@lobehub/lobehub 2.0.0-next.2 → 2.0.0-next.20

package/changelog/v1.json

@@ -1,4 +1,154 @@
 [
+  {
+    "children": {
+      "improvements": [
+        "Improve oidc layout style."
+      ]
+    },
+    "date": "2025-11-03",
+    "version": "2.0.0-next.20"
+  },
+  {
+    "children": {
+      "improvements": [
+        "Remove NEXT_PUBLIC_SERVICE_MODE env and use server by default."
+      ]
+    },
+    "date": "2025-11-03",
+    "version": "2.0.0-next.19"
+  },
+  {
+    "children": {
+      "improvements": [
+        "Improve built-in client OIDC user flow."
+      ]
+    },
+    "date": "2025-11-03",
+    "version": "2.0.0-next.18"
+  },
+  {
+    "children": {
+      "fixes": [
+        "Fix regex ReDoS."
+      ]
+    },
+    "date": "2025-11-03",
+    "version": "2.0.0-next.17"
+  },
+  {
+    "children": {
+      "improvements": [
+        "Remove deperated code."
+      ]
+    },
+    "date": "2025-11-03",
+    "version": "2.0.0-next.16"
+  },
+  {
+    "children": {},
+    "date": "2025-11-03",
+    "version": "2.0.0-next.15"
+  },
+  {
+    "children": {
+      "improvements": [
+        "Remove client service."
+      ]
+    },
+    "date": "2025-11-02",
+    "version": "2.0.0-next.14"
+  },
+  {
+    "children": {
+      "fixes": [
+        "Fix image prompt form."
+      ]
+    },
+    "date": "2025-11-02",
+    "version": "2.0.0-next.13"
+  },
+  {
+    "children": {
+      "improvements": [
+        "Add padding to TopicList component."
+      ]
+    },
+    "date": "2025-11-02",
+    "version": "2.0.0-next.12"
+  },
+  {
+    "children": {
+      "improvements": [
+        "Smoothed model descriptions in ko-KR locales."
+      ]
+    },
+    "date": "2025-11-02",
+    "version": "2.0.0-next.11"
+  },
+  {
+    "children": {},
+    "date": "2025-11-02",
+    "version": "2.0.0-next.10"
+  },
+  {
+    "children": {
+      "improvements": [
+        "Remove dalle builtin plugin."
+      ]
+    },
+    "date": "2025-11-02",
+    "version": "2.0.0-next.9"
+  },
+  {
+    "children": {
+      "improvements": [
+        "Update i18n."
+      ]
+    },
+    "date": "2025-11-02",
+    "version": "2.0.0-next.8"
+  },
+  {
+    "children": {
+      "features": [
+        "Upgrade to Next 16."
+      ]
+    },
+    "date": "2025-11-01",
+    "version": "2.0.0-next.7"
+  },
+  {
+    "children": {},
+    "date": "2025-10-31",
+    "version": "2.0.0-next.6"
+  },
+  {
+    "children": {
+      "improvements": [
+        "Migrating Firecrawl to v2."
+      ]
+    },
+    "date": "2025-10-31",
+    "version": "2.0.0-next.5"
+  },
+  {
+    "children": {
+      "improvements": [
+        "Update i18n."
+      ]
+    },
+    "date": "2025-10-31",
+    "version": "2.0.0-next.4"
+  },
+  {
+    "children": {
+      "improvements": [
+        "Add new bedrock model support, add pricing info for Azure GPT-5 series models."
+      ]
+    },
+    "date": "2025-10-30",
+    "version": "2.0.0-next.3"
+  },
   {
     "children": {
       "fixes": [

package/docs/development/database-schema.dbml

@@ -41,6 +41,7 @@ table agents_files {
 
   indexes {
     (file_id, agent_id, user_id) [pk]
+    agent_id [name: 'agents_files_agent_id_idx']
   }
 }
 
@@ -334,6 +335,7 @@ table message_groups {
 
   indexes {
     (client_id, user_id) [name: 'message_groups_client_id_user_id_unique', unique]
+    topic_id [name: 'message_groups_topic_id_idx']
   }
 }
 
@@ -444,6 +446,7 @@ table messages {
     user_id [name: 'messages_user_id_idx']
     session_id [name: 'messages_session_id_idx']
     thread_id [name: 'messages_thread_id_idx']
+    agent_id [name: 'messages_agent_id_idx']
   }
 }
 
@@ -805,6 +808,8 @@ table agents_to_sessions {
 
   indexes {
     (agent_id, session_id) [pk]
+    session_id [name: 'agents_to_sessions_session_id_idx']
+    agent_id [name: 'agents_to_sessions_agent_id_idx']
   }
 }
 
