npm - @lobehub/lobehub - Versions diffs - 2.0.0-next.5 → 2.0.0-next.51 - Mend

@lobehub/lobehub 2.0.0-next.5 → 2.0.0-next.51

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1468) hide show

package/docs/self-hosting/advanced/auth/next-auth/google.mdx CHANGED Viewed

@@ -21,49 +21,52 @@ tags:
 <Steps>
   ### Create a Google Cloud OAuth 2.0 Client
-In your [Google Cloud Console][google-cloud-console], navigate to **APIs & Services > Credentials**.
+  In your [Google Cloud Console][google-cloud-console], navigate to **APIs & Services > Credentials**.
-Click on **Create Credentials** and select **OAuth client ID**.
+  Click on **Create Credentials** and select **OAuth client ID**.
-If you haven't already set up a consent screen, you will be prompted to do so. Complete the OAuth consent screen setup (specify app name, support email, and add authorized users if needed).
+  If you haven't already set up a consent screen, you will be prompted to do so. Complete the OAuth consent screen setup (specify app name, support email, and add authorized users if needed).
-Select **Web application** as the application type.
+  Select **Web application** as the application type.
-In the **Authorized redirect URIs** section, enter:
+  In the **Authorized redirect URIs** section, enter:
-```bash
-https://your-domain/api/auth/callback/google
-```
+  ```bash
+  https://your-domain/api/auth/callback/google
+  ```
-\<Callout type={'info'}>
-\- You can add or modify redirect URIs after registration, but make sure the URL matches your deployed LobeChat instance.
-\- Replace "your-domain" with your actual domain. </Callout>
+  <Callout type={'info'}>
+    \- You can add or modify redirect URIs after registration, but make sure the URL matches your deployed LobeChat instance.
+    \- Replace "your-domain" with your actual domain.
+  </Callout>
-Click **Create**.
+  Click **Create**.
-After creation, copy the **Client ID** and **Client Secret**.
+  After creation, copy the **Client ID** and **Client Secret**.
   <Image alt="Google OAuth Setup" inStep src="https://developers.google.com/static/identity/images/gsi/web/gcs-signin-2.png" />
-### Add Users (Optional for Internal Use Only)
+  ### Add Users (Optional for Internal Use Only)
-If your application is in **Testing** or **Internal** publishing status, add user emails in the OAuth consent screen under **Test users**.
-Users not added here will not be able to authenticate.
+  If your application is in **Testing** or **Internal** publishing status, add user emails in the OAuth consent screen under **Test users**.
+  Users not added here will not be able to authenticate.
-### Configure Environment Variables
+  ### Configure Environment Variables
-When deploying LobeChat, configure the following environment variables:
+  When deploying LobeChat, configure the following environment variables:
-| Environment Variable      | Type     | Description                                                                                                          |
-| ------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------- |
-| `NEXT_AUTH_SECRET`        | Required | Key to encrypt Auth.js session tokens. Generate using: `openssl rand -base64 32`                                     |
-| `NEXT_AUTH_SSO_PROVIDERS` | Required | Select the single sign-on provider for LobeChat. Use `google` for Google SSO.                                        |
-| `AUTH_GOOGLE_ID`          | Required | Client ID from Google Cloud OAuth.                                                                                   |
-| `AUTH_GOOGLE_SECRET`      | Required | Client Secret from Google Cloud OAuth.                                                                               |
-| `NEXTAUTH_URL`            | Required | Specifies the callback address for Auth.js when performing OAuth authentication. E.g. `https://your-domain/api/auth` |
+  | Environment Variable      | Type     | Description                                                                                                          |
+  | ------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------- |
+  | `NEXT_AUTH_SECRET`        | Required | Key to encrypt Auth.js session tokens. Generate using: `openssl rand -base64 32`                                     |
+  | `NEXT_AUTH_SSO_PROVIDERS` | Required | Select the single sign-on provider for LobeChat. Use `google` for Google SSO.                                        |
+  | `AUTH_GOOGLE_ID`          | Required | Client ID from Google Cloud OAuth.                                                                                   |
+  | `AUTH_GOOGLE_SECRET`      | Required | Client Secret from Google Cloud OAuth.                                                                               |
+  | `AUTH_URL`                | Required | Specifies the callback address for Auth.js when performing OAuth authentication. E.g. `https://your-domain/api/auth` |
-\<Callout type={'tip'}>
-See [📘 environment variables](/docs/self-hosting/environment-variable#google) for more details on these variables. </Callout> </Steps>
+  <Callout type={'tip'}>
+    See [📘 environment variables](/docs/self-hosting/environment-variable#google) for more details on these variables.
+  </Callout>
+</Steps>
 <Callout>
   After successful deployment, users can sign in to LobeChat using their Google accounts (those added as Test Users, if not in production).
@@ -75,8 +78,8 @@ See the [Google Identity Platform Documentation][google-identity-docs] for advan
 ## Related Resources
-* [Quickstart: Configure a Google OAuth client][google-oauth-quickstart]
+- [Quickstart: Configure a Google OAuth client][google-oauth-quickstart]
 [google-cloud-console]: https://console.cloud.google.com/apis/credentials
-[google-oauth-quickstart]: https://developers.google.com/identity/protocols/oauth2/web-server#creatingcred
 [google-identity-docs]: https://developers.google.com/identity
+[google-oauth-quickstart]: https://developers.google.com/identity/protocols/oauth2/web-server#creatingcred

