_kind_unsupported", "当前登录链路只支持 OIDC，SAML 仍需部署层断言消费适配");
|
|
if (!provider.issuer_url || !provider.client_id) throw oidcError(400, "sso_provider_incomplete", "OIDC 提供商缺少 Issuer 或 Client ID");
|
|
return provider;
|
|
}
|
|
|
|
function identityPolicy() {
|
|
return dbGet("SELECT * FROM identity_policies WHERE id = 'default'") || {};
|
|
}
|
|
|
|
function ensureSsoEnabled() {
|
|
if (!identityPolicy().sso_enabled) throw oidcError(403, "sso_disabled", "平台当前未启用企业 SSO");
|
|
}
|
|
|
|
function cleanupExpired() {
|
|
const timestamp = nowIso();
|
|
dbRun("DELETE FROM oidc_login_states WHERE expires_at <= ? OR consumed_at IS NOT NULL", [timestamp]);
|
|
dbRun("DELETE FROM auth_sso_tickets WHERE expires_at <= ? OR consumed_at IS NOT NULL", [timestamp]);
|
|
}
|
|
|
|
async function fetchJson(url, options = {}, label = "OIDC 请求") {
|
|
const controller = new AbortController();
|
|
const timeout = setTimeout(() => controller.abort(), 8000);
|
|
try {
|
|
const response = await fetch(url, { ...options, signal: controller.signal });
|
|
const raw = await response.text();
|
|
const payload = raw ? parseJson(raw, {}) : {};
|
|
if (!response.ok) throw oidcError(502, "oidc_upstream_error", `${label}失败：HTTP ${response.status}`, { status: response.status, response: payload });
|
|
return payload;
|
|
} catch (error) {
|
|
if (error.status) throw error;
|
|
throw oidcError(502, "oidc_upstream_unreachable", `${label}失败：${error.message}`);
|
|
} finally {
|
|
clearTimeout(timeout);
|
|
}
|
|
}
|
|
|
|
async function discover(provider) {
|
|
const discoveryUrl = `${normalizeIssuer(provider.issuer_url)}/.well-known/openid-configuration`;
|
|
const discovery = await fetchJson(discoveryUrl, { headers: { accept: "application/json" } }, "OIDC discovery");
|
|
return {
|
|
issuer: discovery.issuer || provider.issuer_url,
|
|
authorizationEndpoint: provider.authorization_url || discovery.authorization_endpoint,
|
|
tokenEndpoint: provider.token_url || discovery.token_endpoint,
|
|
userinfoEndpoint: provider.userinfo_url || discovery.userinfo_endpoint || "",
|
|
jwksUri: provider.jwks_url || discovery.jwks_uri || ""
|
|
};
|
|
}
|
|
|
|
export function startOidcLogin(providerId, { redirectUri, returnTo = "/", selection = {}, ipAddress = "", userAgent = "" } = {}) {
|
|
ensureSsoEnabled();
|
|
const provider = providerRow(providerId);
|
|
const authorizationUrl = String(provider.authorization_url || "").trim();
|
|
if (!authorizationUrl) throw oidcError(400, "sso_authorization_endpoint_missing", "OIDC 提供商尚未配置 Authorization Endpoint，请先探测");
|
|
const state = base64url(randomBytes(32));
|
|
const nonce = base64url(randomBytes(32));
|
|
const codeVerifier = base64url(randomBytes(48));
|
|
const codeChallenge = base64url(createHash("sha256").update(codeVerifier).digest());
|
|
const timestamp = nowIso();
|
|
const expiresAt = new Date(Date.now() + LOGIN_STATE_TTL_MS).toISOString();
|
|
const id = `oidc-state-${Date.now()}-${randomBytes(4).toString("hex")}`;
|
|
dbRun("INSERT INTO oidc_login_states(id, state_hash, provider_id, nonce_hash, code_verifier_ciphertext, redirect_uri, return_to, selection_json, ip_address, user_agent, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", [
|
|
id,
|
|
hashValue(state),
|
|
provider.id,
|
|
hashValue(nonce),
|
|
encryptOpaque(codeVerifier),
|
|
redirectUri,
|
|
String(returnTo || "/"),
|
|
JSON.stringify(selection || {}),
|
|
String(ipAddress || ""),
|
|
String(userAgent || ""),
