387 lines
14 KiB
TypeScript
387 lines
14 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
||
import { db } from "@/lib/db";
|
||
import { getAuthSettings, getUser } from "@/lib/db/queries";
|
||
import { loginToken, user } from "@/lib/db/schema";
|
||
import { generateUUID } from "@/lib/utils";
|
||
import { signIn } from "@/app/(auth)/auth";
|
||
import { eq } from "drizzle-orm";
|
||
import { createLogger } from "@/lib/observability/logger";
|
||
|
||
const logger = createLogger("dingtalk-callback");
|
||
const normalizeCallbackUrl = (value: unknown) => {
|
||
if (typeof value !== "string" || !value) return "/";
|
||
|
||
try {
|
||
const parsed = new URL(value, "https://local.invalid");
|
||
if (parsed.origin !== "https://local.invalid") return "/";
|
||
return `${parsed.pathname}${parsed.search}${parsed.hash}` || "/";
|
||
} catch {
|
||
return "/";
|
||
}
|
||
};
|
||
|
||
const parseDingTalkState = (state: string | null) => {
|
||
if (!state) {
|
||
return { org: undefined as string | undefined, callbackUrl: "/" };
|
||
}
|
||
|
||
if (state.startsWith("v1.")) {
|
||
try {
|
||
const payload = JSON.parse(
|
||
Buffer.from(state.slice(3), "base64url").toString("utf8"),
|
||
) as { org?: unknown; callbackUrl?: unknown };
|
||
|
||
return {
|
||
org:
|
||
typeof payload.org === "string" && payload.org !== "default"
|
||
? payload.org
|
||
: undefined,
|
||
callbackUrl: normalizeCallbackUrl(payload.callbackUrl),
|
||
};
|
||
} catch (error) {
|
||
logger.warn("[DingTalk Callback] Failed to parse state payload:", error);
|
||
}
|
||
}
|
||
|
||
return {
|
||
org: state !== "default" ? state : undefined,
|
||
callbackUrl: "/",
|
||
};
|
||
};
|
||
|
||
export async function GET(request: NextRequest) {
|
||
const { searchParams } = new URL(request.url);
|
||
const code = searchParams.get("code");
|
||
const state = searchParams.get("state");
|
||
const dingTalkState = parseDingTalkState(state);
|
||
|
||
logger.debug("[DingTalk Callback] Received callback", {
|
||
hasCode: Boolean(code),
|
||
hasState: Boolean(state),
|
||
hasOrg: Boolean(dingTalkState.org),
|
||
});
|
||
|
||
if (!code) {
|
||
return NextResponse.json({ success: false, error: "Missing code" }, { status: 400 });
|
||
}
|
||
|
||
const settings = await getAuthSettings();
|
||
if (!settings.isDingTalkEnabled) {
|
||
return NextResponse.json(
|
||
{ success: false, error: "DingTalk login is not configured" },
|
||
{ status: 400 },
|
||
);
|
||
}
|
||
|
||
const organizations = settings.dingTalkOrganizations ?? [];
|
||
const selectedOrg = dingTalkState.org
|
||
? organizations.find((org) => org.name === dingTalkState.org)
|
||
: organizations[0];
|
||
|
||
const appKey = selectedOrg?.appKey ?? settings.dingTalkAppKey;
|
||
const appSecret = selectedOrg?.appSecret ?? settings.dingTalkAppSecret;
|
||
|
||
if (!appKey || !appSecret) {
|
||
return NextResponse.json(
|
||
{ success: false, error: "DingTalk appKey/appSecret is not configured" },
|
||
{ status: 400 },
|
||
);
|
||
}
|
||
|
||
try {
|
||
// 1. 获取 userAccessToken
|
||
logger.debug("[DingTalk Callback] Getting user access token...");
|
||
const tokenResponse = await fetch(
|
||
"https://api.dingtalk.com/v1.0/oauth2/userAccessToken",
|
||
{
|
||
method: "POST",
|
