Repository navigation
feat(server): 内置 GitHub 登录 - #23
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题
Meterleaf 没有内置认证，对外开放时要在反向代理前另部署认证服务（例如 authentik），只为保护一个应用就要多维护一套服务。
变化
METERLEAF_GITHUB_CLIENT_ID、METERLEAF_GITHUB_CLIENT_SECRET、METERLEAF_GITHUB_USERS、METERLEAF_PUBLIC_URL后开启，只允许名单内的 GitHub 账号访问页面和读取接口。四项都不填时行为不变，只填一部分时拒绝启动。METERLEAF_SESSION_DAYS），使用中每天顺延一次。每次请求都重新核对允许名单，删除账号即撤销访问。更换 Client Secret 会让所有会话失效。/api/*返回 401，由前端现有的会话失效提示处理。健康检查、采集器写入地址和 PWA 静态资源仍可直接访问。.env.example、compose.yaml、README 和 CHANGELOG 同步更新。验证
bun test tests353 个全部通过，新增的tests/auth.test.ts覆盖配置校验、跳转与 401、OAuth state 校验、允许和拒绝的账号、Cookie 篡改、按天顺延、闲置 30 天过期、从名单移除、开放重定向和退出。bun run typecheck通过，改动文件通过 Prettier 检查。/跳转 GitHub、/api/view返回 401、/api/health返回 200。用允许的账号完成真实的 GitHub 授权，回到总览并能读取数据，「关于」页显示账号和退出入口。登录开启后，本机采集器照常推送。🤖 Generated with Claude Code