Rogee
851ca7e372
后端移除： - SAML: auth/saml.go, handler/saml_handler.go, account_saml_settings_handler.go, model/account_saml_settings.go, model/saml_idp_config.go, repo/*.go - LDAP: auth/ldap.go, handler/ldap_handler.go, model/account_ldap_settings.go, repo/account_ldap_settings_repo.go - MFA: auth/mfa.go, handler/mfa_handler.go - auth_service: 移除 mfaService 依赖、MFARequired 字段、LoginWithMFA 方法 - auth_handler: 移除 LoginMFA handler、MFA 分支逻辑 - bootstrap: 移除 SAML/LDAP/MFA service 初始化和 handler 注册 - sso_middleware: 精简为仅支持 OIDC provider - router: 移除 SAML/LDAP/MFA 路由注册 - config: 移除 SAMLConfig/LDAPConfig struct 和 defaults 前端移除： - v3/login: 移除 MFA 验证流程和 SAML 登录入口 - v3/api/auth: 移除 MFA 响应处理 - v3/routes: 移除 SSO login 路由 - dashboard: 移除 MFA 设置页面、SAML 安全设置页面 - i18n: 移除 mfa.json - featureFlags: 移除 SAML feature flag .env.example / .env: 移除 SAML/LDAP 配置段
43 lines
2.9 KiB
Go
43 lines
2.9 KiB
Go
package model
|
|
|
|
// Reference: M13 §4.3 — OIDC (OpenID Connect) per-account configuration
|
|
// Enables multi-tenant OIDC identity isolation: each account (tenant) can configure
|
|
// its own OIDC provider (Google Workspace, Auth0, Keycloak, Azure AD, etc.),
|
|
// allowing enterprise customers to bring their own OIDC IdP while maintaining
|
|
// complete identity isolation between tenants.
|
|
// This is a GoChat enterprise feature that Chatwoot does not offer.
|
|
|
|
import (
|
|
"encoding/json"
|
|
"time"
|
|
|
|
"gorm.io/gorm"
|
|
)
|
|
|
|
// AccountOIDCSettings stores per-account OIDC/OAuth2 provider configuration.
|
|
// Each account can have exactly one active OIDC configuration.
|
|
type AccountOIDCSettings struct {
|
|
ID uint `gorm:"primaryKey" json:"id"`
|
|
AccountID uint `gorm:"not null;uniqueIndex" json:"account_id"` // one active config per account
|
|
ClientID string `gorm:"size:256;not null" json:"client_id"` // OIDC client ID
|
|
ClientSecret string `gorm:"size:256" json:"-"` // OIDC client secret (not exposed via API)
|
|
RedirectURL string `gorm:"size:1024;not null" json:"redirect_url"` // callback redirect URL
|
|
IssuerURL string `gorm:"size:512;not null" json:"issuer_url"` // IdP issuer URL (e.g. https://accounts.google.com)
|
|
AuthorizationURL string `gorm:"size:1024" json:"authorization_url,omitempty"` // authorization endpoint (discovered from issuer if empty)
|
|
TokenURL string `gorm:"size:1024" json:"token_url,omitempty"` // token endpoint (discovered from issuer if empty)
|
|
UserInfoURL string `gorm:"size:1024" json:"user_info_url,omitempty"` // userinfo endpoint (discovered from issuer if empty)
|
|
JWKSURL string `gorm:"size:1024" json:"jwks_url,omitempty"` // JWKS endpoint for id_token verification
|
|
Scopes json.RawMessage `gorm:"type:jsonb" json:"scopes"` // JSON array of scopes (e.g. ["openid","profile","email"])
|
|
AttributeMapping string `gorm:"type:text" json:"attribute_mapping,omitempty"` // JSON: {"email":"email","name":"name","firstName":"given_name","lastName":"family_name"}
|
|
RoleMappings json.RawMessage `gorm:"type:jsonb" json:"role_mappings"` // OIDC group/role claim -> GoChat role mapping
|
|
AutoProvision bool `gorm:"default:true" json:"auto_provision"` // auto-create GoChat user on first OIDC login
|
|
Active bool `gorm:"default:true" json:"active"` // whether this config is active
|
|
CreatedAt time.Time `gorm:"autoCreateTime" json:"created_at"`
|
|
UpdatedAt time.Time `gorm:"autoUpdateTime" json:"updated_at"`
|
|
DeletedAt gorm.DeletedAt `gorm:"index" json:"deleted_at,omitempty"`
|
|
|
|
Account Account `gorm:"foreignKey:AccountID" json:"account,omitempty"`
|
|
}
|
|
|
|
func (AccountOIDCSettings) TableName() string { return "account_oidc_settings" }
|