@lobehub/chat 0.145.7 → 0.145.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +33 -0
- package/docs/self-hosting/environment-variables/auth.mdx +124 -0
- package/docs/self-hosting/environment-variables/auth.zh-CN.mdx +124 -0
- package/docs/self-hosting/environment-variables/basic.mdx +1 -142
- package/docs/self-hosting/environment-variables/basic.zh-CN.mdx +1 -143
- package/package.json +1 -1
- package/src/app/api/auth/next-auth.ts +22 -73
- package/src/app/api/auth/sso-providers/auth0.ts +19 -0
- package/src/app/api/auth/sso-providers/authentik.ts +19 -0
- package/src/app/api/auth/sso-providers/azure-ad.ts +19 -0
- package/src/app/api/auth/sso-providers/github.ts +17 -0
- package/src/app/api/auth/sso-providers/index.ts +6 -0
- package/src/features/ChatInput/ActionBar/Tools/index.tsx +4 -0
package/CHANGELOG.md
CHANGED
|
@@ -2,6 +2,39 @@
|
|
|
2
2
|
|
|
3
3
|
# Changelog
|
|
4
4
|
|
|
5
|
+
### [Version 0.145.8](https://github.com/lobehub/lobe-chat/compare/v0.145.7...v0.145.8)
|
|
6
|
+
|
|
7
|
+
<sup>Released on **2024-04-02**</sup>
|
|
8
|
+
|
|
9
|
+
#### ♻ Code Refactoring
|
|
10
|
+
|
|
11
|
+
- **misc**: Refactor SSO providers.
|
|
12
|
+
|
|
13
|
+
#### 🐛 Bug Fixes
|
|
14
|
+
|
|
15
|
+
- **misc**: Fix plugins dropdown menu overflow.
|
|
16
|
+
|
|
17
|
+
<br/>
|
|
18
|
+
|
|
19
|
+
<details>
|
|
20
|
+
<summary><kbd>Improvements and Fixes</kbd></summary>
|
|
21
|
+
|
|
22
|
+
#### Code refactoring
|
|
23
|
+
|
|
24
|
+
- **misc**: Refactor SSO providers, closes [#1865](https://github.com/lobehub/lobe-chat/issues/1865) ([290d33b](https://github.com/lobehub/lobe-chat/commit/290d33b))
|
|
25
|
+
|
|
26
|
+
#### What's fixed
|
|
27
|
+
|
|
28
|
+
- **misc**: Fix plugins dropdown menu overflow, closes [#1855](https://github.com/lobehub/lobe-chat/issues/1855) ([00e9068](https://github.com/lobehub/lobe-chat/commit/00e9068))
|
|
29
|
+
|
|
30
|
+
</details>
|
|
31
|
+
|
|
32
|
+
<div align="right">
|
|
33
|
+
|
|
34
|
+
[](#readme-top)
|
|
35
|
+
|
|
36
|
+
</div>
|
|
37
|
+
|
|
5
38
|
### [Version 0.145.7](https://github.com/lobehub/lobe-chat/compare/v0.145.6...v0.145.7)
|
|
6
39
|
|
|
7
40
|
<sup>Released on **2024-04-02**</sup>
|
|
@@ -0,0 +1,124 @@
|
|
|
1
|
+
## Authentication Service
|
|
2
|
+
|
|
3
|
+
LobeChat provides a complete authentication service capability when deployed. The following are the relevant environment variables. You can use these environment variables to easily define the identity verification services that need to be enabled in LobeChat.
|
|
4
|
+
|
|
5
|
+
## General Settings
|
|
6
|
+
|
|
7
|
+
### `ENABLE_OAUTH_SSO`
|
|
8
|
+
|
|
9
|
+
- Type: Required
|
|
10
|
+
- Description: Enable single sign-on (SSO) for LobeChat. Set to `1` to enable single sign-on.
|
|
11
|
+
- Default: `-`
|
|
12
|
+
- Example: `1`
|
|
13
|
+
|
|
14
|
+
### `SSO_PROVIDERS`
|
|
15
|
+
|
|
16
|
+
- Type: Required
|
|
17
|
+
- Description: Select the single sign-on provider for LoboChat. For multiple SSO Providers separating them with commas, for example, `auth0,azure-ad,authentik`.
|
|
18
|
+
- Default: `auth0`
|
|
19
|
+
- Example: `auth0,azure-ad,authentik`
|
|
20
|
+
|
|
21
|
+
### `NEXTAUTH_SECRET`
|
|
22
|
+
|
|
23
|
+
- Type: Required
|
|
24
|
+
- Description: Key used to encrypt the session tokens in Auth.js. You can generate the key using the following command: `openssl rand -base64 32`.
|
|
25
|
+
- Default: `-`
|
|
26
|
+
- Example: `Tfhi2t2pelSMEA8eaV61KaqPNEndFFdMIxDaJnS1CUI=`
|
|
27
|
+
|
|
28
|
+
### `NEXTAUTH_URL`
|
|
29
|
+
|
|
30
|
+
- Type: Optional
|
|
31
|
+
- Description: This URL is used to specify the callback address for Auth.js during OAuth authentication. It does not need to be set when deploying on Vercel.
|
|
32
|
+
- Default: `-`
|
|
33
|
+
- Example: `https://example.com/api/auth`
|
|
34
|
+
|
|
35
|
+
## Auth0
|
|
36
|
+
|
|
37
|
+
### `AUTH0_CLIENT_ID`
|
|
38
|
+
|
|
39
|
+
- Type: Required
|
|
40
|
+
- Description: Client ID of the Auth0 application. You can access it [here](https://manage.auth0.com/dashboard) and navigate to the application settings to view.
|
|
41
|
+
- Default: `-`
|
|
42
|
+
- Example: `evCnOJP1UX8FMnXR9Xkj5t0NyFn5p70P`
|
|
43
|
+
|
|
44
|
+
### `AUTH0_CLIENT_SECRET`
|
|
45
|
+
|
|
46
|
+
- Type: Required
|
|
47
|
+
- Description: Client Secret of the Auth0 application.