package/docs/self-hosting/advanced/auth/next-auth/keycloak.mdx CHANGED Viewed

@@ -108,12 +108,12 @@ If you deploy using a public network, this guide assumes:
   | Environment Variable      | Type     | Description                                                                                                                                                                              |
   | ------------------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-  | `NEXT_AUTH_SECRET`        | Required | Key used to encrypt Auth.js session tokens. You can generate a key using: `openssl rand -base64 32`                                                                                      |
+  | `AUTH_SECRET`             | Required | Key used to encrypt Auth.js session tokens. You can generate a key using: `openssl rand -base64 32`                                                                                      |
   | `NEXT_AUTH_SSO_PROVIDERS` | Required | Select the single sign-on provider for LobeChat. For Keycloak, fill in `keycloak`.                                                                                                       |
   | `AUTH_KEYCLOAK_ID`        | Required | Keycloak client ID                                                                                                                                                                       |
   | `AUTH_KEYCLOAK_SECRET`    | Required | Keycloak client secret                                                                                                                                                                   |
   | `AUTH_KEYCLOAK_ISSUER`    | Required | OpenID Connect issuer URL for the Keycloak provider, in the format `{keycloak_url}/realms/{realm_name}`                                                                                  |
-  | `NEXTAUTH_URL`            | Required | This URL specifies the callback address for Auth.js during OAuth verification. Only needed when the default generated redirect address is incorrect. `https://lobe.example.com/api/auth` |
+  | `AUTH_URL`                | Required | This URL specifies the callback address for Auth.js during OAuth verification. Only needed when the default generated redirect address is incorrect. `https://lobe.example.com/api/auth` |
   <Callout type={'tip'}>
     Visit [📘 Environment Variables](/zh/docs/self-hosting/environment-variables/auth#keycloak) for details on related variables.

package/docs/self-hosting/advanced/auth/next-auth/keycloak.zh-CN.mdx CHANGED Viewed

@@ -105,12 +105,12 @@ tags:
   | 环境变量                      | 类型 | 描述                                                                                               |
   | ------------------------- | -- | ------------------------------------------------------------------------------------------------ |
-  | `NEXT_AUTH_SECRET`        | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`                                    |
+  | `AUTH_SECRET`             | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`                                    |
   | `NEXT_AUTH_SSO_PROVIDERS` | 必选 | 选择 LoboChat 的单点登录提供商。使用 Keycloak 请填写 `keycloak`。                                                 |
   | `AUTH_KEYCLOAK_ID`        | 必选 | Keycloak 客户端 ID                                                                                  |
   | `AUTH_KEYCLOAK_SECRET`    | 必选 | Keycloak 客户端密钥                                                                                   |
   | `AUTH_KEYCLOAK_ISSUER`    | 必选 | Keycloak 提供程序的 OpenID Connect 颁发者 URL，格式为 `{keycloak_url}/realms/{realm_name}`                   |
-  | `NEXTAUTH_URL`            | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://lobe.example.com/api/auth` |
+  | `AUTH_URL`                | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://lobe.example.com/api/auth` |
   <Callout type={'tip'}>
     前往 [📘 环境变量](/zh/docs/self-hosting/environment-variables/auth#keycloak) 可查阅相关变量详情。

package/docs/self-hosting/advanced/auth/next-auth/logto.mdx CHANGED Viewed

@@ -50,7 +50,9 @@ If you are using Logto Cloud, assume its endpoint domain is `https://example.log
   Go to `Webhooks`, create a Webhook, and fill in the following fields:
   - Endpoint URL: `https://lobe.example.com/api/webhooks/logto`
-  - Events: `User.Data.Updated`
+  - Events:
+    - `User.Data.Updated`: Allow LobeChat to synchronize user profile information updates from Logto.
+    - `User.SuspensionStatus.Updated`: Allow LobeChat to remove the active session from suspended users from logging in, only available when database session strategy is `database`.
   After successful creation, copy the Webhook's `Signing Key` and fill it in the `LOGTO_WEBHOOK_SIGNING_KEY` environment variable.
@@ -69,12 +71,12 @@ If you are using Logto Cloud, assume its endpoint domain is `https://example.log
   | Environment Variable        | Type     | Description                                                                                                                                                                            |
   | --------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-  | `NEXT_AUTH_SECRET`          | Required | The key used to encrypt Auth.js session tokens. You can generate a key using the command: `openssl rand -base64 32`                                                                    |
+  | `AUTH_SECRET`               | Required | The key used to encrypt Auth.js session tokens. You can generate a key using the command: `openssl rand -base64 32`                                                                    |
   | `NEXT_AUTH_SSO_PROVIDERS`   | Required | Select the single sign-on provider for LobeChat. For Logto, enter `logto`.                                                                                                             |
   | `AUTH_LOGTO_ID`             | Required | The Client ID from the Logto App details page                                                                                                                                          |
   | `AUTH_LOGTO_SECRET`         | Required | The Client Secret from the Logto App details page                                                                                                                                      |
   | `AUTH_LOGTO_ISSUER`         | Required | OpenID Connect issuer of the Logto provider                                                                                                                                            |
-  | `NEXTAUTH_URL`              | Required | This URL specifies the callback address for Auth.js during OAuth verification, needed only if the default generated redirect address is incorrect. `https://lobe.example.com/api/auth` |
+  | `AUTH_URL`                  | Required | This URL specifies the callback address for Auth.js during OAuth verification, needed only if the default generated redirect address is incorrect. `https://lobe.example.com/api/auth` |
   | `LOGTO_WEBHOOK_SIGNING_KEY` | Optional | The key used to verify the legality of Webhook requests sent by Logto.                                                                                                                 |
   <Callout type={'tip'}>

