52 lines
1.5 KiB
TypeScript
52 lines
1.5 KiB
TypeScript
import { NextResponse } from "next/server";
|
||
import { getAuthSettings } from "@/lib/db/queries";
|
||
|
||
export async function GET(request: Request) {
|
||
const settings = await getAuthSettings();
|
||
|
||
if (!settings.isDingTalkEnabled) {
|
||
return NextResponse.json(
|
||
{ error: "DingTalk login is not enabled" },
|
||
{ status: 400 },
|
||
);
|
||
}
|
||
|
||
const urlObj = new URL(request.url);
|
||
const orgName = urlObj.searchParams.get("org");
|
||
const organizations = settings.dingTalkOrganizations ?? [];
|
||
|
||
const selectedOrg = orgName
|
||
? organizations.find((org) => org.name === orgName)
|
||
: organizations[0];
|
||
|
||
const appKey = selectedOrg?.appKey ?? settings.dingTalkAppKey;
|
||
|
||
if (!appKey) {
|
||
return NextResponse.json(
|
||
{ error: "DingTalk appKey is not configured" },
|
||
{ status: 400 },
|
||
);
|
||
}
|
||
|
||
// 动态构建回调地址
|
||
// 优先使用 AUTH_URL 环境变量，确保使用正确的公网域名
|
||
const requestUrl = new URL(request.url);
|
||
const baseUrl = process.env.AUTH_URL || requestUrl.origin;
|
||
const redirectUri = `${baseUrl}/dingtalk-callback.html`;
|
||
|
||
// 使用组织名称作为 state，便于回调时选择对应的配置
|
||
const state = orgName || selectedOrg?.name || "default";
|
||
|
||
// 钉钉 OAuth 2.0 授权地址
|
||
const url =
|
||
`https://login.dingtalk.com/oauth2/auth?` +
|
||
`redirect_uri=${encodeURIComponent(redirectUri)}&` +
|
||
`response_type=code&` +
|
||
`client_id=${encodeURIComponent(appKey)}&` +
|
||
`scope=openid&` +
|
||
`state=${encodeURIComponent(state)}&` +
|
||
`prompt=consent`;
|
||
|
||
return NextResponse.redirect(url);
|
||
}
|