|
|
48
|
+
- Default: `-`
|
|
49
|
+
- Example: `wnX7UbZg85ZUzF6ioxPLnJVEQa1Elbs7aqBUSF16xleBS5AdkVfASS49-fQIC8Rm`
|
|
50
|
+
|
|
51
|
+
### `AUTH0_ISSUER`
|
|
52
|
+
|
|
53
|
+
- Type: Required
|
|
54
|
+
- Description: Issuer/domain of the Auth0 application.
|
|
55
|
+
- Default: `-`
|
|
56
|
+
- Example: `https://example.auth0.com`
|
|
57
|
+
|
|
58
|
+
## Microsoft Entra ID
|
|
59
|
+
|
|
60
|
+
### `AZURE_AD_CLIENT_ID`
|
|
61
|
+
|
|
62
|
+
- Type: Required
|
|
63
|
+
- Description: Client ID of the Microsoft Entra ID application.
|
|
64
|
+
- Default: `-`
|
|
65
|
+
- Example: `be8f6da1-58c3-4f16-ff1b-78f5148e10df`
|
|
66
|
+
|
|
67
|
+
### `AZURE_AD_CLIENT_SECRET`
|
|
68
|
+
|
|
69
|
+
- Type: Required
|
|
70
|
+
- Description: Client Secret of the Microsoft Entra ID application.
|
|
71
|
+
- Default: `-`
|
|
72
|
+
- Example: `~gI8Q.pTiN1vwB6Gl.E1yFT1ojcXABkdACfJXaNj`
|
|
73
|
+
|
|
74
|
+
### `AZURE_AD_TENANT_ID`
|
|
75
|
+
|
|
76
|
+
- Type: Required
|
|
77
|
+
- Description: Tenant ID of the Microsoft Entra ID application.
|
|
78
|
+
- Default: `-`
|
|
79
|
+
- Example: `c8ae2f36-edf6-4cda-96b9-d3e198a47cba`
|
|
80
|
+
|
|
81
|
+
## Authentik
|
|
82
|
+
|
|
83
|
+
### `AUTHENTIK_CLIENT_ID`
|
|
84
|
+
|
|
85
|
+
- Type: Required
|
|
86
|
+
- Description: Client ID of the Authentik provider application. You can access it [here][auth0-client-page] and navigate to the application settings to view.
|
|
87
|
+
- Default: `-`
|
|
88
|
+
- Example: `evCnOJP1UX8FMnXR9Xkj5t0NyFn5p70P`
|
|
89
|
+
|
|
90
|
+
### `AUTHENTIK_CLIENT_SECRET`
|
|
91
|
+
|
|
92
|
+
- Type: Required
|
|
93
|
+
- Description: Client Secret of the Authentik provider application.
|
|
94
|
+
- Default: `-`
|
|
95
|
+
- Example: `wnX7UbZg85ZUzF6ioxPLnJVEQa1Elbs7aqBUSF16xleBS5AdkVfASS49-fQIC8Rm`
|
|
96
|
+
|
|
97
|
+
### `AUTHENTIK_ISSUER`
|
|
98
|
+
|
|
99
|
+
- Type: Required
|
|
100
|
+
- Description: Issuer/domain of the Authentik provider application.
|
|
101
|
+
- Default: `-`
|
|
102
|
+
- Example: `https://your-authentik-domain.com/application/o/slug/`
|
|
103
|
+
|
|
104
|
+
## Github
|
|
105
|
+
|
|
106
|
+
### `GITHUB_CLIENT_ID`
|
|
107
|
+
|
|
108
|
+
- Type: Required
|
|
109
|
+
- Description: Client ID of the Github application. You can access it [here](https://github.com/settings/apps) and navigate to the application settings to view.
|
|
110
|
+
- Default: `-`
|
|
111
|
+
- Example: `abd94200333283550508`
|
|
112
|
+
|
|
113
|
+
### `GITHUB_CLIENT_SECRET`
|
|
114
|
+
|
|
115
|
+
- Type: Required
|
|
116
|
+
- Description: Client Secret of the Github application.
|
|
117
|
+
- Default: `-`
|
|
118
|
+
- Example: `dd262976ac0931d947e104891586a053f3d3750b`
|
|
119
|
+
|
|
120
|
+
<Callout>
|
|
121
|
+
Currently, we only support providers above. If you need to use other identity verification service
|
|
122
|
+
providers, you can submit a [feature
|
|
123
|
+
request](https://github.com/lobehub/lobe-chat/issues/new/choose) or Pull Request.
|
|
124
|
+
</Callout>
|
|
@@ -0,0 +1,124 @@
|
|
|
1
|
+
# 身份验证服务
|
|
2
|
+
|
|
3
|
+
LobeChat 在部署时提供了完善的身份验证服务能力，以下是相关的环境变量，你可以使用这些环境变量轻松定义需要在 LobeChat 中开启的身份验证服务。
|
|
4
|
+
|
|
5
|
+
## 通用设置
|
|
6
|
+
|
|
7
|
+
### `ENABLE_OAUTH_SSO`
|
|
8
|
+
|
|
9
|
+
- 类型：必选
|
|
10
|
+
- 描述：为 LobeChat 启用单点登录 (SSO)。设置为 `1` 以启用单点登录。
|
|
11
|
+
- 默认值: `-`
|
|
12
|
+
- 示例: `1`
|
|
13
|
+
|
|
14
|
+
### `SSO_PROVIDERS`
|
|
15
|
+
|
|
16
|
+
- Type: 必需
|
|
17
|
+
- 描述：选择 LoboChat 的单点登录提供商。如果有多个单点登录提供商，请用逗号分隔，例如 `auth0,azure-ad,authentik`
|
|
18
|
+
- 默认值: `auth0`
|
|
19
|
+
- 示例: `auth0,azure-ad,authentik`
|
|
20
|
+
|
|
21
|
+
### `NEXTAUTH_SECRET`
|
|
22
|
+
|
|
23
|
+
- 类型：必选
|
|
24
|
+
- 描述：用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`.
