From ec75afbc44139dbe9da534d8a8c08a5b91f86d3c Mon Sep 17 00:00:00 2001
From: xiaojunnuo <xiaojunnuo@qq.com>
Date: Thu, 27 Nov 2025 01:59:22 +0800
Subject: [PATCH] =?UTF-8?q?perf:=20=E6=94=AF=E6=8C=81oidc=E5=8D=95?=
 =?UTF-8?q?=E7=82=B9=E7=99=BB=E5=BD=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/system/settings/service/models.ts     |  37 ++---
 .../src/user/addon/service/addon-service.ts   |   2 +-
 .../certd-client/src/router/source/outside.ts |   8 +
 .../src/store/settings/api.basic.ts           |  11 ++
 .../certd/addon/addon-selector/index.vue      |   1 +
 .../src/views/certd/addon/common.tsx          |   3 +-
 .../src/views/certd/addon/crud.tsx            |  11 ++
 .../src/views/framework/login/index.vue       |  26 ++-
 .../src/views/framework/oauth/api.ts          |  45 ++++++
 .../views/framework/oauth/oauth-callback.vue  | 105 ++++++++++++
 .../views/framework/oauth/oauth-footer.vue    |  45 ++++++
 .../src/views/sys/settings/api.ts             |   7 +
 .../src/views/sys/settings/tabs/register.vue  |  62 ++++++-
 .../db/migration/v10034__oauth_bound.sql      |  14 ++
 .../basic/login/oauth-controller.ts           | 153 ++++++++++++++++++
 .../basic/oauth/connect-controller.ts         |  67 --------
 .../sys/settings/sys-settings-controller.ts   |   7 +
 .../src/modules/basic/service/code-service.ts |  18 ++-
 .../entity/{oauth-bind.ts => oauth-bound.ts}  |   4 +-
 .../modules/login/service/login-service.ts    |  24 ++-
 .../login/service/oauth-bound-service.ts      |  74 +++++++++
 .../sys/authority/service/user-service.ts     |   8 +-
 packages/ui/certd-server/src/plugins/index.ts |   1 +
 .../src/plugins/plugin-oauth/api.ts           |   1 -
 .../plugins/plugin-oauth/oidc/plugin-oidc.ts  |   2 +-
 25 files changed, 633 insertions(+), 103 deletions(-)
 create mode 100644 packages/ui/certd-client/src/views/framework/oauth/api.ts
 create mode 100644 packages/ui/certd-client/src/views/framework/oauth/oauth-callback.vue
 create mode 100644 packages/ui/certd-client/src/views/framework/oauth/oauth-footer.vue
 create mode 100644 packages/ui/certd-server/db/migration/v10034__oauth_bound.sql
 create mode 100644 packages/ui/certd-server/src/controller/basic/login/oauth-controller.ts
 delete mode 100644 packages/ui/certd-server/src/controller/basic/oauth/connect-controller.ts
 rename packages/ui/certd-server/src/modules/login/entity/{oauth-bind.ts => oauth-bound.ts} (91%)
 create mode 100644 packages/ui/certd-server/src/modules/login/service/oauth-bound-service.ts

diff --git a/packages/libs/lib-server/src/system/settings/service/models.ts b/packages/libs/lib-server/src/system/settings/service/models.ts
index 50be68713..3312679d0 100644
--- a/packages/libs/lib-server/src/system/settings/service/models.ts
+++ b/packages/libs/lib-server/src/system/settings/service/models.ts
@@ -16,7 +16,7 @@ export class SysPublicSettings extends BaseSettings {
   static __access__ = 'public';
 
   registerEnabled = false;
-  userValidTimeEnabled?:boolean = false;
+  userValidTimeEnabled?: boolean = false;
   passwordLoginEnabled = true;
   usernameRegisterEnabled = true;
   mobileRegisterEnabled = false;
@@ -36,7 +36,7 @@ export class SysPublicSettings extends BaseSettings {
   captchaEnabled = false;
   //验证码类型
   captchaType?: string;
-  captchaAddonId?:number;
+  captchaAddonId?: number;
 
 
 
@@ -49,6 +49,14 @@ export class SysPublicSettings extends BaseSettings {
   // 固定证书有效期天数，0表示不固定
   fixedCertExpireDays?: number;
 
+  // 第三方OAuth配置
+  oauthEnabled?: boolean = false;
+  oauthProviders: Record<string, {
+    type: string;
+    title: string;
+    addonId: number;
+  }> = {};
+
 }
 
 export class SysPrivateSettings extends BaseSettings {
@@ -69,9 +77,9 @@ export class SysPrivateSettings extends BaseSettings {
     type?: string;
     config?: any;
   } = {
-    type: 'aliyun',
-    config: {},
-  };
+      type: 'aliyun',
+      config: {},
+    };
 
   removeSecret() {
     const clone = cloneDeep(this);
@@ -196,7 +204,7 @@ export class SysSuiteSetting extends BaseSettings {
   static __key__ = 'sys.suite';
   static __access__ = 'private';
 
-  enabled:boolean = false;
+  enabled: boolean = false;
 
   registerGift?: {
     productId: number;
@@ -221,22 +229,9 @@ export class SysSafeSetting extends BaseSettings {
   static __access__ = 'private';
 
