@lobehub/chat 1.100.1 → 1.101.0

package/src/libs/oidc-provider/jwt.ts

@@ -41,10 +41,7 @@ export const getJWKS = (): object => {
   }
 };
 
-/**
- * 从环境变量中获取 JWKS 并提取第一个 RSA 密钥
- */
-const getJWKSPublicKey = async () => {
+const getVerificationKey = async () => {
   try {
     const jwksString = oidcEnv.OIDC_JWKS_KEY;
 
@@ -58,20 +55,32 @@ const getJWKSPublicKey = async () => {
       throw new Error('JWKS 格式无效: 缺少或为空的 keys 数组');
     }
 
-    // 查找 RS256 算法的 RSA 密钥
-    const rsaKey = jwks.keys.find((key: any) => key.alg === 'RS256' && key.kty === 'RSA');
-
-    if (!rsaKey) {
+    const privateRsaKey = jwks.keys.find((key: any) => key.alg === 'RS256' && key.kty === 'RSA');
+    if (!privateRsaKey) {
       throw new Error('JWKS 中没有找到 RS256 算法的 RSA 密钥');
     }
 
-    // 导入 JWK 为公钥
-    const publicKey = await importJWK(rsaKey, 'RS256');
+    // 创建一个只包含公钥组件的“纯净”JWK对象。
+    // RSA公钥的关键字段是 kty, n, e。其他如 kid, alg, use 也是公共的。
+    const publicKeyJwk = {
+      alg: privateRsaKey.alg,
+      e: privateRsaKey.e,
+      kid: privateRsaKey.kid,
+      kty: privateRsaKey.kty,
+      n: privateRsaKey.n,
+      use: privateRsaKey.use,
+    };
+
+    // 移除任何可能存在的 undefined 字段，保持对象干净
+    Object.keys(publicKeyJwk).forEach(
+      (key) => (publicKeyJwk as any)[key] === undefined && delete (publicKeyJwk as any)[key],
+    );
 
-    return publicKey;
+    // 现在，无论在哪个环境下，`importJWK` 都会将这个对象正确地识别为一个公钥。
+    return await importJWK(publicKeyJwk, 'RS256');
   } catch (error) {
     log('获取 JWKS 公钥失败: %O', error);
-    throw new Error(`JWKS 公钥获取失败: ${(error as Error).message}`);
+    throw new Error(`JWKS 公key获取失败: ${(error as Error).message}`);
   }
 };
 
@@ -85,7 +94,7 @@ export const validateOIDCJWT = async (token: string) => {
     log('开始验证 OIDC JWT token');
 
     // 获取公钥
-    const publicKey = await getJWKSPublicKey();
+    const publicKey = await getVerificationKey();
 
     // 验证 JWT
     const { payload } = await jwtVerify(token, publicKey, {

package/src/libs/trpc/lambda/context.ts

@@ -3,7 +3,13 @@ import debug from 'debug';
 import { User } from 'next-auth';
 import { NextRequest } from 'next/server';
 
-import { JWTPayload, LOBE_CHAT_AUTH_HEADER, enableClerk, enableNextAuth } from '@/const/auth';
+import {
+  JWTPayload,
+  LOBE_CHAT_AUTH_HEADER,
+  LOBE_CHAT_OIDC_AUTH_HEADER,
+  enableClerk,
+  enableNextAuth,
+} from '@/const/auth';
 import { oidcEnv } from '@/envs/oidc';
 import { ClerkAuth, IClerkAuth } from '@/libs/clerk-auth';
 import { validateOIDCJWT } from '@/libs/oidc-provider/jwt';
@@ -102,7 +108,7 @@ export const createLambdaContext = async (request: NextRequest): Promise<LambdaC
   if (oidcEnv.ENABLE_OIDC) {
     log('OIDC enabled, attempting OIDC authentication');
     const standardAuthorization = request.headers.get('Authorization');
-    const oidcAuthToken = request.headers.get('Oidc-Auth');
+    const oidcAuthToken = request.headers.get(LOBE_CHAT_OIDC_AUTH_HEADER);
     log('Standard Authorization header: %s', standardAuthorization ? 'exists' : 'not found');
     log('Oidc-Auth header: %s', oidcAuthToken ? 'exists' : 'not found');
 

package/src/locales/default/components.ts

@@ -73,10 +73,11 @@ export default {
   ImageUpload: {
     actions: {
       changeImage: '点击更换图片',
+      dropMultipleFiles: '不支持多上传多个文件，只会使用第一个文件',
     },
     placeholder: {
       primary: '添加图片',
-      secondary: '点击上传',
+      secondary: '点击或拖拽上传',
     },
   },
   KeyValueEditor: {
@@ -111,7 +112,7 @@ export default {
   },
   MultiImagesUpload: {
     actions: {
-      uploadMore: '点击上传更多',
+      uploadMore: '点击或拖拽上传更多',
     },
     modal: {
       complete: '完成',
@@ -121,7 +122,7 @@ export default {
       upload: '上传图片',
     },
     placeholder: {
-      primary: '点击上传图片',
+      primary: '点击或拖拽上传图片',
       secondary: '支持多张图片选择',
     },
     progress: {