mirror of
https://github.com/Wei-Shaw/sub2api.git
synced 2026-11-03 08:40:36 +00:00
Merge pull request #2492 from DaydreamCoding/feat/dingtalk-login
feat(dingtalk): 钉钉 OAuth 登录接入 + internal_only 用户属性同步
This commit is contained in:
54 files changed
+5545
-365
No files matched your search
@@ -461,7 +461,7 @@ export default {
|
||||
invitationCodeInvalid: 'Invalid or used invitation code',
|
||||
invitationCodeValidating: 'Validating invitation code...',
|
||||
invitationCodeInvalidCannotRegister: 'Invalid invitation code. Please check and try again',
|
||||
oauthOrContinue: 'or continue with email',
|
||||
oauthOrContinue: 'or continue with others',
|
||||
linuxdo: {
|
||||
signIn: 'Continue with Linux.do',
|
||||
orContinue: 'or continue with email',
|
||||
@@ -476,6 +476,34 @@ export default {
|
||||
completing: 'Completing registration…',
|
||||
completeRegistrationFailed: 'Registration failed. Please check your invitation code and try again.'
|
||||
},
|
||||
dingtalk: {
|
||||
signIn: 'Continue with DingTalk',
|
||||
callbackTitle: 'Signing you in with DingTalk',
|
||||
callbackProcessing: 'Completing DingTalk login, please wait...',
|
||||
callbackHint: 'If you are not redirected automatically, go back to the login page and try again.',
|
||||
callbackMissingToken: 'Missing login token, please try again.',
|
||||
backToLogin: 'Back to Login',
|
||||
invitationRequired: 'This DingTalk account is not yet registered. The site requires an invitation code — please enter one to complete registration.',
|
||||
invalidPendingToken: 'The registration token has expired. Please sign in with DingTalk again.',
|
||||
completeRegistration: 'Complete Registration',
|
||||
completing: 'Completing registration…',
|
||||
completeRegistrationFailed: 'Registration failed. Please check your invitation code and try again.',
|
||||
createAccountTitle: 'Create DingTalk Account',
|
||||
registrationDisabledRedirectToBind: 'New account registration is currently disabled. Please bind to your existing account with its email and password.',
|
||||
error: {
|
||||
title: 'DingTalk Sign-in Failed',
|
||||
csrf: 'Login session expired, please scan again',
|
||||
corp_rejected: 'Your DingTalk account is not part of this organization. Please contact administrator',
|
||||
dingtalk_not_enabled: 'DingTalk login is not enabled',
|
||||
upstream_error: 'DingTalk service is temporarily unavailable. Please try again later',
|
||||
missing_browser_session: 'Browser session lost. Please login again',
|
||||
missing_params: 'Request parameters are incomplete',
|
||||
invalid_state: 'Invalid login state',
|
||||
provider_error: 'DingTalk authorization failed',
|
||||
session_error: 'Failed to create session. Please retry',
|
||||
retry: 'Retry Login'
|
||||
}
|
||||
},
|
||||
emailOAuth: {
|
||||
signIn: 'Continue with {providerName}'
|
||||
},
|
||||
@@ -524,6 +552,7 @@ export default {
|
||||
wechatNotConfigured: 'WeChat sign-in is not configured yet.'
