From 9fd8a9ccbd9e36735d846b9b3728ec2eb633af96 Mon Sep 17 00:00:00 2001
From: HenryDu8133 <813367384@qq.com>
Date: Sun, 13 Sep 2026 00:43:37 +0800
Subject: [PATCH] =?UTF-8?q?fix(ci,build):=20=E5=8F=8C=E8=B7=AF=E5=BE=84?=
 =?UTF-8?q?=E5=8F=8C=20Job=20=E6=B3=A8=E5=85=A5=20OAuth=206=20=E6=9D=A1=20?=
 =?UTF-8?q?secrets=20=E5=88=B0=E6=9E=84=E5=BB=BA=E6=9C=9F\n\n=E6=A0=B9?=
 =?UTF-8?q?=E5=9B=A0=EF=BC=88Run=20#71=20=E5=B7=B2=E7=A1=AE=E8=AF=8A?=
 =?UTF-8?q?=EF=BC=89=EF=BC=9A\n=20=20-=20Preflight=20Job=20=E7=9A=84?=
 =?UTF-8?q?=E3=80=8C=E6=89=A7=E8=A1=8C=20nuxt=20build=E3=80=8Dstep=20?=
 =?UTF-8?q?=E7=9A=84=20env=20=E6=B3=A8=E5=85=A5=E5=9C=A8=E5=BD=93=E5=89=8D?=
 =?UTF-8?q?=20Gitea=20Actions=20=E7=89=88=E6=9C=AC=E4=B8=8B=E6=B2=A1?=
 =?UTF-8?q?=E7=94=9F=E6=95=88=EF=BC=88=E6=95=B4=E4=B8=AA=E6=97=A5=E5=BF=97?=
 =?UTF-8?q?=E4=B8=AD=E6=90=9C=E4=B8=8D=E5=88=B0=20[OAuth]=20=E5=AD=97?=
 =?UTF-8?q?=E6=A0=B7=EF=BC=89\n=20=20-=20=E6=9E=84=E5=BB=BA=E9=95=9C?=
 =?UTF-8?q?=E5=83=8F=20Job=20=E7=9A=84=20docker=20buildx=20build=20?=
 =?UTF-8?q?=E5=AE=8C=E5=85=A8=E6=B2=A1=E9=80=8F=E4=BC=A0=20OAuth=20?=
 =?UTF-8?q?=E5=8F=98=E9=87=8F=EF=BC=8C=E9=95=9C=E5=83=8F=E5=86=85=20RUN=20?=
 =?UTF-8?q?npm=20run=20build=20=E7=9C=8B=E4=B8=8D=E5=88=B0=20process.env.A?=
 =?UTF-8?q?GGREGATE=5FOAUTH=5FAPP=5FID\n=20=20-=20nuxt.config.ts=20runtime?=
 =?UTF-8?q?Config.public.oauth.aggregate=20=3D=20!!process.env.AGGREGATE?=
 =?UTF-8?q?=5FOAUTH=5FAPP=5FID=20=E4=B8=A4=E4=B8=AA=E8=B7=AF=E5=BE=84?=
 =?UTF-8?q?=E9=83=BD=E6=8B=BF=E4=B8=8D=E5=88=B0=E5=80=BC=20=E2=86=92=20?=
 =?UTF-8?q?=E4=B8=80=E7=9B=B4=20false\n=20=20-=20=E5=89=8D=E7=AB=AF?=
 =?UTF-8?q?=E7=99=BB=E5=BD=95=E9=A1=B5=E7=AC=AC=E4=B8=89=E6=96=B9=E7=99=BB?=
 =?UTF-8?q?=E5=BD=95=E5=88=86=E5=8C=BA=E4=B8=80=E7=9B=B4=E6=B8=B2=E6=9F=93?=
 =?UTF-8?q?=E5=8D=A0=E4=BD=8D=E6=8F=90=E7=A4=BA=EF=BC=8C=E4=B8=8D=E5=87=BA?=
 =?UTF-8?q?=E5=BE=AE=E4=BF=A1=E6=8C=89=E9=92=AE\n\n=E4=BF=AE=E5=A4=8D?=
 =?UTF-8?q?=EF=BC=88=E4=B8=A4=E6=9D=A1=E7=8B=AC=E7=AB=8B=E9=93=BE=E8=B7=AF?=
 =?UTF-8?q?=EF=BC=8C=E4=BB=BB=E4=B8=80=E6=9D=A1=E6=88=90=E5=8A=9F=E6=8C=89?=
 =?UTF-8?q?=E9=92=AE=E9=83=BD=E4=BC=9A=E5=87=BA=E7=8E=B0=EF=BC=89=EF=BC=9A?=