|
|
25
|
+
- 默认值: `-`
|
|
26
|
+
- 示例: `Tfhi2t2pelSMEA8eaV61KaqPNEndFFdMIxDaJnS1CUI=`
|
|
27
|
+
|
|
28
|
+
### `NEXTAUTH_URL`
|
|
29
|
+
|
|
30
|
+
- 类型：可选
|
|
31
|
+
- 描述：该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，在 Vercel 上部署时无需设置。
|
|
32
|
+
- 默认值：`-`
|
|
33
|
+
- 示例：`https://example.com/api/auth`
|
|
34
|
+
|
|
35
|
+
## Auth0
|
|
36
|
+
|
|
37
|
+
### `AUTH0_CLIENT_ID`
|
|
38
|
+
|
|
39
|
+
- 类型：必选
|
|
40
|
+
- 描述: Auth0 应用程序的 Client ID，您可以访问[这里](https://manage.auth0.com/dashboard)并导航至应用程序设置来查看
|
|
41
|
+
- 默认值: `-`
|
|
42
|
+
- 示例: `evCnOJP1UX8FMnXR9Xkj5t0NyFn5p70P`
|
|
43
|
+
|
|
44
|
+
### `AUTH0_CLIENT_SECRET`
|
|
45
|
+
|
|
46
|
+
- 类型：必选
|
|
47
|
+
- 描述: Auth0 应用程序的 Client Secret
|
|
48
|
+
- 默认值: `-`
|
|
49
|
+
- 示例: `wnX7UbZg85ZUzF6ioxPLnJVEQa1Elbs7aqBUSF16xleBS5AdkVfASS49-fQIC8Rm`
|
|
50
|
+
|
|
51
|
+
### `AUTH0_ISSUER`
|
|
52
|
+
|
|
53
|
+
- 类型：必选
|
|
54
|
+
- 描述: Auth0 应用程序的签发人 / 域
|
|
55
|
+
- 默认值: `-`
|
|
56
|
+
- 示例: `https://example.auth0.com`
|
|
57
|
+
|
|
58
|
+
## Microsoft Entra ID
|
|
59
|
+
|
|
60
|
+
### `AZURE_AD_CLIENT_ID`
|
|
61
|
+
|
|
62
|
+
- 类型：必需
|
|
63
|
+
- 描述：Microsoft Entra ID 应用程序的客户端 ID。
|
|
64
|
+
- 默认值：`-`
|
|
65
|
+
- 示例：`be8f6da1-58c3-4f16-ff1b-78f5148e10df`
|
|
66
|
+
|
|
67
|
+
### `AZURE_AD_CLIENT_SECRET`
|
|
68
|
+
|
|
69
|
+
- 类型：必需
|
|
70
|
+
- 描述：Microsoft Entra ID 应用程序的客户端密钥。
|
|
71
|
+
- 默认值：`-`
|
|
72
|
+
- 示例：`~gI8Q.pTiN1vwB6Gl.E1yFT1ojcXABkdACfJXaNj`
|
|
73
|
+
|
|
74
|
+
### `AZURE_AD_TENANT_ID`
|
|
75
|
+
|
|
76
|
+
- 类型：必需
|
|
77
|
+
- 描述：Microsoft Entra ID 应用程序的租户 ID。
|
|
78
|
+
- 默认值：`-`
|
|
79
|
+
- 示例：`c8ae2f36-edf6-4cda-96b9-d3e198a47cba`
|
|
80
|
+
|
|
81
|
+
## Authentik
|
|
82
|
+
|
|
83
|
+
|
|
84
|
+
### `AUTHENTIK_CLIENT_ID`
|
|
85
|
+
|
|
86
|
+
- 类型：必选
|
|
87
|
+
- 描述: Authentik 提供程序的 Client ID
|
|
88
|
+
- 默认值: `-`
|
|
89
|
+
- 示例: `YNtbIRlYF8Kj66mTLue59nsGLlb7HNyx1qjPH6VS`
|
|
90
|
+
|
|
91
|
+
### `AUTHENTIK_CLIENT_SECRET`
|
|
92
|
+
|
|
93
|
+
- 类型：必选
|
|
94
|
+
- 描述: Authentik 提供程序的 Client Secret
|
|
95
|
+
- 默认值: `-`
|
|
96
|
+
- 示例: `h3lMI1vPUzqyqqeIDUbH5UNNOxyQLXk35h89yETeaAwHk7qVXBG3sJQWeqHBU5pyggwhP9u0eaZ1eq6DHUddVPLoS4gncqD37yuCr8jI8dY66WAt45MStDsDcQm0Ygze`
|
|
97
|
+
|
|
98
|
+
### `AUTHENTIK_ISSUER`
|
|
99
|
+
|
|
100
|
+
- 类型：必选
|
|
101
|
+
- 描述: Authentik 提供程序的 OpenID Connect 颁发者
|
|
102
|
+
- 默认值: `-`
|
|
103
|
+
- 示例: `https://your-authentik-domain.com/application/o/slug/`
|
|
104
|
+
|
|
105
|
+
## Github
|
|
106
|
+
|
|
107
|
+
### `GITHUB_CLIENT_ID`
|
|
108
|
+
|
|
109
|
+
- Type: Required
|
|
110
|
+
- Description: Github应用的客户端ID。您可以在[这里](https://github.com/settings/apps)访问，并导航到应用程序设置以查看。
|
|
111
|
+
- Default: `-`
|
|
112
|
+
- Example: `abd94200333283550508`
|
|
113
|
+
|
|
114
|
+
### `GITHUB_CLIENT_SECRET`
|
|
115
|
+
|
|
116
|
+
- Type: Required
|
|
117
|
+
- Description: Github应用的客户端密钥。
|
|
118
|
+
- Default: `-`
|
|
119
|
+
- Example: `dd262976ac0931d947e104891586a053f3d3750b`
|
|
120
|
+
|
|
121
|
+
<Callout>
|
|
122
|
+
如果您需要使用其他身份验证服务提供商，可以提交
|
|
123
|
+
[功能请求](https://github.com/lobehub/lobe-chat/issues/new/choose) 或 Pull Request。
|
|
124
|
+
</Callout>
|
|
@@ -49,145 +49,7 @@ The `DEFAULT_AGENT_CONFIG` is used to configure the default settings for the Lob
|
|
|
49
49
|
|
|
50
50
|
Further reading:
|
|
51
51
|
|
|
52
|
-
- [
|
|
53
|
-
|
|
54
|
-
## Identity Verification Service
|
|
55
|
-
|
|
56
|
-
### General Settings
|
|
57
|
-
|
|
58
|
-
#### `ENABLE_OAUTH_SSO`
|
|
59
|
-
|
|
60
|
-
- Type: Required
|
|
61
|
-
- Description: Enable single sign-on (SSO) for LobeChat. Set to `1` to enable single sign-on.