||
headers: { "Content-Type": "application/json" },
|
||
body: JSON.stringify({
|
||
clientId: appKey,
|
||
clientSecret: appSecret,
|
||
code,
|
||
grantType: "authorization_code",
|
||
}),
|
||
},
|
||
);
|
||
|
||
const tokenData = await tokenResponse.json();
|
||
logger.debug("[DingTalk Callback] Token response received", {
|
||
ok: Boolean(tokenData.accessToken),
|
||
status: tokenResponse.status,
|
||
});
|
||
|
||
if (!tokenData.accessToken) {
|
||
logger.error("[DingTalk Callback] Token exchange failed", {
|
||
status: tokenResponse.status,
|
||
hasMessage: Boolean(tokenData.message),
|
||
});
|
||
return NextResponse.json({ success: false, error: "Failed to get access token: " + (tokenData.message || JSON.stringify(tokenData)) }, { status: 400 });
|
||
}
|
||
|
||
// 2. 获取用户 unionId
|
||
logger.debug("[DingTalk Callback] Getting user unionId...");
|
||
const userMeResponse = await fetch("https://api.dingtalk.com/v1.0/contact/users/me", {
|
||
headers: {
|
||
"x-acs-dingtalk-access-token": tokenData.accessToken,
|
||
},
|
||
});
|
||
|
||
const userMeData = await userMeResponse.json();
|
||
logger.debug("[DingTalk Callback] User identity response received", {
|
||
ok: Boolean(userMeData.unionId),
|
||
status: userMeResponse.status,
|
||
});
|
||
|
||
if (!userMeData.unionId) {
|
||
logger.error("[DingTalk Callback] User identity lookup failed", {
|
||
status: userMeResponse.status,
|
||
});
|
||
return NextResponse.json({ success: false, error: "Failed to get user unionId" }, { status: 400 });
|
||
}
|
||
|
||
// 3. 获取应用访问令牌 (用于获取更详细的用户信息)
|
||
logger.debug("[DingTalk Callback] Getting app access token...");
|
||
const appTokenResponse = await fetch(
|
||
`https://oapi.dingtalk.com/gettoken?appkey=${encodeURIComponent(
|
||
appKey,
|
||
)}&appsecret=${encodeURIComponent(appSecret)}`,
|
||
);
|
||
const appTokenData = await appTokenResponse.json();
|
||
|
||
if (!appTokenData.access_token) {
|
||
logger.error("[DingTalk Callback] App token lookup failed", {
|
||
status: appTokenResponse.status,
|
||
hasMessage: Boolean(appTokenData.message),
|
||
});
|
||
return NextResponse.json({ success: false, error: "Failed to get app access token" }, { status: 400 });
|
||
}
|
||
|
||
// 4. 根据 unionId 获取 userId
|
||
logger.debug("[DingTalk Callback] Getting userId by unionId...");
|
||
const userIdResponse = await fetch(`https://oapi.dingtalk.com/topapi/user/getbyunionid?access_token=${appTokenData.access_token}`, {
|
||
method: "POST",
|
||
headers: { "Content-Type": "application/json" },
|
||
body: JSON.stringify({ unionid: userMeData.unionId }),
|
||
});
|
||
const userIdData = await userIdResponse.json();
|
||
logger.debug("[DingTalk Callback] UserId response received", {
|
||
ok: Boolean(userIdData.result?.userid),
|
||
status: userIdResponse.status,
|
||
});
|
||
|
||
let userInfo: any = {
|
||
unionId: userMeData.unionId,
|
||
nick: userMeData.nick,
|
||
avatarUrl: userMeData.avatarUrl,
|
||
};
|
||
|
||
// 如果能获取到 userId，则获取更详细的用户信息
|
||
if (userIdData.result && userIdData.result.userid) {
|
||
logger.debug("[DingTalk Callback] Getting detailed user info...");
|
||
const detailResponse = await fetch(`https://oapi.dingtalk.com/topapi/v2/user/get?access_token=${appTokenData.access_token}`, {
