add remove user token #34

Reset empty password

.dockerignore

@@ -0,0 +1,26 @@
+# Ignore Docker Compose configuration files
+docker-compose.yaml
+
+# Ignore development Dockerfile
+Dockerfile.dev
+
+# Ignore the data directory
+data/
+
+# Ignore version control system directories
+.git/
+
+# Ignore log and temporary files
+*.log
+*.tmp
+*.swp
+
+# Ignore editor/IDE configuration files
+.vscode/
+.idea/
+
+# Ignore binaries and build cache
+release/
+bin/
+*.exe
+*.out

Dockerfile.dev

@@ -0,0 +1,72 @@
+# Use build arguments for Go version and architecture
+ARG GO_VERSION=1.22
+ARG BUILDARCH=amd64
+
+# Stage 1: Builder Stage
+# FROM golang:${GO_VERSION}-alpine AS builder
+FROM crazymax/xgo:${GO_VERSION} AS builder-backend
+
+# Set up working directory
+WORKDIR /app
+
+# Step 1: Copy the source code
+COPY . .
+
+# Step 2: Download dependencies
+RUN go mod tidy && go mod download
+
+
+# Step 3: Install swag and  Run the build script
+RUN go install github.com/swaggo/swag/cmd/swag@latest && \
+    swag init -g cmd/apimain.go --output docs/api --instanceName api --exclude http/controller/admin && \
+    swag init -g cmd/apimain.go --output docs/admin --instanceName admin --exclude http/controller/api
+
+# Build the Go application with CGO enabled and specified ldflags
+RUN CGO_ENABLED=1 GOOS=linux go build -a \
+    -ldflags "-s -w --extldflags '-static -fpic'" \
+    -installsuffix cgo -o release/apimain cmd/apimain.go
+
+# Stage 2: Frontend Build Stage (builder2)
+FROM node:18-alpine AS builder-admin-frontend
+
+# Set working directory
+WORKDIR /frontend
+
+RUN apk update && apk add git --no-cache
+
+# Clone the frontend repository
+RUN git clone https://github.com/lejianwen/rustdesk-api-web .
+
+# Install npm dependencies and build the frontend
+RUN npm install && npm run build
+
+# Stage 2: Final Image
+FROM alpine:latest
+
+# Set up working directory
+WORKDIR /app
+
+# Install necessary runtime dependencies
+RUN apk add --no-cache tzdata file
+
+# Copy the built application and resources from the builder stage
+COPY --from=builder-backend /app/release /app/
+COPY --from=builder-backend /app/conf /app/conf/
+COPY --from=builder-backend /app/resources /app/resources/
+COPY --from=builder-backend /app/docs /app/docs/
+# Copy frontend build from builder2 stage
+COPY --from=builder-admin-frontend /frontend/dist/ /app/resources/admin/
+
+# Ensure the binary is correctly built and linked
+RUN file /app/apimain && \
+    mkdir -p /app/data && \
+    mkdir -p /app/runtime
+
+# Set up a volume for persistent data
+VOLUME /app/data
+
+# Expose the necessary port
+EXPOSE 21114
+
+# Define the command to run the application
+CMD ["./apimain"]

README.md

@@ -19,7 +19,7 @@
     - 登录
     - 地址簿
     - 群组
-    - 授权登录，支持`github`和`google`登录，支持`web后台`授权登录
+    - 授权登录，支持`github`, `google` 和 `OIDC` 登录，支持`web后台`授权登录
     - i18n
 - Web Admin
     - 用户管理
@@ -92,7 +92,7 @@
 
 #### 登录
 
-- 添加了`github`和`google`授权登录，需要在后台配置好就可以用了，具体可看后台OAuth配置
+- 添加了`github`, `google` 以及`OIDC`授权登录，需要在后台配置好就可以用了，具体可看后台OAuth配置
 - 添加了web后台授权登录,点击后直接登录后台就自动登录客户端了
 
 ![pc_login](docs/pc_login.png)
@@ -124,8 +124,10 @@
 4. 可以直接打开webclient，方便使用；也可以分享给游客，游客可以直接通过webclient远程到设备
 
    ![web_webclient](docs/admin_webclient.png)
-5. Oauth,暂时只支持了`Github`和`Google`, 需要创建一个`OAuth App`，然后配置到后台
+5. Oauth,支持了`Github`, `Google` 以及 `OIDC`, 需要创建一个`OAuth App`，然后配置到后台
    ![web_admin_oauth](docs/web_admin_oauth.png)
+    - 对于`Google` 和 `Github`, `Issuer` 和 `Scopes`不需要填写.
+    - 对于`OIDC`, `Issuer`是必须的。`Scopes`是可选的，默认为 `openid,profile,email`. 确保可以获取 `sub`,`email` 和`preferred_username`
     - `github oauth app`在`Settings`->`Developer settings`->`OAuth Apps`->`New OAuth App`
       中创建,地址 [https://github.com/settings/developers](https://github.com/settings/developers)
     - `Authorization callback URL`填写`http://<your server[:port]>/api/oauth/callback`
@@ -157,6 +159,7 @@
 lang: "en"
 app:
   web-client: 1  # 1:启用 0:禁用
+  register: false #是否开启注册
 gin:
   api-addr: "0.0.0.0:21114"
   mode: "release"
@@ -194,6 +197,7 @@ proxy:
 | TZ                                 | 时区                                   | Asia/Shanghai               |
 | RUSTDESK_API_LANG                  | 语言                                   | `en`,`zh-CN`                |
 | RUSTDESK_API_APP_WEB_CLIENT        | 是否启用web-client; 1:启用,0:不启用; 默认启用     | 1                           |
+| RUSTDESK_API_APP_REGISTER          | 是否开启注册; `true`, `false`  默认`false`   | `false`                     |
 | -----GIN配置-----                    | ----------                           | ----------                  |
 | RUSTDESK_API_GIN_TRUST_PROXY       | 信任的代理IP列表，以`,`分割，默认信任所有              | 192.168.1.2,192.168.1.3     |
 | -----------GORM配置----------------  | ------------------------------------ | --------------------------- |

README_EN.md

@@ -18,7 +18,7 @@ desktop software that provides self-hosted solutions.
     - Login
     - Address Book
     - Groups
-    - Authorized login, supports `GitHub` and `Google` login, supports `web admin` authorized login
+    - Authorized login, supports `GitHub`, `Google` and `OIDC` login, supports `web admin` authorized login
     - i18n
 - Web Admin
     - User Management
@@ -93,7 +93,7 @@ Basic implementation of the PC client's primary interfaces.Supports the Personal
 
 #### Login
 
-- Added `GitHub` and `Google` login, which can be used after configuration in the admin panel. See the OAuth
+- Added `GitHub`, `Google` and `OIDC` login, which can be used after configuration in the admin panel. See the OAuth
   configuration section for details.
 - Added authorization login for the web admin panel.
 
@@ -128,9 +128,11 @@ installation are `admin` `admin`, please change the password immediately.
 4. You can directly launch the client or open the web client for convenience; you can also share it with guests, who can remotely access the device via the web client.
 
    ![web_webclient](docs/en_img/admin_webclient.png)
-5. OAuth support: Currently, `GitHub` and `Google`  is supported. You need to create an `OAuth App` and configure it in
+5. OAuth support: Currently, `GitHub`, `Google` and `OIDC`  are supported. You need to create an `OAuth App` and configure it in
    the admin panel.
    ![web_admin_oauth](docs/en_img/web_admin_oauth.png)
+    - For `Google` and `Github`, you don't need to fill the `Issuer` and `Scpoes`
+    - For `OIDC`, you must set the `Issuer`. And `Scopes` is optional which default is `openid,email,profile`, please make sure this `Oauth App` can access `sub`, `email` and `preferred_username`
     - Create a `GitHub OAuth App`
       at `Settings` -> `Developer settings` -> `OAuth Apps` -> `New OAuth App` [here](https://github.com/settings/developers).
     - Set the `Authorization callback URL` to `http://<your server[:port]>/api/oauth/callback`,
@@ -163,6 +165,7 @@ installation are `admin` `admin`, please change the password immediately.
 lang: "en"
 app:
   web-client: 1  # web client route 1:open 0:close  
+  register: false #register enable
 gin:
   api-addr: "0.0.0.0:21114"
   mode: "release"
@@ -200,6 +203,7 @@ The prefix for variable names is `RUSTDESK_API`. If environment variables exist,
 | TZ                                 | timezone                                                  | Asia/Shanghai                 |
 | RUSTDESK_API_LANG                  | Language                                                  | `en`,`zh-CN`                  |
 | RUSTDESK_API_APP_WEB_CLIENT        | web client on/off; 1: on, 0 off, deault 1                 | 1                             |
+| RUSTDESK_API_APP_REGISTER          | register enable; `true`, `false`; default:`false`         | `false`                       |
 | ----- GIN Configuration -----      | ---------------------------------------                   | ----------------------------- |
 | RUSTDESK_API_GIN_TRUST_PROXY       | Trusted proxy IPs, separated by commas.                   | 192.168.1.2,192.168.1.3       |
 | ----- GORM Configuration -----     | ---------------------------------------                   | ----------------------------- |

build.sh

@@ -1,16 +1,46 @@
 #!/bin/sh
 
-rm release -rf
+set -e
+# Automatically get the current environment's GOARCH; if not defined, use the detected system architecture
+GOARCH=${GOARCH:-$(go env GOARCH)}
+DOCS="true"
+# Safely remove the old release directory
+rm -rf release
+
+# Set Go environment variables
 go env -w GO111MODULE=on
 go env -w GOPROXY=https://goproxy.cn,direct
 go env -w CGO_ENABLED=1
 go env -w GOOS=linux
-go env -w GOARCH=amd64
+go env -w GOARCH=${GOARCH}
-swag init -g cmd/apimain.go --output docs/api --instanceName api --exclude http/controller/admin
+
-swag init -g cmd/apimain.go --output docs/admin --instanceName admin --exclude http/controller/api
+
+# Generate Swagger documentation if DOCS is not empty
+if [ -n "${DOCS}" ]; then
+    # Check if swag is installed
+    if ! command -v swag &> /dev/null; then
+        echo "swag command not found. Please install it using:"
+        echo "go install github.com/swaggo/swag/cmd/swag@latest"
+        echo "Skipping Swagger documentation generation due to missing swag tool."
+    else
+        echo "Generating Swagger documentation..."
+        swag init -g cmd/apimain.go --output docs/api --instanceName api --exclude http/controller/admin
+        swag init -g cmd/apimain.go --output docs/admin --instanceName admin --exclude http/controller/api
+    fi
+else
+    echo "Skipping Swagger documentation generation due to DOCS is empty."
+fi
+
+# Compile the Go code and output it to the release directory
 go build -o release/apimain cmd/apimain.go
+
+# Copy resource files to the release directory
 cp -ar resources release/
 cp -ar docs release/
 cp -ar conf release/
+
+# Create necessary directory structures
 mkdir -p release/data
 mkdir -p release/runtime
+
+echo "Build and setup completed successfully."