package/docs/self-hosting/advanced/auth/next-auth/logto.zh-CN.mdx CHANGED Viewed

@@ -47,7 +47,9 @@ tags:
   前往 `Webhooks` ，创建一个 Webhook，填写以下字段：
   - 端点 URL： `https://lobe.example.com/api/webhooks/logto`
-  - 事件： `User.Data.Updated`
+  - 事件：
+    - `User.Data.Updated`: 允许 LobeChat 同步 Logto 中用户资料信息的更新。
+    - `User.SuspensionStatus.Updated`: 允许 LobeChat 将被暂停的用户移除登录会话，仅在数据库会话策略为 `database` 时可用。
   创建成功后，复制 Webhook 的 `签名密钥`。填写到环境变量中的 `LOGTO_WEBHOOK_SIGNING_KEY`。
@@ -66,12 +68,12 @@ tags:
   | 环境变量                        | 类型 | 描述                                                                                               |
   | --------------------------- | -- | ------------------------------------------------------------------------------------------------ |
-  | `NEXT_AUTH_SECRET`          | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`                                    |
+  | `AUTH_SECRET`               | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`                                    |
   | `NEXT_AUTH_SSO_PROVIDERS`   | 必选 | 选择 LoboChat 的单点登录提供商。使用 Logto 请填写 `logto`。                                                       |
   | `AUTH_LOGTO_ID`             | 必选 | Logto App 详情页的 Client ID                                                                         |
   | `AUTH_LOGTO_SECRET`         | 必选 | Logto App 详情页的 Client Secret                                                                     |
   | `AUTH_LOGTO_ISSUER`         | 必选 | Logto 提供程序的 OpenID Connect 颁发者                                                                   |
-  | `NEXTAUTH_URL`              | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://lobe.example.com/api/auth` |
+  | `AUTH_URL`                  | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://lobe.example.com/api/auth` |
   | `LOGTO_WEBHOOK_SIGNING_KEY` | 可选 | 用于验证 Logto 发送的 Webhook 请求是否合法的密钥。                                                                |
   <Callout type={'tip'}>

package/docs/self-hosting/advanced/auth/next-auth/microsoft-entra-id.mdx CHANGED Viewed

@@ -58,12 +58,12 @@ tags:
   | Environment Variable                | Type     | Description                                                                                                                                                                                                                |
   | ----------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-  | `NEXT_AUTH_SECRET`                  | Required | Key used to encrypt Auth.js session tokens. You can generate the key using the following command: `openssl rand -base64 32`                                                                                                |
+  | `AUTH_SECRET`                       | Required | Key used to encrypt Auth.js session tokens. You can generate the key using the following command: `openssl rand -base64 32`                                                                                                |
   | `NEXT_AUTH_SSO_PROVIDERS`           | Required | Select the single sign-on provider for LoboChat. Use `microsoft-entra-id` for Microsoft Entra ID.                                                                                                                          |
   | `AUTH_MICROSOFT_ENTRA_ID_ID`        | Required | Client ID of the Microsoft Entra ID application.                                                                                                                                                                           |
   | `AUTH_MICROSOFT_ENTRA_ID_SECRET`    | Required | Client Secret of the Microsoft Entra ID application.                                                                                                                                                                       |
   | `AUTH_MICROSOFT_ENTRA_ID_TENANT_ID` | Required | Tenant ID of the Microsoft Entra ID application.                                                                                                                                                                           |
-  | `NEXTAUTH_URL`                      | Required | This URL is used to specify the callback address for Auth.js when performing OAuth authentication. It is only necessary to set it when the default generated redirect address is incorrect. `https://example.com/api/auth` |
+  | `AUTH_URL`                          | Required | This URL is used to specify the callback address for Auth.js when performing OAuth authentication. It is only necessary to set it when the default generated redirect address is incorrect. `https://example.com/api/auth` |
   <Callout type={'tip'}>
     You can refer to [📘 environment

package/docs/self-hosting/advanced/auth/next-auth/microsoft-entra-id.zh-CN.mdx CHANGED Viewed