 =?UTF-8?q?\n=20=20=E2=91=A0=20=E9=93=BE=E8=B7=AF=20A=EF=BC=88preflight=20?=
 =?UTF-8?q?=E4=BA=A7=E7=89=A9=EF=BC=89=EF=BC=9Apreflight=20Job=20=E5=8A=A0?=
 =?UTF-8?q?=E3=80=8C=E6=B3=A8=E5=85=A5=20OAuth=20secrets=20=E5=88=B0=20GIT?=
 =?UTF-8?q?HUB=5FENV=E3=80=8DStep=EF=BC=88=5Fappend=5Fenv=20=E5=8F=8C?=
 =?UTF-8?q?=E5=BC=95=E5=8F=B7=E5=8C=85=E4=BD=8F=E5=80=BC=E5=86=99=20$GITHU?=
 =?UTF-8?q?B=5FENV=EF=BC=89=EF=BC=8C=E4=BF=9D=E8=AF=81=E5=90=8E=E7=BB=AD?=
 =?UTF-8?q?=E6=89=80=E6=9C=89=20step=EF=BC=88=E5=90=AB=20nuxt=20build?=
 =?UTF-8?q?=EF=BC=89=E7=9A=84=E8=BF=9B=E7=A8=8B=E7=BA=A7=20process.env=20?=
 =?UTF-8?q?=E9=83=BD=E6=9C=89=206=20=E4=B8=AA=E5=8F=98=E9=87=8F\n=20=20?=
 =?UTF-8?q?=E2=91=A1=20=E9=93=BE=E8=B7=AF=20B=EF=BC=88=E5=AE=B9=E5=99=A8?=
 =?UTF-8?q?=E9=95=9C=E5=83=8F=EF=BC=89=EF=BC=9ADockerfile=20COPY=20.=20.?=
 =?UTF-8?q?=20=E5=90=8E=E6=96=B0=E5=A2=9E=206=20=E4=B8=AA=20ARG=EF=BC=88OA?=
 =?UTF-8?q?UTH=5FREDIRECT=5FURI=20/=20OAUTH=5FSTATE=5FSECRET=20/=20AGGREGA?=
 =?UTF-8?q?TE=5FOAUTH=5FAPP=5FID=20/=20APP=5FKEY=20/=20LOGIN=5FTYPE=20/=20?=
 =?UTF-8?q?ENDPOINT=EF=BC=89=E5=B9=B6=20ENV=20=E5=AF=BC=E5=87=BA=EF=BC=8C?=
 =?UTF-8?q?=E4=BF=9D=E8=AF=81=20RUN=20node=20scripts/memory-build.js?=
 =?UTF-8?q?=EF=BC=88npm=20run=20build=EF=BC=89=E8=83=BD=E8=AF=BB=E5=88=B0\?=
 =?UTF-8?q?n=20=20=E2=91=A2=20deploy.yml=20build-image=20Job=EF=BC=9A?=
 =?UTF-8?q?=E6=96=B0=E5=A2=9E=E3=80=8C=E6=B3=A8=E5=85=A5=20OAuth=20secrets?=
 =?UTF-8?q?=20=E5=88=B0=20GITHUB=5FENV=E3=80=8DStep=EF=BC=88=E4=B8=8E=20pr?=
 =?UTF-8?q?eflight=20=E5=90=8C=E6=A0=B7=E7=9A=84=20=5Fappend=5Fenv=20?=
 =?UTF-8?q?=E9=80=BB=E8=BE=91=EF=BC=89=EF=BC=8C=E7=B4=A7=E6=8E=A5=E7=9D=80?=
 =?UTF-8?q?=E7=9A=84=E3=80=8C=E6=9E=84=E5=BB=BA=E5=B9=B6=E6=8E=A8=E9=80=81?=
 =?UTF-8?q?=E9=95=9C=E5=83=8F=E3=80=8DStep=20=E6=8A=8A=E8=BF=99=206=20?=
 =?UTF-8?q?=E6=9D=A1=E5=8F=98=E9=87=8F=E9=80=90=E4=B8=AA=E9=9D=9E=E7=A9=BA?=
 =?UTF-8?q?=E5=88=A4=E5=90=8E=E6=8B=BC=E8=BF=9B=20BUILD=5FARGS=3D(--build-?=
 =?UTF-8?q?arg=20...)=EF=BC=8C=E5=B9=B6=E6=89=93=E5=8D=B0=E6=AF=8F?=
 =?UTF-8?q?=E6=9D=A1=E6=98=AF=E5=90=A6=E5=B7=B2=E6=B3=A8=E5=85=A5=EF=BC=88?=
