feat: add global auth settings and pending users

app/api/organizations/[id]/route.ts

@@ -61,6 +61,7 @@ export async function PATCH(request: Request, context: RouteContext): Promise<Re
   const oidcClientSecret = readString(body, "oidcClientSecret");
   const oidcScopes = readString(body, "oidcScopes");
   const oidcRedirectUri = readString(body, "oidcRedirectUri");
+  const oidcAvatarClaim = readString(body, "oidcAvatarClaim");
   const status = "status" in body ? readStatus(body.status) : null;
   if ("status" in body && !status) {
     return jsonFailure("机构状态无效");
@@ -77,6 +78,9 @@ export async function PATCH(request: Request, context: RouteContext): Promise<Re
   if ("oidcAutoProvision" in body && oidcAutoProvision === null) {
     return jsonFailure("OIDC自动开户配置无效");
   }
+  if (oidcEnabled === true && (!oidcIssuerUrl || !oidcClientId)) {
+    return jsonFailure("启用 OIDC 前请填写 Issuer URL 和 Client ID");
+  }
 
   if (
     !name &&
@@ -89,6 +93,7 @@ export async function PATCH(request: Request, context: RouteContext): Promise<Re
     !oidcClientSecret &&
     !oidcScopes &&
     !oidcRedirectUri &&
+    !oidcAvatarClaim &&
     oidcAutoProvision === null
   ) {
     return jsonFailure("请至少填写一个要更新的字段");
@@ -105,6 +110,7 @@ export async function PATCH(request: Request, context: RouteContext): Promise<Re
     oidcClientSecret?: string;
     oidcScopes?: string;
     oidcRedirectUri?: string;
+    oidcAvatarClaim?: string;
     oidcAutoProvision?: boolean;
     updatedAt: Date;
   } = {
@@ -141,6 +147,9 @@ export async function PATCH(request: Request, context: RouteContext): Promise<Re
   if (oidcRedirectUri) {
     updateValues.oidcRedirectUri = oidcRedirectUri;
   }
+  if (oidcAvatarClaim) {
+    updateValues.oidcAvatarClaim = oidcAvatarClaim;
+  }
   if (oidcAutoProvision !== null) {
     updateValues.oidcAutoProvision = oidcAutoProvision;
   }