   // 站点隐藏
-  hidden:SiteHidden = {
+  hidden: SiteHidden = {
     enabled: false,
-    hiddenOpenApi:false,
+    hiddenOpenApi: false,
     autoHiddenTimes: 5,
   };
 }
-
-
-export class SysOauthSetting extends BaseSettings {
-  static __title__ = 'OAuth设置';
-  static __key__ = 'sys.oauth';
-  static __access__ = 'private';
-
-  oauths: Record<string, {
-    type: string;
-    title: string;
-    addonId: number;
-  }> = {};
-}
diff --git a/packages/libs/lib-server/src/user/addon/service/addon-service.ts b/packages/libs/lib-server/src/user/addon/service/addon-service.ts
index b009c4751..55928d9bf 100644
--- a/packages/libs/lib-server/src/user/addon/service/addon-service.ts
+++ b/packages/libs/lib-server/src/user/addon/service/addon-service.ts
@@ -76,7 +76,7 @@ export class AddonService extends BaseService<AddonEntity> {
 
 
   getDefineList(addonType: string) {
-    return addonRegistry.getDefineList();
+    return addonRegistry.getDefineList(addonType);
   }
 
   getDefineByType(type: string, prefix?: string) {
diff --git a/packages/ui/certd-client/src/router/source/outside.ts b/packages/ui/certd-client/src/router/source/outside.ts
index 5c9bdfa4b..8aa984baf 100644
--- a/packages/ui/certd-client/src/router/source/outside.ts
+++ b/packages/ui/certd-client/src/router/source/outside.ts
@@ -32,6 +32,14 @@ export const outsideResource = [
         path: "/forgotPassword",
         component: "/framework/forgot-password/index.vue",
       },
+      {
+        meta: {
+          title: "第三方登录回调",
+        },
+        name: "oauthCallback",
+        path: "/oauth/callback/:type",
+        component: "/framework/oauth/oauth-callback.vue",
+      },
     ],
   },
   ...errorPage,
diff --git a/packages/ui/certd-client/src/store/settings/api.basic.ts b/packages/ui/certd-client/src/store/settings/api.basic.ts
index f8c198523..c041db411 100644
--- a/packages/ui/certd-client/src/store/settings/api.basic.ts
+++ b/packages/ui/certd-client/src/store/settings/api.basic.ts
@@ -59,6 +59,17 @@ export type SysPublicSetting = {
 
   // 固定证书有效期天数，0表示不固定
   fixedCertExpireDays?: number;
+
+  // 第三方OAuth配置
+  oauthEnabled?: boolean;
+  oauthProviders?: Record<
+    string,
+    {
+      type: string;
+      title: string;
+      addonId: number;
+    }
+  >;
 };
 export type SuiteSetting = {
   enabled?: boolean;
diff --git a/packages/ui/certd-client/src/views/certd/addon/addon-selector/index.vue b/packages/ui/certd-client/src/views/certd/addon/addon-selector/index.vue
index d64884aa5..104035363 100644
--- a/packages/ui/certd-client/src/views/certd/addon/addon-selector/index.vue
+++ b/packages/ui/certd-client/src/views/certd/addon/addon-selector/index.vue
@@ -82,6 +82,7 @@ function createCrudOptionsWithApi(opts: any) {
   opts.context = {
     api,
     addonType: props.addonType,
+    type: props.type,
   };
   return createCrudOptions(opts);
 }
diff --git a/packages/ui/certd-client/src/views/certd/addon/common.tsx b/packages/ui/certd-client/src/views/certd/addon/common.tsx
index 191786dcc..3177e24ed 100644
--- a/packages/ui/certd-client/src/views/certd/addon/common.tsx
+++ b/packages/ui/certd-client/src/views/certd/addon/common.tsx
@@ -110,7 +110,8 @@ export function getCommonColumnDefine(crudExpose: any, typeRef: any, api: any, a
       type: "dict-select",
       dict: addonTypeDictRef,
       search: {
-        show: false,
+        show: true,
+        valueChange: null,
       },
       column: {
         width: 200,
diff --git a/packages/ui/certd-client/src/views/certd/addon/crud.tsx b/packages/ui/certd-client/src/views/certd/addon/crud.tsx
index 73f00f03c..e606a8659 100644
--- a/packages/ui/certd-client/src/views/certd/addon/crud.tsx
+++ b/packages/ui/certd-client/src/views/certd/addon/crud.tsx
@@ -5,7 +5,12 @@ import { AddReq, CreateCrudOptionsProps, CreateCrudOptionsRet, DelReq, EditReq,
 export default function ({ crudExpose, context }: CreateCrudOptionsProps): CreateCrudOptionsRet {
   const api = context.api;
   const addonType = context.addonType;
+  const type = context.type;
   const pageRequest = async (query: UserPageQuery): Promise<UserPageRes> => {
+    if (query.query?.body) {
+      delete query.query.body;
+    }
+
     return await api.GetList(query);
   };
   const editRequest = async (req: EditReq) => {
@@ -44,6 +49,12 @@ export default function ({ crudExpose, context }: CreateCrudOptionsProps): Creat
           },
         },
       },
+      addForm: {
+        initialForm: {
+          addonType: addonType,
+          type: type,
+        },
+      },
       rowHandle: {
         width: 200,
       },
diff --git a/packages/ui/certd-client/src/views/framework/login/index.vue b/packages/ui/certd-client/src/views/framework/login/index.vue
index f7a26658f..d2a2bd6a9 100644
--- a/packages/ui/certd-client/src/views/framework/login/index.vue
+++ b/packages/ui/certd-client/src/views/framework/login/index.vue
@@ -51,7 +51,7 @@
           {{ t("authentication.loginButton") }}
         </a-button>
 