|
||||
},
|
||||
linuxdoCallbackPageTitle: 'LinuxDo Sign-In Callback',
|
||||
dingtalkCallbackPageTitle: 'DingTalk Sign-In Callback',
|
||||
oidcCallbackPageTitle: 'OIDC Sign-In Callback',
|
||||
oauthCallbackPageTitle: 'OAuth Callback',
|
||||
wechatProviderName: 'WeChat',
|
||||
@@ -1248,6 +1277,7 @@ export default {
|
||||
providers: {
|
||||
email: 'Email',
|
||||
linuxdo: 'LinuxDo',
|
||||
dingtalk: 'DingTalk',
|
||||
oidc: '{providerName}',
|
||||
wechat: 'WeChat',
|
||||
},
|
||||
@@ -5284,6 +5314,47 @@ export default {
|
||||
quickSetCopy: 'Generate & Copy (current site)',
|
||||
redirectUrlSetAndCopied: 'Redirect URL generated and copied to clipboard'
|
||||
},
|
||||
dingtalk: {
|
||||
title: 'DingTalk Login',
|
||||
description: 'Configure DingTalk OAuth for Sub2API end-user login',
|
||||
enable: 'Enable DingTalk Login (Internal Corporate App)',
|
||||
enableHint: 'Show DingTalk login on the login/register pages',
|
||||
clientId: 'Client ID (AppKey)',
|
||||
clientIdPlaceholder: 'e.g., dingxxxxxxxxxxxxxxxx',
|
||||
clientIdHint: 'Get this from the DingTalk Open Platform app details',
|
||||
clientSecret: 'Client Secret (AppSecret)',
|
||||
clientSecretPlaceholder: '********',
|
||||
clientSecretHint: 'Used by backend to exchange tokens (keep it secret)',
|
||||
clientSecretConfiguredPlaceholder: '********',
|
||||
clientSecretConfiguredHint: 'Secret configured. Leave empty to keep the current value.',
|
||||
redirectUrl: 'Redirect URL',
|
||||
redirectUrlPlaceholder: 'https://your-domain.com/api/v1/auth/oauth/dingtalk/callback',
|
||||
redirectUrlHint:
|
||||
'Must match the redirect URL configured in DingTalk Open Platform (must be an absolute http(s) URL)',
|
||||
corpPolicy: {
|
||||
label: 'Corp Restriction Policy',
|
||||
hint: 'Control which DingTalk accounts (orgs) are allowed to sign in',
|
||||
none: 'No restriction (all DingTalk accounts allowed)',
|
||||
internalOnly: 'Internal only (single corp)'
|
||||
},
|
||||
bypassRegistration: 'Enable DingTalk signup',
|
||||
bypassRegistrationHint: 'Allow new users to register via DingTalk even when public registration is disabled.',
|
||||
syncDisplayName: 'Sync DingTalk display name',
|
||||
syncDisplayNameHint: 'Overwrite username with the DingTalk staff name on each login (also stored in the dingtalk_name attribute).',
|
||||
syncCorpEmail: 'Sync corporate email',
|
||||
syncCorpEmailHint: 'Write the DingTalk corporate email to the dingtalk_email attribute on each login (does not change the login email).',
|
||||
syncCorpEmailPermissionHint: 'Requires the OAPI permission "Personal info incl. email (fieldEmail)" to be granted to the app on the DingTalk open platform, otherwise OAPI will not return the email field.',
|
||||
syncDept: 'Sync department',
|
||||
