feat(oauth): add the seven missing providers and open the full aggregate list
The theme shipped six direct providers while the reference carries fourteen, and its aggregate-login channel offered three of sixteen platforms. OAuthProviderClient now owns the providers the bundled SDK does not cover. Douyin, Microsoft, Facebook, Twitter and Apple talk to their documented OAuth2 endpoints directly; Baidu and Alipay reuse yurunsoft, which already ships both (Alipay needs its application private key, so provider_config learned an extra_keys map to surface it). The broker dispatches through handles(), so the existing start/callback routes stay provider-agnostic. Three provider quirks needed handling rather than a plain copy: Apple returns the callback as response_mode=form_post, and handle_callback only read $_GET, so it now reads $_POST when the request is a POST — otherwise every Apple login would fail with code_missing. Its client secret is built as an ES256 JWT from Team ID / Key ID / .p8 rather than a static string. Twitter requires PKCE. The verifier is derived from the state token, so it travels with the existing transaction row and needs no extra storage. Facebook hands back protocol-less avatar URLs, which are upgraded to https the same way the OAuth avatar resolver does. Settings gained matching toggles and credential groups on both sides — the PHP schema and the Vue schema — and the aggregate platform list went from three to sixteen, with CLoginClient's hard-coded allowlist replaced by the catalog constant. Brand icons were extended so each new provider resolves to its sprite; facebook and twitter moved to their colour sprites, and the `twitter -> x` alias was dropped since it bypassed the new mapping. The oauth-security contract previously asserted that Baidu and Alipay must not appear on the OAuth surface. That was the old intent, so the assertion is replaced with a positive one, keeping the separate check that the Alipay payment gateway still exists. Verification: a new harness stubs the HTTP layer and drives all five custom clients — authorization URLs carry redirect/state (Twitter also a PKCE challenge), identities normalize to the shared shape, Facebook's avatar is upgraded to https, Apple's private-relay email survives, and an error payload throws instead of yielding an empty identity. 871 widget/navigation tests pass and the PSR-4 audit reports 0 errors. Not covered: no live handshake happened — every provider needs real AppID and secret pairs, and Apple/Douyin require developer-account review before the full round trip can be exercised.
This commit is contained in:
kate522 committed
1 parent
6f29e3d865
commit
6db34646ed
11 files changed
+939
-28
No files matched your search
@@ -327,6 +327,13 @@ class SchemaUsers {
|
||||
['label' => 'Google', 'value' => 'google'],
|
||||
['label' => '微博', 'value' => 'weibo'],
|
||||
['label' => '微信', 'value' => 'weixin'],
|
||||
['label' => '抖音', 'value' => 'douyin'],
|
||||
['label' => '百度', 'value' => 'baidu'],
|
||||
['label' => '支付宝', 'value' => 'alipay'],
|
||||
['label' => 'Microsoft', 'value' => 'microsoft'],
|
||||
['label' => 'Facebook', 'value' => 'facebook'],
|
||||
['label' => 'Twitter', 'value' => 'twitter'],
|
||||
['label' => 'Apple', 'value' => 'apple'],
|
||||
], 'dependsOn' => ['key' => 'oauth_proxy_mode', 'value' => 'server']],
|
||||
