feat: add OIDC login support

- Introduced OIDC configuration options in config.example.yaml.
- Added OIDC client initialization and routes for OIDC login, callback, and exchange.
- Implemented OIDC login service to handle user authentication via OIDC.
- Created frontend components for OIDC login and callback handling.
- Updated user creation logic to support OIDC users and their identities.
- Enhanced error handling for OIDC login processes.

web/app/dashboard/login/oidc/callback/page.tsx

@@ -0,0 +1,63 @@
+"use client"
+
+import { useRouter, useSearchParams } from "next/navigation"
+import { Suspense, useEffect, useRef } from "react"
+import { toast } from "sonner"
+
+import { exchangeOIDCTicket } from "@/lib/api/auth"
+
+export default function OIDCLoginCallbackPage() {
+  return (
+    <Suspense fallback={<OIDCLoginCallbackFallback />}>
+      <OIDCLoginCallbackContent />
+    </Suspense>
+  )
+}
+
+function OIDCLoginCallbackContent() {
+  const router = useRouter()
+  const searchParams = useSearchParams()
+  const ranRef = useRef(false)
+
+  useEffect(() => {
+    if (ranRef.current) {
+      return
+    }
+    ranRef.current = true
+
+    const ticket = searchParams.get("ticket")?.trim() ?? ""
+    const next = searchParams.get("next")
+    const nextPath = next && next.startsWith("/") ? next : "/dashboard"
+
+    if (!ticket) {
+      toast.error("OIDC 登录票据不存在")
+      router.replace("/dashboard/login")
+      return
+    }
+
+    void exchangeOIDCTicket(ticket)
+      .then(() => {
+        toast.success("登录成功，正在进入系统")
+        router.replace(nextPath)
+      })
+      .catch((error) => {
+        toast.error(error instanceof Error ? error.message : "OIDC 登录失败")
+        router.replace("/dashboard/login")
+      })
+  }, [router, searchParams])
+
+  return <OIDCLoginCallbackFallback />
+}
+
+function OIDCLoginCallbackFallback() {
+  return (
+    <div className="flex min-h-svh items-center justify-center bg-[linear-gradient(145deg,#fff7ed_0%,#ffffff_32%,#ecfeff_100%)] px-6">
+      <div className="w-full max-w-md rounded-[28px] border border-white/70 bg-white/90 p-8 text-center shadow-[0_24px_80px_rgba(15,23,42,0.08)] backdrop-blur">
+        <h1 className="text-2xl font-semibold tracking-tight">OIDC 登录中</h1>
+        <p className="mt-3 text-sm text-muted-foreground">
+          正在校验登录票据并进入系统，请稍候。
+        </p>
+      </div>
+    </div>
+  )
+}

web/components/login-form.tsx

@@ -15,6 +15,7 @@ import {
   FieldLabel,
 } from "@/components/ui/field"
 import { Input } from "@/components/ui/input"
+import { KeyRoundIcon } from "lucide-react"
 
 function detectWxWorkEnvironment() {
   if (typeof navigator === "undefined") {
@@ -35,6 +36,7 @@ export function LoginForm({
   const [isWxWorkEnv, setIsWxWorkEnv] = useState(false)
   const nextPath = searchParams.get("next")
   const wxworkError = searchParams.get("wxworkError")
+  const oidcError = searchParams.get("oidcError")
   const redirectPath =
     nextPath && nextPath.startsWith("/") ? nextPath : "/dashboard"
 
@@ -50,6 +52,12 @@ export function LoginForm({
     }
   }, [wxworkError])
 
+  useEffect(() => {
+    if (oidcError) {
+      toast.error(oidcError)
+    }
+  }, [oidcError])
+
   useEffect(() => {
     setIsWxWorkEnv(detectWxWorkEnvironment())
   }, [])
@@ -130,6 +138,19 @@ export function LoginForm({
             企业微信登录
           </Button>
         </Field>
+        <Field>
+          <Button
+            type="button"
+            variant="outline"
+            className="gap-2"
+            onClick={() => {
+              window.location.href = `/api/auth/oidc_login?next=${encodeURIComponent(redirectPath)}`
+            }}
+          >
+            <KeyRoundIcon className="size-4 shrink-0" />
+            OIDC 登录
+          </Button>
+        </Field>
       </FieldGroup>
     </form>
   )

web/lib/api/auth.ts

@@ -26,6 +26,16 @@ export async function exchangeWxWorkTicket(ticket: string) {
   return data
 }
 
+export async function exchangeOIDCTicket(ticket: string) {
+  const data = await request<AuthSession>("/api/auth/oidc_exchange", {
+    method: "POST",
+    body: JSON.stringify({ ticket }),
+    skipAuth: true,
+  })
+  writeSession(data)
+  return data
+}
+
 export async function fetchProfile() {
   return request<AuthSession>("/api/auth/profile")
 }