@@ -56,12 +56,12 @@ tags:
   | 环境变量                                | 类型 | 描述                                                                                          |
   | ----------------------------------- | -- | ------------------------------------------------------------------------------------------- |
-  | `NEXT_AUTH_SECRET`                  | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`                               |
+  | `AUTH_SECRET`                       | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`                               |
   | `NEXT_AUTH_SSO_PROVIDERS`           | 必选 | 选择 LoboChat 的单点登录提供商。使用 Microsoft Entra ID 请填写 `microsoft-entra-id`。                        |
   | `AUTH_MICROSOFT_ENTRA_ID_ID`        | 必选 | Microsoft Entra ID 应用程序的 Client ID                                                          |
   | `AUTH_MICROSOFT_ENTRA_ID_SECRET`    | 必选 | Microsoft Entra ID 应用程序的 Client Secret                                                      |
   | `AUTH_MICROSOFT_ENTRA_ID_TENANT_ID` | 必选 | Microsoft Entra ID 应用程序的 Tenant ID                                                          |
-  | `NEXTAUTH_URL`                      | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://example.com/api/auth` |
+  | `AUTH_URL`                          | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://example.com/api/auth` |
   <Callout type={'tip'}>
     前往 [📘 环境变量](/zh/docs/self-hosting/environment-variable#microsoft-entra-id) 可查阅相关变量详情。

package/docs/self-hosting/advanced/auth/next-auth/okta.mdx CHANGED Viewed

@@ -45,12 +45,12 @@ tags:
   | Environment Variable      | Type     | Description                                                                                                                                                                                         |
   | ------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-  | `NEXT_AUTH_SECRET`        | Required | Key used to encrypt Auth.js session tokens. You can generate a key using the following command: `openssl rand -base64 32`                                                                           |
+  | `AUTH_SECRET`             | Required | Key used to encrypt Auth.js session tokens. You can generate a key using the following command: `openssl rand -base64 32`                                                                           |
   | `NEXT_AUTH_SSO_PROVIDERS` | Required | Select the single sign-on provider for LoboChat. Use `okta` for Okta.                                                                                                                               |
   | `AUTH_OKTA_ID`            | Required | Client ID of the Okta application                                                                                                                                                                   |
   | `AUTH_OKTA_SECRET`        | Required | Client Secret of the Okta application                                                                                                                                                               |
   | `AUTH_OKTA_ISSUER`        | Required | Domain of the Okta application, `https://example.oktapreview.com`                                                                                                                                   |
-  | `NEXTAUTH_URL`            | Optional | The URL is used to specify the callback address for the execution of OAuth authentication in Auth.js. It needs to be set only when the default address is incorrect. `https://example.com/api/auth` |
+  | `AUTH_URL`                | Optional | The URL is used to specify the callback address for the execution of OAuth authentication in Auth.js. It needs to be set only when the default address is incorrect. `https://example.com/api/auth` |
   <Callout type={'tip'}>
     You can refer to the related variable details at [📘Environment Variables](/docs/self-hosting/environment-variable/auth#okta).

package/docs/self-hosting/advanced/auth/next-auth/okta.zh-CN.mdx CHANGED Viewed

@@ -44,12 +44,12 @@ tags:
   | 环境变量                      | 类型 | 描述                                                                                   |
   | ------------------------- | -- | ------------------------------------------------------------------------------------ |
-  | `NEXT_AUTH_SECRET`        | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成密钥：`openssl rand -base64 32`                         |
+  | `AUTH_SECRET`             | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成密钥：`openssl rand -base64 32`                         |
   | `NEXT_AUTH_SSO_PROVIDERS` | 必选 | 选择 LoboChat 的单点登录提供商。使用 Okta 请填写 `okta`。                                             |
   | `AUTH_OKTA_ID`            | 必选 | Okta 应用程序的客户端 ID                                                                     |
   | `AUTH_OKTA_SECRET`        | 必选 | Okta 应用程序的客户端密钥                                                                      |
   | `AUTH_OKTA_ISSUER`        | 必选 | Okta 应用程序的域名，`https://example.oktapreview.com`                                       |
-  | `NEXTAUTH_URL`            | 可选 | 该 URL 用于指定 Auth.js 在执行 OAuth 认证时的回调地址。仅当默认地址不正确时才需要设置。`https://example.com/api/auth` |
+  | `AUTH_URL`                | 可选 | 该 URL 用于指定 Auth.js 在执行 OAuth 认证时的回调地址。仅当默认地址不正确时才需要设置。`https://example.com/api/auth` |
   <Callout type={'tip'}>
     您可以在 [📘环境变量](/zh/docs/self-hosting/environment-variables/auth#okta) 查阅相关变量详情。

