From 7b605351f4f6b74da1b0a3567b8f02ef2fbb1235 Mon Sep 17 00:00:00 2001
From: HenryDu8133 <813367384@qq.com>
Date: Sat, 12 Sep 2026 22:57:43 +0800
Subject: [PATCH] =?UTF-8?q?feat(auth):=20aggregate=20OAuth=20=E6=94=AF?=
 =?UTF-8?q?=E6=8C=81=E7=8E=AF=E5=A2=83=E5=8F=98=E9=87=8F=E5=9B=9E=E9=80=80?=
 =?UTF-8?q?=E9=85=8D=E7=BD=AE=EF=BC=8C=E9=BB=98=E8=AE=A4=20LOGIN=5FTYPE=3D?=
 =?UTF-8?q?wx?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- oauth-strategies.ts: loadAggregateSettings() DB 未配置时回退读取 process.env.AGGREGATE_OAUTH_*，自动启用
- .env.example: AGGREGATE_OAUTH_LOGIN_TYPE 默认改为 wx，补充 auxx.cn 示例注释
---
 .env.example                     |  7 ++++---
 server/utils/oauth-strategies.ts | 28 +++++++++++++++++++++++++++-
 2 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/.env.example b/.env.example
index 8ea85f4..2709684 100644
--- a/.env.example
+++ b/.env.example
@@ -106,10 +106,11 @@ CASDOOR_ENDPOINT=
 GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
 
-# 聚合登陆 OAuth
+# 聚合登陆 OAuth（如 auxx.cn 等聚合登录服务，支持微信/QQ 等通道
 AGGREGATE_OAUTH_APP_ID=
 AGGREGATE_OAUTH_APP_KEY=
 # 支持单值、逗号分隔或 JSON 数组，例如：qq,wx,sina,baidu
 # 可用值：qq,wx,alipay,sina,baidu,douyin,huawei,xiaomi,gitee,gitea,bilibili,kuaishou
-AGGREGATE_OAUTH_LOGIN_TYPE=qq
-AGGREGATE_OAUTH_ENDPOINT=https://example.com/connect.php
+AGGREGATE_OAUTH_LOGIN_TYPE=wx
+# 聚合登录服务基地址（https，不带 /oauth/... 路径），例如：https://www.auxx.cn
+AGGREGATE_OAUTH_ENDPOINT=
diff --git a/server/utils/oauth-strategies.ts b/server/utils/oauth-strategies.ts
index 333c421..f69e010 100644
--- a/server/utils/oauth-strategies.ts
+++ b/server/utils/oauth-strategies.ts
@@ -270,7 +270,33 @@ async function loadAggregateSettings() {
     .from(systemSettings)
     .orderBy(asc(systemSettings.id))
     .limit(1)
-  return row[0] ?? null
+  const base = row[0] ?? null
+  const envAppId = process.env.AGGREGATE_OAUTH_APP_ID
+  const envAppKey = process.env.AGGREGATE_OAUTH_APP_KEY
+  const envLoginType = process.env.AGGREGATE_OAUTH_LOGIN_TYPE
+  const envEndpoint = process.env.AGGREGATE_OAUTH_ENDPOINT
+  const hasEnvConfig = !!(envAppId && envAppKey && envEndpoint)
+  const dbEnabled = base?.aggregateOAuthEnabled
+  const dbHasConfig = !!(
+    base?.aggregateOAuthAppId &&
+    base?.aggregateOAuthAppKey &&
+    base?.aggregateOAuthEndpoint
+  )
+  const enabled = Boolean(dbEnabled ?? hasEnvConfig)
+  const appId = (base?.aggregateOAuthAppId || envAppId || '') as string
+  const appKey = (base?.aggregateOAuthAppKey || envAppKey || '') as string
+  const loginType = ((base?.aggregateOAuthLoginType as string) || envLoginType || '') as string
+  const endpoint = ((base?.aggregateOAuthEndpoint as string) || envEndpoint || '') as string
+
+  return {
+    aggregateOAuthEnabled: enabled && !!(appId && appKey && endpoint),
+    aggregateOAuthAppId: appId,
+    aggregateOAuthAppKey: appKey,
+    aggregateOAuthLoginType: loginType,
+    aggregateOAuthEndpoint: endpoint,
+    _dbHasConfig: dbHasConfig,
+    _hasEnvConfig: hasEnvConfig
+  } as any
 }
 
 function normalizeEndpoint(endpoint: string): string {