|
|
62
|
-
- Default: `-`
|
|
63
|
-
- Example: `1`
|
|
64
|
-
|
|
65
|
-
#### `SSO_PROVIDERS`
|
|
66
|
-
|
|
67
|
-
- Type: Required
|
|
68
|
-
- Description: Select the single sign-on provider for LoboChat. For multiple SSO Providers separating them with commas, for example, `auth0,azure-ad,authentik`.
|
|
69
|
-
- Default: `auth0`
|
|
70
|
-
- Example: `auth0,azure-ad,authentik`
|
|
71
|
-
|
|
72
|
-
#### `NEXTAUTH_SECRET`
|
|
73
|
-
|
|
74
|
-
- Type: Required
|
|
75
|
-
- Description: Key used to encrypt the session tokens in Auth.js. You can generate the key using the following command: `openssl rand -base64 32`.
|
|
76
|
-
- Default: `-`
|
|
77
|
-
- Example: `Tfhi2t2pelSMEA8eaV61KaqPNEndFFdMIxDaJnS1CUI=`
|
|
78
|
-
|
|
79
|
-
#### `NEXTAUTH_URL`
|
|
80
|
-
|
|
81
|
-
- Type: Optional
|
|
82
|
-
- Description: This URL is used to specify the callback address for Auth.js during OAuth authentication. It does not need to be set when deploying on Vercel.
|
|
83
|
-
- Default: `-`
|
|
84
|
-
- Example: `https://example.com/api/auth`
|
|
85
|
-
|
|
86
|
-
### Auth0
|
|
87
|
-
|
|
88
|
-
<Callout>
|
|
89
|
-
Currently, we only support the Auth0, Microsoft Entra ID, Authentik identity verification service providers.
|
|
90
|
-
If you need to use other identity verification service providers, you can submit a [feature request](https://github.com/lobehub/lobe-chat/issues/new/choose) or Pull Request.
|
|
91
|
-
</Callout>
|
|
92
|
-
|
|
93
|
-
#### `AUTH0_CLIENT_ID`
|
|
94
|
-
|
|
95
|
-
- Type: Required
|
|
96
|
-
- Description: Client ID of the Auth0 application. You can access it [here][auth0-client-page] and navigate to the application settings to view.
|
|
97
|
-
- Default: `-`
|
|
98
|
-
- Example: `evCnOJP1UX8FMnXR9Xkj5t0NyFn5p70P`
|
|
99
|
-
|
|
100
|
-
#### `AUTH0_CLIENT_SECRET`
|
|
101
|
-
|
|
102
|
-
- Type: Required
|
|
103
|
-
- Description: Client Secret of the Auth0 application.
|
|
104
|
-
- Default: `-`
|
|
105
|
-
- Example: `wnX7UbZg85ZUzF6ioxPLnJVEQa1Elbs7aqBUSF16xleBS5AdkVfASS49-fQIC8Rm`
|
|
106
|
-
|
|
107
|
-
#### `AUTH0_ISSUER`
|
|
108
|
-
|
|
109
|
-
- Type: Required
|
|
110
|
-
- Description: Issuer/domain of the Auth0 application.
|
|
111
|
-
- Default: `-`
|
|
112
|
-
- Example: `https://example.auth0.com`
|
|
113
|
-
|
|
114
|
-
### Microsoft Entra ID
|
|
115
|
-
|
|
116
|
-
<Callout>
|
|
117
|
-
Currently, we only support the Auth0, Microsoft Entra ID, Authentik identity verification service providers. If you need to use
|
|
118
|
-
other identity verification service providers, you can submit a [feature request](https://github.com/lobehub/lobe-chat/issues/new/choose) or Pull Request.
|
|
119
|
-
</Callout>
|
|
120
|
-
|
|
121
|
-
#### `AZURE_AD_CLIENT_ID`
|
|
122
|
-
|
|
123
|
-
- Type: Required
|
|
124
|
-
- Description: Client ID of the Microsoft Entra ID application.
|
|
125
|
-
- Default: `-`
|
|
126
|
-
- Example: `be8f6da1-58c3-4f16-ff1b-78f5148e10df`
|
|
127
|
-
|
|
128
|
-
#### `AZURE_AD_CLIENT_SECRET`
|
|
129
|
-
|
|
130
|
-
- Type: Required
|
|
131
|
-
- Description: Client Secret of the Microsoft Entra ID application.
|
|
132
|
-
- Default: `-`
|
|
133
|
-
- Example: `~gI8Q.pTiN1vwB6Gl.E1yFT1ojcXABkdACfJXaNj`
|
|
134
|
-
|
|
135
|
-
#### `AZURE_AD_TENANT_ID`
|
|
136
|
-
|
|
137
|
-
- Type: Required
|
|
138
|
-
- Description: Tenant ID of the Microsoft Entra ID application.
|
|
139
|
-
- Default: `-`
|
|
140
|
-
- Example: `c8ae2f36-edf6-4cda-96b9-d3e198a47cba`
|
|
141
|
-
|
|
142
|
-
### Authentik
|
|
143
|
-
|
|
144
|
-
<Callout>
|
|
145
|
-
Currently, we only support the Auth0, Microsoft Entra ID, Authentik identity verification service providers. If you need to use
|
|
146
|
-
other identity verification service providers, you can submit a [feature
|
|
147
|
-
request](https://github.com/lobehub/lobe-chat/issues/new/choose) or Pull Request.