package/docs/self-hosting/advanced/auth/next-auth/wechat.mdx CHANGED Viewed

@@ -30,11 +30,11 @@ tags:
   | Environment Variable      | Type     | Description                                                                                                                                                                                           |
   | ------------------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-  | `NEXT_AUTH_SECRET`        | Required | Key used to encrypt Auth.js session tokens. You can generate the key using the command: `openssl rand -base64 32`                                                                                     |
+  | `AUTH_SECRET`             | Required | Key used to encrypt Auth.js session tokens. You can generate the key using the command: `openssl rand -base64 32`                                                                                     |
   | `NEXT_AUTH_SSO_PROVIDERS` | Required | Select the Single Sign-On provider for LobeChat. Use `github` for Github.                                                                                                                             |
   | `WECHAT_CLIENT_ID`        | Required | Client ID from the Wechat website application details page                                                                                                                                            |
   | `WECHAT_CLIENT_SECRET`    | Required | Client Secret from the Wechat website application details page                                                                                                                                        |
-  | `NEXTAUTH_URL`            | Required | This URL is used to specify the callback address for Auth.js when performing OAuth authentication. Only set it if the default generated redirect address is incorrect. `https://example.com/api/auth` |
+  | `AUTH_URL`                | Required | This URL is used to specify the callback address for Auth.js when performing OAuth authentication. Only set it if the default generated redirect address is incorrect. `https://example.com/api/auth` |
   <Callout type={'tip'}>
     Go to [📘 Environment Variables](/en/docs/self-hosting/environment-variables/auth#wechat) for more details about related variables.

package/docs/self-hosting/advanced/auth/next-auth/wechat.zh-CN.mdx CHANGED Viewed

@@ -28,11 +28,11 @@ tags:
   | 环境变量                      | 类型 | 描述                                                                                          |
   | ------------------------- | -- | ------------------------------------------------------------------------------------------- |
-  | `NEXT_AUTH_SECRET`        | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`                               |
+  | `AUTH_SECRET`             | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成秘钥： `openssl rand -base64 32`                               |
   | `NEXT_AUTH_SSO_PROVIDERS` | 必选 | 选择 LoboChat 的单点登录提供商。使用 Github 请填写 `github`。                                                |
   | `WECHAT_CLIENT_ID`        | 必选 | 微信网站应用详情页的 客户端 ID                                                                           |
   | `WECHAT_CLIENT_SECRET`    | 必选 | 微信网站应用详情页的 客户端 Secret                                                                       |
-  | `NEXTAUTH_URL`            | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://example.com/api/auth` |
+  | `AUTH_URL`                | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://example.com/api/auth` |
   <Callout type={'tip'}>
     前往 [📘 环境变量](/zh/docs/self-hosting/environment-variables/auth#wechat) 可查阅相关变量详情。

package/docs/self-hosting/advanced/auth/next-auth/zitadel.mdx CHANGED Viewed

@@ -65,12 +65,12 @@ tags:
   | Environment Variable      | Type     | Description                                                                                                                                                                                         |
   | ------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-  | `NEXT_AUTH_SECRET`        | Required | Key used to encrypt Auth.js session tokens. You can generate a key using the following command: `openssl rand -base64 32`                                                                           |
+  | `AUTH_SECRET`             | Required | Key used to encrypt Auth.js session tokens. You can generate a key using the following command: `openssl rand -base64 32`                                                                           |
   | `NEXT_AUTH_SSO_PROVIDERS` | Required | Select the single sign-on provider for LoboChat. Use `zitadel` for ZITADEL.                                                                                                                         |
   | `AUTH_ZITADEL_ID`         | Required | Client ID (`ClientId` as shown in ZITADEL) of the ZITADEL application                                                                                                                               |
   | `AUTH_ZITADEL_SECRET`     | Required | Client Secret (`ClientSecret` as shown in ZITADEL) of the ZITADEL application                                                                                                                       |
   | `AUTH_ZITADEL_ISSUER`     | Required | Issuer URL of the ZITADEL application                                                                                                                                                               |
-  | `NEXTAUTH_URL`            | Required | The URL is used to specify the callback address for the execution of OAuth authentication in Auth.js. It needs to be set only when the default address is incorrect. `https://example.com/api/auth` |
+  | `AUTH_URL`                | Required | The URL is used to specify the callback address for the execution of OAuth authentication in Auth.js. It needs to be set only when the default address is incorrect. `https://example.com/api/auth` |
   <Callout type={'tip'}>
     You can refer to the related variable details at [📘Environment Variables](/docs/self-hosting/environment-variables/auth#zitadel).

package/docs/self-hosting/advanced/auth/next-auth/zitadel.zh-CN.mdx CHANGED Viewed