cmd/apimain.go

@@ -101,7 +101,7 @@ func main() {
 }
 
 func DatabaseAutoUpdate() {
-	version := 241
+	version := 244
 
 	db := global.DB
 

conf/config.yaml

@@ -1,6 +1,7 @@
 lang: "zh-CN"
 app:
   web-client: 1  # 1:启用 0:禁用
+  register: false #是否开启注册
 gin:
   api-addr: "0.0.0.0:21114"
   mode: "release" #release,debug,test

config/config.go

@@ -15,7 +15,8 @@ const (
 )
 
 type App struct {
-	WebClient int `mapstructure:"web-client"`
+	WebClient int  `mapstructure:"web-client"`
+	Register  bool `mapstructure:"register"`
 }
 
 type Config struct {

config/oauth.go

@@ -11,3 +11,10 @@ type GoogleOauth struct {
 	ClientSecret string `mapstructure:"client-secret"`
 	RedirectUrl  string `mapstructure:"redirect-url"`
 }
+
+type OidcOauth struct {
+	Issuer       string `mapstructure:"issuer"`
+	ClientId     string `mapstructure:"client-id"`
+	ClientSecret string `mapstructure:"client-secret"`
+	RedirectUrl  string `mapstructure:"redirect-url"`
+}

docker-compose-dev.yaml

@@ -0,0 +1,20 @@
+services:
+  rustdesk-api:
+    build: 
+      context: .
+      dockerfile: Dockerfile.dev
+    # image: lejianwen/rustdesk-api
+    container_name: rustdesk-api
+    environment:
+      - TZ=Asia/Shanghai
+      - RUSTDESK_API_RUSTDESK_ID_SERVER=192.168.1.66:21116
+      - RUSTDESK_API_RUSTDESK_RELAY_SERVER=192.168.1.66:21117
+      - RUSTDESK_API_RUSTDESK_API_SERVER=http://127.0.0.1:21114
+      - RUSTDESK_API_RUSTDESK_KEY=123456789
+    ports:
+      - 21114:21114
+    volumes:
+      - ./data/rustdesk/api:/app/data #将数据库挂载出来方便备份
+      - ./conf:/app/conf # config
+      # - ./resources:/app/resources # 静态资源
+    restart: unless-stopped

docker-compose.yaml

@@ -6,10 +6,12 @@ services:
       - TZ=Asia/Shanghai
       - RUSTDESK_API_RUSTDESK_ID_SERVER=192.168.1.66:21116
       - RUSTDESK_API_RUSTDESK_RELAY_SERVER=192.168.1.66:21117
-      - RUSTDESK_API_RUSTDESK_API_SERVER=http://192.168.1.66:21114
+      - RUSTDESK_API_RUSTDESK_API_SERVER=http://127.0.0.1:21114
       - RUSTDESK_API_RUSTDESK_KEY=123456789
     ports:
       - 21114:21114
     volumes:
-      - /data/rustdesk/api:/app/data #将数据库挂载出来方便备份
+      - ./data/rustdesk/api:/app/data # database
+      # - ./conf:/app/conf # config
+      # - ./resources:/app/resources # 静态资源
     restart: unless-stopped

docs/admin/admin_docs.go

@@ -1453,7 +1453,39 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/loginLog/delete": {
+        "/admin/login-options": {
+            "post": {
+                "description": "登录选项",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "登录"
+                ],
+                "summary": "登录选项",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            }
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.ErrorResponse"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/login_log/delete": {
             "post": {
                 "security": [
                     {
@@ -1498,7 +1530,7 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/loginLog/detail/{id}": {
+        "/admin/login_log/detail/{id}": {
             "get": {
                 "security": [
                     {
@@ -1553,7 +1585,7 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/loginLog/list": {
+        "/admin/login_log/list": {
             "get": {
                 "security": [
                     {
@@ -1922,6 +1954,63 @@ const docTemplateadmin = `{
                 }
             }
         },
+        "/admin/oidc/auth": {
+            "post": {
+                "description": "OidcAuth",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "OidcAuth",
+                "responses": {}
+            }
+        },
+        "/admin/oidc/auth-query": {
+            "get": {
+                "description": "OidcAuthQuery",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "OidcAuthQuery",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/admin.LoginPayload"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
         "/admin/peer/create": {
             "post": {
                 "security": [
@@ -2127,6 +2216,12 @@ const docTemplateadmin = `{
                         "description": "主机名",
                         "name": "hostname",
                         "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "description": "uuids 用逗号分隔",
+                        "name": "uuids",
+                        "in": "query"
                     }
                 ],
                 "responses": {
@@ -2998,6 +3093,117 @@ const docTemplateadmin = `{
                     }
                 }
             }
+        },
+        "/admin/user_token/delete": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "登录凭证删除",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "登录凭证"
+                ],
+                "summary": "登录凭证删除",
+                "parameters": [
+                    {
+                        "description": "登录凭证信息",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/model.UserToken"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user_token/list": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "登录凭证列表",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "登录凭证"
+                ],
+                "summary": "登录凭证列表",
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "页码",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "页大小",
+                        "name": "page_size",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "用户ID",
+                        "name": "user_id",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.UserTokenList"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
         }
     },
     "definitions": {
@@ -3164,11 +3370,17 @@ const docTemplateadmin = `{
                 "id": {
                     "type": "integer"
                 },
+                "issuer": {
+                    "type": "string"
+                },
                 "op": {
                     "type": "string"
                 },
                 "redirect_url": {
                     "type": "string"
+                },
+                "scopes": {
+                    "type": "string"
                 }
             }
         },
@@ -3706,6 +3918,9 @@ const docTemplateadmin = `{
                 "user_id": {
                     "type": "integer"
                 },
+                "user_token_id": {
+                    "type": "integer"
+                },
                 "uuid": {
                     "type": "string"
                 }
@@ -3749,12 +3964,18 @@ const docTemplateadmin = `{
                 "id": {
                     "type": "integer"
                 },
+                "issuer": {
+                    "type": "string"
+                },
                 "op": {
                     "type": "string"
                 },
                 "redirect_url": {
                     "type": "string"
                 },
+                "scopes": {
+                    "type": "string"
+                },
                 "updated_at": {
                     "type": "string"
                 }
@@ -3795,6 +4016,9 @@ const docTemplateadmin = `{
                 "id": {
                     "type": "string"
                 },
+                "last_online_ip": {
+                    "type": "string"
+                },
                 "last_online_time": {
                     "type": "integer"
                 },
@@ -3964,6 +4188,57 @@ const docTemplateadmin = `{
                 }
             }
         },
+        "model.UserToken": {
+            "type": "object",
+            "properties": {
+                "created_at": {
+                    "type": "string"
+                },
+                "expired_at": {
+                    "type": "integer"
+                },
+                "id": {
+                    "type": "integer"
+                },
+                "token": {
+                    "type": "string"
+                },
+                "updated_at": {
+                    "type": "string"
+                },
+                "user_id": {
+                    "type": "integer"
+                }
+            }
+        },
+        "model.UserTokenList": {
+            "type": "object",
+            "properties": {
+                "list": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/model.UserToken"
+                    }
+                },
+                "page": {
+                    "type": "integer"
+                },
+                "page_size": {
+                    "type": "integer"
+                },
+                "total": {
+                    "type": "integer"
+                }
+            }
+        },
+        "response.ErrorResponse": {
+            "type": "object",
+            "properties": {
+                "error": {
+                    "type": "string"
+                }
+            }
+        },
         "response.Response": {
             "type": "object",
             "properties": {

