Repository navigation
feat(auth): Discord 登录后端 — 自定义 AuthSource + OAuth 端点泛化 - #48
Merged
Merged
Conversation
RFC #42 / ADR-001 M3（后端部分）。这是"接入 Discord 登录"里唯一的新技术点： JustAuth 1.16.6 内置 github/google/microsoft 但无 discord，按其自定义 source 约定补 DiscordAuthSource + AuthDiscordRequest。 - DiscordAuthSource / AuthDiscordRequest：token 交换与拉用户信息用标准 HttpClient 自己发（Discord 严格要求 form-encoded body + Bearer 头），fastjson 解析； scope 空格预编码成 %20（JustAuth UrlBuilder 不编码，裸空格进 Location 头不安全） - OAuthController 泛化：/oauth/render/{provider} + /api/auth/callback/{provider}， provider 工厂（github 内置 / discord 自定义 / 未知或未配置 → error=oauth_provider， 不 500）；callback 改调 loginByProvider（M1 已就绪） - SaToken 白名单 /oauth/render/* + /api/auth/callback/*（原来按 github 具体路径） - Discord 配置可选（AUTH_DISCORD_ID/SECRET），未配不影响启动；README + .env.example 加 Discord App 注册步骤 登录路径复用 M1 的 loginByProvider（identity 双写 + state cookie 硬化 INV-007）。 全量 269 测试通过（+6：Discord 用户解析/authorize URL/未知/未配置 provider）。 注意（launch 前）：尚无绑定流程（M2b），现阶段已有 github 账号的用户用 Discord 登录会新建独立账号（分叉）。ADR 要求"同邮箱提示绑定"随 M2b 前端一起上再开放。 Discord source 的 token 交换需线上真 App 冒烟一次（本地无 Discord 凭据只能单测解析层）。
- requireConfigured 同时检查 client-id 与 secret：只配一半时提前挡在 oauth_provider（配置问题），不再让 token 交换阶段以 oauth_failed 失败误导 - 恢复 render 的调试日志（provider + redirect_uri，均公开信息不含密钥） - OAuthControllerIntegrationTests 加 @TestPropertySource 强制 discord 未配置， 修掉"本机 .env 有真实 AUTH_DISCORD_ID 时该断言失败"的环境脆弱依赖 全量 269 测试通过（本地含 Discord 凭据的环境）。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
RFC #42 / ADR-001 的 M3 后端。"接入 Discord 登录"里唯一的新技术活。
做了什么
DiscordAuthSource+AuthDiscordRequest。token 交换 / 拉/users/@me用标准HttpClient自己发（Discord 严格要求application/x-www-form-urlencodedbody +Bearer头），fastjson 解析。scope 空格预编码%20（JustAuthUrlBuilder不编码，裸空格进Location头不安全）。/oauth/render/{provider}+/api/auth/callback/{provider}，provider 工厂（github 内置 / discord 自定义 / 未知或未配置 →error=oauth_provider，不 500）。callback 改调loginByProvider（M1 就绪）。/oauth/render/*+/api/auth/callback/*。AUTH_DISCORD_ID/SECRET不填不影响启动；README +.env.example加 Discord App 注册步骤。验证
/users/@me→AuthUser 映射（含 global_name 回退、avatar 拼接、缺 id 抛错）、authorize URL 带 scope/client_id、未知 provider → 错误重定向、未配置 discord → 错误重定向、github 原路径不回归。Launch 前必须知道
${AUTH_URL}/api/auth/callback/discord，scope identify+email）。🤖 Generated with Claude Code
https://claude.ai/code/session_01RtSNVtrEkCsFVHrbt4Zjgi