-        <div v-if="!!settingStore.sysPublic.selfServicePasswordRetrievalEnabled" class="mt-2">
+        <div v-if="!!settingStore.sysPublic.selfServicePasswordRetrievalEnabled && !queryBindCode" class="mt-2">
           <router-link :to="{ name: 'forgotPassword' }">
             {{ t("authentication.forgotPassword") }}
           </router-link>
@@ -61,10 +61,14 @@
       <a-form-item class="user-login-other">
         <div class="flex flex-between justify-between items-center">
           <language-toggle class="color-blue"></language-toggle>
-          <router-link v-if="hasRegisterTypeEnabled()" class="register" :to="{ name: 'register' }">
+          <router-link v-if="hasRegisterTypeEnabled() && !queryBindCode" class="register" :to="{ name: 'register' }">
             {{ t("authentication.registerLink") }}
           </router-link>
         </div>
+
+        <div class="flex flex-between justify-between items-center mt-5">
+          <oauth-footer></oauth-footer>
+        </div>
       </a-form-item>
     </a-form>
     <a-form v-else ref="twoFactorFormRef" class="user-layout-login" :model="twoFactor" v-bind="layout">
@@ -96,12 +100,18 @@ import { useI18n } from "/@/locales";
 import { LanguageToggle } from "/@/vben/layouts";
 import CaptchaInput from "/@/components/captcha/captcha-input.vue";
 import { useRoute } from "vue-router";
+import OauthFooter from "/@/views/framework/oauth/oauth-footer.vue";
+import * as oauthApi from "../oauth/api";
+import { notification } from "ant-design-vue";
 export default defineComponent({
   name: "LoginPage",
-  components: { LanguageToggle, SmsCode, CaptchaInput },
+  components: { LanguageToggle, SmsCode, CaptchaInput, OauthFooter },
   setup() {
     const { t } = useI18n();
     const route = useRoute();
+
+    const queryBindCode = ref(route.query.bindCode as string | undefined);
+
     const urlLoginType = route.query.loginType as string | undefined;
     const verifyCodeInputRef = ref();
     const loading = ref(false);
@@ -160,6 +170,13 @@ export default defineComponent({
       },
     };
 
+    async function afterLoginSuccess() {
+      if (queryBindCode.value) {
+        await oauthApi.BindUser(queryBindCode.value);
+        notification.success({ message: "绑定第三方账号成功" });
+      }
+    }
+
     const twoFactor = reactive({
       loginId: "",
       verifyCode: "",
@@ -167,6 +184,7 @@ export default defineComponent({
 
     const handleTwoFactorSubmit = async () => {
       await userStore.loginByTwoFactor(twoFactor);
+      afterLoginSuccess();
     };
 