docs/admin/admin_swagger.json

@@ -1446,7 +1446,39 @@
                 }
             }
         },
-        "/admin/loginLog/delete": {
+        "/admin/login-options": {
+            "post": {
+                "description": "登录选项",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "登录"
+                ],
+                "summary": "登录选项",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "type": "array",
+                            "items": {
+                                "type": "string"
+                            }
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.ErrorResponse"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/login_log/delete": {
             "post": {
                 "security": [
                     {
@@ -1491,7 +1523,7 @@
                 }
             }
         },
-        "/admin/loginLog/detail/{id}": {
+        "/admin/login_log/detail/{id}": {
             "get": {
                 "security": [
                     {
@@ -1546,7 +1578,7 @@
                 }
             }
         },
-        "/admin/loginLog/list": {
+        "/admin/login_log/list": {
             "get": {
                 "security": [
                     {
@@ -1915,6 +1947,63 @@
                 }
             }
         },
+        "/admin/oidc/auth": {
+            "post": {
+                "description": "OidcAuth",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "OidcAuth",
+                "responses": {}
+            }
+        },
+        "/admin/oidc/auth-query": {
+            "get": {
+                "description": "OidcAuthQuery",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "OidcAuthQuery",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/admin.LoginPayload"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
         "/admin/peer/create": {
             "post": {
                 "security": [
@@ -2120,6 +2209,12 @@
                         "description": "主机名",
                         "name": "hostname",
                         "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "description": "uuids 用逗号分隔",
+                        "name": "uuids",
+                        "in": "query"
                     }
                 ],
                 "responses": {
@@ -2991,6 +3086,117 @@
                     }
                 }
             }
+        },
+        "/admin/user_token/delete": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "登录凭证删除",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "登录凭证"
+                ],
+                "summary": "登录凭证删除",
+                "parameters": [
+                    {
+                        "description": "登录凭证信息",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/model.UserToken"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user_token/list": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "登录凭证列表",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "登录凭证"
+                ],
+                "summary": "登录凭证列表",
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "页码",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "页大小",
+                        "name": "page_size",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "用户ID",
+                        "name": "user_id",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.UserTokenList"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
         }
     },
     "definitions": {
@@ -3157,11 +3363,17 @@
                 "id": {
                     "type": "integer"
                 },
+                "issuer": {
+                    "type": "string"
+                },
                 "op": {
                     "type": "string"
                 },
                 "redirect_url": {
                     "type": "string"
+                },
+                "scopes": {
+                    "type": "string"
                 }
             }
         },
@@ -3699,6 +3911,9 @@
                 "user_id": {
                     "type": "integer"
                 },
+                "user_token_id": {
+                    "type": "integer"
+                },
                 "uuid": {
                     "type": "string"
                 }
@@ -3742,12 +3957,18 @@
                 "id": {
                     "type": "integer"
                 },
+                "issuer": {
+                    "type": "string"
+                },
                 "op": {
                     "type": "string"
                 },
                 "redirect_url": {
                     "type": "string"
                 },
+                "scopes": {
+                    "type": "string"
+                },
                 "updated_at": {
                     "type": "string"
                 }
@@ -3788,6 +4009,9 @@
                 "id": {
                     "type": "string"
                 },
+                "last_online_ip": {
+                    "type": "string"
+                },
                 "last_online_time": {
                     "type": "integer"
                 },
@@ -3957,6 +4181,57 @@
                 }
             }
         },
+        "model.UserToken": {
+            "type": "object",
+            "properties": {
+                "created_at": {
+                    "type": "string"
+                },
+                "expired_at": {
+                    "type": "integer"
+                },
+                "id": {
+                    "type": "integer"
+                },
+                "token": {
+                    "type": "string"
+                },
+                "updated_at": {
+                    "type": "string"
+                },
+                "user_id": {
+                    "type": "integer"
+                }
+            }
+        },
+        "model.UserTokenList": {
+            "type": "object",
+            "properties": {
+                "list": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/model.UserToken"
+                    }
+                },
+                "page": {
+                    "type": "integer"
+                },
+                "page_size": {
+                    "type": "integer"
+                },
+                "total": {
+                    "type": "integer"
+                }
+            }
+        },
+        "response.ErrorResponse": {
+            "type": "object",
+            "properties": {
+                "error": {
+                    "type": "string"
+                }
+            }
+        },
         "response.Response": {
             "type": "object",
             "properties": {

docs/admin/admin_swagger.yaml

@@ -105,10 +105,14 @@ definitions:
         type: string
       id:
         type: integer
+      issuer:
+        type: string
       op:
         type: string
       redirect_url:
         type: string
+      scopes:
+        type: string
     required:
     - client_id
     - client_secret
@@ -472,6 +476,8 @@ definitions:
         type: string
       user_id:
         type: integer
+      user_token_id:
+        type: integer
       uuid:
         type: string
     type: object
@@ -500,10 +506,14 @@ definitions:
         type: string
       id:
         type: integer
+      issuer:
+        type: string
       op:
         type: string
       redirect_url:
         type: string
+      scopes:
+        type: string
       updated_at:
         type: string
     type: object
@@ -530,6 +540,8 @@ definitions:
         type: string
       id:
         type: string
+      last_online_ip:
+        type: string
       last_online_time:
         type: integer
       memory:
@@ -643,6 +655,39 @@ definitions:
       total:
         type: integer
     type: object
+  model.UserToken:
+    properties:
+      created_at:
+        type: string
+      expired_at:
+        type: integer
+      id:
+        type: integer
+      token:
+        type: string
+      updated_at:
+        type: string
+      user_id:
+        type: integer
+    type: object
+  model.UserTokenList:
+    properties:
+      list:
+        items:
+          $ref: '#/definitions/model.UserToken'
+        type: array
+      page:
+        type: integer
+      page_size:
+        type: integer
+      total:
+        type: integer
+    type: object
+  response.ErrorResponse:
+    properties:
+      error:
+        type: string
+    type: object
   response.Response:
     properties:
       code:
@@ -1510,7 +1555,28 @@ paths:
       summary: 登录
       tags:
       - 登录
-  /admin/loginLog/delete:
+  /admin/login-options:
+    post:
+      consumes:
+      - application/json
+      description: 登录选项
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            items:
+              type: string
+            type: array
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.ErrorResponse'
+      summary: 登录选项
+      tags:
+      - 登录
+  /admin/login_log/delete:
     post:
       consumes:
       - application/json
@@ -1538,7 +1604,7 @@ paths:
       summary: 登录日志删除
       tags:
       - 登录日志
-  /admin/loginLog/detail/{id}:
+  /admin/login_log/detail/{id}:
     get:
       consumes:
       - application/json
@@ -1570,7 +1636,7 @@ paths:
       summary: 登录日志详情
       tags:
       - 登录日志
-  /admin/loginLog/list:
+  /admin/login_log/list:
     get:
       consumes:
       - application/json
@@ -1789,6 +1855,41 @@ paths:
       summary: Oauth编辑
       tags:
       - Oauth
+  /admin/oidc/auth:
+    post:
+      consumes:
+      - application/json
+      description: OidcAuth
+      produces:
+      - application/json
+      responses: {}
+      summary: OidcAuth
+      tags:
+      - Oauth
+  /admin/oidc/auth-query:
+    get:
+      consumes:
+      - application/json
+      description: OidcAuthQuery
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  $ref: '#/definitions/admin.LoginPayload'
+              type: object
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      summary: OidcAuthQuery
+      tags:
+      - Oauth
   /admin/peer/create:
     post:
       consumes:
@@ -1908,6 +2009,10 @@ paths:
         in: query
         name: hostname
         type: string
+      - description: uuids 用逗号分隔
+        in: query
+        name: uuids
+        type: string
       produces:
       - application/json
       responses:
@@ -2427,6 +2532,73 @@ paths:
       summary: 修改密码
       tags:
       - 用户
+  /admin/user_token/delete:
+    post:
+      consumes:
+      - application/json
+      description: 登录凭证删除
+      parameters:
+      - description: 登录凭证信息
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/model.UserToken'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      summary: 登录凭证删除
+      tags:
+      - 登录凭证
+  /admin/user_token/list:
+    get:
+      consumes:
+      - application/json
+      description: 登录凭证列表
+      parameters:
+      - description: 页码
+        in: query
+        name: page
+        type: integer
+      - description: 页大小
+        in: query
+        name: page_size
+        type: integer
+      - description: 用户ID
+        in: query
+        name: user_id
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  $ref: '#/definitions/model.UserTokenList'
+              type: object
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      summary: 登录凭证列表
+      tags:
+      - 登录凭证
 securityDefinitions:
   BearerAuth:
     in: header

docs/api/api_docs.go

@@ -834,7 +834,7 @@ const docTemplateapi = `{
             }
         },
         "/login-options": {
-            "post": {
+            "get": {
                 "description": "登录选项",
                 "consumes": [
                     "application/json"

docs/api/api_swagger.json

@@ -827,7 +827,7 @@
             }
         },
         "/login-options": {
-            "post": {
+            "get": {
                 "description": "登录选项",
                 "consumes": [
                     "application/json"

docs/api/api_swagger.yaml

@@ -715,7 +715,7 @@ paths:
       tags:
       - 登录
   /login-options:
-    post:
+    get:
       consumes:
       - application/json
       description: 登录选项

http/controller/admin/login.go

@@ -2,13 +2,16 @@ package admin
 
 import (
 	"Gwen/global"
+	"Gwen/http/controller/api"
 	"Gwen/http/request/admin"
+	apiReq "Gwen/http/request/api"
 	"Gwen/http/response"
 	adResp "Gwen/http/response/admin"
 	"Gwen/model"
 	"Gwen/service"
 	"fmt"
 	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
 )
 
 type Login struct {
@@ -50,10 +53,10 @@ func (ct *Login) Login(c *gin.Context) {
 
 	ut := service.AllService.UserService.Login(u, &model.LoginLog{
 		UserId:   u.Id,
-		Client:   "webadmin",
+		Client:   model.LoginLogClientWebAdmin,
-		Uuid:     "",
+		Uuid:     "", //must be empty
 		Ip:       c.ClientIP(),
-		Type:     "account",
+		Type:     model.LoginLogTypeAccount,
 		Platform: f.Platform,
 	})
 
@@ -82,3 +85,90 @@ func (ct *Login) Logout(c *gin.Context) {
 	}
 	response.Success(c, nil)
 }
+
+// LoginOptions
+// @Tags 登录
+// @Summary 登录选项
+// @Description 登录选项
+// @Accept  json
+// @Produce  json
+// @Success 200 {object} []string
+// @Failure 500 {object} response.ErrorResponse
+// @Router /admin/login-options [post]
+func (ct *Login) LoginOptions(c *gin.Context) {
+	res := service.AllService.OauthService.List(1, 100, func(tx *gorm.DB) {
+		tx.Select("op").Order("id")
+	})
+	var ops []string
+	for _, v := range res.Oauths {
+		ops = append(ops, v.Op)
+	}
+	response.Success(c, gin.H{
+		"ops":      ops,
+		"register": global.Config.App.Register,
+	})
+}
+
+// OidcAuth
+// @Tags Oauth
+// @Summary OidcAuth
+// @Description OidcAuth
+// @Accept  json
+// @Produce  json
+// @Router /admin/oidc/auth [post]
+func (ct *Login) OidcAuth(c *gin.Context) {
+	// o := &api.Oauth{}
+	// o.OidcAuth(c)
+	f := &apiReq.OidcAuthRequest{}
+	err := c.ShouldBindJSON(f)
+	if err != nil {
+		response.Fail(c, 101, response.TranslateMsg(c, "ParamsError")+err.Error())
+		return
+	}
+
+	err, code, url := service.AllService.OauthService.BeginAuth(f.Op)
+	if err != nil {
+		response.Error(c, response.TranslateMsg(c, err.Error()))
+		return
+	}
+
+	service.AllService.OauthService.SetOauthCache(code, &service.OauthCacheItem{
+		Action:     service.OauthActionTypeLogin,
+		Op:         f.Op,
+		Id:         f.Id,
+		DeviceType: "webadmin",
+		// DeviceOs: ct.Platform(c),
+		DeviceOs: f.DeviceInfo.Os,
+		Uuid:     f.Uuid,
+	}, 5*60)
+
+	response.Success(c, gin.H{
+		"code": code,
+		"url":  url,
+	})
+}
+
+// OidcAuthQuery
+// @Tags Oauth
+// @Summary OidcAuthQuery
+// @Description OidcAuthQuery
+// @Accept  json
+// @Produce  json
+// @Success 200 {object} response.Response{data=adResp.LoginPayload}
+// @Failure 500 {object} response.Response
+// @Router /admin/oidc/auth-query [get]
+func (ct *Login) OidcAuthQuery(c *gin.Context) {
+	o := &api.Oauth{}
+	u, ut := o.OidcAuthQueryPre(c)
+	if ut == nil {
+		return
+	}
+	//fmt.Println("u:", u)
+	//fmt.Println("ut:", ut)
+	response.Success(c, &adResp.LoginPayload{
+		Token:      ut.Token,
+		Username:   u.Username,
+		RouteNames: service.AllService.UserService.RouteNames(u),
+		Nickname:   u.Nickname,
+	})
+}