@@ -865,6 +870,8 @@ table sessions {
     (client_id, user_id) [name: 'sessions_client_id_user_id_unique', unique]
     user_id [name: 'sessions_user_id_idx']
     (id, user_id) [name: 'sessions_id_user_id_idx']
+    (user_id, updated_at) [name: 'sessions_user_id_updated_at_idx']
+    group_id [name: 'sessions_group_id_idx']
   }
 }
 
@@ -885,6 +892,7 @@ table threads {
 
   indexes {
     (client_id, user_id) [name: 'threads_client_id_user_id_unique', unique]
+    topic_id [name: 'threads_topic_id_idx']
   }
 }
 
@@ -917,6 +925,8 @@ table topics {
     (client_id, user_id) [name: 'topics_client_id_user_id_unique', unique]
     user_id [name: 'topics_user_id_idx']
     (id, user_id) [name: 'topics_id_user_id_idx']
+    session_id [name: 'topics_session_id_idx']
+    group_id [name: 'topics_group_id_idx']
   }
 }
 
@@ -1166,4 +1176,4 @@ ref: topic_documents.document_id > documents.id
 
 ref: topic_documents.topic_id > topics.id
 
-ref: topics.session_id - sessions.id
+ref: topics.session_id - sessions.id

package/docs/self-hosting/advanced/auth/next-auth/auth0.mdx

@@ -55,12 +55,12 @@ tags:
 
   | Environment Variable      | Type     | Description                                                                                                                                                                                         |
   | ------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-  | `NEXT_AUTH_SECRET`        | Required | Key used to encrypt Auth.js session tokens. You can generate a key using the following command: `openssl rand -base64 32`                                                                           |
+  | `AUTH_SECRET`             | Required | Key used to encrypt Auth.js session tokens. You can generate a key using the following command: `openssl rand -base64 32`                                                                           |
   | `NEXT_AUTH_SSO_PROVIDERS` | Required | Select the single sign-on provider for LoboChat. Use `auth0` for Auth0.                                                                                                                             |
   | `AUTH_AUTH0_ID`           | Required | Client ID of the Auth0 application                                                                                                                                                                  |
   | `AUTH_AUTH0_SECRET`       | Required | Client Secret of the Auth0 application                                                                                                                                                              |
   | `AUTH_AUTH0_ISSUER`       | Required | Domain of the Auth0 application, `https://example.auth0.com`                                                                                                                                        |
-  | `NEXTAUTH_URL`            | Required | The URL is used to specify the callback address for the execution of OAuth authentication in Auth.js. It needs to be set only when the default address is incorrect. `https://example.com/api/auth` |
+  | `AUTH_URL`                | Required | The URL is used to specify the callback address for the execution of OAuth authentication in Auth.js. It needs to be set only when the default address is incorrect. `https://example.com/api/auth` |
 
   <Callout type={'tip'}>
     You can refer to the related variable details at [📘Environment Variables](/docs/self-hosting/environment-variable#auth0).

package/docs/self-hosting/advanced/auth/next-auth/auth0.zh-CN.mdx

@@ -51,12 +51,12 @@ tags:
 
   | 环境变量                      | 类型 | 描述                                                                                          |
   | ------------------------- | -- | ------------------------------------------------------------------------------------------- |
-  | `NEXT_AUTH_SECRET`        | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`                               |
+  | `AUTH_SECRET`             | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`                               |
   | `NEXT_AUTH_SSO_PROVIDERS` | 必选 | 选择 LoboChat 的单点登录提供商。使用 Auth0 请填写 `auth0`。                                                  |
   | `AUTH_AUTH0_ID`           | 必选 | Auth0 应用程序的 Client ID                                                                       |
   | `AUTH_AUTH0_SECRET`       | 必选 | Auth0 应用程序的 Client Secret                                                                   |
   | `AUTH_AUTH0_ISSUER`       | 必选 | Auth0 应用程序的 Domain，`https://example.auth0.com`                                              |
-  | `NEXTAUTH_URL`            | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://example.com/api/auth` |
+  | `AUTH_URL`                | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://example.com/api/auth` |
 
   <Callout type={'tip'}>
     前往 [📘 环境变量](/zh/docs/self-hosting/environment-variables/auth#auth-0) 可查阅相关变量详情。

package/docs/self-hosting/advanced/auth/next-auth/authelia.mdx

@@ -54,12 +54,12 @@ tags:
 