|
||
method: "POST",
|
||
headers: { "Content-Type": "application/json" },
|
||
body: JSON.stringify({ userid: userIdData.result.userid }),
|
||
});
|
||
const detailData = await detailResponse.json();
|
||
|
||
if (detailData.result) {
|
||
// 获取部门名称
|
||
let departmentNames: string[] = [];
|
||
const deptIdList = detailData.result.dept_id_list || [];
|
||
|
||
if (deptIdList.length > 0) {
|
||
logger.debug("[DingTalk Callback] Getting department info", {
|
||
departmentCount: deptIdList.length,
|
||
});
|
||
try {
|
||
// 获取每个部门的详细信息
|
||
for (const deptId of deptIdList) {
|
||
const deptResponse = await fetch(`https://oapi.dingtalk.com/topapi/v2/department/get?access_token=${appTokenData.access_token}`, {
|
||
method: "POST",
|
||
headers: { "Content-Type": "application/json" },
|
||
body: JSON.stringify({ dept_id: deptId }),
|
||
});
|
||
const deptData = await deptResponse.json();
|
||
if (deptData.result && deptData.result.name) {
|
||
departmentNames.push(deptData.result.name);
|
||
}
|
||
}
|
||
logger.debug("[DingTalk Callback] Department info resolved", {
|
||
departmentCount: departmentNames.length,
|
||
});
|
||
} catch (deptError) {
|
||
logger.error("[DingTalk Callback] Failed to get department info:", deptError);
|
||
}
|
||
}
|
||
|
||
userInfo = {
|
||
...userInfo,
|
||
userId: userIdData.result.userid,
|
||
name: detailData.result.name,
|
||
email: detailData.result.email,
|
||
mobile: detailData.result.mobile,
|
||
avatar: detailData.result.avatar,
|
||
jobNumber: detailData.result.job_number,
|
||
title: detailData.result.title, // 职位
|
||
deptIdList: deptIdList,
|
||
departmentNames: departmentNames, // 部门名称列表
|
||
};
|
||
}
|
||
}
|
||
|
||
logger.debug("[DingTalk Callback] Final user info resolved", {
|
||
hasEmail: Boolean(userInfo.email),
|
||
hasName: Boolean(userInfo.name || userInfo.nick),
|
||
hasMobile: Boolean(userInfo.mobile),
|
||
departmentCount: userInfo.departmentNames?.length || 0,
|
||
});
|
||
|
||
// 5. 查找或创建用户
|
||
// 使用 unionId 作为唯一标识，email 可能为空
|
||
const email = userInfo.email || `dingtalk_${userInfo.unionId}@dingtalk.local`;
|
||
logger.debug("[DingTalk Callback] Checking user", {
|
||
hasEmail: Boolean(email),
|
||
isSyntheticEmail: !userInfo.email,
|
||
});
|
||
|
||
// 检查用户是否存在（直接使用 Drizzle 查询，不通过 getUser）
|
||
let existingUsers;
|
||
try {
|
||
existingUsers = await db
|
||
.select()
|
||
.from(user)
|
||
.where(eq(user.email, email));
|
||
logger.debug("[DingTalk Callback] User found:", existingUsers.length > 0);
|
||
if (existingUsers.length > 0) {
|
||
logger.debug("[DingTalk Callback] User details:", {
|
||
id: existingUsers[0].id,
|
||
hasEmail: Boolean(existingUsers[0].email),
|
||
hasName: Boolean(existingUsers[0].name),
|
||
isActive: existingUsers[0].isActive
|
||
});
|
||
}
|
||
} catch (error) {
|
||
logger.error("[DingTalk Callback] Error querying user:", error);
|
||
throw error;
|
||
}
|
||
|
||
// 组合部门信息为字符串
|
||
const departmentStr = userInfo.departmentNames?.length > 0
|
||
? userInfo.departmentNames.join(" / ")
|
||
: null;
|
||
logger.debug("[DingTalk Callback] Department string resolved", {
|
||
hasDepartment: Boolean(departmentStr),
|
||
});
|
||
|
||
// 获取钉钉用户ID
|
||
const dingtalkUserId = userInfo.userId || null;
