From 3381cc128e09f5da6b43a13237e24a9d573337cb Mon Sep 17 00:00:00 2001 From: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> Date: Mon, 21 Sep 2026 10:52:44 +0800 Subject: [PATCH] fix(deploy): pass Feishu redirect URI through releases Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> --- .env.release.example | 2 ++ charts/skillhub/templates/server-deployment.yaml | 2 ++ charts/skillhub/values.schema.json | 3 ++- charts/skillhub/values.yaml | 1 + compose.release.yml | 1 + deploy/k8s/base/backend-deployment.yaml | 2 ++ docs/03-authentication-design.md | 1 + docs/09-deployment.md | 5 ++++- scripts/tests/validate-release-config-test.sh | 6 ++++++ scripts/validate-release-config.sh | 2 +- 10 files changed, 22 insertions(+), 3 deletions(-) diff --git a/.env.release.example b/.env.release.example index 682e3456..73800c73 100644 --- a/.env.release.example +++ b/.env.release.example @@ -134,6 +134,8 @@ OAUTH2_FEISHU_AUTHORIZATION_URI=https://accounts.feishu.cn/open-apis/authen/v1/a OAUTH2_FEISHU_PROTOCOL_VERSION=v3 OAUTH2_FEISHU_TOKEN_URI=https://accounts.feishu.cn/oauth/v3/token OAUTH2_FEISHU_USER_INFO_URI=https://open.feishu.cn/open-apis/authen/v1/user_info +# Optional; defaults to {baseUrl}/login/oauth2/code/feishu. Set explicitly for local previews or reverse proxies. +OAUTH2_FEISHU_REDIRECT_URI= OAUTH2_FEISHU_DISPLAY_NAME=飞书 # Optional: OIDC login (e.g. Keycloak, Okta, Azure AD). diff --git a/charts/skillhub/templates/server-deployment.yaml b/charts/skillhub/templates/server-deployment.yaml index 6d5b24f0..6359f5c0 100644 --- a/charts/skillhub/templates/server-deployment.yaml +++ b/charts/skillhub/templates/server-deployment.yaml @@ -376,6 +376,8 @@ spec: value: {{ .Values.oauth2.feishu.tokenUri | default "https://accounts.feishu.cn/oauth/v3/token" | quote }} - name: OAUTH2_FEISHU_USER_INFO_URI value: {{ .Values.oauth2.feishu.userInfoUri | default "https://open.feishu.cn/open-apis/authen/v1/user_info" | quote }} + - name: OAUTH2_FEISHU_REDIRECT_URI + value: {{ .Values.oauth2.feishu.redirectUri | default "" | quote }} {{- if .Values.server.javaOpts }} - name: JAVA_OPTS diff --git a/charts/skillhub/values.schema.json b/charts/skillhub/values.schema.json index 7139f13f..e7bb6b47 100644 --- a/charts/skillhub/values.schema.json +++ b/charts/skillhub/values.schema.json @@ -47,7 +47,8 @@ "authorizationUri": { "type": "string", "format": "uri" }, "protocolVersion": { "type": "string", "enum": ["v2", "v3"] }, "tokenUri": { "type": "string", "format": "uri" }, - "userInfoUri": { "type": "string", "format": "uri" } + "userInfoUri": { "type": "string", "format": "uri" }, + "redirectUri": { "type": "string" } } } } diff --git a/charts/skillhub/values.yaml b/charts/skillhub/values.yaml index c1a8e635..f004f3f0 100644 --- a/charts/skillhub/values.yaml +++ b/charts/skillhub/values.yaml @@ -28,6 +28,7 @@ oauth2: protocolVersion: v3 tokenUri: https://accounts.feishu.cn/oauth/v3/token userInfoUri: https://open.feishu.cn/open-apis/authen/v1/user_info + redirectUri: "" builtinSkills: enabled: true diff --git a/compose.release.yml b/compose.release.yml index ab3318ca..9eca86b4 100644 --- a/compose.release.yml +++ b/compose.release.yml @@ -125,6 +125,7 @@ services: OAUTH2_FEISHU_PROTOCOL_VERSION: ${OAUTH2_FEISHU_PROTOCOL_VERSION:-v3} OAUTH2_FEISHU_TOKEN_URI: ${OAUTH2_FEISHU_TOKEN_URI:-https://accounts.feishu.cn/oauth/v3/token} OAUTH2_FEISHU_USER_INFO_URI: ${OAUTH2_FEISHU_USER_INFO_URI:-${OAUTH2_FEISHU_BASE_URI:-https://open.feishu.cn}/open-apis/authen/v1/user_info} + OAUTH2_FEISHU_REDIRECT_URI: ${OAUTH2_FEISHU_REDIRECT_URI:-} OAUTH2_FEISHU_DISPLAY_NAME: ${OAUTH2_FEISHU_DISPLAY_NAME:-飞书} SPRING_MAIL_HOST: ${SPRING_MAIL_HOST:-} SPRING_MAIL_PORT: ${SPRING_MAIL_PORT:-25} diff --git a/deploy/k8s/base/backend-deployment.yaml b/deploy/k8s/base/backend-deployment.yaml index 38fdbfa9..303e554c 100644 --- a/deploy/k8s/base/backend-deployment.yaml +++ b/deploy/k8s/base/backend-deployment.yaml @@ -248,6 +248,8 @@ spec: value: "https://accounts.feishu.cn/oauth/v3/token" - name: OAUTH2_FEISHU_USER_INFO_URI value: "https://open.feishu.cn/open-apis/authen/v1/user_info" + - name: OAUTH2_FEISHU_REDIRECT_URI + value: "" volumeMounts: - name: skillhub-storage diff --git a/docs/03-authentication-design.md b/docs/03-authentication-design.md index 4fcb8b30..ef5aa98a 100644 --- a/docs/03-authentication-design.md +++ b/docs/03-authentication-design.md @@ -320,6 +320,7 @@ OAUTH2_FEISHU_PROTOCOL_VERSION=v3 OAUTH2_FEISHU_AUTHORIZATION_URI=https://accounts.feishu.cn/open-apis/authen/v1/authorize OAUTH2_FEISHU_TOKEN_URI=https://accounts.feishu.cn/oauth/v3/token OAUTH2_FEISHU_USER_INFO_URI=https://open.feishu.cn/open-apis/authen/v1/user_info +OAUTH2_FEISHU_REDIRECT_URI= # 历史 v2 应用可显式切换： # OAUTH2_FEISHU_PROTOCOL_VERSION=v2 diff --git a/docs/09-deployment.md b/docs/09-deployment.md index bbceba19..8c8286d0 100644 --- a/docs/09-deployment.md +++ b/docs/09-deployment.md @@ -292,6 +292,8 @@ services: - `OAUTH2_FEISHU_PROTOCOL_VERSION=v3` - `OAUTH2_FEISHU_TOKEN_URI=https://accounts.feishu.cn/oauth/v3/token` - `OAUTH2_FEISHU_USER_INFO_URI=https://open.feishu.cn/open-apis/authen/v1/user_info` + - `OAUTH2_FEISHU_REDIRECT_URI=`（可选；默认使用 `{baseUrl}/login/oauth2/code/feishu`， + 经过反向代理或本地动态端口时应显式设置完整回调 URL） Lark 国际版、私有化部署或企业网关可分别覆盖这三个完整 endpoint；历史的 `OAUTH2_FEISHU_AUTHORIZE_URI` / `OAUTH2_FEISHU_BASE_URI` 仍可作为 base-URI @@ -309,7 +311,8 @@ services: Secret 中注入： 1. 在飞书自建应用中登记 - `https://<公网域名>/login/oauth2/code/feishu`，并开启用户信息所需权限。 + `https://<公网域名>/login/oauth2/code/feishu`，并开启用户信息所需权限；如果使用 + 本地预览，则把 `OAUTH2_FEISHU_REDIRECT_URI` 设置为预览 Web 地址对应的完整回调 URL。 2. 在受控环境设置 `OAUTH2_FEISHU_CLIENT_ID`、`OAUTH2_FEISHU_CLIENT_SECRET`，确认 `OAUTH2_FEISHU_PROTOCOL_VERSION` 与 token endpoint 匹配，然后运行： diff --git a/scripts/tests/validate-release-config-test.sh b/scripts/tests/validate-release-config-test.sh index be16f291..e7be3d97 100755 --- a/scripts/tests/validate-release-config-test.sh +++ b/scripts/tests/validate-release-config-test.sh @@ -79,6 +79,7 @@ OAUTH2_FEISHU_PROTOCOL_VERSION=v2 OAUTH2_FEISHU_AUTHORIZATION_URI=https://accounts.feishu.cn/open-apis/authen/v1/authorize OAUTH2_FEISHU_TOKEN_URI=https://open.feishu.cn/open-apis/authen/v2/oauth/token OAUTH2_FEISHU_USER_INFO_URI=https://open.feishu.cn/open-apis/authen/v1/user_info +OAUTH2_FEISHU_REDIRECT_URI=http://127.0.0.1:55041/login/oauth2/code/feishu EOF "$SCRIPT" "$valid_feishu_env" >/dev/null @@ -92,6 +93,11 @@ write_env "$invalid_feishu_endpoint_env" "release-download-secret-32-bytes-minim printf '%s\n' "OAUTH2_FEISHU_TOKEN_URI=https://open.feishu.cn/oauth/token?tenant=prod" >>"$invalid_feishu_endpoint_env" expect_fail "$invalid_feishu_endpoint_env" "OAUTH2_FEISHU_TOKEN_URI must not contain a query" +invalid_feishu_redirect_env="$tmp/invalid-feishu-redirect.env" +write_env "$invalid_feishu_redirect_env" "release-download-secret-32-bytes-minimum" +printf '%s\n' "OAUTH2_FEISHU_REDIRECT_URI=https://skillhub.example.com/login/oauth2/code/feishu?bad=1" >>"$invalid_feishu_redirect_env" +expect_fail "$invalid_feishu_redirect_env" "OAUTH2_FEISHU_REDIRECT_URI must not contain a query" + disabled_builtin_skills_env="$tmp/disabled-builtin-skills.env" write_env "$disabled_builtin_skills_env" "release-download-secret-32-bytes-minimum" printf '%s\n' "SKILLHUB_BUILTIN_SKILLS_ENABLED=false" >>"$disabled_builtin_skills_env" diff --git a/scripts/validate-release-config.sh b/scripts/validate-release-config.sh index 03ba596b..e9a85899 100755 --- a/scripts/validate-release-config.sh +++ b/scripts/validate-release-config.sh @@ -399,7 +399,7 @@ esac # OAuth endpoints are sent directly to the provider. Validate them here so a # typo fails before the release container starts. -for feishu_endpoint in OAUTH2_FEISHU_AUTHORIZATION_URI OAUTH2_FEISHU_TOKEN_URI OAUTH2_FEISHU_USER_INFO_URI; do +for feishu_endpoint in OAUTH2_FEISHU_AUTHORIZATION_URI OAUTH2_FEISHU_TOKEN_URI OAUTH2_FEISHU_USER_INFO_URI OAUTH2_FEISHU_REDIRECT_URI; do eval "feishu_endpoint_value=\${$feishu_endpoint:-}" if [ -n "$feishu_endpoint_value" ]; then validate_url "$feishu_endpoint"