['key' => 'oauth_proxy_client_providers', 'label' => '客户端启用平台', 'type' => 'checkbox', 'default' => ['github', 'gitee', 'qq', 'google'], 'options' => [
|
||||
['label' => 'GitHub', 'value' => 'github'],
|
||||
@@ -335,6 +342,13 @@ class SchemaUsers {
|
||||
['label' => 'Google', 'value' => 'google'],
|
||||
['label' => '微博', 'value' => 'weibo'],
|
||||
['label' => '微信', 'value' => 'weixin'],
|
||||
['label' => '抖音', 'value' => 'douyin'],
|
||||
['label' => '百度', 'value' => 'baidu'],
|
||||
['label' => '支付宝', 'value' => 'alipay'],
|
||||
['label' => 'Microsoft', 'value' => 'microsoft'],
|
||||
['label' => 'Facebook', 'value' => 'facebook'],
|
||||
['label' => 'Twitter', 'value' => 'twitter'],
|
||||
['label' => 'Apple', 'value' => 'apple'],
|
||||
], 'dependsOn' => ['key' => 'oauth_proxy_mode', 'value' => 'client']],
|
||||
['key' => 'oauth_bind_type', 'label' => '绑定方式', 'type' => 'radio', 'default' => 'auto', 'options' => [
|
||||
['label' => '自动绑定', 'value' => 'auto'],
|
||||
@@ -351,6 +365,13 @@ class SchemaUsers {
|
||||
['key' => 'oauth_weibo_s', 'label' => '微博登录', 'type' => 'switch', 'default' => false],
|
||||
['key' => 'oauth_weixin_s', 'label' => '微信开放平台登录', 'type' => 'switch', 'default' => false],
|
||||
['key' => 'oauth_weixingzh_s', 'label' => '微信公众号登录', 'type' => 'switch', 'default' => false],
|
||||
['key' => 'oauth_douyin_s', 'label' => '抖音登录', 'type' => 'switch', 'default' => false],
|
||||
['key' => 'oauth_baidu_s', 'label' => '百度登录', 'type' => 'switch', 'default' => false],
|
||||
['key' => 'oauth_alipay_s', 'label' => '支付宝登录', 'type' => 'switch', 'default' => false],
|
||||
['key' => 'oauth_microsoft_s', 'label' => 'Microsoft 登录', 'type' => 'switch', 'default' => false],
|
||||
['key' => 'oauth_facebook_s', 'label' => 'Facebook 登录', 'type' => 'switch', 'default' => false],
|
||||
['key' => 'oauth_twitter_s', 'label' => 'Twitter 登录', 'type' => 'switch', 'default' => false],
|
||||
['key' => 'oauth_apple_s', 'label' => 'Apple 登录', 'type' => 'switch', 'default' => false],
|
||||
['key' => 'clogin_s', 'label' => '彩虹聚合登录', 'type' => 'switch', 'default' => false, 'help' => '通过第三方聚合登录平台统一接入 QQ、微信和微博'],
|
||||
]],
|
||||
['key' => 'github', 'title' => 'GitHub配置', 'collapsible' => true, 'defaultCollapsed' => true, 'fields' => [
|
||||
@@ -377,6 +398,38 @@ class SchemaUsers {
|
||||
['key' => 'weixin_appid', 'label' => 'AppID', 'type' => 'input', 'default' => ''],
|
||||
['key' => 'weixin_appsecret', 'label' => 'AppSecret', 'type' => 'input', 'inputType' => 'password', 'secret' => true, 'default' => ''],
|
||||
]],
|
||||
['key' => 'douyin', 'title' => '抖音配置', 'collapsible' => true, 'defaultCollapsed' => true, 'fields' => [
|
||||
['key' => 'douyin_appid', 'label' => 'Client Key', 'type' => 'input', 'default' => ''],
|
||||
['key' => 'douyin_appkey', 'label' => 'Client Secret', 'type' => 'input', 'inputType' => 'password', 'secret' => true, 'default' => ''],
|
||||
]],
|
||||
['key' => 'baidu', 'title' => '百度配置', 'collapsible' => true, 'defaultCollapsed' => true, 'fields' => [
|
||||
['key' => 'baidu_appid', 'label' => 'API Key', 'type' => 'input', 'default' => ''],
|
||||
['key' => 'baidu_appkey', 'label' => 'Secret Key', 'type' => 'input', 'inputType' => 'password', 'secret' => true, 'default' => ''],
|
||||
]],
|
||||
['key' => 'alipay', 'title' => '支付宝配置', 'collapsible' => true, 'defaultCollapsed' => true, 'fields' => [
|
||||
['key' => 'alipay_appid', 'label' => 'App ID', 'type' => 'input', 'default' => ''],