     const handleFinish = async () => {
@@ -178,6 +196,7 @@ export default defineComponent({
         // }
         const loginType = formState.loginType;
         await userStore.login(loginType, toRaw(formState));
+        afterLoginSuccess();
       } catch (e: any) {
         //@ts-ignore
         if (e.code === 10020) {
@@ -233,6 +252,7 @@ export default defineComponent({
       settingStore,
       captchaInputRef,
       captchaInputForSmsCode,
+      queryBindCode,
     };
   },
 });
diff --git a/packages/ui/certd-client/src/views/framework/oauth/api.ts b/packages/ui/certd-client/src/views/framework/oauth/api.ts
new file mode 100644
index 000000000..b8b65adc6
--- /dev/null
+++ b/packages/ui/certd-client/src/views/framework/oauth/api.ts
@@ -0,0 +1,45 @@
+import { request } from "/src/api/service";
+
+const apiPrefix = "/oauth";
+
+export async function OauthLogin(type: string) {
+  return await request({
+    url: apiPrefix + `/login`,
+    method: "post",
+    data: {
+      type,
+    },
+  });
+}
+
+export async function OauthCallback(type: string, query: Record<string, string>) {
+  return await request({
+    url: apiPrefix + `/callback`,
+    method: "post",
+    data: {
+      type,
+      ...query,
+    },
+  });
+}
+
+export async function AutoRegister(type: string, code: string) {
+  return await request({
+    url: apiPrefix + `/autoRegister`,
+    method: "post",
+    data: {
+      validationCode: code,
+      type,
+    },
+  });
+}
+
+export async function BindUser(code: string) {
+  return await request({
+    url: apiPrefix + `/bind`,
+    method: "post",
+    data: {
+      validationCode: code,
+    },
+  });
+}
diff --git a/packages/ui/certd-client/src/views/framework/oauth/oauth-callback.vue b/packages/ui/certd-client/src/views/framework/oauth/oauth-callback.vue
new file mode 100644
index 000000000..2de66e0bf
--- /dev/null
+++ b/packages/ui/certd-client/src/views/framework/oauth/oauth-callback.vue
@@ -0,0 +1,105 @@
+<template>
+  <div class="oauth-callback-page">
+    <div class="oauth-callback-content">
+      <div v-if="!bindRequired" class="oauth-callback-title">
+        <span>登录中...</span>
+      </div>
+      <div v-else class="oauth-callback-title">
+        <div>第三方登录成功，还未绑定账号，请选择</div>
+
+        <div>
+          <a-button class="w-full mt-5" type="primary" @click="goBindUser">绑定已有账号</a-button>
+          <a-button class="w-full mt-5" type="primary" @click="autoRegister">创建新账号</a-button>
+        </div>
+
+        <div class="w-full mt-5">
+          <router-link to="/login" class="w-full mt-5" type="primary">返回登录页</router-link>
+        </div>
+      </div>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, onMounted } from "vue";
+import * as api from "./api";
+import { useRoute, useRouter } from "vue-router";
+import { useUserStore } from "/@/store/user";
+
+const route = useRoute();
+const router = useRouter();
+const oauthType = route.params.type as string;
+
+const query = route.query as Record<string, string>;
+
+const userStore = useUserStore();
+
+const bindRequired = ref(false);
+const bindCode = ref("");
+
+async function handleOauthCallback() {
+  //处理第三方登录回调
+  const res = await api.OauthCallback(oauthType, query);
+  if (res.token) {
+    //登录成功
+    userStore.onLoginSuccess(res);
+    //跳转到首页
+    router.replace("/");
+    return;
+  }
+  if (res.bindRequired) {
+    //需要绑定
+    bindRequired.value = true;
+    bindCode.value = res.validationCode;
+  }
+}
+
+onMounted(async () => {
+  await handleOauthCallback();
+});
+
+async function goBindUser() {
+  //绑定已有账号
+  router.replace({
+    path: "/login",
+    query: {
+      bindCode: bindCode.value,
+    },
+  });
+}
+
+async function autoRegister() {
+  //自动注册账号
+  const res = await api.AutoRegister(oauthType, bindCode.value);
+  //登录成功
+  userStore.onLoginSuccess(res);
+  //跳转到首页
+  router.replace("/");
+}
+</script>
+<style lang="less">
+.oauth-callback-page {
+  display: flex;
+  justify-content: center;
+  align-items: center;
+  gap: 16px;
+
+  .oauth-callback-content {
+    display: flex;
+    justify-content: center;
+    align-items: center;
+    gap: 16px;
+    padding: 16px;
+    border-radius: 16px;
+    box-shadow: 0 0 16px rgba(0, 0, 0, 0.1);
+    width: 500px;
+    margin: 0 auto;
+    margin-top: 50px;
+
+    .oauth-callback-title {
+      font-size: 24px;
+      font-weight: 500;