syncDeptHint: 'Write the full DingTalk department path to the dingtalk_department attribute on each login (fetched live each time).',
|
||||
syncDeptPermissionHint: 'Requires the OAPI "Department info read (qyapi_get_department_list)" permission to be granted to the app on the DingTalk open platform, otherwise the department path cannot be resolved.',
|
||||
syncDisplayNameTarget: 'Attribute key',
|
||||
syncDisplayNameTargetHint: 'Defaults to dingtalk_name / DingTalk Name. Saving settings auto-creates the user attribute by the key and display name above (existing definition only has its display name synced).',
|
||||
syncCorpEmailTarget: 'Attribute key',
|
||||
syncCorpEmailTargetHint: 'Defaults to dingtalk_email / DingTalk Corporate Email. Saving settings auto-creates the user attribute by the key and display name above (existing definition only has its display name synced).',
|
||||
syncDeptTarget: 'Attribute key',
|
||||
syncDeptTargetHint: 'Defaults to dingtalk_department / DingTalk Department. Saving settings auto-creates the user attribute by the key and display name above (existing definition only has its display name synced).',
|
||||
syncAttrDisplayName: 'Display name'
|
||||
},
|
||||
oidc: {
|
||||
title: 'OIDC Login',
|
||||
description: 'Configure a standard OIDC provider (for example Keycloak)',
|
||||
|
||||
@@ -460,7 +460,7 @@ export default {
|
||||
invitationCodeInvalid: '邀请码无效或已被使用',
|
||||
invitationCodeValidating: '正在验证邀请码...',
|
||||
invitationCodeInvalidCannotRegister: '邀请码无效，请检查后重试',
|
||||
oauthOrContinue: '或使用邮箱密码继续',
|
||||
oauthOrContinue: '或使用其他继续',
|
||||
linuxdo: {
|
||||
signIn: '使用 Linux.do 登录',
|
||||
orContinue: '或使用邮箱密码继续',
|
||||
@@ -475,6 +475,34 @@ export default {
|
||||
completing: '正在完成注册...',
|
||||
completeRegistrationFailed: '注册失败，请检查邀请码后重试。'
|
||||
},
|
||||
dingtalk: {
|
||||
signIn: '钉钉登录',
|
||||
callbackTitle: '正在完成钉钉登录',
|
||||
callbackProcessing: '正在验证钉钉登录信息，请稍候...',
|
||||
callbackHint: '如果页面未自动跳转，请返回登录页重试。',
|
||||
callbackMissingToken: '登录信息缺失，请返回重试。',
|
||||
backToLogin: '返回登录',
|
||||
invitationRequired: '该钉钉账号尚未注册，站点已开启邀请码注册，请输入邀请码以完成注册。',
|
||||
invalidPendingToken: '注册凭证已失效，请重新使用钉钉登录。',
|
||||
completeRegistration: '完成注册',
|
||||
completing: '正在完成注册...',
|
||||
completeRegistrationFailed: '注册失败，请检查邀请码后重试。',
|
||||
createAccountTitle: '创建钉钉账户',
|
||||
registrationDisabledRedirectToBind: '当前已禁止注册新账户，请使用已有账户邮箱和密码绑定钉钉登录',
|
||||
error: {
|
||||
title: '钉钉登录失败',
|
||||
csrf: '登录会话已过期，请重新扫码登录',
|
||||
corp_rejected: '您的钉钉账号不属于本企业，请联系管理员',
|
||||
dingtalk_not_enabled: '钉钉登录暂未启用',
|
||||
upstream_error: '钉钉服务暂时不可用，请稍后重试',
|
||||
missing_browser_session: '浏览器会话丢失，请重新登录',
|
||||
missing_params: '请求参数不完整',
|
||||
invalid_state: '登录状态异常',
|
||||
provider_error: '钉钉授权失败',
|
||||
session_error: '会话创建失败，请重试',
|
||||
retry: '重新登录'
|
||||
}
|
||||
},
|
||||
emailOAuth: {
|