http/controller/admin/loginLog.go

@@ -23,7 +23,7 @@ type LoginLog struct {
 // @Param id path int true "ID"
 // @Success 200 {object} response.Response{data=model.LoginLog}
 // @Failure 500 {object} response.Response
-// @Router /admin/loginLog/detail/{id} [get]
+// @Router /admin/login_log/detail/{id} [get]
 // @Security token
 func (ct *LoginLog) Detail(c *gin.Context) {
 	id := c.Param("id")
@@ -48,7 +48,7 @@ func (ct *LoginLog) Detail(c *gin.Context) {
 // @Param user_id query int false "用户ID"
 // @Success 200 {object} response.Response{data=model.LoginLogList}
 // @Failure 500 {object} response.Response
-// @Router /admin/loginLog/list [get]
+// @Router /admin/login_log/list [get]
 // @Security token
 func (ct *LoginLog) List(c *gin.Context) {
 	query := &admin.LoginLogQuery{}
@@ -78,7 +78,7 @@ func (ct *LoginLog) List(c *gin.Context) {
 // @Param body body model.LoginLog true "登录日志信息"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
-// @Router /admin/loginLog/delete [post]
+// @Router /admin/login_log/delete [post]
 // @Security token
 func (ct *LoginLog) Delete(c *gin.Context) {
 	f := &model.LoginLog{}

http/controller/admin/oauth.go

@@ -102,7 +102,7 @@ func (o *Oauth) BindConfirm(c *gin.Context) {
 		return
 	}
 	u := service.AllService.UserService.CurUser(c)
-	err = service.AllService.OauthService.BindGithubUser(v.ThirdOpenId, v.ThirdOpenId, u.Id)
+	err = service.AllService.OauthService.BindOauthUser(v.Op, v.ThirdOpenId, v.ThirdName, u.Id)
 	if err != nil {
 		response.Fail(c, 101, response.TranslateMsg(c, "BindFail"))
 		return
@@ -140,6 +140,13 @@ func (o *Oauth) Unbind(c *gin.Context) {
 			return
 		}
 	}
+	if f.Op == model.OauthTypeOidc {
+		err = service.AllService.OauthService.UnBindOidcUser(u.Id)
+		if err != nil {
+			response.Fail(c, 101, response.TranslateMsg(c, "OperationFailed")+err.Error())
+			return
+		}
+	}
 
 	response.Success(c, nil)
 }

http/controller/admin/peer.go

@@ -79,6 +79,7 @@ func (ct *Peer) Create(c *gin.Context) {
 // @Param time_ago query int false "时间"
 // @Param id query string false "ID"
 // @Param hostname query string false "主机名"
+// @Param uuids query string false "uuids 用逗号分隔"
 // @Success 200 {object} response.Response{data=model.PeerList}
 // @Failure 500 {object} response.Response
 // @Router /admin/peer/list [get]
@@ -104,6 +105,9 @@ func (ct *Peer) List(c *gin.Context) {
 		if query.Hostname != "" {
 			tx.Where("hostname like ?", "%"+query.Hostname+"%")
 		}
+		if query.Uuids != "" {
+			tx.Where("uuid in (?)", query.Uuids)
+		}
 	})
 	response.Success(c, res)
 }

http/controller/admin/user.go

@@ -5,6 +5,7 @@ import (
 	"Gwen/http/request/admin"
 	"Gwen/http/response"
 	adResp "Gwen/http/response/admin"
+	"Gwen/model"
 	"Gwen/service"
 	"github.com/gin-gonic/gin"
 	"gorm.io/gorm"
@@ -247,10 +248,14 @@ func (ct *User) ChangeCurPwd(c *gin.Context) {
 		return
 	}
 	u := service.AllService.UserService.CurUser(c)
-	oldPwd := service.AllService.UserService.EncryptPassword(f.OldPassword)
+	// If the password is not empty, the old password is verified
-	if u.Password != oldPwd {
+	// otherwise, the old password is not verified
-		response.Fail(c, 101, response.TranslateMsg(c, "OldPasswordError"))
+	if !service.AllService.UserService.IsPasswordEmptyByUser(u) {
-		return
+		oldPwd := service.AllService.UserService.EncryptPassword(f.OldPassword)
+		if u.Password != oldPwd {
+			response.Fail(c, 101, response.TranslateMsg(c, "OldPasswordError"))
+			return
+		}
 	}
 	err := service.AllService.UserService.UpdatePassword(u, f.NewPassword)
 	if err != nil {
@@ -323,3 +328,40 @@ func (ct *User) GroupUsers(c *gin.Context) {
 	}
 	response.Success(c, data)
 }
+
+// Register
+func (ct *User) Register(c *gin.Context) {
+	if !global.Config.App.Register {
+		response.Fail(c, 101, response.TranslateMsg(c, "RegisterClosed"))
+		return
+	}
+	f := &admin.RegisterForm{}
+	if err := c.ShouldBindJSON(f); err != nil {
+		response.Fail(c, 101, response.TranslateMsg(c, "ParamsError")+err.Error())
+		return
+	}
+	errList := global.Validator.ValidStruct(c, f)
+	if len(errList) > 0 {
+		response.Fail(c, 101, errList[0])
+		return
+	}
+	u := service.AllService.UserService.Register(f.Username, f.Password)
+	if u == nil || u.Id == 0 {
+		response.Fail(c, 101, response.TranslateMsg(c, "OperationFailed"))
+		return
+	}
+	// 注册成功后自动登录
+	ut := service.AllService.UserService.Login(u, &model.LoginLog{
+		UserId: u.Id,
+		Client: model.LoginLogClientWebAdmin,
+		Uuid:   "",
+		Ip:     c.ClientIP(),
+		Type:   model.LoginLogTypeAccount,
+	})
+	response.Success(c, &adResp.LoginPayload{
+		Token:      ut.Token,
+		Username:   u.Username,
+		RouteNames: service.AllService.UserService.RouteNames(u),
+		Nickname:   u.Nickname,
+	})
+}

http/controller/admin/userToken.go

@@ -0,0 +1,83 @@
+package admin
+
+import (
+	"Gwen/global"
+	"Gwen/http/request/admin"
+	"Gwen/http/response"
+	"Gwen/model"
+	"Gwen/service"
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+)
+
+type UserToken struct {
+}
+
+// List 列表
+// @Tags 登录凭证
+// @Summary 登录凭证列表
+// @Description 登录凭证列表
+// @Accept  json
+// @Produce  json
+// @Param page query int false "页码"
+// @Param page_size query int false "页大小"
+// @Param user_id query int false "用户ID"
+// @Success 200 {object} response.Response{data=model.UserTokenList}
+// @Failure 500 {object} response.Response
+// @Router /admin/user_token/list [get]
+// @Security token
+func (ct *UserToken) List(c *gin.Context) {
+	query := &admin.LoginTokenQuery{}
+	if err := c.ShouldBindQuery(query); err != nil {
+		response.Fail(c, 101, response.TranslateMsg(c, "ParamsError")+err.Error())
+		return
+	}
+	res := service.AllService.UserService.TokenList(query.Page, query.PageSize, func(tx *gorm.DB) {
+		if query.UserId > 0 {
+			tx.Where("user_id = ?", query.UserId)
+		}
+		tx.Order("id desc")
+	})
+	response.Success(c, res)
+}
+
+// Delete 删除
+// @Tags 登录凭证
+// @Summary 登录凭证删除
+// @Description 登录凭证删除
+// @Accept  json
+// @Produce  json
+// @Param body body model.UserToken true "登录凭证信息"
+// @Success 200 {object} response.Response
+// @Failure 500 {object} response.Response
+// @Router /admin/user_token/delete [post]
+// @Security token
+func (ct *UserToken) Delete(c *gin.Context) {
+	f := &model.UserToken{}
+	if err := c.ShouldBindJSON(f); err != nil {
+		response.Fail(c, 101, response.TranslateMsg(c, "ParamsError")+err.Error())
+		return
+	}
+	id := f.Id
+	errList := global.Validator.ValidVar(c, id, "required,gt=0")
+	if len(errList) > 0 {
+		response.Fail(c, 101, errList[0])
+		return
+	}
+	l := service.AllService.UserService.TokenInfoById(f.Id)
+	u := service.AllService.UserService.CurUser(c)
+	if !service.AllService.UserService.IsAdmin(u) && l.UserId != u.Id {
+		response.Fail(c, 101, response.TranslateMsg(c, "NoAccess"))
+		return
+	}
+	if l.Id > 0 {
+		err := service.AllService.UserService.DeleteToken(l)
+		if err == nil {
+			response.Success(c, nil)
+			return
+		}
+		response.Fail(c, 101, err.Error())
+		return
+	}
+	response.Fail(c, 101, response.TranslateMsg(c, "ItemNotFound"))
+}

http/controller/api/login.go

@@ -54,7 +54,7 @@ func (l *Login) Login(c *gin.Context) {
 	//根据refer判断是webclient还是app
 	ref := c.GetHeader("referer")
 	if ref != "" {
-		f.DeviceInfo.Type = "webclient"
+		f.DeviceInfo.Type = model.LoginLogClientWeb
 	}
 