 =?UTF-8?q?=E4=B8=8D=E6=89=93=E5=8D=B0=E5=80=BC=EF=BC=89\n\n=E9=85=8D?=
 =?UTF-8?q?=E5=90=88=20Deploy=20Job=20=E5=8E=9F=E6=9C=AC=E5=B7=B2=E5=AE=9E?=
 =?UTF-8?q?=E7=8E=B0=E7=9A=84=E8=BF=9C=E7=AB=AF=20/data/opt/byw-voicehub/.?=
 =?UTF-8?q?env=20upsert=EF=BC=88SSH=20=E8=BF=90=E8=A1=8C=E6=9C=9F=E5=86=99?=
 =?UTF-8?q?=E5=85=A5=EF=BC=89:\n=20=20-=20=E8=BF=90=E8=A1=8C=E6=9C=9F?=
 =?UTF-8?q?=E5=AE=B9=E5=99=A8=EF=BC=88docker-compose=20env=5Ffile:=20[.env?=
 =?UTF-8?q?]=EF=BC=89=E4=B9=9F=E6=9C=89=E5=90=8C=E4=B8=80=E5=A5=97=206=20?=
 =?UTF-8?q?=E6=9D=A1=E5=8F=98=E9=87=8F=20=E2=86=92=20server/utils/oauth-st?=
 =?UTF-8?q?rategies.ts=20loadAggregateSettings=20=E7=9A=84=20env=20fallbac?=
 =?UTF-8?q?k=20=E8=83=BD=E8=AF=BB=E5=88=B0=20auxx.cn=20=E5=87=AD=E6=8D=AE?=
 =?UTF-8?q?=EF=BC=8C=E5=AE=8C=E6=88=90=E5=BE=AE=E4=BF=A1=E6=89=AB=E7=A0=81?=
 =?UTF-8?q?=E7=99=BB=E5=BD=95/=E7=BB=91=E5=AE=9A=E5=85=A8=E9=93=BE?=
 =?UTF-8?q?=E8=B7=AF=E3=80=82\n\n=E8=AF=8A=E6=96=AD=E6=97=A5=E5=BF=97?=
 =?UTF-8?q?=EF=BC=88=E6=96=B0=E7=9A=84=20Run=20#72=20=E4=B8=AD=E5=BA=94?=
 =?UTF-8?q?=E5=87=BA=E7=8E=B0=EF=BC=89=EF=BC=9A\n=20=20[OAuth-secrets]=20A?=
 =?UTF-8?q?GGREGATE=5FOAUTH=5FAPP=5FID=3D=E5=B7=B2=E6=B3=A8=E5=85=A5=20(le?=
 =?UTF-8?q?n=3D4)=20=20=20=EF=BC=88=E8=8B=A5=E9=85=8D=E7=BD=AE=E8=BF=87=20?=
 =?UTF-8?q?Secrets=EF=BC=89\n=20=20[OAuth=20build-args]=20AGGREGATE=5FOAUT?=
 =?UTF-8?q?H=5FAPP=5FID=3D=E5=B7=B2=E6=B3=A8=E5=85=A5\n=20=20[OAuth]=20bui?=
 =?UTF-8?q?ld-time=20AGGREGATE=5FOAUTH=5FAPP=5FID=20=E5=B7=B2=E9=85=8D?=
 =?UTF-8?q?=E7=BD=AE=EF=BC=88=E5=89=8D=E7=AB=AF=E7=AC=AC=E4=B8=89=E6=96=B9?=
 =?UTF-8?q?=E7=99=BB=E5=BD=95=E6=8C=89=E9=92=AE=E4=BC=9A=E6=98=BE=E7=A4=BA?=
 =?UTF-8?q?=EF=BC=89,=20LOGIN=5FTYPE=3Dwx?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/deploy.yml | 74 +++++++++++++++++++++++++++++++++++++
 Dockerfile                  | 17 +++++++++
 2 files changed, 91 insertions(+)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 60e5d4d..b44fba5 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -178,6 +178,35 @@ jobs:
           git clone --depth 1 -b "${BRANCH}" "${REPO_URL}" .