|
|
148
|
-
</Callout>
|
|
149
|
-
|
|
150
|
-
#### `AUTHENTIK_CLIENT_ID`
|
|
151
|
-
|
|
152
|
-
- Type: Required
|
|
153
|
-
- Description: Client ID of the Authentik provider application. You can access it [here][auth0-client-page] and navigate to the application settings to view.
|
|
154
|
-
- Default: `-`
|
|
155
|
-
- Example: `evCnOJP1UX8FMnXR9Xkj5t0NyFn5p70P`
|
|
156
|
-
|
|
157
|
-
#### `AUTHENTIK_CLIENT_SECRET`
|
|
158
|
-
|
|
159
|
-
- Type: Required
|
|
160
|
-
- Description: Client Secret of the Authentik provider application.
|
|
161
|
-
- Default: `-`
|
|
162
|
-
- Example: `wnX7UbZg85ZUzF6ioxPLnJVEQa1Elbs7aqBUSF16xleBS5AdkVfASS49-fQIC8Rm`
|
|
163
|
-
|
|
164
|
-
#### `AUTHENTIK_ISSUER`
|
|
165
|
-
|
|
166
|
-
- Type: Required
|
|
167
|
-
- Description: Issuer/domain of the Authentik provider application.
|
|
168
|
-
- Default: `-`
|
|
169
|
-
- Example: `https://your-authentik-domain.com/application/o/slug/`
|
|
170
|
-
|
|
171
|
-
### Github
|
|
172
|
-
|
|
173
|
-
<Callout>
|
|
174
|
-
Currently, we only support the Auth0, Microsoft Entra ID, Authentik, Github identity verification service providers.
|
|
175
|
-
If you need to use other identity verification service providers, you can submit a [feature request](https://github.com/lobehub/lobe-chat/issues/new/choose) or Pull Request.
|
|
176
|
-
</Callout>
|
|
177
|
-
|
|
178
|
-
#### `GITHUB_CLIENT_ID`
|
|
179
|
-
|
|
180
|
-
- Type: Required
|
|
181
|
-
- Description: Client ID of the Github application. You can access it [here][github-client-page] and navigate to the application settings to view.
|
|
182
|
-
- Default: `-`
|
|
183
|
-
- Example: `abd94200333283550508`
|
|
184
|
-
|
|
185
|
-
#### `GITHUB_CLIENT_SECRET`
|
|
186
|
-
|
|
187
|
-
- Type: Required
|
|
188
|
-
- Description: Client Secret of the Github application.
|
|
189
|
-
- Default: `-`
|
|
190
|
-
- Example: `dd262976ac0931d947e104891586a053f3d3750b`
|
|
52
|
+
- [[RFC] 022 - Default Assistant Parameters Configuration via Environment Variables](https://github.com/lobehub/lobe-chat/discussions/913)
|
|
191
53
|
|
|
192
54
|
## Plugin Service
|
|
193
55
|
|
|
@@ -225,6 +87,3 @@ The above example sets the `SERPAPI_API_KEY` of the `search-engine` plugin to `x
|
|
|
225
87
|
- Type: Optional
|
|
226
88
|
- Description: Index address of the LobeChat assistant market. If you have deployed the assistant market service on your own, you can use this variable to override the default market address.
|
|
227
89
|
- Default: `https://chat-agents.lobehub.com`
|
|
228
|
-
|
|
229
|
-
[auth0-client-page]: https://manage.auth0.com/dashboard
|
|
230
|
-
[github-client-page]: https://github.com/settings/apps
|
|
@@ -49,146 +49,7 @@ LobeChat 在部署时提供了一些额外的配置项，你可以使用环境
|
|
|
49
49
|
|
|
50
50
|
相关阅读：
|
|
51
51
|
|
|
52
|
-
- [
|
|
53
|
-
|
|
54
|
-
## 身份验证服务
|
|
55
|
-
|
|
56
|
-
### 通用设置
|
|
57
|
-
|
|
58
|
-
#### `ENABLE_OAUTH_SSO`
|
|
59
|
-
|
|
60
|
-
- 类型：必选
|
|
61
|
-
- 描述：为 LobeChat 启用单点登录 (SSO)。设置为 `1` 以启用单点登录。
|
|
62
|
-
- 默认值: `-`
|
|
63
|
-
- 示例: `1`
|
|
64
|
-
|
|
65
|
-
#### `SSO_PROVIDERS`
|
|
66
|
-
|
|
67
|
-
- Type: 必需
|
|
68
|
-
- 描述：选择 LoboChat 的单点登录提供商。如果有多个单点登录提供商，请用逗号分隔，例如 `auth0,azure-ad,authentik`
|
|
69
|
-
- 默认值: `auth0`
|
|
70
|
-
- 示例: `auth0,azure-ad,authentik`
|
|
71
|
-
|
|
72
|
-
#### `NEXTAUTH_SECRET`
|
|
73
|
-
|
|
74
|
-
- 类型：必选
|
|
75
|
-
- 描述：用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`.
