Login complete. You can close this window and return to csglite.
`) + return + } + _, _ = io.WriteString(w, `Login failed (`+errCode+`). Please try again.
`) } func (s *Server) handleCloudAuthTokenDelete(w http.ResponseWriter, r *http.Request) { diff --git a/internal/server/handlers_cloud_test.go b/internal/server/handlers_cloud_test.go index c367eb7..666bdea 100644 --- a/internal/server/handlers_cloud_test.go +++ b/internal/server/handlers_cloud_test.go @@ -224,6 +224,49 @@ func TestHandleCloudAuthTokenSaveAndDelete(t *testing.T) { } } +func TestHandleCloudAuthCallback(t *testing.T) { + config.Reset() + t.Cleanup(config.Reset) + + home := t.TempDir() + t.Setenv("HOME", home) + t.Setenv("USERPROFILE", home) + + s := newTestServer(t) + + saveReq := httptest.NewRequest(http.MethodGet, "/api/cloud/auth/callback?token=%20test-token%20", nil) + w := httptest.NewRecorder() + s.handleCloudAuthCallback(w, saveReq) + + if w.Code != http.StatusOK { + t.Fatalf("status = %d, want %d", w.Code, http.StatusOK) + } + if ct := w.Header().Get("Content-Type"); !strings.HasPrefix(ct, "text/html") { + t.Fatalf("Content-Type = %q, want text/html", ct) + } + if !strings.Contains(w.Body.String(), "Login complete") { + t.Fatalf("body = %q, want success page", w.Body.String()) + } + if s.cfg.Token != "test-token" { + t.Fatalf("saved token = %q, want %q", s.cfg.Token, "test-token") + } +} + +func TestHandleCloudAuthCallbackMissingToken(t *testing.T) { + s := newTestServer(t) + + req := httptest.NewRequest(http.MethodGet, "/api/cloud/auth/callback", nil) + w := httptest.NewRecorder() + s.handleCloudAuthCallback(w, req) + + if w.Code != http.StatusOK { + t.Fatalf("status = %d, want %d", w.Code, http.StatusOK) + } + if !strings.Contains(w.Body.String(), "Login failed") || !strings.Contains(w.Body.String(), "missing_token") { + t.Fatalf("body = %q, want failure page with missing_token", w.Body.String()) + } +} + func TestHandleCloudAPIKeySaveAndDelete(t *testing.T) { config.Reset() t.Cleanup(config.Reset) diff --git a/internal/server/routes.go b/internal/server/routes.go index 152429d..9a7791d 100644 --- a/internal/server/routes.go +++ b/internal/server/routes.go @@ -204,6 +204,12 @@ func (s *Server) externalAPIRoutes() http.Handler { )) } +func (s *Server) authCallbackRoutes() http.Handler { + mux := http.NewServeMux() + mux.HandleFunc("GET /api/cloud/auth/callback", s.handleCloudAuthCallback) + return mux +} + func desktopExternalAPIMiddleware(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { if r.Header.Get("Origin") != "" { diff --git a/internal/server/server.go b/internal/server/server.go index 3df2fd4..d922b9e 100644 --- a/internal/server/server.go +++ b/internal/server/server.go @@ -158,10 +158,11 @@ type Server struct { appManager *apps.Manager sourceSwitches *apps.SourceSwitchManager appShells *aiAppShellManager - cloud *cloud.Service - http *http.Server - externalHTTP *http.Server - logBuf *LogBuffer + cloud *cloud.Service + http *http.Server + externalHTTP *http.Server + authCallbackHTTP *http.Server + logBuf *LogBuffer mu sync.RWMutex engines map[string]*managedEngine @@ -302,6 +303,16 @@ func New(cfg *config.Config, version string) *Server { return s } +// authCallbackAddr returns the loopback address dedicated to receiving the +// "lite" SSO redirect, so the browser can hand the access token back to this +// process on a stable port regardless of the main listener address. +func (s *Server) authCallbackAddr() string { + if s != nil && strings.TrimSpace(s.cfg.AuthCallbackAddr) != "" { + return strings.TrimSpace(s.cfg.AuthCallbackAddr) + } + return config.DefaultAuthCallbackAddr +} + func resolveCloudURL(cfg *config.Config) string { if u := strings.TrimSpace(cfg.AIGatewayURL); u != "" { return u @@ -338,10 +349,23 @@ func (s *Server) Run(ctx context.Context) error { s.cfg.DesktopAPIBoundAddr = externalListener.Addr().String() } + authCallbackListener, err := net.Listen("tcp", s.authCallbackAddr()) + if err != nil { + log.Printf("cloud auth callback listener unavailable on %s: %v", s.authCallbackAddr(), err) + } else { + defer authCallbackListener.Close() + s.authCallbackHTTP = &http.Server{ + Handler: s.authCallbackRoutes(), + ReadHeaderTimeout: 30 * time.Second, + WriteTimeout: 0, + IdleTimeout: 120 * time.Second, + } + } + go s.startEvictor(ctx) go s.refreshCloudModelsOnStartup(ctx) - errCh := make(chan error, 2) + errCh := make(chan error, 3) if s.cfg.DesktopMode { baseURL := "http://" + boundAddr ready := desktopReady{ @@ -380,6 +404,14 @@ func (s *Server) Run(ctx context.Context) error { } }() } + if s.authCallbackHTTP != nil { + go func() { + log.Printf(" Auth callback: http://%s", s.authCallbackAddr()) + if