scriptoriumadmin/skillhub
1
0
Fork 0
mirror of https://github.com/iflytek/skillhub.git synced 2026-09-24 00:55:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix(deploy): pass Feishu redirect URI through releases

Browse source 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
This commit is contained in:
XiaoSeS 2026-09-21 10:52:44 +08:00
parent 013f744f0b
commit 3381cc128e
10 changed files with 22 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
.env.release.example
View file

@ -134,6 +134,8 @@ OAUTH2_FEISHU_AUTHORIZATION_URI=https://accounts.feishu.cn/open-apis/authen/v1/a
OAUTH2_FEISHU_PROTOCOL_VERSION=v3
OAUTH2_FEISHU_TOKEN_URI=https://accounts.feishu.cn/oauth/v3/token
OAUTH2_FEISHU_USER_INFO_URI=https://open.feishu.cn/open-apis/authen/v1/user_info
# Optional; defaults to {baseUrl}/login/oauth2/code/feishu. Set explicitly for local previews or reverse proxies.
OAUTH2_FEISHU_REDIRECT_URI=
OAUTH2_FEISHU_DISPLAY_NAME=飞书
# Optional: OIDC login (e.g. Keycloak, Okta, Azure AD).

2
charts/skillhub/templates/server-deployment.yaml
View file

@ -376,6 +376,8 @@ spec:
value: {{ .Values.oauth2.feishu.tokenUri | default "https://accounts.feishu.cn/oauth/v3/token" | quote }}
- name: OAUTH2_FEISHU_USER_INFO_URI
value: {{ .Values.oauth2.feishu.userInfoUri | default "https://open.feishu.cn/open-apis/authen/v1/user_info" | quote }}
- name: OAUTH2_FEISHU_REDIRECT_URI
value: {{ .Values.oauth2.feishu.redirectUri | default "" | quote }}
{{- if .Values.server.javaOpts }}
- name: JAVA_OPTS

3
charts/skillhub/values.schema.json
View file

@ -47,7 +47,8 @@
"authorizationUri": { "type": "string", "format": "uri" },
"protocolVersion": { "type": "string", "enum": ["v2", "v3"] },
"tokenUri": { "type": "string", "format": "uri" },
"userInfoUri": { "type": "string", "format": "uri" }
"userInfoUri": { "type": "string", "format": "uri" },
"redirectUri": { "type": "string" }
}
}
}

1
charts/skillhub/values.yaml
View file

@ -28,6 +28,7 @@ oauth2:
protocolVersion: v3
tokenUri: https://accounts.feishu.cn/oauth/v3/token
userInfoUri: https://open.feishu.cn/open-apis/authen/v1/user_info
redirectUri: ""
builtinSkills:
enabled: true

1
compose.release.yml
View file

@ -125,6 +125,7 @@ services:
OAUTH2_FEISHU_PROTOCOL_VERSION: ${OAUTH2_FEISHU_PROTOCOL_VERSION:-v3}
OAUTH2_FEISHU_TOKEN_URI: ${OAUTH2_FEISHU_TOKEN_URI:-https://accounts.feishu.cn/oauth/v3/token}
OAUTH2_FEISHU_USER_INFO_URI: ${OAUTH2_FEISHU_USER_INFO_URI:-${OAUTH2_FEISHU_BASE_URI:-https://open.feishu.cn}/open-apis/authen/v1/user_info}
OAUTH2_FEISHU_REDIRECT_URI: ${OAUTH2_FEISHU_REDIRECT_URI:-}
OAUTH2_FEISHU_DISPLAY_NAME: ${OAUTH2_FEISHU_DISPLAY_NAME:-飞书}
SPRING_MAIL_HOST: ${SPRING_MAIL_HOST:-}
SPRING_MAIL_PORT: ${SPRING_MAIL_PORT:-25}

2
deploy/k8s/base/backend-deployment.yaml
View file

@ -248,6 +248,8 @@ spec:
value: "https://accounts.feishu.cn/oauth/v3/token"
- name: OAUTH2_FEISHU_USER_INFO_URI
value: "https://open.feishu.cn/open-apis/authen/v1/user_info"
- name: OAUTH2_FEISHU_REDIRECT_URI
value: ""
volumeMounts:
- name: skillhub-storage

1
docs/03-authentication-design.md
View file

@ -320,6 +320,7 @@ OAUTH2_FEISHU_PROTOCOL_VERSION=v3
OAUTH2_FEISHU_AUTHORIZATION_URI=https://accounts.feishu.cn/open-apis/authen/v1/authorize
OAUTH2_FEISHU_TOKEN_URI=https://accounts.feishu.cn/oauth/v3/token
OAUTH2_FEISHU_USER_INFO_URI=https://open.feishu.cn/open-apis/authen/v1/user_info
OAUTH2_FEISHU_REDIRECT_URI=
# 历史 v2 应用可显式切换：
# OAUTH2_FEISHU_PROTOCOL_VERSION=v2