@@ -62,12 +62,12 @@ tags:
   | 环境变量                      | 类型 | 描述                                                                                  |
   | ------------------------- | -- | ----------------------------------------------------------------------------------- |
-  | `NEXT_AUTH_SECRET`        | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成密钥：`openssl rand -base64 32`                        |
+  | `AUTH_SECRET`             | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令生成密钥：`openssl rand -base64 32`                        |
   | `NEXT_AUTH_SSO_PROVIDERS` | 必选 | 为 LobeChat 选择单点登录提供程序。对于 ZITADEL，请填写 `zitadel`。                                     |
   | `AUTH_ZITADEL_ID`         | 必选 | ZITADEL 应用的 Client ID（`ClientId`）。                                                  |
   | `AUTH_ZITADEL_SECRET`     | 必选 | ZITADEL 应用的 Client Secret（`ClientSecret`）。                                          |
   | `AUTH_ZITADEL_ISSUER`     | 必选 | ZITADEL 应用的 OpenID Connect 颁发者（issuer）URL。                                          |
-  | `NEXTAUTH_URL`            | 必选 | 该 URL 用于指定 Auth.js 中执行 OAuth 认证的回调地址。仅当默认地址不正确时才需要设置。`https://example.com/api/auth` |
+  | `AUTH_URL`                | 必选 | 该 URL 用于指定 Auth.js 中执行 OAuth 认证的回调地址。仅当默认地址不正确时才需要设置。`https://example.com/api/auth` |
   <Callout type={'tip'}>
     您可以在 [📘 环境变量](/zh/docs/self-hosting/environment-variables/auth#zitadel) 中查看相关变量的详细信息。

package/docs/self-hosting/advanced/auth.mdx CHANGED Viewed

@@ -26,12 +26,13 @@ By setting the environment variables `NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY` and `CL
 Before using NextAuth, please set the following variables in LobeChat's environment variables:
-| Environment Variable           | Type     | Description                                                                                                                                                                                                                                |
-| ------------------------------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `NEXT_PUBLIC_ENABLE_NEXT_AUTH` | Required | This is used to enable the NextAuth service. Set it to `1` to enable it; changing this setting requires recompiling the application. Users deploying with the `lobehub/lobe-chat-database` image have this configuration added by default. |
-| `NEXT_AUTH_SECRET`             | Required | The key used to encrypt Auth.js session tokens. You can use the following command: `openssl rand -base64 32`, or visit `https://generate-secret.vercel.app/32` to generate the key.                                                        |
-| `NEXTAUTH_URL`                 | Required | This URL specifies the callback address for Auth.js when performing OAuth verification. Set this only if the default generated redirect address is incorrect. `https://example.com/api/auth`                                               |
-| `NEXT_AUTH_SSO_PROVIDERS`      | Optional | This environment variable is used to enable multiple identity verification sources simultaneously, separated by commas, for example, `auth0,microsoft-entra-id,authentik`.                                                                 |
+| Environment Variable             | Type     | Description                                                                                                                                                                                                                                |
+| -------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `NEXT_PUBLIC_ENABLE_NEXT_AUTH`   | Required | This is used to enable the NextAuth service. Set it to `1` to enable it; changing this setting requires recompiling the application. Users deploying with the `lobehub/lobe-chat-database` image have this configuration added by default. |
+| `AUTH_SECRET`                    | Required | The key used to encrypt Auth.js session tokens. You can use the following command: `openssl rand -base64 32`, or visit `https://generate-secret.vercel.app/32` to generate the key.                                                        |
+| `AUTH_URL`                       | Required | This URL specifies the callback address for Auth.js when performing OAuth verification. Set this only if the default generated redirect address is incorrect. `https://example.com/api/auth`                                               |
+| `NEXT_AUTH_SSO_PROVIDERS`        | Optional | This environment variable is used to enable multiple identity verification sources simultaneously, separated by commas, for example, `auth0,microsoft-entra-id,authentik`.                                                                 |
+| `NEXT_AUTH_SSO_SESSION_STRATEGY` | Optional | The session strategy for Auth.js. Options are `jwt` or `database`. Default is `jwt`.                                                                                                                                                       |
 Currently supported identity verification services include:
@@ -67,21 +68,31 @@ To simultaneously enable multiple identity verification sources, please set the
 The order corresponds to the display order of the SSO providers.
-| SSO Provider          | Value                   |
-| --------------------- | ----------------------- |
-| Auth0                 | `auth0`                 |
-| Authenlia             | `authenlia`             |
-| Authentik             | `authentik`             |
-| Casdoor               | `casdoor`               |
-| Cloudflare Zero Trust | `cloudflare-zero-trust` |
-| Github                | `github`                |
-| Logto                 | `logto`                 |
-| Microsoft Entra ID    | `microsoft-entra-id`    |
-| ZITADEL               | `zitadel`               |
-| Keycloak              | `keycloak`              |
-| Google                | `google`                |
-| Okta                  | `okta`                  |
+| SSO Provider          | Value                   | Additional Features |
+| --------------------- | ----------------------- | ------------------- |
+| Auth0                 | `auth0`                 |                     |
+| Authenlia             | `authenlia`             |                     |
+| Authentik             | `authentik`             |                     |
+| Casdoor               | `casdoor`               | `Webhook`           |
+| Cloudflare Zero Trust | `cloudflare-zero-trust` |                     |
+| Github                | `github`                |                     |
+| Logto                 | `logto`                 | `Webhook`           |
+| Microsoft Entra ID    | `microsoft-entra-id`    |                     |
+| ZITADEL               | `zitadel`               |                     |
+| Keycloak              | `keycloak`              |                     |
+| Google                | `google`                |                     |
+| Okta                  | `okta`                  |                     |
+## Additional Features
+### Webhook Support
+Allow LobeChat to receive notifications when user information is updated in the identity provider. Supported providers include Casdoor and Logto. Please refer to the specific provider documentation for configuration details.
+### Database Session
+Allow the session store in database, see also the [Auth.js Session Documentation](https://authjs.dev/concepts/session-strategies#database-session).
 ## Other SSO Providers
-Please refer to the [NextAuth.js](https://next-auth.js.org/providers) documentation and feel free to submit a Pull Request.
+Please refer to the [Auth.js](https://authjs.dev/getting-started/authentication/oauth) documentation and feel free to submit a Pull Request.