 	ut := service.AllService.UserService.Login(u, &model.LoginLog{
@@ -81,7 +81,7 @@ func (l *Login) Login(c *gin.Context) {
 // @Produce  json
 // @Success 200 {object} []string
 // @Failure 500 {object} response.ErrorResponse
-// @Router /login-options [post]
+// @Router /login-options [get]
 func (l *Login) LoginOptions(c *gin.Context) {
 	oauthOks := []string{}
 	err, _ := service.AllService.OauthService.GetOauthConfig(model.OauthTypeGithub)
@@ -92,6 +92,10 @@ func (l *Login) LoginOptions(c *gin.Context) {
 	if err == nil {
 		oauthOks = append(oauthOks, model.OauthTypeGoogle)
 	}
+	err, _ = service.AllService.OauthService.GetOauthConfig(model.OauthTypeOidc)
+	if err == nil {
+		oauthOks = append(oauthOks, model.OauthTypeOidc)
+	}
 	oauthOks = append(oauthOks, model.OauthTypeWebauth)
 	var oidcItems []map[string]string
 	for _, v := range oauthOks {

http/controller/api/ouath.go

@@ -32,7 +32,8 @@ func (o *Oauth) OidcAuth(c *gin.Context) {
 		response.Error(c, response.TranslateMsg(c, "ParamsError")+err.Error())
 		return
 	}
-	if f.Op != model.OauthTypeWebauth && f.Op != model.OauthTypeGoogle && f.Op != model.OauthTypeGithub {
+	//fmt.Println(f)
+	if f.Op != model.OauthTypeWebauth && f.Op != model.OauthTypeGoogle && f.Op != model.OauthTypeGithub && f.Op != model.OauthTypeOidc {
 		response.Error(c, response.TranslateMsg(c, "ParamsError"))
 		return
 	}
@@ -59,6 +60,59 @@ func (o *Oauth) OidcAuth(c *gin.Context) {
 	})
 }
 
+func (o *Oauth) OidcAuthQueryPre(c *gin.Context) (*model.User, *model.UserToken) {
+	var u *model.User
+	var ut *model.UserToken
+	q := &api.OidcAuthQuery{}
+
+	// 解析查询参数并处理错误
+	if err := c.ShouldBindQuery(q); err != nil {
+		response.Error(c, response.TranslateMsg(c, "ParamsError")+": "+err.Error())
+		return nil, nil
+	}
+
+	// 获取 OAuth 缓存
+	v := service.AllService.OauthService.GetOauthCache(q.Code)
+	if v == nil {
+		response.Error(c, response.TranslateMsg(c, "OauthExpired"))
+		return nil, nil
+	}
+
+	// 如果 UserId 为 0，说明还在授权中
+	if v.UserId == 0 {
+		c.JSON(http.StatusOK, gin.H{"message": "Authorization in progress, please login and bind"})
+		return nil, nil
+	}
+
+	// 获取用户信息
+	u = service.AllService.UserService.InfoById(v.UserId)
+	if u == nil {
+		response.Error(c, response.TranslateMsg(c, "UserNotFound"))
+		return nil, nil
+	}
+
+	// 删除 OAuth 缓存
+	service.AllService.OauthService.DeleteOauthCache(q.Code)
+
+	// 创建登录日志并生成用户令牌
+	ut = service.AllService.UserService.Login(u, &model.LoginLog{
+		UserId:   u.Id,
+		Client:   v.DeviceType,
+		Uuid:     v.Uuid,
+		Ip:       c.ClientIP(),
+		Type:     model.LoginLogTypeOauth,
+		Platform: v.DeviceOs,
+	})
+
+	if ut == nil {
+		response.Error(c, response.TranslateMsg(c, "LoginFailed"))
+		return nil, nil
+	}
+
+	// 返回用户令牌
+	return u, ut
+}
+
 // OidcAuthQuery
 // @Tags Oauth
 // @Summary OidcAuthQuery
@@ -69,33 +123,10 @@ func (o *Oauth) OidcAuth(c *gin.Context) {
 // @Failure 500 {object} response.ErrorResponse
 // @Router /oidc/auth-query [get]
 func (o *Oauth) OidcAuthQuery(c *gin.Context) {
-	q := &api.OidcAuthQuery{}
+	u, ut := o.OidcAuthQueryPre(c)
-	err := c.ShouldBindQuery(q)
+	if u == nil || ut == nil {
-	if err != nil {
-		response.Error(c, response.TranslateMsg(c, "ParamsError")+err.Error())
 		return
 	}
-	v := service.AllService.OauthService.GetOauthCache(q.Code)
-	if v == nil {
-		response.Error(c, response.TranslateMsg(c, "OauthExpired"))
-		return
-	}
-	if v.UserId == 0 {
-		//正在授权
-		c.JSON(http.StatusOK, gin.H{})
-		return
-	}
-	u := service.AllService.UserService.InfoById(v.UserId)
-	//fmt.Println("auth success u", u)
-	service.AllService.OauthService.DeleteOauthCache(q.Code)
-	ut := service.AllService.UserService.Login(u, &model.LoginLog{
-		UserId:   u.Id,
-		Client:   v.DeviceType,
-		Uuid:     v.Uuid,
-		Ip:       c.ClientIP(),
-		Type:     model.LoginLogTypeOauth,
-		Platform: v.DeviceOs,
-	})
 	c.JSON(http.StatusOK, apiResp.LoginRes{
 		AccessToken: ut.Token,
 		Type:        "access_token",
@@ -129,7 +160,11 @@ func (o *Oauth) OauthCallback(c *gin.Context) {
 
 	ty := v.Op
 	ac := v.Action
+	var u *model.User
+	openid := ""
+	thirdName := ""
 	//fmt.Println("ty ac ", ty, ac)
+
 	if ty == model.OauthTypeGithub {
 		code := c.Query("code")
 		err, userData := service.AllService.OauthService.GithubCallback(code)
@@ -137,123 +172,100 @@ func (o *Oauth) OauthCallback(c *gin.Context) {
 			c.String(http.StatusInternalServerError, response.TranslateMsg(c, "OauthFailed")+response.TranslateMsg(c, err.Error()))
 			return
 		}
-		if ac == service.OauthActionTypeBind {
+		openid = strconv.Itoa(userData.Id)
-			//fmt.Println("bind", ty, userData)
+		thirdName = userData.Login
-			utr := service.AllService.OauthService.UserThirdInfo(ty, strconv.Itoa(userData.Id))
+	} else if ty == model.OauthTypeGoogle {
-			if utr.UserId > 0 {
-				c.String(http.StatusInternalServerError, response.TranslateMsg(c, "OauthHasBindOtherUser"))
-				return
-			}
-			//绑定
-			u := service.AllService.UserService.InfoById(v.UserId)
-			if u == nil {
-				c.String(http.StatusInternalServerError, response.TranslateMsg(c, "ItemNotFound"))
-				return
-			}
-			//绑定github
-			err = service.AllService.OauthService.BindGithubUser(strconv.Itoa(userData.Id), userData.Login, v.UserId)
-			if err != nil {
-				c.String(http.StatusInternalServerError, response.TranslateMsg(c, "BindFail"))
-				return
-			}
-			c.String(http.StatusOK, response.TranslateMsg(c, "BindSuccess"))
-			return
-		} else if ac == service.OauthActionTypeLogin {
-			//登录
-			if v.UserId != 0 {
-				c.String(http.StatusInternalServerError, response.TranslateMsg(c, "OauthHasBeenSuccess"))
-				return
-			}
-			u := service.AllService.UserService.InfoByGithubId(strconv.Itoa(userData.Id))
-			if u == nil {
-				oa := service.AllService.OauthService.InfoByOp(ty)
-				if !*oa.AutoRegister {
-					//c.String(http.StatusInternalServerError, "还未绑定用户，请先绑定")
-					v.ThirdName = userData.Login
-					v.ThirdOpenId = strconv.Itoa(userData.Id)
-					url := global.Config.Rustdesk.ApiServer + "/_admin/#/oauth/bind/" + cacheKey
-					c.Redirect(http.StatusFound, url)
-					return
-				}
-
-				//自动注册
-				u = service.AllService.UserService.RegisterByGithub(userData.Login, strconv.Itoa(userData.Id))
-				if u.Id == 0 {
-					c.String(http.StatusInternalServerError, response.TranslateMsg(c, "OauthRegisterFailed"))
-					return
-				}
-			}
-
-			v.UserId = u.Id
-			service.AllService.OauthService.SetOauthCache(cacheKey, v, 0)
-			c.String(http.StatusOK, response.TranslateMsg(c, "OauthSuccess"))
-			return
-		}
-
-	}
-
-	if ty == model.OauthTypeGoogle {
 		code := c.Query("code")
 		err, userData := service.AllService.OauthService.GoogleCallback(code)
 		if err != nil {
 			c.String(http.StatusInternalServerError, response.TranslateMsg(c, "OauthFailed")+response.TranslateMsg(c, err.Error()))
 			return
 		}
+		openid = userData.Email
 		//将空格替换成_
-		googleName := strings.Replace(userData.Name, " ", "_", -1)
+		thirdName = strings.Replace(userData.Name, " ", "_", -1)
-		if ac == service.OauthActionTypeBind {
+	} else if ty == model.OauthTypeOidc {
-			//fmt.Println("bind", ty, userData)
+		code := c.Query("code")
-			utr := service.AllService.OauthService.UserThirdInfo(ty, userData.Email)
+		err, userData := service.AllService.OauthService.OidcCallback(code)
-			if utr.UserId > 0 {
+		if err != nil {
-				c.String(http.StatusInternalServerError, response.TranslateMsg(c, "OauthHasBindOtherUser"))
+			c.String(http.StatusInternalServerError, response.TranslateMsg(c, "OauthFailed")+response.TranslateMsg(c, err.Error()))
-				return
-			}
-			//绑定
-			u := service.AllService.UserService.InfoById(v.UserId)
-			if u == nil {
-				c.String(http.StatusInternalServerError, response.TranslateMsg(c, "ItemNotFound"))
-				return
-			}
-			//绑定
-			err = service.AllService.OauthService.BindGoogleUser(userData.Email, googleName, v.UserId)
-			if err != nil {
-				c.String(http.StatusInternalServerError, response.TranslateMsg(c, "BindFail"))
-				return
-			}
-			c.String(http.StatusOK, response.TranslateMsg(c, "BindSuccess"))
-			return
-		} else if ac == service.OauthActionTypeLogin {
-			if v.UserId != 0 {
-				c.String(http.StatusInternalServerError, response.TranslateMsg(c, "OauthHasBeenSuccess"))
-				return
-			}
-			u := service.AllService.UserService.InfoByGoogleEmail(userData.Email)
-			if u == nil {
-				oa := service.AllService.OauthService.InfoByOp(ty)
-				if !*oa.AutoRegister {
-					//c.String(http.StatusInternalServerError, "还未绑定用户，请先绑定")
-
-					v.ThirdName = googleName
-					v.ThirdOpenId = userData.Email
-					url := global.Config.Rustdesk.ApiServer + "/_admin/#/oauth/bind/" + cacheKey
-					c.Redirect(http.StatusFound, url)
-					return
-				}
-
-				//自动注册
-				u = service.AllService.UserService.RegisterByGoogle(googleName, userData.Email)
-				if u.Id == 0 {
-					c.String(http.StatusInternalServerError, response.TranslateMsg(c, "OauthRegisterFailed"))
-					return
-				}
-			}
-
-			v.UserId = u.Id
-			service.AllService.OauthService.SetOauthCache(cacheKey, v, 0)
-			c.String(http.StatusOK, response.TranslateMsg(c, "OauthSuccess"))
 			return
 		}
+		openid = userData.Sub
+		thirdName = userData.PreferredUsername
+	} else {
+		c.String(http.StatusInternalServerError, response.TranslateMsg(c, "ParamsError"))
+		return
+	}
+	if ac == service.OauthActionTypeBind {
+
+		//fmt.Println("bind", ty, userData)
+		utr := service.AllService.OauthService.UserThirdInfo(ty, openid)
+		if utr.UserId > 0 {
+			c.String(http.StatusInternalServerError, response.TranslateMsg(c, "OauthHasBindOtherUser"))
+			return
+		}
+		//绑定
+		u = service.AllService.UserService.InfoById(v.UserId)
+		if u == nil {
+			c.String(http.StatusInternalServerError, response.TranslateMsg(c, "ItemNotFound"))
+			return
+		}
+		//绑定
+		err := service.AllService.OauthService.BindOauthUser(ty, openid, thirdName, v.UserId)
+		if err != nil {
+			c.String(http.StatusInternalServerError, response.TranslateMsg(c, "BindFail"))
+			return
+		}
+		c.String(http.StatusOK, response.TranslateMsg(c, "BindSuccess"))
+		return
+
+	} else if ac == service.OauthActionTypeLogin {
+		//登录
+		if v.UserId != 0 {
+			c.String(http.StatusInternalServerError, response.TranslateMsg(c, "OauthHasBeenSuccess"))
+			return
+		}
+		u = service.AllService.UserService.InfoByGithubId(openid)
+		if u == nil {
+			oa := service.AllService.OauthService.InfoByOp(ty)
+			if !*oa.AutoRegister {
+				//c.String(http.StatusInternalServerError, "还未绑定用户，请先绑定")
+				v.ThirdName = thirdName
+				v.ThirdOpenId = openid
+				url := global.Config.Rustdesk.ApiServer + "/_admin/#/oauth/bind/" + cacheKey
+				c.Redirect(http.StatusFound, url)
+				return
+			}
+
+			//自动注册
+			u = service.AllService.UserService.RegisterByOauth(ty, thirdName, openid)
+			if u.Id == 0 {
+				c.String(http.StatusInternalServerError, response.TranslateMsg(c, "OauthRegisterFailed"))
+				return
+			}
+		}
+		v.UserId = u.Id
+		service.AllService.OauthService.SetOauthCache(cacheKey, v, 0)
+		// 如果是webadmin，登录成功后跳转到webadmin
+		if v.DeviceType == "webadmin" {
+			/*service.AllService.UserService.Login(u, &model.LoginLog{
+				UserId:   u.Id,
+				Client:   "webadmin",
+				Uuid:     "", //must be empty
+				Ip:       c.ClientIP(),
+				Type:     model.LoginLogTypeOauth,
+				Platform: v.DeviceOs,
+			})*/
+			url := global.Config.Rustdesk.ApiServer + "/_admin/#/"
+			c.Redirect(http.StatusFound, url)
+			return
+		}
+		c.String(http.StatusOK, response.TranslateMsg(c, "OauthSuccess"))
+		return
+	} else {
+		c.String(http.StatusInternalServerError, response.TranslateMsg(c, "ParamsError"))
+		return
 	}
-	c.String(http.StatusInternalServerError, response.TranslateMsg(c, "SystemError"))
 