           git rev-parse --short HEAD
 
+      - name: 注入 OAuth secrets 到 GITHUB_ENV（所有后续 step 自动继承，避免 step.env 在某些 Gitea Actions 版本中不生效）
+        env:
+          OAUTH_REDIRECT_URI: ${{ secrets.OAUTH_REDIRECT_URI }}
+          OAUTH_STATE_SECRET: ${{ secrets.OAUTH_STATE_SECRET }}
+          AGGREGATE_OAUTH_APP_ID: ${{ secrets.AGGREGATE_OAUTH_APP_ID }}
+          AGGREGATE_OAUTH_APP_KEY: ${{ secrets.AGGREGATE_OAUTH_APP_KEY }}
+          AGGREGATE_OAUTH_LOGIN_TYPE: ${{ secrets.AGGREGATE_OAUTH_LOGIN_TYPE }}
+          AGGREGATE_OAUTH_ENDPOINT: ${{ secrets.AGGREGATE_OAUTH_ENDPOINT }}
+        run: |
+          set -euo pipefail
+          OAUTH_ENV_FILE="$GITHUB_ENV"
+          # 所有变量只要非空就写入 GITHUB_ENV；写入时用双引号包住值，避免包含 ://[provider]/ 等特殊字符时被错误解析
+          _append_env() {
+            local K="$1" V="$2"
+            if [ -n "${V}" ]; then
+              printf '%s="%s"\n' "$K" "$V" >> "$OAUTH_ENV_FILE"
+              echo "[OAuth-secrets] $K=已注入 (len=${#V})"
+            else
+              echo "[OAuth-secrets] $K=未配置（Repository Secrets 中缺失或为空）"
+            fi
+          }
+          _append_env OAUTH_REDIRECT_URI              "${OAUTH_REDIRECT_URI:-}"
+          _append_env OAUTH_STATE_SECRET              "${OAUTH_STATE_SECRET:-}"
+          _append_env AGGREGATE_OAUTH_APP_ID          "${AGGREGATE_OAUTH_APP_ID:-}"
+          _append_env AGGREGATE_OAUTH_APP_KEY         "${AGGREGATE_OAUTH_APP_KEY:-}"
+          _append_env AGGREGATE_OAUTH_LOGIN_TYPE      "${AGGREGATE_OAUTH_LOGIN_TYPE:-}"
+          _append_env AGGREGATE_OAUTH_ENDPOINT        "${AGGREGATE_OAUTH_ENDPOINT:-}"
+          echo "[OAuth-secrets] 写入完成；后续所有 step 都会自动把上述变量作为进程级 process.env.* 继承（包括 nuxt build）"
+
       - name: 安装依赖（npm ci，含网络超时兜底：双 registry 切换 + 3 次重试 + fetch-retires 5 次 + 5 分钟 fetch-timeout）
         run: |
           set -euo pipefail
@@ -355,6 +384,34 @@ jobs:
           docker version
           docker buildx version || echo "buildx 未安装，将使用 docker build --push"
 
+      - name: 注入 OAuth secrets 到 GITHUB_ENV（Docker build-arg 与运行期容器 .env 共用同一来源，构建期注入对应镜像 .output）
+        env:
+          OAUTH_REDIRECT_URI: ${{ secrets.OAUTH_REDIRECT_URI }}
+          OAUTH_STATE_SECRET: ${{ secrets.OAUTH_STATE_SECRET }}
+          AGGREGATE_OAUTH_APP_ID: ${{ secrets.AGGREGATE_OAUTH_APP_ID }}
+          AGGREGATE_OAUTH_APP_KEY: ${{ secrets.AGGREGATE_OAUTH_APP_KEY }}