   | Environment Variable      | Type     | Description                                                                                                                                                                                                                                               |
   | ------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-  | `NEXT_AUTH_SECRET`        | Required | The secret used to encrypt Auth.js session tokens. You can generate a secret using the following command: `openssl rand -base64 32`                                                                                                                       |
+  | `AUTH_SECRET`             | Required | The secret used to encrypt Auth.js session tokens. You can generate a secret using the following command: `openssl rand -base64 32`                                                                                                                       |
   | `NEXT_AUTH_SSO_PROVIDERS` | Required | Select the SSO provider for LoboChat. Use `authentik` for Authentik.                                                                                                                                                                                      |
   | `AUTH_AUTHELIA_ID`        | Required | The id just configured in Authelia, example value is lobe-chat                                                                                                                                                                                            |
   | `AUTH_AUTHELIA_SECRET`    | Required | The plaintext corresponding to the secret just configured in Authelia, example value is `insecure_secret`                                                                                                                                                 |
   | `AUTH_AUTHELIA_ISSUER`    | Required | Your Authelia URL, for example [https://sso.example.com](https://sso.example.com)                                                                                                                                                                         |
-  | `NEXTAUTH_URL`            | Required | This URL is used to specify the callback address for Auth.js when performing OAuth verification. It only needs to be set when the default generated redirect address is incorrect. [https://chat.example.com/api/auth](https://chat.example.com/api/auth) |
+  | `AUTH_URL`                | Required | This URL is used to specify the callback address for Auth.js when performing OAuth verification. It only needs to be set when the default generated redirect address is incorrect. [https://chat.example.com/api/auth](https://chat.example.com/api/auth) |
 
   <Callout type={'tip'}>
     Go to  [📘 Environment Variables](/docs/self-hosting/environment-variable#Authelia) for details about the variables.

package/docs/self-hosting/advanced/auth/next-auth/authelia.zh-CN.mdx

@@ -53,12 +53,12 @@ tags:
 
   | 环境变量                      | 类型 | 描述                                                                                               |
   | ------------------------- | -- | ------------------------------------------------------------------------------------------------ |
-  | `NEXT_AUTH_SECRET`        | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`                                    |
+  | `AUTH_SECRET`             | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`                                    |
   | `NEXT_AUTH_SSO_PROVIDERS` | 必选 | 选择 LoboChat 的单点登录提供商。使用 Authelia 请填写 `authelia`。                                                 |
   | `AUTH_AUTHELIA_ID`        | 必选 | 刚刚在 Authelia 配置的 `id`，示例值是 `lobe-chat`                                                           |
   | `AUTH_AUTHELIA_SECRET`    | 必选 | 刚刚在 Authelia 配置的 `secret` 对应的明文，示例值是 `insecure_secret`                                           |
   | `AUTH_AUTHELIA_ISSUER`    | 必选 | 您的 Authelia 的网址，例如 `https://sso.example.com`                                                     |
-  | `NEXTAUTH_URL`            | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://chat.example.com/api/auth` |
+  | `AUTH_URL`                | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://chat.example.com/api/auth` |
 
   <Callout type={'tip'}>
     前往 [📘 环境变量](/zh/docs/self-hosting/environment-variable#Authelia) 可查阅相关变量详情。

package/docs/self-hosting/advanced/auth/next-auth/authentik.mdx

@@ -49,12 +49,12 @@ tags:
 
   | Environment Variable      | Type     | Description                                                                                                                                                                                                         |
   | ------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-  | `NEXT_AUTH_SECRET`        | Required | The secret used to encrypt Auth.js session tokens. You can generate a secret using the following command: `openssl rand -base64 32`                                                                                 |
+  | `AUTH_SECRET`             | Required | The secret used to encrypt Auth.js session tokens. You can generate a secret using the following command: `openssl rand -base64 32`                                                                                 |
   | `NEXT_AUTH_SSO_PROVIDERS` | Required | Select the SSO provider for LoboChat. Use `authentik` for Authentik.                                                                                                                                                |
   | `AUTH_AUTHENTIK_ID`       | Required | The Client ID from the Authentik application provider details page                                                                                                                                                  |
   | `AUTH_AUTHENTIK_SECRET`   | Required | The Client Secret from the Authentik application provider details page                                                                                                                                              |
   | `AUTH_AUTHENTIK_ISSUER`   | Required | The OpenID Configuration Issuer from the Authentik application provider details page                                                                                                                                |
-  | `NEXTAUTH_URL`            | Required | This URL is used to specify the callback address for Auth.js when performing OAuth authentication. It only needs to be set when the default generated redirect address is incorrect. `https://example.com/api/auth` |
+  | `AUTH_URL`                | Required | This URL is used to specify the callback address for Auth.js when performing OAuth authentication. It only needs to be set when the default generated redirect address is incorrect. `https://example.com/api/auth` |
 
   <Callout type={'tip'}>
     Go to  [📘 Environment Variables](/docs/self-hosting/environment-variable#Authentik) for details about the variables.