|
|
expiresAt,
|
|
timestamp
|
|
]);
|
|
const url = new URL(authorizationUrl);
|
|
const scopes = parseJson(provider.scopes_json, ["openid", "profile", "email"]);
|
|
url.searchParams.set("response_type", "code");
|
|
url.searchParams.set("client_id", provider.client_id);
|
|
url.searchParams.set("redirect_uri", redirectUri);
|
|
url.searchParams.set("scope", Array.isArray(scopes) ? scopes.join(" ") : "openid profile email");
|
|
url.searchParams.set("state", state);
|
|
url.searchParams.set("nonce", nonce);
|
|
url.searchParams.set("code_challenge", codeChallenge);
|
|
url.searchParams.set("code_challenge_method", "S256");
|
|
return { provider: { id: provider.id, name: provider.name }, authorizationUrl: url.toString(), expiresAt };
|
|
}
|
|
|
|
function consumeLoginState(state) {
|
|
cleanupExpired();
|
|
const timestamp = nowIso();
|
|
const result = dbRun("UPDATE oidc_login_states SET consumed_at = ? WHERE state_hash = ? AND consumed_at IS NULL AND expires_at > ?", [timestamp, hashValue(state), timestamp]);
|
|
if (!Number(result.changes || 0)) throw oidcError(401, "oidc_state_invalid", "OIDC 登录状态无效、已使用或已过期");
|
|
const row = dbGet("SELECT * FROM oidc_login_states WHERE state_hash = ?", [hashValue(state)]);
|
|
if (!row) throw oidcError(401, "oidc_state_invalid", "OIDC 登录状态不存在");
|
|
return row;
|
|
}
|
|
|
|
function parseJwt(token) {
|
|
const parts = String(token || "").split(".");
|
|
if (parts.length !== 3) throw oidcError(502, "oidc_id_token_invalid", "OIDC 返回的 ID Token 格式无效");
|
|
try {
|
|
return { header: JSON.parse(decodeBase64url(parts[0]).toString("utf8")), claims: JSON.parse(decodeBase64url(parts[1]).toString("utf8")), encodedHeader: parts[0], encodedPayload: parts[1], signature: decodeBase64url(parts[2]) };
|
|
} catch {
|
|
throw oidcError(502, "oidc_id_token_invalid", "OIDC 返回的 ID Token 不是有效 JWT");
|
|
}
|
|
}
|
|
|
|
function ecdsaJoseToDer(signature) {
|
|
const half = Math.floor(signature.length / 2);
|
|
const encodeInteger = (value) => {
|
|
let output = Buffer.from(value);
|
|
while (output.length > 1 && output[0] === 0) output = output.subarray(1);
|
|
if (output[0] & 0x80) output = Buffer.concat([Buffer.from([0]), output]);
|
|
return Buffer.concat([Buffer.from([0x02, output.length]), output]);
|
|
};
|
|
const sequence = Buffer.concat([encodeInteger(signature.subarray(0, half)), encodeInteger(signature.subarray(half))]);
|
|
if (sequence.length >= 128) return Buffer.concat([Buffer.from([0x30, 0x81, sequence.length]), sequence]);
|
|
return Buffer.concat([Buffer.from([0x30, sequence.length]), sequence]);
|
|
}
|
|
|
|
async function verifyIdToken(token, provider, discovery) {
|
|
const parsed = parseJwt(token);
|
|
const { header, claims, encodedHeader, encodedPayload, signature } = parsed;
|
|
const algorithms = {
|
|
RS256: { hash: "SHA256", type: "rsa" },
|
|
RS384: { hash: "SHA384", type: "rsa" },
|
|
RS512: { hash: "SHA512", type: "rsa" },
|
|
PS256: { hash: "SHA256", type: "pss" },
|
|
PS384: { hash: "SHA384", type: "pss" },
|
|
PS512: { hash: "SHA512", type: "pss" },
|
|
ES256: { hash: "SHA256", type: "ecdsa" },
|
|
ES384: { hash: "SHA384", type: "ecdsa" },
|
|
ES512: { hash: "SHA512", type: "ecdsa" }
|
|
};
|
|
const algorithm = algorithms[header.alg];
|
|
if (!algorithm) throw oidcError(502, "oidc_algorithm_unsupported", `OIDC ID Token 签名算法不受支持：${header.alg || "未声明"}`);
|
|
if (!discovery.jwksUri) throw oidcError(502, "oidc_jwks_missing", "OIDC 提供商未返回 JWKS 地址");