|
|
76
|
-
- 默认值: `-`
|
|
77
|
-
- 示例: `Tfhi2t2pelSMEA8eaV61KaqPNEndFFdMIxDaJnS1CUI=`
|
|
78
|
-
|
|
79
|
-
#### `NEXTAUTH_URL`
|
|
80
|
-
|
|
81
|
-
- 类型：可选
|
|
82
|
-
- 描述：该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，在 Vercel 上部署时无需设置。
|
|
83
|
-
- 默认值：`-`
|
|
84
|
-
- 示例：`https://example.com/api/auth`
|
|
85
|
-
|
|
86
|
-
### Auth0
|
|
87
|
-
|
|
88
|
-
<Callout>
|
|
89
|
-
目前，我们仅支持 Auth0,Microsoft Entra ID,Authentik 作为身份验证服务提供商。
|
|
90
|
-
如果您需要使用其他身份验证服务提供商，可以提交 [功能请求](https://github.com/lobehub/lobe-chat/issues/new/choose) 或 Pull Request。
|
|
91
|
-
</Callout>
|
|
92
|
-
|
|
93
|
-
#### `AUTH0_CLIENT_ID`
|
|
94
|
-
|
|
95
|
-
- 类型：必选
|
|
96
|
-
- 描述: Auth0 应用程序的 Client ID，您可以访问[这里][auth0-client-page]并导航至应用程序设置来查看
|
|
97
|
-
- 默认值: `-`
|
|
98
|
-
- 示例: `evCnOJP1UX8FMnXR9Xkj5t0NyFn5p70P`
|
|
99
|
-
|
|
100
|
-
#### `AUTH0_CLIENT_SECRET`
|
|
101
|
-
|
|
102
|
-
- 类型：必选
|
|
103
|
-
- 描述: Auth0 应用程序的 Client Secret
|
|
104
|
-
- 默认值: `-`
|
|
105
|
-
- 示例: `wnX7UbZg85ZUzF6ioxPLnJVEQa1Elbs7aqBUSF16xleBS5AdkVfASS49-fQIC8Rm`
|
|
106
|
-
|
|
107
|
-
#### `AUTH0_ISSUER`
|
|
108
|
-
|
|
109
|
-
- 类型：必选
|
|
110
|
-
- 描述: Auth0 应用程序的签发人 / 域
|
|
111
|
-
- 默认值: `-`
|
|
112
|
-
- 示例: `https://example.auth0.com`
|
|
113
|
-
|
|
114
|
-
### Microsoft Entra ID
|
|
115
|
-
|
|
116
|
-
<Callout>
|
|
117
|
-
目前，我们仅支持 Auth0,Microsoft Entra ID,Authentik 作为身份验证服务提供商。
|
|
118
|
-
如果您需要使用其他身份验证服务提供商，可以提交 [功能请求](https://github.com/lobehub/lobe-chat/issues/new/choose) 或 Pull Request。
|
|
119
|
-
</Callout>
|
|
120
|
-
|
|
121
|
-
#### `AZURE_AD_CLIENT_ID`
|
|
122
|
-
|
|
123
|
-
- 类型：必需
|
|
124
|
-
- 描述：Microsoft Entra ID 应用程序的客户端 ID。
|
|
125
|
-
- 默认值：`-`
|
|
126
|
-
- 示例：`be8f6da1-58c3-4f16-ff1b-78f5148e10df`
|
|
127
|
-
|
|
128
|
-
#### `AZURE_AD_CLIENT_SECRET`
|
|
129
|
-
|
|
130
|
-
- 类型：必需
|
|
131
|
-
- 描述：Microsoft Entra ID 应用程序的客户端密钥。
|
|
132
|
-
- 默认值：`-`
|
|
133
|
-
- 示例：`~gI8Q.pTiN1vwB6Gl.E1yFT1ojcXABkdACfJXaNj`
|
|
134
|
-
|
|
135
|
-
#### `AZURE_AD_TENANT_ID`
|
|
136
|
-
|
|
137
|
-
- 类型：必需
|
|
138
|
-
- 描述：Microsoft Entra ID 应用程序的租户 ID。
|
|
139
|
-
- 默认值：`-`
|
|
140
|
-
- 示例：`c8ae2f36-edf6-4cda-96b9-d3e198a47cba`
|
|
141
|
-
|
|
142
|
-
### Authentik
|
|
143
|
-
|
|
144
|
-
<Callout>
|
|
145
|
-
目前，我们仅支持 Auth0,Microsoft Entra ID,Authentik 作为身份验证服务提供商。如果您需要使用其他身份验证服务提供商，可以提交
|
|
146
|
-
[功能请求](https://github.com/lobehub/lobe-chat/issues/new/choose) 或 Pull Request。
|
|
147
|
-
</Callout>
|
|
148
|
-
|
|
149
|
-
#### `AUTHENTIK_CLIENT_ID`
|
|
150
|
-
|
|
151
|
-
- 类型：必选
|
|
152
|
-
- 描述: Authentik 提供程序的 Client ID
|
|
153
|
-
- 默认值: `-`
|
|
154
|
-
- 示例: `YNtbIRlYF8Kj66mTLue59nsGLlb7HNyx1qjPH6VS`
|
|
155
|
-
|
|
156
|
-
#### `AUTHENTIK_CLIENT_SECRET`
|
|
157
|
-
|
|
158
|
-
- 类型：必选
|
|
159
|
-
- 描述: Authentik 提供程序的 Client Secret
|
|
160
|
-
- 默认值: `-`
|
|
161
|
-
- 示例: `h3lMI1vPUzqyqqeIDUbH5UNNOxyQLXk35h89yETeaAwHk7qVXBG3sJQWeqHBU5pyggwhP9u0eaZ1eq6DHUddVPLoS4gncqD37yuCr8jI8dY66WAt45MStDsDcQm0Ygze`
|
|
162
|
-
|
|
163
|
-
#### `AUTHENTIK_ISSUER`
|
|
164
|
-
|
|
165
|
-
- 类型：必选
|
|
166
|
-
- 描述: Authentik 提供程序的 OpenID Connect 颁发者
|
|
167
|
-
- 默认值: `-`
|
|
168
|
-
- 示例: `https://your-authentik-domain.com/application/o/slug/`
|
|
169
|
-
|
|
170
|
-
|
|
171
|
-
### Github
|
|
172
|
-
|
|
173
|
-
<Callout>
|
|
174
|
-
目前，我们仅支持 Auth0,Microsoft Entra ID,Authentik,Github 作为身份验证服务提供商。如果您需要使用其他身份验证服务提供商，可以提交
|
|
175
|
-
[功能请求](https://github.com/lobehub/lobe-chat/issues/new/choose) 或 Pull Request。
|
|
176
|
-
</Callout>
|
|
177
|
-
|
|
178
|
-
#### `GITHUB_CLIENT_ID`
|
|
179
|
-
|
|
180
|
-
- Type: Required
|
|
181
|
-
- Description: Github应用的客户端ID。您可以在[这里][github-client-page]访问，并导航到应用程序设置以查看。
|
|
182
|
-
- Default: `-`
|
|
183
|
-
- Example: `abd94200333283550508`
|
|
184
|
-
|
|
185
|
-
#### `GITHUB_CLIENT_SECRET`
|
|
186
|
-
|
|
187
|
-
- Type: Required
|
|
188
|
-
- Description: Github应用的客户端密钥。
|
|
189
|
-
- Default: `-`
|
|
190
|
-
- Example: `dd262976ac0931d947e104891586a053f3d3750b`
|
|
191
|
-
|
|
52
|
+
- [[RFC] 022 - 环境变量配置默认助手参数](https://github.com/lobehub/lobe-chat/discussions/913)
|
|
192
53
|
|
|
193
54
|
## 插件服务
|
|
194
55
|
|
|
@@ -226,6 +87,3 @@ LobeChat 在部署时提供了一些额外的配置项，你可以使用环境
|
|
|
226
87
|
- 类型：可选
|
|
227
88
|
- 描述：LobeChat 助手市场的索引地址，如果你自行部署了助手市场的服务，可以使用该变量来覆盖默认的市场地址
|
|
228
89
|
- 默认值：`https://chat-agents.lobehub.com`
|
|
229
|
-
|
|
230
|
-
[auth0-client-page]: https://manage.auth0.com/dashboard
|
|
231
|
-
[github-client-page]: https://github.com/settings/apps
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@lobehub/chat",
|
|
3
|
-
"version": "0.145.