||||
signIn: '使用 {providerName} 登录'
|
||||
},
|
||||
@@ -522,6 +550,7 @@ export default {
|
||||
wechatNotConfigured: '微信登录尚未配置。'
|
||||
},
|
||||
linuxdoCallbackPageTitle: 'LinuxDo 登录回调',
|
||||
dingtalkCallbackPageTitle: '钉钉登录回调',
|
||||
oidcCallbackPageTitle: 'OIDC 登录回调',
|
||||
oauthCallbackPageTitle: 'OAuth 回调',
|
||||
wechatProviderName: '微信',
|
||||
@@ -1252,6 +1281,7 @@ export default {
|
||||
providers: {
|
||||
email: '邮箱',
|
||||
linuxdo: 'LinuxDo',
|
||||
dingtalk: '钉钉',
|
||||
oidc: '{providerName}',
|
||||
wechat: '微信',
|
||||
},
|
||||
@@ -5447,6 +5477,46 @@ export default {
|
||||
quickSetCopy: '使用当前站点生成并复制',
|
||||
redirectUrlSetAndCopied: '已使用当前站点生成回调地址并复制到剪贴板'
|
||||
},
|
||||
dingtalk: {
|
||||
title: '钉钉登录',
|
||||
description: '配置钉钉 OAuth，用于 Sub2API 用户登录',
|
||||
enable: '启用钉钉登录-企业内部应用',
|
||||
enableHint: '在登录/注册页面显示钉钉登录入口',
|
||||
clientId: 'Client ID（AppKey）',
|
||||
clientIdPlaceholder: '例如：dingxxxxxxxxxxxxxxxx',
|
||||
clientIdHint: '从钉钉开放平台应用详情页获取',
|
||||
clientSecret: 'Client Secret（AppSecret）',
|
||||
clientSecretPlaceholder: '********',
|
||||
clientSecretHint: '用于后端交换 token（请保密）',
|
||||
clientSecretConfiguredPlaceholder: '********',
|
||||
clientSecretConfiguredHint: '密钥已配置，留空以保留当前值。',
|
||||
redirectUrl: '回调地址（Redirect URL）',
|
||||
redirectUrlPlaceholder: 'https://your-domain.com/api/v1/auth/oauth/dingtalk/callback',
|
||||
redirectUrlHint: '需与钉钉开放平台中配置的回调地址一致（必须是 http(s) 完整 URL）',
|
||||
corpPolicy: {
|
||||
label: '企业限制策略',
|
||||
hint: '控制哪些钉钉账号（企业）可以登录',
|
||||
none: '不限制（所有钉钉账号均可登录）',
|
||||
internalOnly: '仅本企业（Internal Only）'
|
||||
},
|
||||
bypassRegistration: '开放钉钉注册',
|
||||
bypassRegistrationHint: '即使「开放注册」关闭时也可以通过钉钉登录来注册',
|
||||
syncDisplayName: '同步钉钉姓名',
|
||||
syncDisplayNameHint: '登录时将钉钉姓名写入 username 字段（同时记录到 dingtalk_name 属性）',
|
||||
syncCorpEmail: '同步企业邮箱',
|
||||
syncCorpEmailHint: '登录时将钉钉企业邮箱写入 dingtalk_email 属性（不影响登录邮箱）',
|
||||
syncCorpEmailPermissionHint: '需在钉钉开放平台 → 应用 → 权限管理中为本应用申请「邮箱等个人信息（fieldEmail）」权限，否则 OAPI 不会返回企业邮箱字段',
|
||||
syncDept: '同步部门',
|
||||
syncDeptHint: '登录时将钉钉首个部门完整路径写入 dingtalk_department 属性（每次登录实时拉取）',
|
||||
syncDeptPermissionHint: '需在钉钉开放平台 → 应用 → 权限管理中为本应用申请「通讯录部门信息读权限（qyapi_get_department_list）」，否则无法递归出部门路径',
|
||||
syncDisplayNameTarget: '属性键',
|
||||
syncDisplayNameTargetHint: '默认 dingtalk_name / 钉钉姓名；保存设置时按上述属性键和显示名称自动创建用户属性（已存在则仅同步显示名称）',
|
||||
syncCorpEmailTarget: '属性键',
|
||||
syncCorpEmailTargetHint: '默认 dingtalk_email / 钉钉企业邮箱；保存设置时按上述属性键和显示名称自动创建用户属性（已存在则仅同步显示名称）',
|
||||
syncDeptTarget: '属性键',
|
||||
syncDeptTargetHint: '默认 dingtalk_department / 钉钉部门；保存设置时按上述属性键和显示名称自动创建用户属性（已存在则仅同步显示名称）',
|
||||
syncAttrDisplayName: '显示名称'
|
||||
},
|
||||
oidc: {
|
||||
title: 'OIDC 登录',
|
||||
description: '配置标准 OIDC Provider（例如 Keycloak）',
|
||||
|
||||
Reference in new issue
Block a user