|
||
logger.debug("[DingTalk Callback] DingTalk user id resolved", {
|
||
hasUserId: Boolean(dingtalkUserId),
|
||
});
|
||
|
||
if (existingUsers.length === 0) {
|
||
// 创建新用户
|
||
logger.debug("[DingTalk Callback] Creating new user", {
|
||
hasName: Boolean(userInfo.name || userInfo.nick),
|
||
hasDepartment: Boolean(departmentStr),
|
||
hasDingTalkUserId: Boolean(dingtalkUserId),
|
||
});
|
||
try {
|
||
await db.insert(user).values({
|
||
email,
|
||
password: "", // 钉钉用户无密码
|
||
name: userInfo.name || userInfo.nick, // 保存真实姓名或昵称
|
||
department: departmentStr, // 保存部门信息
|
||
dingtalkUserId: dingtalkUserId, // 保存钉钉用户ID
|
||
role: "regular",
|
||
isActive: true,
|
||
});
|
||
logger.debug("[DingTalk Callback] User created successfully", {
|
||
hasDepartment: Boolean(departmentStr),
|
||
hasDingTalkUserId: Boolean(dingtalkUserId),
|
||
});
|
||
// 重新查询用户
|
||
existingUsers = await db
|
||
.select()
|
||
.from(user)
|
||
.where(eq(user.email, email));
|
||
} catch (error) {
|
||
logger.error("[DingTalk Callback] Error creating user:", error);
|
||
throw error;
|
||
}
|
||
} else {
|
||
// 更新现有用户的姓名、部门信息和钉钉用户ID
|
||
const existingUser = existingUsers[0];
|
||
logger.debug("[DingTalk Callback] Existing user found", {
|
||
hasName: Boolean(existingUser.name),
|
||
hasDepartment: Boolean((existingUser as any).department),
|
||
});
|
||
|
||
const updateData: Record<string, string | null> = {};
|
||
|
||
// 更新姓名（如果数据库中为空但钉钉有数据）
|
||
if (!existingUser.name && (userInfo.name || userInfo.nick)) {
|
||
updateData.name = userInfo.name || userInfo.nick;
|
||
}
|
||
|
||
// 每次登录都更新部门信息（部门可能变化）
|
||
if (departmentStr) {
|
||
updateData.department = departmentStr;
|
||
}
|
||
|
||
// 更新钉钉用户ID（如果数据库中为空）
|
||
if (!(existingUser as any).dingtalkUserId && dingtalkUserId) {
|
||
updateData.dingtalkUserId = dingtalkUserId;
|
||
}
|
||
|
||
if (Object.keys(updateData).length > 0) {
|
||
logger.debug("[DingTalk Callback] Updating user info", {
|
||
fields: Object.keys(updateData),
|
||
});
|
||
try {
|
||
await db.update(user)
|
||
.set(updateData)
|
||
.where(eq(user.email, email));
|
||
logger.debug("[DingTalk Callback] User info updated successfully");
|
||
} catch (error) {
|
||
logger.error("[DingTalk Callback] Error updating user info:", error);
|
||
// 不抛出错误，继续登录流程
|
||
}
|
||
}
|
||
}
|
||
|
||
// 6. 生成临时登录令牌
|
||
const token = generateUUID();
|
||
await db.insert(loginToken).values({
|
||
token,
|
||
email,
|
||
expiresAt: new Date(Date.now() + 5 * 60 * 1000), // 5分钟有效期
|
||
});
|
||
|
||
logger.debug("[DingTalk Callback] Login successful", {
|
||
isSyntheticEmail: !userInfo.email,
|
||
});
|
||
|
||
// 7. 返回成功响应（给 iframe 中的回调页面）
|
||
return NextResponse.json({
|
||
success: true,
|
||
message: "登录成功",
|
||
user: {
|
||
email,
|
||
name: userInfo.name || userInfo.nick,
|
||
avatar: userInfo.avatar || userInfo.avatarUrl,
|
||
title: userInfo.title,
|
||
departments: userInfo.departmentNames || [],
|
||
},
|
||
token,
|
||
callbackUrl: dingTalkState.callbackUrl,
|
||
});
|
||
|
||
} catch (error) {
|
||
logger.error("[DingTalk Callback] Error:", error);
|
||
return NextResponse.json({ success: false, error: "Internal server error: " + (error as Error).message }, { status: 500 });
|
||
}
|
||
}
|