From 6b36336ca6da655abc250d7938bca6597fb35892 Mon Sep 17 00:00:00 2001
From: bot_dev1 <bot_dev1@xayunmei.com>
Date: Wed, 5 Aug 2026 10:37:26 +0800
Subject: [PATCH] =?UTF-8?q?feat:=20=E5=AE=8C=E6=88=90=20issue=20#152=20?=
 =?UTF-8?q?=E7=99=BB=E5=BD=95=E9=A1=B5=20OIDC=20SSO=20=E5=8F=8C=E8=BD=A8?=
 =?UTF-8?q?=E5=85=A5=E5=8F=A3=EF=BC=88=E9=85=8D=E7=BD=AE=E7=82=B9=E5=B7=B2?=
 =?UTF-8?q?=E6=96=87=E6=A1=A3=E5=8C=96=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 web/auth/login.html | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/web/auth/login.html b/web/auth/login.html
index c4ff7f0..3526220 100644
--- a/web/auth/login.html
+++ b/web/auth/login.html
@@ -38,6 +38,12 @@
       <button type="button" class="btn btn-ghost" id="togglePwd" title="显示/隐藏密码" aria-label="显示或隐藏密码">👁</button>
     </div>
 
+    <!-- issue #152：OIDC SSO 双轨入口——配置了 issuer/client_id 时显示，
+         未配置仅本地账号（PRD 8.2 双轨）。配置点在用户管理页维护。 -->
+    <div class="auth-actions" id="sso-row" hidden>
+      <button type="button" class="btn btn-ghost" id="ssoBtn" style="width:100%">企业 SSO 登录（OIDC）</button>
+    </div>
+
     <div class="role-hint">
       角色：readonly 只读 / engineer 可配置 / admin 可发布回滚。<br>
       未登录或只读角色不可执行写操作（PRD 8.2）。
@@ -48,6 +54,20 @@
     </div>
   </form>
 
+  <script src="user_store.js"></script>
   <script src="auth.js"></script>
+  <script>
+    // issue #152：OIDC 双轨——已配置 issuer/client_id 则显示 SSO 入口，
+    // 点击跳转标准授权码流程 authorize URL（state 已写入 sessionStorage）；
+    // 未配置则保持纯本地账号登录。
+    document.addEventListener("DOMContentLoaded", function () {
+      if (typeof UserStore === "undefined") return;
+      var url = UserStore.oidcAuthorizeUrl("/auth/login.html");
+      if (!url) return;
+      var row = document.getElementById("sso-row");
+      row.hidden = false;
+      document.getElementById("ssoBtn").onclick = function () { location.href = url; };
+    });
+  </script>
 </body>
 </html>