5
docs/09-deployment.md
View file

@ -292,6 +292,8 @@ services:
- `OAUTH2_FEISHU_PROTOCOL_VERSION=v3`
- `OAUTH2_FEISHU_TOKEN_URI=https://accounts.feishu.cn/oauth/v3/token`
- `OAUTH2_FEISHU_USER_INFO_URI=https://open.feishu.cn/open-apis/authen/v1/user_info`
- `OAUTH2_FEISHU_REDIRECT_URI=`（可选；默认使用 `{baseUrl}/login/oauth2/code/feishu`，
经过反向代理或本地动态端口时应显式设置完整回调 URL）
Lark 国际版、私有化部署或企业网关可分别覆盖这三个完整 endpoint；历史的
`OAUTH2_FEISHU_AUTHORIZE_URI` / `OAUTH2_FEISHU_BASE_URI` 仍可作为 base-URI
@ -309,7 +311,8 @@ services:
Secret 中注入：
1. 在飞书自建应用中登记
`https://<公网域名>/login/oauth2/code/feishu`，并开启用户信息所需权限。
`https://<公网域名>/login/oauth2/code/feishu`，并开启用户信息所需权限；如果使用
本地预览，则把 `OAUTH2_FEISHU_REDIRECT_URI` 设置为预览 Web 地址对应的完整回调 URL。
2. 在受控环境设置 `OAUTH2_FEISHU_CLIENT_ID`、`OAUTH2_FEISHU_CLIENT_SECRET`，确认
`OAUTH2_FEISHU_PROTOCOL_VERSION` 与 token endpoint 匹配，然后运行：

6
scripts/tests/validate-release-config-test.sh
View file

@ -79,6 +79,7 @@ OAUTH2_FEISHU_PROTOCOL_VERSION=v2
OAUTH2_FEISHU_AUTHORIZATION_URI=https://accounts.feishu.cn/open-apis/authen/v1/authorize
OAUTH2_FEISHU_TOKEN_URI=https://open.feishu.cn/open-apis/authen/v2/oauth/token
OAUTH2_FEISHU_USER_INFO_URI=https://open.feishu.cn/open-apis/authen/v1/user_info
OAUTH2_FEISHU_REDIRECT_URI=http://127.0.0.1:55041/login/oauth2/code/feishu
EOF
"$SCRIPT" "$valid_feishu_env" >/dev/null
@ -92,6 +93,11 @@ write_env "$invalid_feishu_endpoint_env" "release-download-secret-32-bytes-minim
printf '%s\n' "OAUTH2_FEISHU_TOKEN_URI=https://open.feishu.cn/oauth/token?tenant=prod" >>"$invalid_feishu_endpoint_env"
expect_fail "$invalid_feishu_endpoint_env" "OAUTH2_FEISHU_TOKEN_URI must not contain a query"
invalid_feishu_redirect_env="$tmp/invalid-feishu-redirect.env"
write_env "$invalid_feishu_redirect_env" "release-download-secret-32-bytes-minimum"
printf '%s\n' "OAUTH2_FEISHU_REDIRECT_URI=https://skillhub.example.com/login/oauth2/code/feishu?bad=1" >>"$invalid_feishu_redirect_env"
expect_fail "$invalid_feishu_redirect_env" "OAUTH2_FEISHU_REDIRECT_URI must not contain a query"
disabled_builtin_skills_env="$tmp/disabled-builtin-skills.env"
write_env "$disabled_builtin_skills_env" "release-download-secret-32-bytes-minimum"
printf '%s\n' "SKILLHUB_BUILTIN_SKILLS_ENABLED=false" >>"$disabled_builtin_skills_env"

2
scripts/validate-release-config.sh
View file

@ -399,7 +399,7 @@ esac
# OAuth endpoints are sent directly to the provider. Validate them here so a
# typo fails before the release container starts.
for feishu_endpoint in OAUTH2_FEISHU_AUTHORIZATION_URI OAUTH2_FEISHU_TOKEN_URI OAUTH2_FEISHU_USER_INFO_URI; do
for feishu_endpoint in OAUTH2_FEISHU_AUTHORIZATION_URI OAUTH2_FEISHU_TOKEN_URI OAUTH2_FEISHU_USER_INFO_URI OAUTH2_FEISHU_REDIRECT_URI; do
eval "feishu_endpoint_value=\${$feishu_endpoint:-}"
if [ -n "$feishu_endpoint_value" ]; then
validate_url "$feishu_endpoint"