+    }
+  }
+}
+</style>
diff --git a/packages/ui/certd-client/src/views/framework/oauth/oauth-footer.vue b/packages/ui/certd-client/src/views/framework/oauth/oauth-footer.vue
new file mode 100644
index 000000000..1939cddf2
--- /dev/null
+++ b/packages/ui/certd-client/src/views/framework/oauth/oauth-footer.vue
@@ -0,0 +1,45 @@
+<template>
+  <div class="oauth-footer">
+    <div v-for="item in oauthList" :key="item.type">
+      <div class="oauth-icon-button pointer" @click="goOauthLogin(item.type)">
+        <el-icon :icon="item.icon" />
+        <span>{{ item.name }}</span>
+      </div>
+    </div>
+  </div>
+</template>
+<script setup lang="ts">
+import { ref } from "vue";
+import * as api from "./api";
+
+const oauthList = ref([
+  {
+    name: "OIDC",
+    type: "oidc",
+    icon: "ion:oidc",
+  },
+]);
+
+async function goOauthLogin(type: string) {
+  //获取第三方登录URL
+  const res = await api.OauthLogin(type);
+  const loginUrl = res.loginUrl;
+  window.location.href = loginUrl;
+}
+</script>
+<style lang="less">
+.oauth-footer {
+  display: flex;
+  justify-content: center;
+  align-items: center;
+  gap: 16px;
+  .oauth-icon-button {
+    display: flex;
+    justify-content: center;
+    align-items: center;
+    gap: 8px;
+    padding: 8px 16px;
+    border-radius: 100px;
+  }
+}
+</style>
diff --git a/packages/ui/certd-client/src/views/sys/settings/api.ts b/packages/ui/certd-client/src/views/sys/settings/api.ts
index 9624a3ab5..a252ad3a4 100644
--- a/packages/ui/certd-client/src/views/sys/settings/api.ts
+++ b/packages/ui/certd-client/src/views/sys/settings/api.ts
@@ -111,3 +111,10 @@ export async function GetSmsTypeDefine(type: string) {
     },
   });
 }
+
+export async function GetOauthProviders() {
+  return await request({
+    url: apiPrefix + "/oauth/providers",
+    method: "post",
+  });
+}
diff --git a/packages/ui/certd-client/src/views/sys/settings/tabs/register.vue b/packages/ui/certd-client/src/views/sys/settings/tabs/register.vue
index 881584d0f..62767c2b8 100644
--- a/packages/ui/certd-client/src/views/sys/settings/tabs/register.vue
+++ b/packages/ui/certd-client/src/views/sys/settings/tabs/register.vue
@@ -54,6 +54,33 @@
             <div class="helper">{{ t("certd.saveThenTest") }}</div>
           </a-form-item>
         </template>
+        <a-form-item :label="t('certd.enableOauth')" :name="['public', 'oauthEnabled']">
+          <div class="flex-o">
+            <a-switch v-model:checked="formState.public.oauthEnabled" :disabled="!settingsStore.isPlus" :title="t('certd.plusFeature')" />
+            <vip-button class="ml-5" mode="plus"></vip-button>
+          </div>
+        </a-form-item>
+        <a-form-item v-if="formState.public.oauthEnabled" :label="t('certd.oauthProviders')" :name="['public', 'oauthProviders']">
+          <div class="flex flex-wrap">
+            <table>
+              <tr>
+                <th>{{ t("certd.oauthType") }}</th>
+                <th>{{ t("certd.oauthConfig") }}</th>
+              </tr>
+              <tr v-for="(item, key) of oauthProviders" :key="key">
+                <td>
+                  <div class="flex items-center">
+                    <fs-icon :icon="item.icon" />
+                    {{ item.title }}
+                  </div>
+                </td>
+                <td>
+                  <AddonSelector v-model:model-value="item.addonId" addon-type="oauth" from="sys" :type="item.name" :placeholder="t('certd.clientIdPlaceholder')" />
+                </td>
+              </tr>
+            </table>
+          </div>
+        </a-form-item>
       </template>
 
       <a-form-item label=" " :colon="false" :wrapper-col="{ span: 16 }">
@@ -64,14 +91,14 @@
 </template>
 
 <script setup lang="tsx">
-import { reactive, ref, Ref } from "vue";
+import { computed, reactive, ref, Ref } from "vue";
 import { GetSmsTypeDefine, SysSettings } from "/@/views/sys/settings/api";
 import * as api from "/@/views/sys/settings/api";
 import { merge } from "lodash-es";
 import { useSettingStore } from "/@/store/settings";
 import { notification } from "ant-design-vue";
 import { useI18n } from "/src/locales";
-
+import AddonSelector from "../../../certd/addon/addon-selector/index.vue";
 const { t } = useI18n();
 
 defineOptions({
@@ -158,6 +185,35 @@ async function loadTypeDefine(type: string) {
   smsTypeDefineInputs.value = inputs;
 }
 
