mirror of
https://github.com/Tencent/WeKnora.git
synced 2026-11-01 20:52:50 +08:00
sunmh
95ddeae067
New endpoint GET /api/v1/auth/oidc/start — unlike /auth/oidc/url which returns JSON and requires frontend JS to navigate, this endpoint directly returns a 302 redirect to the OIDC Provider's authorization page. This enables external platforms (enterprise portals, Nexus, etc.) to give a single clickable link that triggers the full OIDC authorization code flow and, when the IdP has an active SSO session, achieves passwordless login without any frontend involvement. - backend derives the callback URL from the request origin automatically (no caller-supplied redirect_uri needed) - OIDC nonce cookie is bound identically to /auth/oidc/url (CSRF/replay protection) - registered in the auth middleware public-path whitelist (otherwise the global auth middleware returns 401 before routing reaches the handler) - refactored shared nonce-cookie helper out of GetOIDCAuthorizationURL for reuse by OIDCStart