|
|
let cache = OIDC_JWKS_CACHE.get(discovery.jwksUri);
|
|
if (!cache || cache.expiresAt <= Date.now()) {
|
|
cache = { keys: (await fetchJson(discovery.jwksUri, { headers: { accept: "application/json" } }, "OIDC JWKS")).keys || [], expiresAt: Date.now() + 5 * 60 * 1000 };
|
|
OIDC_JWKS_CACHE.set(discovery.jwksUri, cache);
|
|
}
|
|
let jwk = cache.keys.find((item) => item.kid && item.kid === header.kid);
|
|
if (!jwk && !header.kid && cache.keys.length === 1) jwk = cache.keys[0];
|
|
if (!jwk) {
|
|
OIDC_JWKS_CACHE.delete(discovery.jwksUri);
|
|
const refreshed = (await fetchJson(discovery.jwksUri, { headers: { accept: "application/json" } }, "OIDC JWKS 刷新")).keys || [];
|
|
OIDC_JWKS_CACHE.set(discovery.jwksUri, { keys: refreshed, expiresAt: Date.now() + 5 * 60 * 1000 });
|
|
jwk = refreshed.find((item) => item.kid && item.kid === header.kid) || (!header.kid && refreshed.length === 1 ? refreshed[0] : null);
|
|
}
|
|
if (!jwk) throw oidcError(502, "oidc_signing_key_not_found", "OIDC ID Token 的签名密钥不在 JWKS 中");
|
|
let publicKey;
|
|
try { publicKey = createPublicKey({ key: jwk, format: "jwk" }); } catch (error) { throw oidcError(502, "oidc_jwk_invalid", `OIDC JWKS 公钥无效：${error.message}`); }
|
|
const verify = createVerify(algorithm.hash);
|
|
verify.update(`${encodedHeader}.${encodedPayload}`);
|
|
verify.end();
|
|
const normalizedSignature = algorithm.type === "ecdsa" ? ecdsaJoseToDer(signature) : signature;
|
|
const verified = algorithm.type === "pss"
|
|
? verify.verify({ key: publicKey, padding: RSA_PKCS1_PSS_PADDING, saltLength: RSA_PSS_SALTLEN_DIGEST }, normalizedSignature)
|
|
: verify.verify(publicKey, normalizedSignature);
|
|
if (!verified) throw oidcError(401, "oidc_signature_invalid", "OIDC ID Token 签名校验失败");
|
|
const now = Date.now();
|
|
if (normalizeIssuer(claims.iss) !== normalizeIssuer(provider.issuer_url)) throw oidcError(401, "oidc_issuer_invalid", "OIDC ID Token 的 Issuer 不匹配");
|
|
const audiences = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
|
|
if (!audiences.includes(provider.client_id)) throw oidcError(401, "oidc_audience_invalid", "OIDC ID Token 的 Audience 不匹配");
|
|
if (claims.azp && claims.azp !== provider.client_id) throw oidcError(401, "oidc_authorized_party_invalid", "OIDC ID Token 的 azp 不匹配");
|
|
if (!claims.nonce) throw oidcError(401, "oidc_nonce_missing", "OIDC ID Token 缺少 nonce");
|
|
if (!claims.sub) throw oidcError(401, "oidc_subject_missing", "OIDC ID Token 缺少 subject");
|
|
if (!claims.exp || Number(claims.exp) * 1000 + CLOCK_SKEW_MS < now) throw oidcError(401, "oidc_token_expired", "OIDC ID Token 已过期");
|
|
if (claims.iat && Number(claims.iat) * 1000 - CLOCK_SKEW_MS > now) throw oidcError(401, "oidc_token_issued_in_future", "OIDC ID Token 的签发时间无效");
|
|
return claims;
|
|
}
|
|
|
|
async function exchangeCode(provider, stateRow, code) {
|
|
const discovery = await discover(provider);
|
|
if (!discovery.tokenEndpoint) throw oidcError(400, "sso_token_endpoint_missing", "OIDC 提供商尚未配置 Token Endpoint");
|
|
const clientSecret = process.env[provider.client_secret_ref];
|
|
if (!clientSecret) throw oidcError(503, "sso_client_secret_missing", `服务端环境变量 ${provider.client_secret_ref} 未配置`);
|
|
const body = new URLSearchParams({
|
|
grant_type: "authorization_code",
|
|
code: String(code || ""),
|
|
redirect_uri: stateRow.redirect_uri,
|
|
client_id: provider.client_id,
|
|
client_secret: clientSecret,
|
|