package/docs/self-hosting/advanced/auth.zh-CN.mdx CHANGED Viewed

@@ -24,12 +24,13 @@ LobeChat 与 Clerk 做了深度集成，能够为用户提供一个更加安全
 在使用 NextAuth 之前，请先在 LobeChat 的环境变量中设置以下变量：
-| 环境变量                           | 类型 | 描述                                                                                                           |
-| ------------------------------ | -- | ------------------------------------------------------------------------------------------------------------ |
-| `NEXT_PUBLIC_ENABLE_NEXT_AUTH` | 必选 | 用于启用 NextAuth 服务，设置为 `1` 以启用，更改此项需要重新编译应用。使用 `lobehub/lobe-chat-database` 镜像部署的用户已经默认添加了该项配置。                |
-| `NEXT_AUTH_SECRET`             | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令： `openssl rand -base64 32`，或者访问 `https://generate-secret.vercel.app/32` 生成秘钥。 |
-| `NEXTAUTH_URL`                 | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://example.com/api/auth`                  |
-| `NEXT_AUTH_SSO_PROVIDERS`      | 可选 | 该环境变量用于同时启用多个身份验证源，以逗号 `,` 分割，例如 `auth0,microsoft-entra-id,authentik`。                                       |
+| 环境变量                             | 类型 | 描述                                                                                                           |
+| -------------------------------- | -- | ------------------------------------------------------------------------------------------------------------ |
+| `NEXT_PUBLIC_ENABLE_NEXT_AUTH`   | 必选 | 用于启用 NextAuth 服务，设置为 `1` 以启用，更改此项需要重新编译应用。使用 `lobehub/lobe-chat-database` 镜像部署的用户已经默认添加了该项配置。                |
+| `NEXT_AUTH_SECRET`               | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令： `openssl rand -base64 32`，或者访问 `https://generate-secret.vercel.app/32` 生成秘钥。 |
+| `AUTH_URL`                       | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://example.com/api/auth`                  |
+| `NEXT_AUTH_SSO_PROVIDERS`        | 可选 | 该环境变量用于同时启用多个身份验证源，以逗号 `,` 分割，例如 `auth0,microsoft-entra-id,authentik`。                                       |
+| `NEXT_AUTH_SSO_SESSION_STRATEGY` | 可选 | Auth.js 的会话策略。选项为 `jwt` 或 `database`。默认值为 `jwt`。                                                             |
 目前支持的身份验证服务有：
@@ -63,19 +64,29 @@ LobeChat 与 Clerk 做了深度集成，能够为用户提供一个更加安全
 顺序为 SSO 提供商的显示顺序。
-| SSO 提供商               | 值                       |
-| --------------------- | ----------------------- |
-| Auth0                 | `auth0`                 |
-| Authenlia             | `authenlia`             |
-| Authentik             | `authentik`             |
-| Casdoor               | `casdoor`               |
-| Cloudflare Zero Trust | `cloudflare-zero-trust` |
-| Github                | `github`                |
-| Logto                 | `logto`                 |
-| Microsoft Entra ID    | `microsoft-entra-id`    |
-| ZITADEL               | `zitadel`               |
-| Keycloak              | `keycloak`              |
-| Okta                  | `okta`                  |
+| SSO 提供商               | 值                       | 额外功能      |
+| --------------------- | ----------------------- | --------- |
+| Auth0                 | `auth0`                 |           |
+| Authenlia             | `authenlia`             |           |
+| Authentik             | `authentik`             |           |
+| Casdoor               | `casdoor`               | `Webhook` |
+| Cloudflare Zero Trust | `cloudflare-zero-trust` |           |
+| Github                | `github`                |           |
+| Logto                 | `logto`                 | `Webhook` |
+| Microsoft Entra ID    | `microsoft-entra-id`    |           |
+| ZITADEL               | `zitadel`               |           |
+| Keycloak              | `keycloak`              |           |
+| Okta                  | `okta`                  |           |
+## 额外功能
+### Webhook 支持
+允许 LobeChat 在身份提供商中用户信息更新时接收通知。支持的提供商包括 Casdoor 和 Logto。请参考具体提供商文档进行配置。
+### 数据库会话
+允许会话存储在数据库中，详情请参阅 [Auth.js 会话文档](https://authjs.dev/concepts/session-strategies#database-session)。
 ## 其他 SSO 提供商