 }

http/request/admin/login.go

@@ -11,3 +11,7 @@ type LoginLogQuery struct {
 	IsMy   int `form:"is_my"`
 	PageQuery
 }
+type LoginTokenQuery struct {
+	UserId int `form:"user_id"`
+	PageQuery
+}

http/request/admin/oauth.go

@@ -15,6 +15,8 @@ type UnBindOauthForm struct {
 type OauthForm struct {
 	Id           uint   `json:"id"`
 	Op           string `json:"op" validate:"required"`
+	Issuer	     string `json:"issuer" validate:"omitempty,url"`
+	Scopes	   	 string `json:"scopes" validate:"omitempty"`
 	ClientId     string `json:"client_id" validate:"required"`
 	ClientSecret string `json:"client_secret" validate:"required"`
 	RedirectUrl  string `json:"redirect_url" validate:"required"`
@@ -28,6 +30,8 @@ func (of *OauthForm) ToOauth() *model.Oauth {
 		ClientSecret: of.ClientSecret,
 		RedirectUrl:  of.RedirectUrl,
 		AutoRegister: of.AutoRegister,
+		Issuer:       of.Issuer,
+		Scopes:       of.Scopes,
 	}
 	oa.Id = of.Id
 	return oa

http/request/admin/peer.go

@@ -38,6 +38,7 @@ type PeerQuery struct {
 	TimeAgo  int    `json:"time_ago" form:"time_ago"`
 	Id       string `json:"id" form:"id"`
 	Hostname string `json:"hostname" form:"hostname"`
+	Uuids    string `json:"uuids" form:"uuids"`
 }
 
 type SimpleDataQuery struct {

http/request/admin/user.go

@@ -59,3 +59,9 @@ type GroupUsersQuery struct {
 	IsMy   int  `json:"is_my"`
 	UserId uint `json:"user_id"`
 }
+
+type RegisterForm struct {
+	Username        string `json:"username" validate:"required,gte=4,lte=10"`
+	Password        string `json:"password" validate:"required,gte=4,lte=20"`
+	ConfirmPassword string `json:"confirm_password" validate:"required,gte=4,lte=20"`
+}

http/router/admin.go

@@ -17,7 +17,7 @@ func Init(g *gin.Engine) {
 
 	adg := g.Group("/api/admin")
 	LoginBind(adg)
-
+	adg.POST("/user/register", (&admin.User{}).Register)
 	adg.Use(middleware.AdminAuth())
 	//FileBind(adg)
 	UserBind(adg)
@@ -30,10 +30,10 @@ func Init(g *gin.Engine) {
 	AuditBind(adg)
 	AddressBookCollectionBind(adg)
 	AddressBookCollectionRuleBind(adg)
+	UserTokenBind(adg)
 	rs := &admin.Rustdesk{}
 	adg.GET("/server-config", rs.ServerConfig)
 	adg.GET("/app-config", rs.AppConfig)
-
 	//访问静态文件
 	//g.StaticFS("/upload", http.Dir(global.Config.Gin.ResourcesPath+"/upload"))
 }
@@ -41,6 +41,9 @@ func LoginBind(rg *gin.RouterGroup) {
 	cont := &admin.Login{}
 	rg.POST("/login", cont.Login)
 	rg.POST("/logout", cont.Logout)
+	rg.GET("/login-options", cont.LoginOptions)
+	rg.POST("/oidc/auth", cont.OidcAuth)
+	rg.GET("/oidc/auth-query", cont.OidcAuthQuery)
 }
 
 func UserBind(rg *gin.RouterGroup) {
@@ -179,6 +182,12 @@ func AddressBookCollectionRuleBind(rg *gin.RouterGroup) {
 		aR.POST("/delete", cont.Delete)
 	}
 }
+func UserTokenBind(rg *gin.RouterGroup) {
+	aR := rg.Group("/user_token").Use(middleware.AdminPrivilege())
+	cont := &admin.UserToken{}
+	aR.GET("/list", cont.List)
+	aR.POST("/delete", cont.Delete)
+}
 
 /*
 func FileBind(rg *gin.RouterGroup) {

lib/lock/local_test.go

@@ -51,30 +51,22 @@ func TestLocal_GetLock(t *testing.T) {
 func TestLocal_Lock(t *testing.T) {
 	l := NewLocal()
 	wg := sync.WaitGroup{}
-	wg.Add(3)
+	m := 10
+	wg.Add(m)
 	i := 0
-	go func() {
+	for j := 0; j < m; j++ {
-		l.Lock("key")
+		go func() {
-		fmt.Println("l1", i)
+			l.Lock("key")
-		i++
+			//fmt.Println(j, i)
-		l.UnLock("key")
+			i++
-		wg.Done()
+			fmt.Println(j, i)
-	}()
+			l.UnLock("key")
-	go func() {
+			wg.Done()
-		l.Lock("key")
+		}()
-		fmt.Println("l2", i)
+	}
-		i++
+
-		l.UnLock("key")
-		wg.Done()
-	}()
-	go func() {
-		l.Lock("key")
-		fmt.Println("l3", i)
-		i++
-		l.UnLock("key")
-		wg.Done()
-	}()
 	wg.Wait()
+	fmt.Println(i)
 
 }
 func TestSyncMap(t *testing.T) {

model/loginLog.go

@@ -2,16 +2,22 @@ package model
 
 type LoginLog struct {
 	IdModel
-	UserId   uint   `json:"user_id"`
+	UserId      uint   `json:"user_id" gorm:"default:0;not null;"`
-	Client   string `json:"client"` //webadmin,webclient,app,
+	Client      string `json:"client"` //webadmin,webclient,app,
-	Uuid     string `json:"uuid"`
+	Uuid        string `json:"uuid"`
-	Ip       string `json:"ip"`
+	Ip          string `json:"ip"`
-	Type     string `json:"type"`     //account,oauth
+	Type        string `json:"type"`     //account,oauth
-	Platform string `json:"platform"` //windows,linux,mac,android,ios
+	Platform    string `json:"platform"` //windows,linux,mac,android,ios
-
+	UserTokenId uint   `json:"user_token_id" gorm:"default:0;not null;"`
 	TimeModel
 }
 