+          AGGREGATE_OAUTH_LOGIN_TYPE: ${{ secrets.AGGREGATE_OAUTH_LOGIN_TYPE }}
+          AGGREGATE_OAUTH_ENDPOINT: ${{ secrets.AGGREGATE_OAUTH_ENDPOINT }}
+        run: |
+          set -euo pipefail
+          OAUTH_ENV_FILE="$GITHUB_ENV"
+          _append_env() {
+            local K="$1" V="$2"
+            if [ -n "${V}" ]; then
+              printf '%s="%s"\n' "$K" "$V" >> "$OAUTH_ENV_FILE"
+              echo "[OAuth-secrets] $K=已注入 (len=${#V})"
+            else
+              echo "[OAuth-secrets] $K=未配置（Repository Secrets 中缺失或为空）"
+            fi
+          }
+          _append_env OAUTH_REDIRECT_URI              "${OAUTH_REDIRECT_URI:-}"
+          _append_env OAUTH_STATE_SECRET              "${OAUTH_STATE_SECRET:-}"
+          _append_env AGGREGATE_OAUTH_APP_ID          "${AGGREGATE_OAUTH_APP_ID:-}"
+          _append_env AGGREGATE_OAUTH_APP_KEY         "${AGGREGATE_OAUTH_APP_KEY:-}"
+          _append_env AGGREGATE_OAUTH_LOGIN_TYPE      "${AGGREGATE_OAUTH_LOGIN_TYPE:-}"
+          _append_env AGGREGATE_OAUTH_ENDPOINT        "${AGGREGATE_OAUTH_ENDPOINT:-}"
+          echo "[OAuth-secrets] build-image 作业写入完成；docker build 可作为 build-arg 透传到 nuxt build"
+
       - name: 计算镜像标签
         id: meta
         run: |
@@ -483,6 +540,23 @@ jobs:
             --build-arg NODE_BUILDER_TAG="${NODE_BUILDER_TAG}"
             --build-arg NODE_RUNTIME_TAG="${NODE_RUNTIME_TAG}"
           )
+          # ========== 关键：OAuth 6 条 secrets 通过 --build-arg 透传到 Dockerfile 的 ARG ==========
+          # 这样镜像内部 RUN node scripts/memory-build.js（npm run build）时，
+          # process.env.AGGREGATE_OAUTH_APP_ID 就能读到，nuxt.config.ts public.oauth.aggregate = !!process.env.AGGREGATE_OAUTH_APP_ID
+          # 才会为 true → 前端渲染绿色微信按钮，不显示占位提示
+          if [ -n "${OAUTH_REDIRECT_URI:-}" ];     then BUILD_ARGS+=( --build-arg OAUTH_REDIRECT_URI="${OAUTH_REDIRECT_URI}" ); fi
+          if [ -n "${OAUTH_STATE_SECRET:-}" ];     then BUILD_ARGS+=( --build-arg OAUTH_STATE_SECRET="${OAUTH_STATE_SECRET}" ); fi
+          if [ -n "${AGGREGATE_OAUTH_APP_ID:-}" ]; then BUILD_ARGS+=( --build-arg AGGREGATE_OAUTH_APP_ID="${AGGREGATE_OAUTH_APP_ID}" ); fi
+          if [ -n "${AGGREGATE_OAUTH_APP_KEY:-}" ];then BUILD_ARGS+=( --build-arg AGGREGATE_OAUTH_APP_KEY="${AGGREGATE_OAUTH_APP_KEY}" ); fi
+          if [ -n "${AGGREGATE_OAUTH_LOGIN_TYPE:-}" ]; then BUILD_ARGS+=( --build-arg AGGREGATE_OAUTH_LOGIN_TYPE="${AGGREGATE_OAUTH_LOGIN_TYPE}" ); fi
