feat: add OIDC login support

- Introduced OIDC configuration options in config.example.yaml.
- Added OIDC client initialization and routes for OIDC login, callback, and exchange.
- Implemented OIDC login service to handle user authentication via OIDC.
- Created frontend components for OIDC login and callback handling.
- Updated user creation logic to support OIDC users and their identities.
- Enhanced error handling for OIDC login processes.

web/components/login-form.tsx

@@ -15,6 +15,7 @@ import {
   FieldLabel,
 } from "@/components/ui/field"
 import { Input } from "@/components/ui/input"
+import { KeyRoundIcon } from "lucide-react"
 
 function detectWxWorkEnvironment() {
   if (typeof navigator === "undefined") {
@@ -35,6 +36,7 @@ export function LoginForm({
   const [isWxWorkEnv, setIsWxWorkEnv] = useState(false)
   const nextPath = searchParams.get("next")
   const wxworkError = searchParams.get("wxworkError")
+  const oidcError = searchParams.get("oidcError")
   const redirectPath =
     nextPath && nextPath.startsWith("/") ? nextPath : "/dashboard"
 
@@ -50,6 +52,12 @@ export function LoginForm({
     }
   }, [wxworkError])
 
+  useEffect(() => {
+    if (oidcError) {
+      toast.error(oidcError)
+    }
+  }, [oidcError])
+
   useEffect(() => {
     setIsWxWorkEnv(detectWxWorkEnvironment())
   }, [])
@@ -130,6 +138,19 @@ export function LoginForm({
             企业微信登录
           </Button>
         </Field>
+        <Field>
+          <Button
+            type="button"
+            variant="outline"
+            className="gap-2"
+            onClick={() => {
+              window.location.href = `/api/auth/oidc_login?next=${encodeURIComponent(redirectPath)}`
+            }}
+          >
+            <KeyRoundIcon className="size-4 shrink-0" />
+            OIDC 登录
+          </Button>
+        </Field>
       </FieldGroup>
     </form>
   )