|
|
3
|
+
"version": "0.145.8",
|
|
4
4
|
"description": "Lobe Chat - an open-source, high-performance chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Supports one-click free deployment of your private ChatGPT/LLM web application.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"framework",
|
|
@@ -1,34 +1,22 @@
|
|
|
1
1
|
import NextAuth from 'next-auth';
|
|
2
|
-
import Auth0 from 'next-auth/providers/auth0';
|
|
3
|
-
import Authentik from 'next-auth/providers/authentik';
|
|
4
|
-
import AzureAd from 'next-auth/providers/azure-ad';
|
|
5
|
-
import Github from 'next-auth/providers/github';
|
|
6
2
|
|
|
7
3
|
import { getServerConfig } from '@/config/server';
|
|
8
4
|
|
|
9
|
-
|
|
10
|
-
ENABLE_OAUTH_SSO,
|
|
11
|
-
SSO_PROVIDERS,
|
|
12
|
-
AUTH0_CLIENT_ID,
|
|
13
|
-
AUTH0_CLIENT_SECRET,
|
|
14
|
-
AUTH0_ISSUER,
|
|
15
|
-
GITHUB_CLIENT_ID,
|
|
16
|
-
GITHUB_CLIENT_SECRET,
|
|
17
|
-
AZURE_AD_CLIENT_ID,
|
|
18
|
-
AZURE_AD_CLIENT_SECRET,
|
|
19
|
-
AZURE_AD_TENANT_ID,
|
|
20
|
-
AUTHENTIK_CLIENT_ID,
|
|
21
|
-
AUTHENTIK_CLIENT_SECRET,
|
|
22
|
-
AUTHENTIK_ISSUER,
|
|
23
|
-
NEXTAUTH_SECRET,
|
|
24
|
-
} = getServerConfig();
|
|
5
|
+
import { ssoProviders } from './sso-providers';
|
|
25
6
|
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
7
|
+
const { NEXTAUTH_SECRET, ENABLE_OAUTH_SSO, SSO_PROVIDERS } = getServerConfig();
|
|
8
|
+
|
|
9
|
+
export const initSSOProviders = () => {
|
|
10
|
+
return ENABLE_OAUTH_SSO
|
|
11
|
+
? SSO_PROVIDERS.split(/[,，]/).map((provider) => {
|
|
12
|
+
const validProvider = ssoProviders.find((item) => item.id === provider);
|
|
13
|
+
|
|
14
|
+
if (validProvider) return validProvider.provider;
|
|
15
|
+
|
|
16
|
+
throw new Error(`[NextAuth] provider ${provider} is not supported`);
|
|
17
|
+
})
|
|
18
|
+
: [];
|
|
19
|
+
};
|
|
32
20
|
|
|
33
21
|
const nextAuth = NextAuth({
|
|
34
22
|
callbacks: {
|
|
@@ -49,53 +37,7 @@ const nextAuth = NextAuth({
|
|
|
49
37
|
return session;
|
|
50
38
|
},
|
|
51
39
|
},
|
|
52
|
-
providers:
|
|
53
|
-
? SSO_PROVIDERS.split(/[,，]/).map((provider) => {
|
|
54
|
-
switch (provider) {
|
|
55
|
-
case 'auth0': {
|
|
56
|
-
return Auth0({
|
|
57
|
-
// Specify auth scope, at least include 'openid email'
|
|
58
|
-
// all scopes in Auth0 ref: https://auth0.com/docs/get-started/apis/scopes/openid-connect-scopes#standard-claims
|
|
59
|
-
authorization: { params: { scope: 'openid email profile' } },
|
|
60
|
-
clientId: AUTH0_CLIENT_ID,
|
|
61
|
-
clientSecret: AUTH0_CLIENT_SECRET,
|
|
62
|
-
issuer: AUTH0_ISSUER,
|
|
63
|
-
});
|
|
64
|
-
}
|
|
65
|
-
case 'github': {
|
|
66
|
-
return Github({
|
|
67
|
-
// Specify auth scope, at least include 'openid email'
|
|
68
|
-
authorization: { params: { scope: 'read:user user:email' } },
|
|
69
|
-
clientId: GITHUB_CLIENT_ID,
|
|
70
|
-
clientSecret: GITHUB_CLIENT_SECRET,
|
|
71
|
-
});
|
|
72
|
-
}
|
|
73
|
-
case 'azure-ad': {
|
|
74
|
-
return AzureAd({
|
|
75
|
-
// Specify auth scope, at least include 'openid email'
|
|
76
|
-
// all scopes in Azure AD ref: https://learn.microsoft.com/en-us/entra/identity-platform/scopes-oidc#openid-connect-scopes
|
|
77
|
-
authorization: { params: { scope: 'openid email profile' } },
|
|
78
|
-
clientId: AZURE_AD_CLIENT_ID,
|
|
79
|
-
clientSecret: AZURE_AD_CLIENT_SECRET,
|
|
80
|
-
tenantId: AZURE_AD_TENANT_ID,
|
|
81
|
-
});
|
|
82
|
-
}
|
|
83
|
-
case 'authentik': {
|
|
84
|
-
return Authentik({
|
|
85
|
-
// Specify auth scope, at least include 'openid email'
|
|
86
|
-
// all scopes in Authentik ref: https://goauthentik.io/docs/providers/oauth2
|
|
87
|
-
authorization: { params: { scope: 'openid email profile' } },
|
|
88
|
-
clientId: AUTHENTIK_CLIENT_ID,
|
|
89
|
-
clientSecret: AUTHENTIK_CLIENT_SECRET,
|
|
90
|
-
issuer: AUTHENTIK_ISSUER,
|
|
91
|
-
});
|
|
92
|
-