+const (
+	LoginLogClientWebAdmin = "webadmin"
+	LoginLogClientWeb      = "webclient"
+	LoginLogClientApp      = "app"
+)
+
 const (
 	LoginLogTypeAccount = "account"
 	LoginLogTypeOauth   = "oauth"

model/oauth.go

@@ -7,12 +7,15 @@ type Oauth struct {
 	ClientSecret string `json:"client_secret"`
 	RedirectUrl  string `json:"redirect_url"`
 	AutoRegister *bool  `json:"auto_register"`
+	Scopes       string `json:"scopes"`
+	Issuer	     string `json:"issuer"`
 	TimeModel
 }
 
 const (
 	OauthTypeGithub  = "github"
 	OauthTypeGoogle  = "google"
+	OauthTypeOidc    = "oidc"
 	OauthTypeWebauth = "webauth"
 )
 

model/user.go

@@ -2,7 +2,7 @@ package model
 
 type User struct {
 	IdModel
-	Username string     `json:"username" gorm:"default:'';not null;index,unique"`
+	Username string     `json:"username" gorm:"default:'';not null;uniqueIndex"`
 	Password string     `json:"-" gorm:"default:'';not null;"`
 	Nickname string     `json:"nickname" gorm:"default:'';not null;"`
 	Avatar   string     `json:"avatar" gorm:"default:'';not null;"`

model/userToken.go

@@ -7,3 +7,8 @@ type UserToken struct {
 	ExpiredAt int64  `json:"expired_at" gorm:"default:0;not null;"`
 	TimeModel
 }
+
+type UserTokenList struct {
+	UserTokens []UserToken `json:"list"`
+	Pagination
+}

resources/i18n/en.toml

@@ -119,3 +119,7 @@ other = "Default Group"
 description = "Share group"
 one = "Share Group"
 other = "Share Group"
+[RegisterClosed]
+description = "Register closed."
+one = "Register closed."
+other = "Register closed."

resources/i18n/ko.toml

@@ -121,3 +121,8 @@ other = "기본 그룹"
 description = "Share group."
 one = "공유 그룹"
 other = "공유 그룹"
+
+[RegisterClosed]
+description = "Register closed."
+one = "가입이 종료되었습니다."
+other = "가입이 종료되었습니다."

resources/i18n/ru.toml

@@ -127,3 +127,8 @@ other = "Группа по умолчанию"
 description = "Share group."
 one = "Общая группа"
 other = "Общая группа"
+
+[RegisterClosed]
+description = "Register closed."
+one = "Регистрация закрыта."
+other = "Регистрация закрыта."

resources/i18n/zh_CN.toml

@@ -121,3 +121,7 @@ other = "默认组"
 description = "Share group."
 one = "共享组"
 other = "共享组"
+[RegisterClosed]
+description = "Register closed."
+one = "注册已关闭。"
+other = "注册已关闭。"

service/oauth.go

@@ -15,10 +15,19 @@ import (
 	"net/http"
 	"net/url"
 	"strconv"
+	"strings"
 	"sync"
 	"time"
 )
 
+// Define a struct to parse the .well-known/openid-configuration response
+type OidcEndpoint struct {
+	Issuer   string `json:"issuer"`
+	AuthURL  string `json:"authorization_endpoint"`
+	TokenURL string `json:"token_endpoint"`
+	UserInfo string `json:"userinfo_endpoint"`
+}
+
 type OauthService struct {
 }
 
@@ -78,6 +87,14 @@ type GoogleUserdata struct {
 	Picture       string `json:"picture"`
 	VerifiedEmail bool   `json:"verified_email"`
 }
+type OidcUserdata struct {
+	Sub               string `json:"sub"`
+	Email             string `json:"email"`
+	VerifiedEmail     bool   `json:"email_verified"`
+	Name              string `json:"name"`
+	PreferredUsername string `json:"preferred_username"`
+}
+
 type OauthCacheItem struct {
 	UserId      uint   `json:"user_id"`
 	Id          string `json:"id"` //rustdesk的设备ID
@@ -137,38 +154,106 @@ func (os *OauthService) BeginAuth(op string) (error error, code, url string) {
 	return err, code, ""
 }
 
-// GetOauthConfig 获取配置
+// Method to fetch OIDC configuration dynamically
+func FetchOidcConfig(issuer string) (error, OidcEndpoint) {
+	configURL := strings.TrimSuffix(issuer, "/") + "/.well-known/openid-configuration"
+
+	// Get the HTTP client (with or without proxy based on configuration)
+	client := getHTTPClientWithProxy()
+
+	resp, err := client.Get(configURL)
+	if err != nil {
+		return errors.New("failed to fetch OIDC configuration"), OidcEndpoint{}
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return errors.New("OIDC configuration not found, status code: %d"), OidcEndpoint{}
+	}
+
+	var endpoint OidcEndpoint
+	if err := json.NewDecoder(resp.Body).Decode(&endpoint); err != nil {
+		return errors.New("failed to parse OIDC configuration"), OidcEndpoint{}
+	}
+
+	return nil, endpoint
+}
+
+// GetOauthConfig retrieves the OAuth2 configuration based on the provider type
 func (os *OauthService) GetOauthConfig(op string) (error, *oauth2.Config) {
-	if op == model.OauthTypeGithub {
+	switch op {
-		g := os.InfoByOp(model.OauthTypeGithub)
+	case model.OauthTypeGithub:
-		if g.Id == 0 || g.ClientId == "" || g.ClientSecret == "" || g.RedirectUrl == "" {
+		return os.getGithubConfig()
-			return errors.New("ConfigNotFound"), nil
+	case model.OauthTypeGoogle:
-		}
+		return os.getGoogleConfig()
-		return nil, &oauth2.Config{
+	case model.OauthTypeOidc:
-			ClientID:     g.ClientId,
+		return os.getOidcConfig()
-			ClientSecret: g.ClientSecret,
+	default:
-			RedirectURL:  g.RedirectUrl,
+		return errors.New("unsupported OAuth type"), nil
-			Endpoint:     github.Endpoint,
-			Scopes:       []string{"read:user", "user:email"},
-		}
 	}
-	if op == model.OauthTypeGoogle {
+}
-		g := os.InfoByOp(model.OauthTypeGoogle)
+
-		if g.Id == 0 || g.ClientId == "" || g.ClientSecret == "" || g.RedirectUrl == "" {
+// Helper function to get GitHub OAuth2 configuration
-			return errors.New("ConfigNotFound"), nil
+func (os *OauthService) getGithubConfig() (error, *oauth2.Config) {
-		}
+	g := os.InfoByOp(model.OauthTypeGithub)
-		return nil, &oauth2.Config{
+	if g.Id == 0 || g.ClientId == "" || g.ClientSecret == "" || g.RedirectUrl == "" {
-			ClientID:     g.ClientId,
+		return errors.New("ConfigNotFound"), nil
-			ClientSecret: g.ClientSecret,
+	}
-			RedirectURL:  g.RedirectUrl,
+	return nil, &oauth2.Config{
-			Endpoint:     google.Endpoint,
+		ClientID:     g.ClientId,
-			Scopes:       []string{"https://www.googleapis.com/auth/userinfo.profile", "https://www.googleapis.com/auth/userinfo.email"},
+		ClientSecret: g.ClientSecret,
-		}
+		RedirectURL:  g.RedirectUrl,
+		Endpoint:     github.Endpoint,
+		Scopes:       []string{"read:user", "user:email"},
+	}
+}
+
+// Helper function to get Google OAuth2 configuration
+func (os *OauthService) getGoogleConfig() (error, *oauth2.Config) {
+	g := os.InfoByOp(model.OauthTypeGoogle)
+	if g.Id == 0 || g.ClientId == "" || g.ClientSecret == "" || g.RedirectUrl == "" {
+		return errors.New("ConfigNotFound"), nil
+	}
+	return nil, &oauth2.Config{
+		ClientID:     g.ClientId,
+		ClientSecret: g.ClientSecret,
+		RedirectURL:  g.RedirectUrl,
+		Endpoint:     google.Endpoint,
+		Scopes:       []string{"https://www.googleapis.com/auth/userinfo.profile", "https://www.googleapis.com/auth/userinfo.email"},
+	}
+}
+
+// Helper function to get OIDC OAuth2 configuration
+func (os *OauthService) getOidcConfig() (error, *oauth2.Config) {
+	g := os.InfoByOp(model.OauthTypeOidc)
+	if g.Id == 0 || g.ClientId == "" || g.ClientSecret == "" || g.RedirectUrl == "" || g.Issuer == "" {
+		return errors.New("ConfigNotFound"), nil
+	}
+
+	// Set scopes
+	scopes := strings.TrimSpace(g.Scopes)
+	if scopes == "" {
+		scopes = "openid,profile,email"
+	}
+	scopeList := strings.Split(scopes, ",")
+	err, endpoint := FetchOidcConfig(g.Issuer)
+	if err != nil {
+		return err, nil
+	}
+	return nil, &oauth2.Config{
+		ClientID:     g.ClientId,
+		ClientSecret: g.ClientSecret,
+		RedirectURL:  g.RedirectUrl,
+		Endpoint: oauth2.Endpoint{
+			AuthURL:  endpoint.AuthURL,
+			TokenURL: endpoint.TokenURL,
+		},
+		Scopes: scopeList,
 	}
-	return errors.New("ConfigNotFound"), nil
 }
 
 func getHTTPClientWithProxy() *http.Client {
+	//todo add timeout
 	if global.Config.Proxy.Enable {
 		if global.Config.Proxy.Host == "" {
 			global.Logger.Warn("Proxy is enabled but proxy host is empty.")
@@ -269,6 +354,53 @@ func (os *OauthService) GoogleCallback(code string) (error error, userData *Goog
 	return
 }
 