code_verifier: decryptOpaque(stateRow.code_verifier_ciphertext)
|
|
});
|
|
const token = await fetchJson(discovery.tokenEndpoint, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" }, body }, "OIDC code exchange");
|
|
if (!token.id_token) throw oidcError(502, "oidc_id_token_missing", "OIDC Token Endpoint 未返回 ID Token");
|
|
const claims = await verifyIdToken(token.id_token, provider, discovery);
|
|
if (hashValue(claims.nonce) !== stateRow.nonce_hash) throw oidcError(401, "oidc_nonce_invalid", "OIDC ID Token 的 nonce 不匹配");
|
|
if (discovery.userinfoEndpoint && token.access_token) {
|
|
try {
|
|
const userInfo = await fetchJson(discovery.userinfoEndpoint, { headers: { authorization: `Bearer ${token.access_token}`, accept: "application/json" } }, "OIDC UserInfo");
|
|
for (const [key, value] of Object.entries(userInfo || {})) if (claims[key] === undefined) claims[key] = value;
|
|
} catch {
|
|
// ID Token claims remain authoritative when an optional UserInfo call fails.
|
|
}
|
|
}
|
|
return { claims, token, discovery };
|
|
}
|
|
|
|
function avatarColorFor(email) {
|
|
const colors = ["#d97757", "#3f7f87", "#a77646", "#8e6a9f", "#477d69", "#9a6b51"];
|
|
const digest = createHash("sha256").update(email).digest().readUInt16BE(0);
|
|
return colors[digest % colors.length];
|
|
}
|
|
|
|
function organizationFor(provider, existingUser) {
|
|
if (provider.organization_id) {
|
|
const organization = dbGet("SELECT * FROM organizations WHERE id = ? AND status = 'active'", [provider.organization_id]);
|
|
if (!organization) throw oidcError(403, "sso_organization_unavailable", "SSO 提供商绑定的组织不存在或已停用");
|
|
return organization;
|
|
}
|
|
if (existingUser) {
|
|
const membership = dbGet("SELECT o.* FROM organizations o JOIN organization_members om ON om.organization_id = o.id WHERE om.user_id = ? AND om.status = 'active' AND o.status = 'active' ORDER BY om.joined_at ASC LIMIT 1", [existingUser.id]);
|
|
if (membership) return membership;
|
|
}
|
|
throw oidcError(403, "sso_organization_required", "该 SSO 提供商尚未绑定组织，不能自动创建企业成员");
|
|
}
|
|
|
|
function ensureOrganizationMembership(user, organization, provider) {
|
|
const current = dbGet("SELECT * FROM organization_members WHERE organization_id = ? AND user_id = ?", [organization.id, user.id]);
|
|
if (current?.status === "active") return current;
|
|
if (current && current.status !== "active" && !provider.auto_provision) throw oidcError(403, "sso_membership_inactive", "当前用户在目标组织中已被停用");
|
|
if (!current && !provider.auto_provision) throw oidcError(403, "sso_membership_required", "当前企业账号尚未加入目标组织");
|
|
const timestamp = nowIso();
|
|
const roleKey = provider.default_role_key || "org_member";
|
|
dbRun("INSERT INTO organization_members(id, organization_id, user_id, role_key, status, joined_at, created_at, updated_at) VALUES (?, ?, ?, ?, 'active', ?, ?, ?) ON CONFLICT(organization_id, user_id) DO UPDATE SET role_key = excluded.role_key, status = 'active', joined_at = excluded.joined_at, updated_at = excluded.updated_at", [`om-sso-${organization.id}-${user.id}`, organization.id, user.id, roleKey, timestamp, timestamp, timestamp]);
|
|
return dbGet("SELECT * FROM organization_members WHERE organization_id = ? AND user_id = ?", [organization.id, user.id]);
|
|
}
|
|
|
|
function ensureWorkspaceMembership(user, organization, provider) {
|
|
const workspace = provider.workspace_id
|
|
? dbGet("SELECT * FROM workspaces WHERE id = ? AND organization_id = ? AND status = 'active'", [provider.workspace_id, organization.id])