+          if [ -n "${AGGREGATE_OAUTH_ENDPOINT:-}" ];  then BUILD_ARGS+=( --build-arg AGGREGATE_OAUTH_ENDPOINT="${AGGREGATE_OAUTH_ENDPOINT}" ); fi
+          # 日志打印（只打有无，不打 value）
+          echo "[OAuth build-args] OAUTH_REDIRECT_URI=$( [ -n "${OAUTH_REDIRECT_URI:-}" ] && echo 已注入 || echo 空 )"
+          echo "[OAuth build-args] OAUTH_STATE_SECRET=$( [ -n "${OAUTH_STATE_SECRET:-}" ] && echo 已注入 || echo 空 )"
+          echo "[OAuth build-args] AGGREGATE_OAUTH_APP_ID=$( [ -n "${AGGREGATE_OAUTH_APP_ID:-}" ] && echo 已注入 || echo 空 )"
+          echo "[OAuth build-args] AGGREGATE_OAUTH_APP_KEY=$( [ -n "${AGGREGATE_OAUTH_APP_KEY:-}" ] && echo 已注入 || echo 空 )"
+          echo "[OAuth build-args] AGGREGATE_OAUTH_LOGIN_TYPE=$( [ -n "${AGGREGATE_OAUTH_LOGIN_TYPE:-}" ] && echo 已注入 || echo 空 )"
+          echo "[OAuth build-args] AGGREGATE_OAUTH_ENDPOINT=$( [ -n "${AGGREGATE_OAUTH_ENDPOINT:-}" ] && echo 已注入 || echo 空 )"
           # 说明：暂时关闭 registry 分层缓存（buildkitd 推 buildcache 也要认证，同样会触发 Gitea 1.27 OAuth2 空 token）
           # 改为本地 Docker daemon 缓存，已构建的层会自动复用，下次 build 速度几乎相同
           BUILD_ARGS+=( --no-cache )
diff --git a/Dockerfile b/Dockerfile
index 8b8a59c..384ceae 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -37,6 +37,23 @@ RUN set -eux; \
 # 只有在 package.json 没变而源代码改变时，才会从这一步开始重新执行，跳过上面的耗时依赖安装
 COPY . .
 
+# ========== OAuth / 第三方登录构建期配置（process.env.AGGREGATE_OAUTH_APP_ID 控制 nuxt.config.ts public.oauth.aggregate 开关） ==========
+# 说明：
+#   - 这些是 **构建期** 变量，只在 RUN npm run build 时用到（runtimeConfig.public 只会在 build 时固化到 .output/public 包）
+#   - 部署时运行期变量（同一套值）会通过 docker-compose.yml env_file: [.env] 注入到容器 process.env 供 server/utils/oauth-strategies.ts loadAggregateSettings 使用
+ARG OAUTH_REDIRECT_URI=""
+ARG OAUTH_STATE_SECRET=""
+ARG AGGREGATE_OAUTH_APP_ID=""
+ARG AGGREGATE_OAUTH_APP_KEY=""
+ARG AGGREGATE_OAUTH_LOGIN_TYPE=""
+ARG AGGREGATE_OAUTH_ENDPOINT=""
+ENV OAUTH_REDIRECT_URI="${OAUTH_REDIRECT_URI}" \
+    OAUTH_STATE_SECRET="${OAUTH_STATE_SECRET}" \
+    AGGREGATE_OAUTH_APP_ID="${AGGREGATE_OAUTH_APP_ID}" \
+    AGGREGATE_OAUTH_APP_KEY="${AGGREGATE_OAUTH_APP_KEY}" \
+    AGGREGATE_OAUTH_LOGIN_TYPE="${AGGREGATE_OAUTH_LOGIN_TYPE}" \
+    AGGREGATE_OAUTH_ENDPOINT="${AGGREGATE_OAUTH_ENDPOINT}"
+
 # 构建应用，使用内存优化脚本适应4GB总内存
 RUN chmod +x scripts/memory-build.js && \
     node scripts/memory-build.js