|
||||
['key' => 'alipay_appkey', 'label' => '支付宝公钥', 'type' => 'textarea', 'default' => ''],
|
||||
['key' => 'alipay_private_key', 'label' => '应用私钥', 'type' => 'textarea', 'secret' => true, 'default' => '', 'help' => 'RSA2 签名使用的应用私钥（PKCS8 格式）'],
|
||||
]],
|
||||
['key' => 'microsoft', 'title' => 'Microsoft 配置', 'collapsible' => true, 'defaultCollapsed' => true, 'fields' => [
|
||||
['key' => 'microsoft_appid', 'label' => 'Application (client) ID', 'type' => 'input', 'default' => ''],
|
||||
['key' => 'microsoft_appkey', 'label' => 'Client Secret', 'type' => 'input', 'inputType' => 'password', 'secret' => true, 'default' => ''],
|
||||
]],
|
||||
['key' => 'facebook', 'title' => 'Facebook 配置', 'collapsible' => true, 'defaultCollapsed' => true, 'fields' => [
|
||||
['key' => 'facebook_appid', 'label' => 'App ID', 'type' => 'input', 'default' => ''],
|
||||
['key' => 'facebook_appkey', 'label' => 'App Secret', 'type' => 'input', 'inputType' => 'password', 'secret' => true, 'default' => ''],
|
||||
]],
|
||||
['key' => 'twitter', 'title' => 'Twitter 配置', 'collapsible' => true, 'defaultCollapsed' => true, 'fields' => [
|
||||
['key' => 'twitter_appid', 'label' => 'Client ID', 'type' => 'input', 'default' => ''],
|
||||
['key' => 'twitter_appkey', 'label' => 'Client Secret', 'type' => 'input', 'inputType' => 'password', 'secret' => true, 'default' => ''],
|
||||
]],
|
||||
['key' => 'apple', 'title' => 'Apple 配置', 'collapsible' => true, 'defaultCollapsed' => true, 'fields' => [
|
||||
['key' => 'apple_appid', 'label' => 'Service ID', 'type' => 'input', 'default' => ''],
|
||||
['key' => 'apple_appkey', 'label' => '备用 Secret', 'type' => 'input', 'inputType' => 'password', 'secret' => true, 'default' => ''],
|
||||
['key' => 'apple_team_id', 'label' => 'Team ID', 'type' => 'input', 'default' => ''],
|
||||
['key' => 'apple_key_id', 'label' => 'Key ID', 'type' => 'input', 'default' => ''],
|
||||
['key' => 'apple_private_key', 'label' => '私钥（.p8）', 'type' => 'textarea', 'secret' => true, 'default' => '', 'help' => '用于生成 client_secret 的 ES256 私钥'],
|
||||
]],
|
||||
['key' => 'weixingzh', 'title' => '微信公众号配置', 'collapsible' => true, 'defaultCollapsed' => true, 'fields' => [
|
||||
['key' => 'weixingzh_gzh_type', 'label' => '公众号类型', 'type' => 'radio', 'default' => 'service', 'options' => [
|
||||
['label' => '服务号', 'value' => 'service'],
|
||||
@@ -398,7 +451,20 @@ class SchemaUsers {
|
||||
['key' => 'clogin_oauth_s', 'label' => '启用平台', 'type' => 'checkbox', 'default' => ['qq', 'weixin', 'weibo'], 'options' => [
|
||||
['label' => 'QQ', 'value' => 'qq'],
|
||||
['label' => '微信', 'value' => 'weixin'],
|
||||
['label' => '支付宝', 'value' => 'alipay'],
|
||||
['label' => '微博', 'value' => 'weibo'],
|
||||
['label' => '抖音', 'value' => 'douyin'],
|
||||
['label' => '百度', 'value' => 'baidu'],
|
||||
['label' => 'GitHub', 'value' => 'github'],
|
||||
['label' => 'Gitee', 'value' => 'gitee'],
|
||||
['label' => '钉钉', 'value' => 'dingtalk'],
|
||||
['label' => '华为', 'value' => 'huawei'],
|
||||
['label' => '小米', 'value' => 'xiaomi'],
|
||||
['label' => 'Google', 'value' => 'google'],
|
||||
['label' => 'Microsoft', 'value' => 'microsoft'],
|
||||
['label' => 'Facebook', 'value' => 'facebook'],
|
||||
['label' => 'Twitter', 'value' => 'twitter'],
|
||||
['label' => 'Apple', 'value' => 'apple'],
|
||||
]],
|
||||
]],
|
||||
],
|
||||
|
||||
Reference in new issue
Block a user