|
|
: dbGet("SELECT * FROM workspaces WHERE organization_id = ? AND status = 'active' ORDER BY created_at ASC LIMIT 1", [organization.id]);
|
|
if (!workspace) throw oidcError(403, "sso_workspace_required", "SSO 提供商没有可用的默认工作区");
|
|
const current = dbGet("SELECT * FROM workspace_members WHERE workspace_id = ? AND user_id = ?", [workspace.id, user.id]);
|
|
if (current?.status === "active") return { workspace, membership: current };
|
|
if (current && current.status !== "active" && !provider.auto_provision) throw oidcError(403, "sso_workspace_membership_inactive", "当前用户在默认工作区中已被停用");
|
|
if (!current && !provider.auto_provision) throw oidcError(403, "sso_workspace_membership_required", "当前企业账号尚未加入默认工作区");
|
|
const timestamp = nowIso();
|
|
const roleKey = provider.default_workspace_role_key || "writer";
|
|
dbRun("INSERT INTO workspace_members(id, workspace_id, user_id, role_key, status, created_at, updated_at) VALUES (?, ?, ?, ?, 'active', ?, ?) ON CONFLICT(workspace_id, user_id) DO UPDATE SET role_key = excluded.role_key, status = 'active', updated_at = excluded.updated_at", [`wm-sso-${workspace.id}-${user.id}`, workspace.id, user.id, roleKey, timestamp, timestamp]);
|
|
return { workspace, membership: dbGet("SELECT * FROM workspace_members WHERE workspace_id = ? AND user_id = ?", [workspace.id, user.id]) };
|
|
}
|
|
|
|
export function resolveOidcUser(provider, claims) {
|
|
const mapping = parseJson(provider.claim_mapping_json, { email: "email", displayName: "name", externalId: "sub" });
|
|
const subject = String(claimValue(claims, mapping.externalId || "sub") || claims.sub || "").trim();
|
|
const email = String(claimValue(claims, mapping.email || "email") || claims.preferred_username || "").trim().toLowerCase();
|
|
const displayName = String(claimValue(claims, mapping.displayName || "name") || claims.preferred_username || email || subject).trim();
|
|
if (!subject) throw oidcError(401, "sso_subject_missing", "企业身份没有返回可用的 subject");
|
|
if (!email || !email.includes("@")) throw oidcError(401, "sso_email_missing", "企业身份没有返回可用邮箱，无法完成平台账号绑定");
|
|
const existingIdentity = dbGet("SELECT ei.*, u.* FROM external_identities ei JOIN users u ON u.id = ei.user_id WHERE ei.provider_id = ? AND ei.subject = ?", [provider.id, subject]);
|
|
let user = existingIdentity ? dbGet("SELECT * FROM users WHERE id = ?", [existingIdentity.user_id]) : dbGet("SELECT * FROM users WHERE lower(email) = ?", [email]);
|
|
const organization = organizationFor(provider, user);
|
|
if (existingIdentity && existingIdentity.email_at_login && existingIdentity.email_at_login !== email && user?.email !== email) throw oidcError(403, "sso_identity_mismatch", "企业身份 subject 与邮箱绑定不一致，需要管理员处理");
|
|
if (!user) {
|
|
if (!provider.auto_provision) throw oidcError(403, "sso_auto_provision_disabled", "该企业账号尚未注册，且当前 SSO 提供商关闭了自动入组");
|
|
const timestamp = nowIso();
|
|
const id = `u-sso-${Date.now()}-${randomBytes(5).toString("hex")}`;
|
|
dbRun("INSERT INTO users(id, display_name, email, avatar_color, status, created_at, updated_at) VALUES (?, ?, ?, ?, 'active', ?, ?)", [id, displayName.slice(0, 120) || email, email, avatarColorFor(email), timestamp, timestamp]);
|
|
user = dbGet("SELECT * FROM users WHERE id = ?", [id]);
|
|
}
|
|
if (!user || user.status !== "active") throw oidcError(403, "user_not_active", "当前企业账号已停用");
|
|
ensureOrganizationMembership(user, organization, provider);