+func (os *OauthService) OidcCallback(code string) (error error, userData *OidcUserdata) {
+	err, oauthConfig := os.GetOauthConfig(model.OauthTypeOidc)
+	if err != nil {
+		return err, nil
+	}
+	// 使用代理配置创建 HTTP 客户端
+	httpClient := getHTTPClientWithProxy()
+	ctx := context.WithValue(context.Background(), oauth2.HTTPClient, httpClient)
+
+	token, err := oauthConfig.Exchange(ctx, code)
+	if err != nil {
+		global.Logger.Warn("oauthConfig.Exchange() failed: ", err)
+		error = errors.New("GetOauthTokenError")
+		return
+	}
+
+	// 使用带有代理的 HTTP 客户端获取用户信息
+	client := oauthConfig.Client(ctx, token)
+	g := os.InfoByOp(model.OauthTypeOidc)
+	err, endpoint := FetchOidcConfig(g.Issuer)
+	if err != nil {
+		global.Logger.Warn("failed fetching OIDC configuration: ", err)
+		error = errors.New("FetchOidcConfigError")
+		return
+	}
+	resp, err := client.Get(endpoint.UserInfo)
+	if err != nil {
+		global.Logger.Warn("failed getting user info: ", err)
+		error = errors.New("GetOauthUserInfoError")
+		return
+	}
+	defer func(Body io.ReadCloser) {
+		err := Body.Close()
+		if err != nil {
+			global.Logger.Warn("failed closing response body: ", err)
+		}
+	}(resp.Body)
+
+	// 解析用户信息
+	if err = json.NewDecoder(resp.Body).Decode(&userData); err != nil {
+		global.Logger.Warn("failed decoding user info: ", err)
+		error = errors.New("DecodeOauthUserInfoError")
+		return
+	}
+	return
+}
+
 func (os *OauthService) UserThirdInfo(op, openid string) *model.UserThird {
 	ut := &model.UserThird{}
 	global.DB.Where("open_id = ? and third_type = ?", openid, op).First(ut)
@@ -282,6 +414,11 @@ func (os *OauthService) BindGithubUser(openid, username string, userId uint) err
 func (os *OauthService) BindGoogleUser(email, username string, userId uint) error {
 	return os.BindOauthUser(model.OauthTypeGoogle, email, username, userId)
 }
+
+func (os *OauthService) BindOidcUser(sub, username string, userId uint) error {
+	return os.BindOauthUser(model.OauthTypeOidc, sub, username, userId)
+}
+
 func (os *OauthService) BindOauthUser(thirdType, openid, username string, userId uint) error {
 	utr := &model.UserThird{
 		OpenId:    openid,
@@ -298,10 +435,18 @@ func (os *OauthService) UnBindGithubUser(userid uint) error {
 func (os *OauthService) UnBindGoogleUser(userid uint) error {
 	return os.UnBindThird(model.OauthTypeGoogle, userid)
 }
+func (os *OauthService) UnBindOidcUser(userid uint) error {
+	return os.UnBindThird(model.OauthTypeOidc, userid)
+}
 func (os *OauthService) UnBindThird(thirdType string, userid uint) error {
 	return global.DB.Where("user_id = ? and third_type = ?", userid, thirdType).Delete(&model.UserThird{}).Error
 }
 
+// DeleteUserByUserId: When user is deleted, delete all third party bindings
+func (os *OauthService) DeleteUserByUserId(userid uint) error {
+	return global.DB.Where("user_id = ?", userid).Delete(&model.UserThird{}).Error
+}
+
 // InfoById 根据id取用户信息
 func (os *OauthService) InfoById(id uint) *model.Oauth {
 	u := &model.Oauth{}

service/user.go

@@ -70,6 +70,7 @@ func (us *UserService) Login(u *model.User, llog *model.LoginLog) *model.UserTok
 		ExpiredAt: time.Now().Add(time.Hour * 24 * 7).Unix(),
 	}
 	global.DB.Create(ut)
+	llog.UserTokenId = ut.UserId
 	global.DB.Create(llog)
 	if llog.Uuid != "" {
 		AllService.PeerService.UuidBindUserId(llog.Uuid, u.Id)
@@ -148,8 +149,37 @@ func (us *UserService) Create(u *model.User) error {
 func (us *UserService) Logout(u *model.User, token string) error {
 	return global.DB.Where("user_id = ? and token = ?", u.Id, token).Delete(&model.UserToken{}).Error
 }
+
+// Delete 删除用户和oauth信息
 func (us *UserService) Delete(u *model.User) error {
-	return global.DB.Delete(u).Error
+	tx := global.DB.Begin()
+	// 删除用户
+	if err := tx.Delete(u).Error; err != nil {
+		tx.Rollback()
+		return err
+	}
+	// 删除关联的 OAuth 信息
+	if err := tx.Where("user_id = ?", u.Id).Delete(&model.UserThird{}).Error; err != nil {
+		tx.Rollback()
+		return err
+	}
+	//  删除关联的ab
+	if err := tx.Where("user_id = ?", u.Id).Delete(&model.AddressBook{}).Error; err != nil {
+		tx.Rollback()
+		return err
+	}
+	//  删除关联的abc
+	if err := tx.Where("user_id = ?", u.Id).Delete(&model.AddressBookCollection{}).Error; err != nil {
+		tx.Rollback()
+		return err
+	}
+	//  删除关联的abcr
+	if err := tx.Where("user_id = ?", u.Id).Delete(&model.AddressBookCollectionRule{}).Error; err != nil {
+		tx.Rollback()
+		return err
+	}
+	tx.Commit()
+	return nil
 }
 
 // Update 更新
@@ -196,6 +226,11 @@ func (us *UserService) InfoByGoogleEmail(email string) *model.User {
 	return us.InfoByOauthId(model.OauthTypeGithub, email)
 }
 
+// InfoByOidcSub 根据oidc取用户信息
+func (us *UserService) InfoByOidcSub(sub string) *model.User {
+	return us.InfoByOauthId(model.OauthTypeOidc, sub)
+}
+
 // InfoByOauthId 根据oauth取用户信息
 func (us *UserService) InfoByOauthId(thirdType, uid string) *model.User {
 	ut := AllService.OauthService.UserThirdInfo(thirdType, uid)
@@ -219,32 +254,42 @@ func (us *UserService) RegisterByGoogle(name string, email string) *model.User {
 	return us.RegisterByOauth(model.OauthTypeGoogle, name, email)
 }
 
+// RegisterByOidc 注册, use PreferredUsername as username, sub as openid
+func (us *UserService) RegisterByOidc(PreferredUsername string, sub string) *model.User {
+	return us.RegisterByOauth(model.OauthTypeOidc, PreferredUsername, sub)
+}
+
 // RegisterByOauth 注册
 func (us *UserService) RegisterByOauth(thirdType, thirdName, uid string) *model.User {
+	global.Lock.Lock("registerByOauth")
+	defer global.Lock.UnLock("registerByOauth")
+	ut := AllService.OauthService.UserThirdInfo(thirdType, uid)
+	if ut.Id != 0 {
+		u := &model.User{}
+		global.DB.Where("id = ?", ut.UserId).First(u)
+		return u
+	}
+
 	tx := global.DB.Begin()
-	ut := &model.UserThird{
+	ut = &model.UserThird{
 		OpenId:    uid,
 		ThirdName: thirdName,
 		ThirdType: thirdType,
 	}
-	//global.DB.Where("open_id = ?", githubId).First(ut)
-	//这种情况不应该出现，如果出现说明有bug
-	//if ut.Id != 0 {
-	//	u := &model.User{}
-	//	global.DB.Where("id = ?", ut.UserId).First(u)
-	//	tx.Commit()
-	//	return u
-	//}
 
 	username := us.GenerateUsernameByOauth(thirdName)
 	u := &model.User{
 		Username: username,
 		GroupId:  1,
 	}
-	global.DB.Create(u)
+	tx.Create(u)
+	if u.Id == 0 {
+		tx.Rollback()
+		return u
+	}
 
 	ut.UserId = u.Id
-	global.DB.Create(ut)
+	tx.Create(ut)
 
 	tx.Commit()
 	return u
@@ -279,3 +324,60 @@ func (us *UserService) FindLatestUserIdFromLoginLogByUuid(uuid string) uint {
 	global.DB.Where("uuid = ?", uuid).Order("id desc").First(llog)
 	return llog.UserId
 }
+
+// IsPasswordEmptyById 根据用户id判断密码是否为空，主要用于第三方登录的自动注册
+func (us *UserService) IsPasswordEmptyById(id uint) bool {
+	u := &model.User{}
+	if global.DB.Where("id = ?", id).First(u).Error != nil {
+		return false
+	}
+	return u.Password == ""
+}
+
+// IsPasswordEmptyByUsername 根据用户id判断密码是否为空，主要用于第三方登录的自动注册
+func (us *UserService) IsPasswordEmptyByUsername(username string) bool {
+	u := &model.User{}
+	if global.DB.Where("username = ?", username).First(u).Error != nil {
+		return false
+	}
+	return u.Password == ""
+}
+
+// IsPasswordEmptyByUser 判断密码是否为空，主要用于第三方登录的自动注册
+func (us *UserService) IsPasswordEmptyByUser(u *model.User) bool {
+	return us.IsPasswordEmptyById(u.Id)
+}
+
+func (us *UserService) Register(username string, password string) *model.User {
+	u := &model.User{
+		Username: username,
+		Password: us.EncryptPassword(password),
+		GroupId:  1,
+	}
+	global.DB.Create(u)
+	return u
+}
+
+func (us *UserService) TokenList(page uint, size uint, f func(tx *gorm.DB)) *model.UserTokenList {
+	res := &model.UserTokenList{}
+	res.Page = int64(page)
+	res.PageSize = int64(size)
+	tx := global.DB.Model(&model.UserToken{})
+	if f != nil {
+		f(tx)
+	}
+	tx.Count(&res.Total)
+	tx.Scopes(Paginate(page, size))
+	tx.Find(&res.UserTokens)
+	return res
+}
+
+func (us *UserService) TokenInfoById(id uint) *model.UserToken {
+	ut := &model.UserToken{}
+	global.DB.Where("id = ?", id).First(ut)
+	return ut
+}
+
+func (us *UserService) DeleteToken(l *model.UserToken) error {
+	return global.DB.Delete(l).Error
+}