feat: add global auth settings and pending users

app/api/organizations/route.ts

@@ -6,6 +6,7 @@ import { requirePermission } from "@/modules/core/server/auth";
 import { getDatabase } from "@/modules/core/server/db";
 import { seedOrganizationRoles } from "@/modules/core/server/permissions";
 import { organizations } from "@/modules/core/server/schema";
+import { getSystemSettings } from "@/modules/core/server/system-settings";
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -28,11 +29,14 @@ function createSlug(name: string): string {
 
 export async function GET(): Promise<Response> {
   const database = getDatabase();
-  const rows = await database.select().from(organizations).where(eq(organizations.status, "active"));
+  const [settings, rows] = await Promise.all([
+    getSystemSettings(),
+    database.select().from(organizations).where(eq(organizations.status, "active")),
+  ]);
 
   return jsonSuccess("机构列表已加载", {
     organizations: rows
-      .filter((organization) => organization.registrationEnabled)
+      .filter((organization) => settings.registrationEnabled && organization.registrationEnabled)
       .map((organization) => ({
         id: organization.id,
         name: organization.name,
@@ -45,6 +49,7 @@ export async function GET(): Promise<Response> {
         oidcHasClientSecret: organization.oidcClientSecret.length > 0,
         oidcScopes: organization.oidcScopes,
         oidcRedirectUri: organization.oidcRedirectUri,
+        oidcAvatarClaim: organization.oidcAvatarClaim,
         oidcAutoProvision: organization.oidcAutoProvision,
         createdAt: organization.createdAt.toISOString(),
         updatedAt: organization.updatedAt.toISOString(),