+const oauthProviders = ref([]);
+async function loadOauthProviders() {
+  let list: any = await api.GetOauthProviders();
+  oauthProviders.value = list;
+  for (const item of list) {
+    debugger;
+    const type = item.name;
+    const provider = formState.public.oauthProviders?.[type];
+    if (provider) {
+      item.addonId = provider.addonId;
+    }
+  }
+}
+
+function fillOauthProviders(form: any) {
+  const providers: any = {};
+  for (const item of oauthProviders.value) {
+    const type = item.name;
+    providers[type] = {
+      type: type,
+      title: item.title,
+      icon: item.icon,
+      addonId: item.addonId || null,
+    };
+  }
+  form.public.oauthProviders = providers;
+  return providers;
+}
+
 async function loadSysSettings() {
   const data: any = await api.SysSettingsGet();
   merge(formState, data);
@@ -172,6 +228,7 @@ async function loadSysSettings() {
   if (!settingsStore.isComm) {
     formState.public.smsLoginEnabled = false;
   }
+  await loadOauthProviders();
 }
 
 const saveLoading = ref(false);
@@ -180,6 +237,7 @@ const settingsStore = useSettingStore();
 const onFinish = async (form: any) => {
   try {
     saveLoading.value = true;
+    fillOauthProviders(form);
     await api.SysSettingsSave(form);
     await settingsStore.loadSysSettings();
     notification.success({
diff --git a/packages/ui/certd-server/db/migration/v10034__oauth_bound.sql b/packages/ui/certd-server/db/migration/v10034__oauth_bound.sql
new file mode 100644
index 000000000..1ed1bb095
--- /dev/null
+++ b/packages/ui/certd-server/db/migration/v10034__oauth_bound.sql
@@ -0,0 +1,14 @@
+
+CREATE TABLE "cd_oauth_bound"
+(
+  "id"          integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+  "user_id"     integer      NOT NULL,
+  "type"        varchar(512) NOT NULL,
+  "open_id"     varchar(512) NOT NULL,
+  "create_time" datetime     NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+  "update_time" datetime     NOT NULL DEFAULT (CURRENT_TIMESTAMP)
+);
+
+
+CREATE INDEX "index_oauth_bound_user_id" ON "cd_oauth_bound" ("user_id");
+CREATE INDEX "index_oauth_bound_open_id" ON "cd_oauth_bound" ("open_id");
diff --git a/packages/ui/certd-server/src/controller/basic/login/oauth-controller.ts b/packages/ui/certd-server/src/controller/basic/login/oauth-controller.ts
new file mode 100644
index 000000000..79bba1c5d
--- /dev/null
+++ b/packages/ui/certd-server/src/controller/basic/login/oauth-controller.ts
@@ -0,0 +1,153 @@
+import { addonRegistry, BaseController, Constants, SysInstallInfo, SysSettingsService } from "@certd/lib-server";
+import { ALL, Body, Controller, Inject, Post, Provide } from "@midwayjs/core";
+import { AddonGetterService } from "../../../modules/pipeline/service/addon-getter-service.js";
+import { IOauthProvider } from "../../../plugins/plugin-oauth/api.js";
+import { LoginService } from "../../../modules/login/service/login-service.js";
+import { CodeService } from "../../../modules/basic/service/code-service.js";
+import { UserService } from "../../../modules/sys/authority/service/user-service.js";
+import { UserEntity } from "../../../modules/sys/authority/entity/user.js";
+import { simpleNanoId } from "@certd/basic";
+import { OauthBoundService } from "../../../modules/login/service/oauth-bound-service.js";
+import { OauthBoundEntity } from "../../../modules/login/entity/oauth-bound.js";
+
+/**
+ */
+@Provide()
+@Controller('/api/oauth')
+export class ConnectController extends BaseController {
+
+  @Inject()
+  addonGetterService: AddonGetterService;
+  @Inject()
+  sysSettingsService: SysSettingsService;
+  @Inject()
+  loginService: LoginService;
+  @Inject()
+  codeService: CodeService;
+  @Inject()
+  userService: UserService;
+
+  @Inject()
+  oauthBoundService: OauthBoundService;
+
+
+
+  private async getOauthProvider(type: string) {
+    const publicSettings = await this.sysSettingsService.getPublicSettings()
+    if (!publicSettings?.oauthEnabled) {
+      throw new Error("OAuth功能未启用");
+    }
+    const setting = publicSettings?.oauthProviders?.[type || ""]
+    if (!setting) {
+      throw new Error(`未配置该OAuth类型:${type}`);
+    }
+
+    const addon = await this.addonGetterService.getAddonById(setting.addonId, true, 0);
+    if (!addon) {
+      throw new Error("初始化OAuth插件失败");
+    }
+    return addon as IOauthProvider;
+  }
+
+  @Post('/login', { summary: Constants.per.guest })
+  public async login(@Body(ALL) body: { type: string }) {
+
+    const addon = await this.getOauthProvider(body.type);
+    const installInfo = await this.sysSettingsService.getSetting<SysInstallInfo>(SysInstallInfo);
+    const bindUrl = installInfo?.bindUrl || "";
+    //构造登录url
+    const redirectUrl = `${bindUrl}#/oauth/callback/${body.type}`;
+    const loginUrl = await addon.buildLoginUrl({ redirectUri: redirectUrl });
+    return this.ok({loginUrl});
+  }
+  @Post('/callback', { summary: Constants.per.guest })
+  public async callback(@Body(ALL) body: any) {
+    //处理登录回调
+    const addon = await this.getOauthProvider(body.type);
+    const tokenRes = await addon.onCallback({
+      code: body.code,
+      state: body.state,
+    });
+
+    const userInfo = tokenRes.userInfo;
+
+    const openId = userInfo.openId;
+
+    const loginRes = await this.loginService.loginByOpenId({ openId, type: body.type });
+    if (loginRes == null) {
+      // 用户还未绑定，让用户选择绑定已有账号还是自动注册新账号
+      const validationCode = await this.codeService.setValidationValue({
+        type: body.type,
+        userInfo,
+      });
+      return this.ok({
+        bindRequired: true,
+        validationCode,
+      });
+    }
+
+    //返回登录成功token
+    return this.ok(loginRes);
+  }
+
+  @Post('/bind', { summary: Constants.per.loginOnly })
+  public async bind(@Body(ALL) body: any) {
+    //需要已登录
+    const userId = this.getUserId();
+    const validationValue = this.codeService.getValidationValue(body.validationCode);
+    if (!validationValue) {
+      throw new Error("校验码错误");
+    }
+
+    await this.oauthBoundService.bind({
+      userId,
+      type: body.type,
+      openId: validationValue.openId,
+    });
+    return this.ok(1);
+  }
+
+  @Post('/autoRegister', { summary: Constants.per.guest })
+  public async autoRegister(@Body(ALL) body: { validationCode: string, type: string }) {
+
+    const validationValue = this.codeService.getValidationValue(body.validationCode);
+    if (!validationValue) {
+      throw new Error("第三方认证授权已过期");
+    }
+    const userInfo = validationValue.userInfo;