package/docs/self-hosting/advanced/feature-flags.mdx CHANGED Viewed

@@ -49,7 +49,6 @@ You can achieve various feature combinations using the above configuration synta
 | `token_counter`           | Reserved for token counter display.                                                                      | Enabled       |
 | `welcome_suggest`         | Displays welcome suggestions.                                                                            | Enabled       |
 | `changelog`               | Controls changelog modal/page display.                                                                   | Enabled       |
-| `clerk_sign_up`           | Enables the Clerk SignUp functionality.                                                                  | Enabled       |
 | `market`                  | Enables the assistant market functionality.                                                              | Enabled       |
 | `knowledge_base`          | Enables the knowledge base functionality.                                                                | Enabled       |
 | `rag_eval`                | Controls RAG evaluation feature (/repos/\[id]/evals).                                                    | Disabled      |

package/docs/self-hosting/advanced/feature-flags.zh-CN.mdx CHANGED Viewed

@@ -46,7 +46,6 @@ tags:
 | `token_counter`           | 保留用于令牌计数器显示。                         | 开启  |
 | `welcome_suggest`         | 显示欢迎建议。                              | 开启  |
 | `changelog`               | 控制更新日志弹窗 / 页面的显示。                    | 开启  |
-| `clerk_sign_up`           | 启用 Clerk 注册功能。                       | 开启  |
 | `market`                  | 启用助手市场功能。                            | 开启  |
 | `knowledge_base`          | 启用知识库功能。                             | 开启  |
 | `rag_eval`                | 控制 RAG 评估功能 (/repos/\[id]/evals)。    | 关闭  |

package/docs/self-hosting/environment-variables/basic.mdx CHANGED Viewed

@@ -127,16 +127,62 @@ For specific content, please refer to the [Feature Flags](/docs/self-hosting/adv
 ### `SSRF_ALLOW_PRIVATE_IP_ADDRESS`
 - Type: Optional
-- Description: Allow to connect private IP address. In a trusted environment, it can be set to true to turn off SSRF protection.
+- Description: Controls whether to allow connections to private IP addresses. Set to `1` to disable SSRF protection and allow all private IP addresses. In a trusted environment (e.g., internal network), this can be enabled to allow access to internal resources.
 - Default: `0`
 - Example: `1` or `0`
+<Callout type="warning">
+  **Security Notice**: Enabling this option will disable SSRF protection and allow connections to private
+  IP addresses (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, etc.). Only enable this in
+  trusted environments where you need to access internal network resources.
+</Callout>
+**Use Cases**:
+LobeChat performs SSRF security checks in the following scenarios:
+1. **Image/Video URL to Base64 Conversion**: When processing media messages (e.g., vision models, multimodal models), LobeChat converts image and video URLs to base64 format. This check prevents malicious users from accessing internal network resources.
+   Examples:
+   - Image: A user sends an image message with URL `http://192.168.1.100/admin/secrets.png`
+   - Video: A user sends a video message with URL `http://10.0.0.50/internal/meeting.mp4`
+   Without SSRF protection, these requests could expose internal network resources.
+2. **Web Crawler**: When using web crawling features to fetch external content.
+3. **Proxy Requests**: When proxying external API requests.
+**Configuration Examples**:
+```bash
+# Scenario 1: Public deployment (recommended)
+# Block all private IP addresses for security
+SSRF_ALLOW_PRIVATE_IP_ADDRESS=0
+# Scenario 2: Internal deployment
+# Allow all private IP addresses to access internal image servers
+SSRF_ALLOW_PRIVATE_IP_ADDRESS=1
+# Scenario 3: Hybrid deployment (most common)
+# Block private IPs by default, but allow specific trusted internal servers
+SSRF_ALLOW_PRIVATE_IP_ADDRESS=0
+SSRF_ALLOW_IP_ADDRESS_LIST=192.168.1.100,10.0.0.50
+```
 ### `SSRF_ALLOW_IP_ADDRESS_LIST`
 - Type: Optional
-- Description: Allow private IP address list, multiple IP addresses are separated by commas. Only when `SSRF_ALLOW_PRIVATE_IP_ADDRESS` is `0`, it takes effect.
+- Description: Whitelist of allowed IP addresses, separated by commas. Only takes effect when `SSRF_ALLOW_PRIVATE_IP_ADDRESS` is `0`. Use this to allow specific internal IP addresses while keeping SSRF protection enabled for other private IPs.
 - Default: -
-- Example: `198.18.1.62,224.0.0.3`
+- Example: `192.168.1.100,10.0.0.50,172.16.0.10`
+**Common Use Cases**:
+- Allow access to internal image storage server: `192.168.1.100`
+- Allow access to internal API gateway: `10.0.0.50`
+- Allow access to internal documentation server: `172.16.0.10`
 ### `ENABLE_AUTH_PROTECTION`