}
|
|
93
|
-
default: {
|
|
94
|
-
throw new Error(`[NextAuth] provider ${provider} is not supported`);
|
|
95
|
-
}
|
|
96
|
-
}
|
|
97
|
-
})
|
|
98
|
-
: [],
|
|
40
|
+
providers: initSSOProviders(),
|
|
99
41
|
secret: NEXTAUTH_SECRET,
|
|
100
42
|
trustHost: true,
|
|
101
43
|
});
|
|
@@ -104,3 +46,10 @@ export const {
|
|
|
104
46
|
handlers: { GET, POST },
|
|
105
47
|
auth,
|
|
106
48
|
} = nextAuth;
|
|
49
|
+
|
|
50
|
+
declare module '@auth/core/jwt' {
|
|
51
|
+
// Returned by the `jwt` callback and `auth`, when using JWT sessions
|
|
52
|
+
interface JWT {
|
|
53
|
+
userId?: string;
|
|
54
|
+
}
|
|
55
|
+
}
|
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
import Auth0 from 'next-auth/providers/auth0';
|
|
2
|
+
|
|
3
|
+
import { getServerConfig } from '@/config/server';
|
|
4
|
+
|
|
5
|
+
const { AUTH0_CLIENT_ID, AUTH0_CLIENT_SECRET, AUTH0_ISSUER } = getServerConfig();
|
|
6
|
+
|
|
7
|
+
const provider = {
|
|
8
|
+
id: 'auth0',
|
|
9
|
+
provider: Auth0({
|
|
10
|
+
// Specify auth scope, at least include 'openid email'
|
|
11
|
+
// all scopes in Auth0 ref: https://auth0.com/docs/get-started/apis/scopes/openid-connect-scopes#standard-claims
|
|
12
|
+
authorization: { params: { scope: 'openid email profile' } },
|
|
13
|
+
clientId: AUTH0_CLIENT_ID,
|
|
14
|
+
clientSecret: AUTH0_CLIENT_SECRET,
|
|
15
|
+
issuer: AUTH0_ISSUER,
|
|
16
|
+
}),
|
|
17
|
+
};
|
|
18
|
+
|
|
19
|
+
export default provider;
|
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
import Authentik from 'next-auth/providers/authentik';
|
|
2
|
+
|
|
3
|
+
import { getServerConfig } from '@/config/server';
|
|
4
|
+
|
|
5
|
+
const { AUTHENTIK_CLIENT_ID, AUTHENTIK_CLIENT_SECRET, AUTHENTIK_ISSUER } = getServerConfig();
|
|
6
|
+
|
|
7
|
+
const provider = {
|
|
8
|
+
id: 'authentik',
|
|
9
|
+
provider: Authentik({
|
|
10
|
+
// Specify auth scope, at least include 'openid email'
|
|
11
|
+
// all scopes in Authentik ref: https://goauthentik.io/docs/providers/oauth2
|
|
12
|
+
authorization: { params: { scope: 'openid email profile' } },
|
|
13
|
+
clientId: AUTHENTIK_CLIENT_ID,
|
|
14
|
+
clientSecret: AUTHENTIK_CLIENT_SECRET,
|
|
15
|
+
issuer: AUTHENTIK_ISSUER,
|
|
16
|
+
}),
|
|
17
|
+
};
|
|
18
|
+
|
|
19
|
+
export default provider;
|
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
import AzureAD from 'next-auth/providers/azure-ad';
|
|
2
|
+
|
|
3
|
+
import { getServerConfig } from '@/config/server';
|
|
4
|
+
|
|
5
|
+
const { AZURE_AD_CLIENT_ID, AZURE_AD_CLIENT_SECRET, AZURE_AD_TENANT_ID } = getServerConfig();
|
|
6
|
+
|
|
7
|
+
const provider = {
|
|
8
|
+
id: 'azureAd',
|
|
9
|
+
provider: AzureAD({
|
|
10
|
+
// Specify auth scope, at least include 'openid email'
|
|
11
|
+
// all scopes in Azure AD ref: https://learn.microsoft.com/en-us/entra/identity-platform/scopes-oidc#openid-connect-scopes
|
|
12
|
+
authorization: { params: { scope: 'openid email profile' } },
|
|
13
|
+
clientId: AZURE_AD_CLIENT_ID,
|
|
14
|
+
clientSecret: AZURE_AD_CLIENT_SECRET,
|
|
15
|
+
tenantId: AZURE_AD_TENANT_ID,
|
|
16
|
+
}),
|
|
17
|
+
};
|
|
18
|
+
|
|
19
|
+
export default provider;
|
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
import GitHub from 'next-auth/providers/github';
|
|
2
|
+
|
|
3
|
+
import { getServerConfig } from '@/config/server';
|
|
4
|
+
|
|
5
|
+
const { GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET } = getServerConfig();
|
|
6
|
+
|
|
7
|
+
const provider = {
|
|
8
|
+
id: 'github',
|
|
9
|
+
provider: GitHub({
|
|
10
|
+
// Specify auth scope, at least include 'openid email'
|
|
11
|
+
authorization: { params: { scope: 'read:user user:email' } },
|
|
12
|
+
clientId: GITHUB_CLIENT_ID,
|
|
13
|
+
clientSecret: GITHUB_CLIENT_SECRET,
|
|
14
|
+
}),
|
|
15
|
+
};
|
|
16
|
+
|
|
17
|
+
export default provider;
|