err := s.authCallbackHTTP.Serve(authCallbackListener); err != nil && !errors.Is(err, http.ErrServerClosed) { + errCh <- err + } + }() + } select { case err := <-errCh: @@ -416,6 +448,11 @@ func (s *Server) shutdownHTTPServers(ctx context.Context) error { if s.externalHTTP != nil { externalErr = s.externalHTTP.Shutdown(ctx) } + if s.authCallbackHTTP != nil { + if err := s.authCallbackHTTP.Shutdown(ctx); err != nil && externalErr == nil { + externalErr = err + } + } internalErr := s.http.Shutdown(ctx) if internalErr != nil { return internalErr diff --git a/internal/server/static/openapi/local-api.json b/internal/server/static/openapi/local-api.json index 2afc24d..6924aab 100644 --- a/internal/server/static/openapi/local-api.json +++ b/internal/server/static/openapi/local-api.json @@ -3833,6 +3833,39 @@ } } }, + "/api/cloud/auth/callback": { + "get": { + "tags": [ + "CloudAuth" + ], + "summary": "Complete the OpenCSG SSO login redirect", + "description": "Browser redirect target for the lite SSO flow. Persists the access token carried in the token query parameter and returns a confirmation page.", + "operationId": "completeCloudAuthCallback", + "parameters": [ + { + "name": "token", + "in": "query", + "required": true, + "description": "OpenCSG access token issued to the lite client.", + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "HTML confirmation showing whether the token was saved.", + "content": { + "text/html": { + "schema": { + "type": "string" + } + } + } + } + } + } + }, "/api/cloud/auth/token": { "post": { "tags": [ diff --git a/openapi/local-api.json b/openapi/local-api.json index 2afc24d..6924aab 100644 --- a/openapi/local-api.json +++ b/openapi/local-api.json @@ -3833,6 +3833,39 @@ } } }, + "/api/cloud/auth/callback": { + "get": { + "tags": [ + "CloudAuth" + ], + "summary": "Complete the OpenCSG SSO login redirect", + "description": "Browser redirect target for the lite SSO flow. Persists the access token carried in the token query parameter and returns a confirmation page.", + "operationId": "completeCloudAuthCallback", + "parameters": [ + { + "name": "token", + "in": "query", + "required": true, + "description": "OpenCSG access token issued to the lite client.", + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "HTML confirmation showing whether the token was saved.", + "content": { + "text/html": { + "schema": { + "type": "string" + } + } + } + } + } + } + }, "/api/cloud/auth/token": { "post": { "tags": [ diff --git a/web/src/pages/Settings.tsx b/web/src/pages/Settings.tsx index 38ee7c3..bbb8e91 100644 --- a/web/src/pages/Settings.tsx +++ b/web/src/pages/Settings.tsx @@ -297,6 +297,32 @@ function fetchCloudAuth() { }); } +function pollCloudAuthAfterLogin() { + const deadline = Date.now() + 5 * 60 * 1000; + let timer: number | undefined; + + const poll = async () => { + try { + const status = await getCloudAuthStatus(); + cloudAuth.value = status; + if (status.authenticated && status.user) { + cloudAuthError.value = ""; + return; + } + } catch (err: any) { + cloudAuthError.value = err?.message || ""; + } + if (Date.now() < deadline) { + timer = window.setTimeout(poll, 1500); + } + }; + + void poll(); + return () => { + if (timer !== undefined) window.clearTimeout(timer); + }; +} + async function fetchUpgradeInfo() { try { const upgrade = await checkUpgrade(); @@ -656,6 +682,7 @@ export function Settings() { const handleOpenCloudLogin = () => { openExternal(cloudAuth.value?.login_url); + pollCloudAuthAfterLogin(); }; const handleOpenCloudTokenPage = () => { From 1654ef23cf9910b66fb9141d8b1f6a6f21c69efb Mon Sep 17 00:00:00 2001 From: ganisback <370036720@qq.com> Date: Sat, 5 Sep 2026 10:38:56 +0800 Subject: [PATCH 2/2] feat(cloud): finish lite-side SSO auto login in web dialogs Replace the manual Access Token entry flow in the Chat, AI Apps, Image Generation, and Settings dialogs with polling: clicking Open Login opens SSO and polls cloud auth status until the callback persists the token, then refreshes the model lists. Removes the now-unused token input UI and i18n strings. --- web/src/i18n.ts | 18 ------ web/src/pages/AIApps.tsx | 93 ++++++++++------------------- web/src/pages/Chat.tsx | 99 ++++++++++++------------------- web/src/pages/ImageGeneration.tsx | 97 +++++++++++------------------- web/src/pages/Settings.tsx | 70 ---------------------- 5 files changed, 103 insertions(+), 274 deletions(-) diff --git a/web/src/i18n.ts b/web/src/i18n.ts index a314ae1..119bc0b 100644 --- a/web/src/i18n.ts +++ b/web/src/i18n.ts @@ -875,7 +875,6 @@ const en: Record{t("chat.cloudTokenHint")}
{t("chat.cloudTokenHint")}
{t("chat.cloudTokenHint")}
{t("settings.tokenInputHint")}
-