适配钉钉端内免登Cookie策略

lib/dingtalk-login.ts

@@ -254,6 +254,9 @@ async function createAuthenticatedResponse(
     avatar?: string | null
     isSuperAdmin?: boolean | null
   },
+  options?: {
+    cookieSameSite?: 'lax' | 'none'
+  },
 ) {
   const secret = process.env.NEXTAUTH_SECRET
   if (!secret) {
@@ -266,6 +269,7 @@ async function createAuthenticatedResponse(
   const cookieNames = secureCookie
     ? getAuthSessionCookieCandidates(true)
     : [cookieName]
+  const sameSite = options?.cookieSameSite === 'none' && secureCookie ? 'none' : 'lax'
   const sessionToken = await encode({
     secret,
     maxAge,
@@ -300,7 +304,7 @@ async function createAuthenticatedResponse(
 
   response.cookies.set(cookieName, sessionToken, {
     httpOnly: true,
-    sameSite: 'lax',
+    sameSite,
     secure: secureCookie,
     path: '/',
     maxAge,
@@ -313,7 +317,7 @@ async function createAuthenticatedResponse(
 
     response.cookies.set(name, sessionToken, {
       httpOnly: true,
-      sameSite: 'lax',
+      sameSite,
       secure: secureCookie,
       path: '/',
       maxAge,
@@ -327,6 +331,9 @@ async function createOrUpdateUserSession(
   request: NextRequest,
   userId: string,
   userInfo: DingtalkUserInfo,
+  options?: {
+    cookieSameSite?: 'lax' | 'none'
+  },
 ) {
   const displayName = String(userInfo.name || '').trim()
   if (!displayName) {
@@ -474,7 +481,7 @@ async function createOrUpdateUserSession(
     managedDepartment: user.managedDepartment,
     avatar: user.avatar,
     isSuperAdmin: (user as any).isSuperAdmin ?? false,
-  })
+  }, options)
 }
 
 function getAppAccessToken(appSource: DingtalkLoginAppSource) {
@@ -669,5 +676,7 @@ export async function loginDingtalkUserByH5AuthCode(
   const userInfo = await getUserInfo(userId, appAccessToken)
   console.log('获取用户信息成功:', userInfo.name)
 
-  return createOrUpdateUserSession(request, userId, userInfo)
+  return createOrUpdateUserSession(request, userId, userInfo, {
+    cookieSameSite: 'none',
+  })
 }