49 lines
1.5 KiB
TypeScript
49 lines
1.5 KiB
TypeScript
import { NextRequest, NextResponse } from 'next/server'
|
|
import {
|
|
createDingtalkLoginHandoff,
|
|
DINGTALK_LOGIN_HANDOFF_COOKIE,
|
|
} from '@/lib/dingtalk-login-handoff'
|
|
import { getTrustedDingtalkReturnOriginFromRequest } from '@/lib/dingtalk-return-origin'
|
|
import { normalizeInternalRedirectPath } from '@/lib/safe-redirect'
|
|
import { resolveSecureAuthCookieFromRequest } from '@/lib/auth-cookie'
|
|
|
|
export const runtime = 'nodejs'
|
|
export const dynamic = 'force-dynamic'
|
|
|
|
export async function POST(request: NextRequest) {
|
|
const trustedOrigin = getTrustedDingtalkReturnOriginFromRequest(request)
|
|
|
|
// 公网登录不需要、也不能创建内网回跳票据；保持既有的公网登录流程。
|
|
if (!trustedOrigin) {
|
|
return NextResponse.json(
|
|
{ success: true, enabled: false },
|
|
{ headers: { 'Cache-Control': 'no-store' } },
|
|
)
|
|
}
|
|
|
|
const body = await request.json().catch(() => ({}))
|
|
const handoff = await createDingtalkLoginHandoff({
|
|
returnOrigin: trustedOrigin,
|
|
redirectPath: normalizeInternalRedirectPath(body?.redirectPath),
|
|
})
|
|
|
|
const response = NextResponse.json(
|
|
{
|
|
success: true,
|
|
enabled: true,
|
|
handoffId: handoff.id,
|
|
},
|
|
{ headers: { 'Cache-Control': 'no-store' } },
|
|
)
|
|
|
|
response.cookies.set(DINGTALK_LOGIN_HANDOFF_COOKIE, handoff.binding, {
|
|
httpOnly: true,
|
|
sameSite: 'lax',
|
|
secure: resolveSecureAuthCookieFromRequest(request),
|
|
path: '/api/dingtalk/session-ticket',
|
|
maxAge: 5 * 60,
|
|
})
|
|
|
|
return response
|
|
}
|