package/docs/self-hosting/advanced/auth/next-auth/authentik.zh-CN.mdx

@@ -45,12 +45,12 @@ tags:
 
   | 环境变量                      | 类型 | 描述                                                                                          |
   | ------------------------- | -- | ------------------------------------------------------------------------------------------- |
-  | `NEXT_AUTH_SECRET`        | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`                               |
+  | `AUTH_SECRET`             | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`                               |
   | `NEXT_AUTH_SSO_PROVIDERS` | 必选 | 选择 LoboChat 的单点登录提供商。使用 Authentik 请填写 `authentik`。                                          |
   | `AUTH_AUTHENTIK_ID`       | 必选 | Authentik 提供程序详情页的 客户端 ID                                                                   |
   | `AUTH_AUTHENTIK_SECRET`   | 必选 | Authentik 提供程序详情页的 客户端 Secret                                                               |
   | `AUTH_AUTHENTIK_ISSUER`   | 必选 | Authentik 提供程序详情页的 OpenID 配置颁发者                                                             |
-  | `NEXTAUTH_URL`            | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://example.com/api/auth` |
+  | `AUTH_URL`                | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://example.com/api/auth` |
 
   <Callout type={'tip'}>
     前往 [📘 环境变量](/zh/docs/self-hosting/environment-variable#Authentik) 可查阅相关变量详情。

package/docs/self-hosting/advanced/auth/next-auth/casdoor.mdx

@@ -134,12 +134,12 @@ If you are deploying using a public network, the following assumptions apply:
 
   | Environment Variable      | Type     | Description                                                                                                                                                                                        |
   | ------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-  | `NEXT_AUTH_SECRET`        | Required | A key for encrypting Auth.js session tokens. You can generate a key using the command: `openssl rand -base64 32`.                                                                                  |
+  | `AUTH_SECRET`             | Required | A key for encrypting Auth.js session tokens. You can generate a key using the command: `openssl rand -base64 32`.                                                                                  |
   | `NEXT_AUTH_SSO_PROVIDERS` | Required | Select the single sign-on provider for LobeChat. Fill in `casdoor` for using Casdoor.                                                                                                              |
   | `AUTH_CASDOOR_ID`         | Required | The client ID from the Casdoor application details page.                                                                                                                                           |
   | `AUTH_CASDOOR_SECRET`     | Required | The client secret from the Casdoor application details page.                                                                                                                                       |
   | `AUTH_CASDOOR_ISSUER`     | Required | The OpenID Connect issuer for the Casdoor provider.                                                                                                                                                |
-  | `NEXTAUTH_URL`            | Required | This URL specifies the callback address for Auth.js during OAuth verification and needs to be set only if the default generated redirect address is incorrect. `https://lobe.example.com/api/auth` |
+  | `AUTH_URL`                | Required | This URL specifies the callback address for Auth.js during OAuth verification and needs to be set only if the default generated redirect address is incorrect. `https://lobe.example.com/api/auth` |
   | `CASDOOR_WEBHOOK_SECRET`  | Optional | A key used to verify whether the request sent by Casdoor is legal.                                                                                                                                 |
 
   <Callout type={'tip'}>

package/docs/self-hosting/advanced/auth/next-auth/casdoor.zh-CN.mdx

@@ -133,12 +133,12 @@ tags:
 
   | 环境变量                      | 类型 | 描述                                                                                               |
   | ------------------------- | -- | ------------------------------------------------------------------------------------------------ |
-  | `NEXT_AUTH_SECRET`        | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`                                    |
+  | `AUTH_SECRET`             | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`                                    |
   | `NEXT_AUTH_SSO_PROVIDERS` | 必选 | 选择 LoboChat 的单点登录提供商。使用 Casdoor 请填写 `casdoor`。                                                   |
   | `AUTH_CASDOOR_ID`         | 必选 | Casdoor 应用详情页的客户端 ID                                                                             |
   | `AUTH_CASDOOR_SECRET`     | 必选 | Casdoor 应用详情页的客户端密钥                                                                              |
   | `AUTH_CASDOOR_ISSUER`     | 必选 | Casdoor 提供程序的 OpenID Connect 颁发者。                                                                |
-  | `NEXTAUTH_URL`            | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://lobe.example.com/api/auth` |
+  | `AUTH_URL`                | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://lobe.example.com/api/auth` |
   | `CASDOOR_WEBHOOK_SECRET`  | 可选 | 用于验证 Casdoor 发送的 Webhook 请求是否合法的密钥。                                                              |
 