|
|
ensureWorkspaceMembership(user, organization, provider);
|
|
const timestamp = nowIso();
|
|
if (!existingIdentity) {
|
|
const identityId = `ext-${Date.now()}-${randomBytes(5).toString("hex")}`;
|
|
try {
|
|
dbRun("INSERT INTO external_identities(id, provider_id, user_id, subject, issuer, email_at_login, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)", [identityId, provider.id, user.id, subject, normalizeIssuer(claims.iss || provider.issuer_url), email, timestamp, timestamp]);
|
|
} catch (error) {
|
|
const conflict = dbGet("SELECT user_id FROM external_identities WHERE provider_id = ? AND subject = ?", [provider.id, subject]);
|
|
if (!conflict || conflict.user_id !== user.id) throw oidcError(409, "sso_identity_already_bound", "该企业身份已经绑定其他平台用户");
|
|
}
|
|
} else {
|
|
dbRun("UPDATE external_identities SET email_at_login = ?, issuer = ?, updated_at = ? WHERE id = ?", [email, normalizeIssuer(claims.iss || provider.issuer_url), timestamp, existingIdentity.id]);
|
|
}
|
|
return { user: dbGet("SELECT * FROM users WHERE id = ?", [user.id]), organization, subject, email };
|
|
}
|
|
|
|
export async function handleOidcCallback({ code, state }) {
|
|
const stateRow = consumeLoginState(state);
|
|
const provider = providerRow(stateRow.provider_id);
|
|
const exchanged = await exchangeCode(provider, stateRow, code);
|
|
return { ...resolveOidcUser(provider, exchanged.claims), selection: parseJson(stateRow.selection_json, {}), returnTo: stateRow.return_to, provider };
|
|
}
|
|
|
|
export function createSsoTicket(userId, selection = {}, metadata = {}) {
|
|
cleanupExpired();
|
|
const ticket = base64url(randomBytes(32));
|
|
const timestamp = nowIso();
|
|
const expiresAt = new Date(Date.now() + TICKET_TTL_MS).toISOString();
|
|
const id = `sso-ticket-${Date.now()}-${randomBytes(4).toString("hex")}`;
|
|
dbRun("INSERT INTO auth_sso_tickets(id, ticket_hash, user_id, selection_json, ip_address, user_agent, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)", [id, hashValue(ticket), userId, JSON.stringify(selection || {}), String(metadata.ipAddress || ""), String(metadata.userAgent || ""), expiresAt, timestamp]);
|
|
return { ticket, expiresAt };
|
|
}
|
|
|
|
export function redeemSsoTicket(ticket, metadata = {}) {
|
|
cleanupExpired();
|
|
const timestamp = nowIso();
|
|
const result = dbRun("UPDATE auth_sso_tickets SET consumed_at = ? WHERE ticket_hash = ? AND consumed_at IS NULL AND expires_at > ?", [timestamp, hashValue(ticket), timestamp]);
|
|
if (!Number(result.changes || 0)) throw oidcError(401, "sso_ticket_invalid", "SSO 登录票据无效、已使用或已过期");
|
|
const row = dbGet("SELECT * FROM auth_sso_tickets WHERE ticket_hash = ?", [hashValue(ticket)]);
|
|
if (!row) throw oidcError(401, "sso_ticket_invalid", "SSO 登录票据不存在");
|
|
const user = dbGet("SELECT * FROM users WHERE id = ?", [row.user_id]);
|
|
if (!user || user.status !== "active") throw oidcError(403, "user_not_active", "当前企业账号已停用");
|
|
const selection = parseJson(row.selection_json, {});
|
|
if (mfaStatus(user.id).enabled) return { mfaRequired: true, challenge: createMfaChallenge(user.id), user: safeUser(user), selection };
|
|
if (mfaRequiredForUser(user.id)) return { mfaRequired: true, mfaEnrollmentRequired: true, enrollment: createMfaEnrollmentChallenge(user.id), user: safeUser(user), selection };
|
|
return { session: createSession(user.id, metadata), user: safeUser(user), selection };
|
|
}
|