+    const oauthType = validationValue.type;
+    let newUser = new UserEntity()
+    newUser.username = `${oauthType}:_${userInfo.nickName}_${simpleNanoId(6)}`;
+    newUser.avatar = userInfo.avatar;
+    newUser.nickName = userInfo.nickName;
+
+    newUser = await this.userService.register("username", newUser, async (txManager) => {
+      const oauthBound : OauthBoundEntity = new OauthBoundEntity()
+      oauthBound.userId = newUser.id;
+      oauthBound.type = oauthType;
+      oauthBound.openId = userInfo.openId;
+      await txManager.save(oauthBound);
+    });
+
+    const loginRes = await this.loginService.generateToken(newUser);
+    return this.ok(loginRes);
+  }
+
+  @Post('/unbind', { summary: Constants.per.loginOnly })
+  public async unbind(@Body(ALL) body: any) {
+    //需要已登录
+    const userId = this.getUserId();
+    await this.oauthBoundService.unbind({
+      userId,
+      type: body.type,
+    });
+    return this.ok(1);
+  }
+
+  @Post('/providers', { summary: Constants.per.guest })
+  public async providers() {
+    const list = addonRegistry.getDefineList("oauth");
+    return this.ok(list);
+  }
+
+}
diff --git a/packages/ui/certd-server/src/controller/basic/oauth/connect-controller.ts b/packages/ui/certd-server/src/controller/basic/oauth/connect-controller.ts
deleted file mode 100644
index a166dc711..000000000
--- a/packages/ui/certd-server/src/controller/basic/oauth/connect-controller.ts
+++ /dev/null
@@ -1,67 +0,0 @@
-import { BaseController, Constants, SysInstallInfo, SysOauthSetting, SysSettingsService } from "@certd/lib-server";
-import { ALL, Body, Controller, Inject, Post, Provide } from "@midwayjs/core";
-import { AddonGetterService } from "../../../modules/pipeline/service/addon-getter-service.js";
-import { IOauthProvider } from "../../../plugins/plugin-oauth/api.js";
-
-/**
- */
-@Provide()
-@Controller('/api/connect')
-export class ConnectController extends BaseController {
-
-  @Inject()
-  addonGetterService: AddonGetterService;
-  @Inject()
-  sysSettingsService: SysSettingsService;
-
-  private async getOauthProvider(type:string){
-    const oauthSetting = await this.sysSettingsService.getSetting<SysOauthSetting>(SysOauthSetting);
-    const setting = oauthSetting?.oauths?.[type||""]
-    if (!setting) {
-      throw new Error(`未配置该OAuth类型:${type}`);
-    }
-
-    const addon = await this.addonGetterService.getAddonById(setting.addonId, true, 0);
-    if(!addon) {
-      throw new Error("初始化OAuth插件失败");
-    }
-    return addon as IOauthProvider;
-  }
-
-  @Post('/login', { summary: Constants.per.guest })
-  public async login(@Body(ALL) body: {type:string}) {
-
-    const addon = await this.getOauthProvider(body.type);
-    const installInfo = await this.sysSettingsService.getSetting<SysInstallInfo>(SysInstallInfo);
-    const bindUrl = installInfo?.bindUrl || "";
-    //构造登录url
-    const redirectUrl = `${bindUrl}#/auth/callback/${body.type}`;
-    const loginUrl = await addon.buildLoginUrl({ redirectUri: redirectUrl});
-    return this.ok(loginUrl);
-  }
-  @Post('/callback', { summary: Constants.per.guest })
-  public async callback(@Body(ALL) body: any) {
-    //处理登录回调
-    const addon = await this.getOauthProvider(body.type);
-    const tokenRes = await addon.onCallback({
-      code: body.code,
-      redirectUri: body.redirectUri,
-      state: body.state,
-    });
-
-    const userInfo = tokenRes.userInfo;
-
-    const openId = userInfo.openId;
-
-    return this.ok(openId);
-  }
-
-  @Post('/bind', { summary: Constants.per.guest })
-  public async bind(@Body(ALL) body: any) {
-    // const autoRegister = body.autoRegister || false;
-    // const bindInfo = body.bind || {};
-    //处理登录回调
-    return this.ok(1);
-  }
-  
-}
diff --git a/packages/ui/certd-server/src/controller/sys/settings/sys-settings-controller.ts b/packages/ui/certd-server/src/controller/sys/settings/sys-settings-controller.ts
index 949b022a2..22f52dd74 100644
--- a/packages/ui/certd-server/src/controller/sys/settings/sys-settings-controller.ts
+++ b/packages/ui/certd-server/src/controller/sys/settings/sys-settings-controller.ts
@@ -1,5 +1,6 @@
 import { ALL, Body, Controller, Inject, Post, Provide, Query } from "@midwayjs/core";
 import {
+  addonRegistry,
   CrudController,
   SysPrivateSettings,
   SysPublicSettings,
@@ -199,4 +200,10 @@ export class SysSettingsController extends CrudController<SysSettingsService> {
     await this.codeService.checkCaptcha(body)
     return this.ok({});
   }
+
+  @Post('/oauth/providers', { summary: 'sys:settings:view' })
+  async oauthProviders() {
+    const list = await addonRegistry.getDefineList("oauth");
+    return this.ok(list);
+  }
 }
diff --git a/packages/ui/certd-server/src/modules/basic/service/code-service.ts b/packages/ui/certd-server/src/modules/basic/service/code-service.ts
index 1d2e60d25..13f361947 100644
--- a/packages/ui/certd-server/src/modules/basic/service/code-service.ts
+++ b/packages/ui/certd-server/src/modules/basic/service/code-service.ts
@@ -1,5 +1,5 @@
 import { Inject, Provide, Scope, ScopeEnum } from '@midwayjs/core';
-import { cache, isDev, randomNumber } from '@certd/basic';
+import { cache, isDev, randomNumber, simpleNanoId } from '@certd/basic';
 import { SysSettingsService, SysSiteInfo } from '@certd/lib-server';
 import { SmsServiceFactory } from '../sms/factory.js';
 import { ISmsService } from '../sms/api.js';
@@ -188,4 +188,20 @@ export class CodeService {
     `
     );
   }
+
+
+  buildValidationValueKey(code:string) {
+    return `validationValue:${code}`;
+  }
+  setValidationValue(value:any) {
+    const randomCode = simpleNanoId(12);
+    const key = this.buildValidationValueKey(randomCode);
+    cache.set(key, value, {
+      ttl: 5 * 60 * 1000, //5分钟
+    });
+    return randomCode;
+  }
+  getValidationValue(code:string) {
+    return cache.get(this.buildValidationValueKey(code));
+  }
 }
diff --git a/packages/ui/certd-server/src/modules/login/entity/oauth-bind.ts b/packages/ui/certd-server/src/modules/login/entity/oauth-bound.ts
similarity index 91%
rename from packages/ui/certd-server/src/modules/login/entity/oauth-bind.ts
rename to packages/ui/certd-server/src/modules/login/entity/oauth-bound.ts
index b8929102c..87115f9a1 100644
--- a/packages/ui/certd-server/src/modules/login/entity/oauth-bind.ts
+++ b/packages/ui/certd-server/src/modules/login/entity/oauth-bound.ts
@@ -1,7 +1,7 @@
 import { Column, Entity, PrimaryGeneratedColumn } from 'typeorm';
 