   <Callout type={'tip'}>

package/docs/self-hosting/advanced/auth/next-auth/cloudflare-zero-trust.mdx

@@ -48,12 +48,12 @@ tags:
 
   | Environment Variable                | Type     | Description                                                                                                                                                                                                         |
   | ----------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-  | `NEXT_AUTH_SECRET`                  | Required | The secret used to encrypt Auth.js session tokens. You can generate a secret using the following command: `openssl rand -base64 32`                                                                                 |
+  | `AUTH_SECRET`                       | Required | The secret used to encrypt Auth.js session tokens. You can generate a secret using the following command: `openssl rand -base64 32`                                                                                 |
   | `NEXT_AUTH_SSO_PROVIDERS`           | Required | Select the SSO provider for LoboChat. Use `cloudflare-zero-trust` for Cloudflare Zero Trust.                                                                                                                        |
   | `AUTH_CLOUDFLARE_ZERO_TRUST_ID`     | Required | The Client ID from the Cloudflare Zero Trust application provider details page                                                                                                                                      |
   | `AUTH_CLOUDFLARE_ZERO_TRUST_SECRET` | Required | The Client Secret from the Cloudflare Zero Trust application provider details page                                                                                                                                  |
   | `AUTH_CLOUDFLARE_ZERO_TRUST_ISSUER` | Required | The OpenID Configuration Issuer from the Cloudflare Zero Trust application provider details page                                                                                                                    |
-  | `NEXTAUTH_URL`                      | Required | This URL is used to specify the callback address for Auth.js when performing OAuth authentication. It only needs to be set when the default generated redirect address is incorrect. `https://example.com/api/auth` |
+  | `AUTH_URL`                          | Required | This URL is used to specify the callback address for Auth.js when performing OAuth authentication. It only needs to be set when the default generated redirect address is incorrect. `https://example.com/api/auth` |
 
   <Callout type={'tip'}>
     Go to  [📘 Environment Variables](/docs/self-hosting/environment-variable#Cloudflare%20Zero%20Trust) for details about the variables.

package/docs/self-hosting/advanced/auth/next-auth/cloudflare-zero-trust.zh-CN.mdx

@@ -46,12 +46,12 @@ tags:
 
   | 环境变量                                | 类型 | 描述                                                                                                           |
   | ----------------------------------- | -- | ------------------------------------------------------------------------------------------------------------ |
-  | `NEXT_AUTH_SECRET`                  | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`                                                |
+  | `AUTH_SECRET`                       | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`                                                |
   | `NEXT_AUTH_SSO_PROVIDERS`           | 必选 | 选择 LoboChat 的单点登录提供商。使用 Cloudflare Zero Trust 请填写 `cloudflare-zero-trust`。                                   |
   | `AUTH_CLOUDFLARE_ZERO_TRUST_ID`     | 必选 | 在 Cloudflare Zero Trust 生成的 `Client ID`，示例值是 `lobe-chat`                                                     |
   | `AUTH_CLOUDFLARE_ZERO_TRUST_SECRET` | 必选 | 在 Cloudflare Zero Trust 生成的 `Client secret`，示例值是 `insecure_secret`                                           |
   | `AUTH_CLOUDFLARE_ZERO_TRUST_ISSUER` | 必选 | 在 Cloudflare Zero Trust 生成的 `Issuer`，例如 `https://example.cloudflareaccess.com/cdn-cgi/access/sso/oidc/7db0f` |
-  | `NEXTAUTH_URL`                      | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://chat.example.com/api/auth`             |
+  | `AUTH_URL`                          | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://chat.example.com/api/auth`             |
 
   <Callout type={'tip'}>
     前往 [📘 环境变量](/zh/docs/self-hosting/environment-variable#Cloudflare%20Zero%20Trust) 可查阅相关变量详情。

package/docs/self-hosting/advanced/auth/next-auth/github.mdx

@@ -54,11 +54,11 @@ tags:
 
   | Environment Variable      | Type     | Description                                                                                                                                                                                           |
   | ------------------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-  | `NEXT_AUTH_SECRET`        | Required | Key used to encrypt Auth.js session tokens. You can generate the key using the command: `openssl rand -base64 32`                                                                                     |
+  | `AUTH_SECRET`             | Required | Key used to encrypt Auth.js session tokens. You can generate the key using the command: `openssl rand -base64 32`                                                                                     |
   | `NEXT_AUTH_SSO_PROVIDERS` | Required | Select the Single Sign-On provider for LobeChat. Use `github` for Github.                                                                                                                             |
   | `AUTH_GITHUB_ID`          | Required | Client ID in the Github App details page.                                                                                                                                                             |
   | `AUTH_GITHUB_SECRET`      | Required | Client Secret in the Github App details page.                                                                                                                                                         |
-  | `NEXTAUTH_URL`            | Required | This URL is used to specify the callback address for Auth.js when performing OAuth authentication. Only set it if the default generated redirect address is incorrect. `https://example.com/api/auth` |
+  | `AUTH_URL`                | Required | This URL is used to specify the callback address for Auth.js when performing OAuth authentication. Only set it if the default generated redirect address is incorrect. `https://example.com/api/auth` |
 
