fix(deploy): preserve default Feishu callback derivation

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

charts/skillhub/templates/server-deployment.yaml

@@ -376,8 +376,10 @@ spec:
               value: {{ .Values.oauth2.feishu.tokenUri | default "https://accounts.feishu.cn/oauth/v3/token" | quote }}
             - name: OAUTH2_FEISHU_USER_INFO_URI
               value: {{ .Values.oauth2.feishu.userInfoUri | default "https://open.feishu.cn/open-apis/authen/v1/user_info" | quote }}
+            {{- with .Values.oauth2.feishu.redirectUri }}
             - name: OAUTH2_FEISHU_REDIRECT_URI
-              value: {{ .Values.oauth2.feishu.redirectUri | default "" | quote }}
+              value: {{ . | quote }}
+            {{- end }}
 
             {{- if .Values.server.javaOpts }}
             - name: JAVA_OPTS

charts/skillhub/tests/configuration-contracts.sh

@@ -39,6 +39,16 @@ grep -Fq 'fsGroupChangePolicy: OnRootMismatch' "$TMP_DIR/default.yaml"
 grep -Fq 'type: Recreate' "$TMP_DIR/default.yaml"
 grep -A1 -F 'name: SKILLHUB_SUITE_REVIEW_WRITES_ENABLED' "$TMP_DIR/default.yaml" \
   | grep -Fq 'value: "false"'
+if grep -Fq 'name: OAUTH2_FEISHU_REDIRECT_URI' "$TMP_DIR/default.yaml"; then
+  fail "default Helm rendering must omit an empty Feishu redirect URI so Spring can derive baseUrl"
+fi
+
+render feishu-redirect "$CHART_DIR" \
+  --set-string oauth2.feishu.redirectUri=https://skills.example.com/login/oauth2/code/feishu \
+  --show-only templates/server-deployment.yaml >"$TMP_DIR/feishu-redirect.yaml"
+grep -A1 -F 'name: OAUTH2_FEISHU_REDIRECT_URI' "$TMP_DIR/feishu-redirect.yaml" \
+  | grep -Fq 'value: "https://skills.example.com/login/oauth2/code/feishu"' \
+  || fail "Helm must inject an explicitly configured Feishu redirect URI"
 
 render suite-review-enabled "$CHART_DIR" \
   --set server.suiteReviewWritesEnabled=true \

compose.release.yml

@@ -126,7 +126,7 @@ services:
       OAUTH2_FEISHU_PROTOCOL_VERSION: ${OAUTH2_FEISHU_PROTOCOL_VERSION:-v3}
       OAUTH2_FEISHU_TOKEN_URI: ${OAUTH2_FEISHU_TOKEN_URI:-https://accounts.feishu.cn/oauth/v3/token}
       OAUTH2_FEISHU_USER_INFO_URI: ${OAUTH2_FEISHU_USER_INFO_URI:-${OAUTH2_FEISHU_BASE_URI:-https://open.feishu.cn}/open-apis/authen/v1/user_info}
-      OAUTH2_FEISHU_REDIRECT_URI: ${OAUTH2_FEISHU_REDIRECT_URI:-}
+      OAUTH2_FEISHU_REDIRECT_URI: ${OAUTH2_FEISHU_REDIRECT_URI:-${SKILLHUB_PUBLIC_BASE_URL:-http://localhost}/login/oauth2/code/feishu}
       OAUTH2_FEISHU_DISPLAY_NAME: ${OAUTH2_FEISHU_DISPLAY_NAME:-飞书}
       SPRING_MAIL_HOST: ${SPRING_MAIL_HOST:-}
       SPRING_MAIL_PORT: ${SPRING_MAIL_PORT:-25}

deploy/k8s/base/backend-deployment.yaml

@@ -248,9 +248,6 @@ spec:
               value: "https://accounts.feishu.cn/oauth/v3/token"
             - name: OAUTH2_FEISHU_USER_INFO_URI
               value: "https://open.feishu.cn/open-apis/authen/v1/user_info"
-            - name: OAUTH2_FEISHU_REDIRECT_URI
-              value: ""
-
           volumeMounts:
             - name: skillhub-storage
               mountPath: /var/lib/skillhub/storage

docs/09-deployment.md

@@ -305,8 +305,9 @@ services:
     - `OAUTH2_FEISHU_PROTOCOL_VERSION=v3`
     - `OAUTH2_FEISHU_TOKEN_URI=https://accounts.feishu.cn/oauth/v3/token`
     - `OAUTH2_FEISHU_USER_INFO_URI=https://open.feishu.cn/open-apis/authen/v1/user_info`
-    - `OAUTH2_FEISHU_REDIRECT_URI=`（可选；默认使用 `{baseUrl}/login/oauth2/code/feishu`，
-      经过反向代理或本地动态端口时应显式设置完整回调 URL）
+    - `OAUTH2_FEISHU_REDIRECT_URI=`（可选；Compose 默认根据
+      `SKILLHUB_PUBLIC_BASE_URL` 生成 `/login/oauth2/code/feishu`，Helm/K8s 未设置时由
+      Spring 使用 `{baseUrl}`；经过特殊反向代理或本地动态端口时应显式设置完整回调 URL）
 
     Lark 国际版、私有化部署或企业网关可分别覆盖这三个完整 endpoint；历史的
     `OAUTH2_FEISHU_AUTHORIZE_URI` / `OAUTH2_FEISHU_BASE_URI` 仍可作为 base-URI

scripts/tests/validate-release-config-test.sh

@@ -71,6 +71,14 @@ write_env "$valid_env" "release-download-secret-32-bytes-minimum"
 printf '%s\n' "SKILLHUB_STORAGE_S3_DISABLE_CHUNKED_ENCODING=true" >>"$valid_env"
 "$SCRIPT" "$valid_env" >/dev/null
 
+compose_default_redirect="$tmp/compose-default-redirect.txt"
+SKILLHUB_DOWNLOAD_ANON_COOKIE_SECRET=release-download-secret-32-bytes-minimum \
+SKILLHUB_PUBLIC_BASE_URL=https://skillhub.example.com \
+  docker compose -f "$REPO_ROOT/compose.release.yml" config \
+  | grep -A1 'OAUTH2_FEISHU_REDIRECT_URI:' >"$compose_default_redirect"
+grep -Fq 'https://skillhub.example.com/login/oauth2/code/feishu' "$compose_default_redirect" \
+  || fail "compose must derive the default Feishu redirect URI from SKILLHUB_PUBLIC_BASE_URL"
+
 valid_feishu_env="$tmp/valid-feishu.env"
 write_env "$valid_feishu_env" "release-download-secret-32-bytes-minimum"
 cat >>"$valid_feishu_env" <<'EOF'