-@Entity('cd_oauth_bind')
-export class OauthBindEntity {
+@Entity('cd_oauth_bound')
+export class OauthBoundEntity {
   @PrimaryGeneratedColumn()
   id: number;
 
diff --git a/packages/ui/certd-server/src/modules/login/service/login-service.ts b/packages/ui/certd-server/src/modules/login/service/login-service.ts
index b4d208992..ca805c409 100644
--- a/packages/ui/certd-server/src/modules/login/service/login-service.ts
+++ b/packages/ui/certd-server/src/modules/login/service/login-service.ts
@@ -17,9 +17,9 @@ import { TwoFactorService } from "../../mine/service/two-factor-service.js";
 import { UserSettingsService } from "../../mine/service/user-settings-service.js";
 import { isPlus } from "@certd/plus-core";
 import { AddonService } from "@certd/lib-server";
+import { OauthBoundService } from "./oauth-bound-service.js";
 
 /**
- * 系统用户
  */
 @Provide()
 @Scope(ScopeEnum.Request, {allowDowngrade: true})
@@ -42,6 +42,8 @@ export class LoginService {
   twoFactorService: TwoFactorService;
   @Inject()
   addonService: AddonService;
+  @Inject()
+  oauthBoundService: OauthBoundService;
 
   checkIsBlocked(username: string) {
     const blockDurationKey = `login_block_duration:${username}`;
@@ -204,6 +206,10 @@ export class LoginService {
    * @param roleIds
    */
   async generateToken(user: UserEntity) {
+    if (user.status === 0) {
+      throw new CommonException('用户已被禁用');
+    }
+
     const roleIds = await this.roleService.getRoleIdsByUserId(user.id);
     const tokenInfo = {
       username: user.username,
@@ -224,4 +230,20 @@ export class LoginService {
       expire,
     };
   }
+
+
+  async loginByOpenId(req: { openId: string, type:string }) {
+    const {openId, type} = req;
+    const oauthBound = await this.oauthBoundService.findOne({
+      where:{openId, type}
+    });
+    if (oauthBound == null) {
+      return null
+    }
+    const info = await this.userService.findOne({id: oauthBound.userId});
+    if (info == null) {
+      throw new CommonException('用户不存在');
+    }
+    return this.generateToken(info);
+  }
 }
diff --git a/packages/ui/certd-server/src/modules/login/service/oauth-bound-service.ts b/packages/ui/certd-server/src/modules/login/service/oauth-bound-service.ts
new file mode 100644
index 000000000..aa32cac3d
--- /dev/null
+++ b/packages/ui/certd-server/src/modules/login/service/oauth-bound-service.ts
@@ -0,0 +1,74 @@
+import { BaseService, SysSettingsService } from "@certd/lib-server";
+import { Inject, Provide, Scope, ScopeEnum } from "@midwayjs/core";
+import { InjectEntityModel } from "@midwayjs/typeorm";
+import { Repository } from "typeorm";
+import { OauthBoundEntity } from "../entity/oauth-bound.js";
+
+
+@Provide()
+@Scope(ScopeEnum.Request, { allowDowngrade: true })
+export class OauthBoundService extends BaseService<OauthBoundEntity> {
+ 
+  @InjectEntityModel(OauthBoundEntity)
+  repository: Repository<OauthBoundEntity>;
+
+  @Inject()
+  sysSettingsService: SysSettingsService;
+
+
+  //@ts-ignore
+  getRepository() {
+    return this.repository;
+  }
+
+  async unbind(req: { userId: any; type: any; }) {
+    const { userId, type } = req;
+    if (!userId || !type) {
+      throw new Error('参数错误');
+    }
+
+    await this.repository.delete({
+      userId,
+      type,
+    });
+  }
+
+ async bind(req: { userId: any; type: any; openId: any; }) {
+    const { userId, type, openId } = req;
+    if (!userId || !type || !openId) {
+      throw new Error('参数错误');
+    }
+    const exist = await this.repository.findOne({
+      where: {
+        openId,
+        type,
+      },
+    });
+    if (exist) {
+      throw new Error('该第三方账号已绑定用户');
+    }
+
+    const exist2 = await this.repository.findOne({
+      where: {
+        userId,
+        type,
+      },
+    });
+    if (exist2) {
+      //覆盖绑定
+      exist2.openId = openId;
+      await this.update({
+        id: exist2.id,
+        openId,
+      });
+      return;
+    } 
+    //新增
+    await this.add({
+      userId,
+      type,
+      openId,
+    });
+  }
+
+}
diff --git a/packages/ui/certd-server/src/modules/sys/authority/service/user-service.ts b/packages/ui/certd-server/src/modules/sys/authority/service/user-service.ts
index de913194f..3ab7cb892 100644
--- a/packages/ui/certd-server/src/modules/sys/authority/service/user-service.ts
+++ b/packages/ui/certd-server/src/modules/sys/authority/service/user-service.ts
@@ -1,6 +1,6 @@
 import { Inject, Provide, Scope, ScopeEnum } from '@midwayjs/core';
 import { InjectEntityModel } from '@midwayjs/typeorm';
-import {In, MoreThan, Not, Repository} from 'typeorm';
+import {EntityManager, In, MoreThan, Not, Repository} from 'typeorm';
 import { UserEntity } from '../entity/user.js';
 import * as _ from 'lodash-es';
 import { BaseService, CommonException, Constants, FileService, SysInstallInfo, SysSettingsService } from '@certd/lib-server';
@@ -171,7 +171,7 @@ export class UserService extends BaseService<UserEntity> {
     return await this.roleService.getPermissionByRoleIds(roleIds);
   }
 
-  async register(type: string, user: UserEntity) {
+  async register(type: string, user: UserEntity,withTx?:(tx: EntityManager)=>Promise<void>) {
     if (!user.password) {
       user.password = simpleNanoId();
     }
@@ -227,6 +227,10 @@ export class UserService extends BaseService<UserEntity> {
       newUser = await txManager.save(newUser);
       const userRole: UserRoleEntity = UserRoleEntity.of(newUser.id, Constants.role.defaultUser);
       await txManager.save(userRole);
+
+      if(withTx) {
+        await withTx(txManager);
+      }
     });
 
     delete newUser.password;
diff --git a/packages/ui/certd-server/src/plugins/index.ts b/packages/ui/certd-server/src/plugins/index.ts
index 93ba1e2b0..2f58ffa8c 100644
--- a/packages/ui/certd-server/src/plugins/index.ts
+++ b/packages/ui/certd-server/src/plugins/index.ts
@@ -38,3 +38,4 @@ export * from './plugin-godaddy/index.js'
 export * from './plugin-captcha/index.js'
 export * from './plugin-xinnet/index.js'
 export * from './plugin-xinnetconnet/index.js'
+export * from './plugin-oauth/index.js'
diff --git a/packages/ui/certd-server/src/plugins/plugin-oauth/api.ts b/packages/ui/certd-server/src/plugins/plugin-oauth/api.ts
index b7bd0e7cc..d6cacf901 100644
--- a/packages/ui/certd-server/src/plugins/plugin-oauth/api.ts
+++ b/packages/ui/certd-server/src/plugins/plugin-oauth/api.ts
@@ -1,6 +1,5 @@
 export type OnCallbackReq = {
     code: string;
-    redirectUri: string;
     state: string;
 }
 
diff --git a/packages/ui/certd-server/src/plugins/plugin-oauth/oidc/plugin-oidc.ts b/packages/ui/certd-server/src/plugins/plugin-oauth/oidc/plugin-oidc.ts
index 5c2084df3..a9f4551b3 100644
--- a/packages/ui/certd-server/src/plugins/plugin-oauth/oidc/plugin-oidc.ts
+++ b/packages/ui/certd-server/src/plugins/plugin-oauth/oidc/plugin-oidc.ts
@@ -58,7 +58,7 @@ export class OidcOauthProvider extends BaseAddon implements IOauthProvider {
   async onCallback(req: OnCallbackReq) {
     const { config, client } = await this.getClient()
 
-    const currentUrl = new URL(req.redirectUri)
+    const currentUrl = new URL("")
     let tokens: any = await client.authorizationCodeGrant(
       config,
       currentUrl,