   <Callout type={'tip'}>
     Go to [📘 Environment Variables](/docs/self-hosting/environment-variables/auth#github) for detailed

package/docs/self-hosting/advanced/auth/next-auth/github.zh-CN.mdx

@@ -52,11 +52,11 @@ tags:
 
   | 环境变量                      | 类型 | 描述                                                                                          |
   | ------------------------- | -- | ------------------------------------------------------------------------------------------- |
-  | `NEXT_AUTH_SECRET`        | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`                               |
+  | `AUTH_SECRET`             | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`                               |
   | `NEXT_AUTH_SSO_PROVIDERS` | 必选 | 选择 LoboChat 的单点登录提供商。使用 Github 请填写 `github`。                                                |
   | `AUTH_GITHUB_ID`          | 必选 | Github App 详情页的 客户端 ID                                                                      |
   | `AUTH_GITHUB_SECRET`      | 必选 | Github App 详情页的 客户端 Secret                                                                  |
-  | `NEXTAUTH_URL`            | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://example.com/api/auth` |
+  | `AUTH_URL`                | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://example.com/api/auth` |
 
   <Callout type={'tip'}>
     前往 [📘 环境变量](/zh/docs/self-hosting/environment-variables/auth#github) 可查阅相关变量详情。

package/docs/self-hosting/advanced/auth/next-auth/google.mdx

@@ -21,49 +21,52 @@ tags:
 <Steps>
   ### Create a Google Cloud OAuth 2.0 Client
 
-In your [Google Cloud Console][google-cloud-console], navigate to **APIs & Services > Credentials**.
+  In your [Google Cloud Console][google-cloud-console], navigate to **APIs & Services > Credentials**.
 
-Click on **Create Credentials** and select **OAuth client ID**.
+  Click on **Create Credentials** and select **OAuth client ID**.
 
-If you haven't already set up a consent screen, you will be prompted to do so. Complete the OAuth consent screen setup (specify app name, support email, and add authorized users if needed).
+  If you haven't already set up a consent screen, you will be prompted to do so. Complete the OAuth consent screen setup (specify app name, support email, and add authorized users if needed).
 
-Select **Web application** as the application type.
+  Select **Web application** as the application type.
 
-In the **Authorized redirect URIs** section, enter:
+  In the **Authorized redirect URIs** section, enter:
 
-```bash
-https://your-domain/api/auth/callback/google
-```
+  ```bash
+  https://your-domain/api/auth/callback/google
+  ```
 
-\<Callout type={'info'}>
-\- You can add or modify redirect URIs after registration, but make sure the URL matches your deployed LobeChat instance.
-\- Replace "your-domain" with your actual domain. </Callout>
+  <Callout type={'info'}>
+    \- You can add or modify redirect URIs after registration, but make sure the URL matches your deployed LobeChat instance.
+    \- Replace "your-domain" with your actual domain.
+  </Callout>
 
-Click **Create**.
+  Click **Create**.
 
-After creation, copy the **Client ID** and **Client Secret**.
+  After creation, copy the **Client ID** and **Client Secret**.
 
   <Image alt="Google OAuth Setup" inStep src="https://developers.google.com/static/identity/images/gsi/web/gcs-signin-2.png" />
 
-### Add Users (Optional for Internal Use Only)
+  ### Add Users (Optional for Internal Use Only)
 
-If your application is in **Testing** or **Internal** publishing status, add user emails in the OAuth consent screen under **Test users**.
-Users not added here will not be able to authenticate.
+  If your application is in **Testing** or **Internal** publishing status, add user emails in the OAuth consent screen under **Test users**.
+  Users not added here will not be able to authenticate.
 
-### Configure Environment Variables
+  ### Configure Environment Variables
 
-When deploying LobeChat, configure the following environment variables:
+  When deploying LobeChat, configure the following environment variables:
 
-| Environment Variable      | Type     | Description                                                                                                          |
-| ------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------- |
-| `NEXT_AUTH_SECRET`        | Required | Key to encrypt Auth.js session tokens. Generate using: `openssl rand -base64 32`                                     |
-| `NEXT_AUTH_SSO_PROVIDERS` | Required | Select the single sign-on provider for LobeChat. Use `google` for Google SSO.                                        |
-| `AUTH_GOOGLE_ID`          | Required | Client ID from Google Cloud OAuth.                                                                                   |
-| `AUTH_GOOGLE_SECRET`      | Required | Client Secret from Google Cloud OAuth.                                                                               |
-| `NEXTAUTH_URL`            | Required | Specifies the callback address for Auth.js when performing OAuth authentication. E.g. `https://your-domain/api/auth` |
+  | Environment Variable      | Type     | Description                                                                                                          |
+  | ------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------- |
+  | `NEXT_AUTH_SECRET`        | Required | Key to encrypt Auth.js session tokens. Generate using: `openssl rand -base64 32`                                     |
+  | `NEXT_AUTH_SSO_PROVIDERS` | Required | Select the single sign-on provider for LobeChat. Use `google` for Google SSO.                                        |
+  | `AUTH_GOOGLE_ID`          | Required | Client ID from Google Cloud OAuth.                                                                                   |
+  | `AUTH_GOOGLE_SECRET`      | Required | Client Secret from Google Cloud OAuth.                                                                               |
+  | `AUTH_URL`                | Required | Specifies the callback address for Auth.js when performing OAuth authentication. E.g. `https://your-domain/api/auth` |
 
-\<Callout type={'tip'}>
-See [📘 environment variables](/docs/self-hosting/environment-variable#google) for more details on these variables. </Callout> </Steps>
+  <Callout type={'tip'}>
+    See [📘 environment variables](/docs/self-hosting/environment-variable#google) for more details on these variables.
+  </Callout>
+</Steps>
 
 <Callout>
   After successful deployment, users can sign in to LobeChat using their Google accounts (those added as Test Users, if not in production).
@@ -75,8 +78,8 @@ See the [Google Identity Platform Documentation][google-identity-docs] for advan
 
 ## Related Resources
 
-* [Quickstart: Configure a Google OAuth client][google-oauth-quickstart]
+- [Quickstart: Configure a Google OAuth client][google-oauth-quickstart]
 
 [google-cloud-console]: https://console.cloud.google.com/apis/credentials
-[google-oauth-quickstart]: https://developers.google.com/identity/protocols/oauth2/web-server#creatingcred
 [google-identity-docs]: https://developers.google.com/identity
+[google-oauth-quickstart]: https://developers.google.com/identity/protocols/oauth2/web-server#creatingcred

package/docs/self-hosting/advanced/auth/next-auth/keycloak.mdx

@@ -108,12 +108,12 @@ If you deploy using a public network, this guide assumes:
 
   | Environment Variable      | Type     | Description                                                                                                                                                                              |
   | ------------------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-  | `NEXT_AUTH_SECRET`        | Required | Key used to encrypt Auth.js session tokens. You can generate a key using: `openssl rand -base64 32`                                                                                      |
+  | `AUTH_SECRET`             | Required | Key used to encrypt Auth.js session tokens. You can generate a key using: `openssl rand -base64 32`                                                                                      |
   | `NEXT_AUTH_SSO_PROVIDERS` | Required | Select the single sign-on provider for LobeChat. For Keycloak, fill in `keycloak`.                                                                                                       |
   | `AUTH_KEYCLOAK_ID`        | Required | Keycloak client ID                                                                                                                                                                       |
   | `AUTH_KEYCLOAK_SECRET`    | Required | Keycloak client secret                                                                                                                                                                   |
   | `AUTH_KEYCLOAK_ISSUER`    | Required | OpenID Connect issuer URL for the Keycloak provider, in the format `{keycloak_url}/realms/{realm_name}`                                                                                  |
-  | `NEXTAUTH_URL`            | Required | This URL specifies the callback address for Auth.js during OAuth verification. Only needed when the default generated redirect address is incorrect. `https://lobe.example.com/api/auth` |
+  | `AUTH_URL`                | Required | This URL specifies the callback address for Auth.js during OAuth verification. Only needed when the default generated redirect address is incorrect. `https://lobe.example.com/api/auth` |
 
   <Callout type={'tip'}>
     Visit [📘 Environment Variables](/zh/docs/self-hosting/environment-variables/auth#keycloak) for details on related variables.

package/docs/self-hosting/advanced/auth/next-auth/keycloak.zh-CN.mdx

@@ -105,12 +105,12 @@ tags:
 
   | 环境变量                      | 类型 | 描述                                                                                               |
   | ------------------------- | -- | ------------------------------------------------------------------------------------------------ |
-  | `NEXT_AUTH_SECRET`        | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`                                    |
+  | `AUTH_SECRET`             | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`                                    |
   | `NEXT_AUTH_SSO_PROVIDERS` | 必选 | 选择 LoboChat 的单点登录提供商。使用 Keycloak 请填写 `keycloak`。                                                 |
   | `AUTH_KEYCLOAK_ID`        | 必选 | Keycloak 客户端 ID                                                                                  |
   | `AUTH_KEYCLOAK_SECRET`    | 必选 | Keycloak 客户端密钥                                                                                   |
   | `AUTH_KEYCLOAK_ISSUER`    | 必选 | Keycloak 提供程序的 OpenID Connect 颁发者 URL，格式为 `{keycloak_url}/realms/{realm_name}`                   |
-  | `NEXTAUTH_URL`            | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://lobe.example.com/api/auth` |
+  | `AUTH_URL`                | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://lobe.example.com/api/auth` |
 
   <Callout type={'tip'}>
     前往 [📘 环境变量](/zh/docs/self-hosting/environment-variables/auth#keycloak) 可查阅相关变量详情。

package/docs/self-hosting/advanced/auth/next-auth/logto.mdx

@@ -50,7 +50,9 @@ If you are using Logto Cloud, assume its endpoint domain is `https://example.log
   Go to `Webhooks`, create a Webhook, and fill in the following fields:
 
   - Endpoint URL: `https://lobe.example.com/api/webhooks/logto`
-  - Events: `User.Data.Updated`
+  - Events:
+    - `User.Data.Updated`: Allow LobeChat to synchronize user profile information updates from Logto.
+    - `User.SuspensionStatus.Updated`: Allow LobeChat to remove the active session from suspended users from logging in, only available when database session strategy is `database`.
 
   After successful creation, copy the Webhook's `Signing Key` and fill it in the `LOGTO_WEBHOOK_SIGNING_KEY` environment variable.
 
@@ -69,12 +71,12 @@ If you are using Logto Cloud, assume its endpoint domain is `https://example.log
 
   | Environment Variable        | Type     | Description                                                                                                                                                                            |
   | --------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-  | `NEXT_AUTH_SECRET`          | Required | The key used to encrypt Auth.js session tokens. You can generate a key using the command: `openssl rand -base64 32`                                                                    |
+  | `AUTH_SECRET`               | Required | The key used to encrypt Auth.js session tokens. You can generate a key using the command: `openssl rand -base64 32`                                                                    |
   | `NEXT_AUTH_SSO_PROVIDERS`   | Required | Select the single sign-on provider for LobeChat. For Logto, enter `logto`.                                                                                                             |
   | `AUTH_LOGTO_ID`             | Required | The Client ID from the Logto App details page                                                                                                                                          |
   | `AUTH_LOGTO_SECRET`         | Required | The Client Secret from the Logto App details page                                                                                                                                      |
   | `AUTH_LOGTO_ISSUER`         | Required | OpenID Connect issuer of the Logto provider                                                                                                                                            |
-  | `NEXTAUTH_URL`              | Required | This URL specifies the callback address for Auth.js during OAuth verification, needed only if the default generated redirect address is incorrect. `https://lobe.example.com/api/auth` |
+  | `AUTH_URL`                  | Required | This URL specifies the callback address for Auth.js during OAuth verification, needed only if the default generated redirect address is incorrect. `https://lobe.example.com/api/auth` |
   | `LOGTO_WEBHOOK_SIGNING_KEY` | Optional | The key used to verify the legality of Webhook requests sent by Logto.                                                                                                                 |
 
   <Callout type={'tip'}>

package/docs/self-hosting/advanced/auth/next-auth/logto.zh-CN.mdx

@@ -47,7 +47,9 @@ tags:
   前往 `Webhooks` ，创建一个 Webhook，填写以下字段：
 
   - 端点 URL： `https://lobe.example.com/api/webhooks/logto`
-  - 事件： `User.Data.Updated`
+  - 事件：
+    - `User.Data.Updated`: 允许 LobeChat 同步 Logto 中用户资料信息的更新。
+    - `User.SuspensionStatus.Updated`: 允许 LobeChat 将被暂停的用户移除登录会话，仅在数据库会话策略为 `database` 时可用。
 
   创建成功后，复制 Webhook 的 `签名密钥`。填写到环境变量中的 `LOGTO_WEBHOOK_SIGNING_KEY`。
 
@@ -66,12 +68,12 @@ tags:
 
   | 环境变量                        | 类型 | 描述                                                                                               |
   | --------------------------- | -- | ------------------------------------------------------------------------------------------------ |
-  | `NEXT_AUTH_SECRET`          | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`                                    |
+  | `AUTH_SECRET`               | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`                                    |
   | `NEXT_AUTH_SSO_PROVIDERS`   | 必选 | 选择 LoboChat 的单点登录提供商。使用 Logto 请填写 `logto`。                                                       |
   | `AUTH_LOGTO_ID`             | 必选 | Logto App 详情页的 Client ID                                                                         |
   | `AUTH_LOGTO_SECRET`         | 必选 | Logto App 详情页的 Client Secret                                                                     |
   | `AUTH_LOGTO_ISSUER`         | 必选 | Logto 提供程序的 OpenID Connect 颁发者                                                                   |
-  | `NEXTAUTH_URL`              | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://lobe.example.com/api/auth` |
+  | `AUTH_URL`                  | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://lobe.example.com/api/auth` |
   | `LOGTO_WEBHOOK_SIGNING_KEY` | 可选 | 用于验证 Logto 发送的 Webhook 请求是否合法的密钥。                                                                |
 
   <Callout type={'tip'}>