feat: add global auth settings and pending users

app/api/settings/accounts/[id]/route.ts

@@ -46,6 +46,7 @@ function toOrganization(row: typeof organizations.$inferSelect): Organization {
     oidcHasClientSecret: row.oidcClientSecret.length > 0,
     oidcScopes: row.oidcScopes,
     oidcRedirectUri: row.oidcRedirectUri,
+    oidcAvatarClaim: row.oidcAvatarClaim,
     oidcAutoProvision: row.oidcAutoProvision,
     createdAt: row.createdAt.toISOString(),
     updatedAt: row.updatedAt.toISOString(),
@@ -70,6 +71,8 @@ export async function PATCH(request: Request, context: RouteContext): Promise<Re
   }
 
   const name = readString(body, "name");
+  const avatarUrl = readString(body, "avatarUrl");
+  const hasAvatarUrl = "avatarUrl" in body;
   const status = "status" in body ? readStatus(body.status) : null;
   const roleId = readString(body, "roleId");
   const requestedOrganizationId = readString(body, "organizationId");
@@ -79,7 +82,7 @@ export async function PATCH(request: Request, context: RouteContext): Promise<Re
     return jsonFailure("账号状态无效");
   }
 
-  if (!name && !status && !roleId) {
+  if (!name && !hasAvatarUrl && !status && !roleId) {
     return jsonFailure("请至少填写一个要更新的字段");
   }
 
@@ -113,9 +116,10 @@ export async function PATCH(request: Request, context: RouteContext): Promise<Re
 
   try {
     await database.transaction(async (transaction) => {
-      if (name || status) {
+      if (name || hasAvatarUrl || status) {
         const updateValues: {
           name?: string;
+          avatarUrl?: string;
           status?: AccountStatus;
           updatedAt: Date;
         } = {
@@ -124,6 +128,9 @@ export async function PATCH(request: Request, context: RouteContext): Promise<Re
         if (name) {
           updateValues.name = name;
         }
+        if (hasAvatarUrl) {
+          updateValues.avatarUrl = avatarUrl;
+        }
         if (status) {
           updateValues.status = status;
         }

app/api/settings/accounts/route.ts

@@ -76,6 +76,7 @@ export async function POST(request: Request): Promise<Response> {
 
   const name = readString(body, "name");
   const email = readString(body, "email");
+  const avatarUrl = readString(body, "avatarUrl");
   const password = readString(body, "password");
   const roleId = readString(body, "roleId");
   const organizationId = readString(body, "organizationId") || auth.context.organization?.id;
@@ -119,6 +120,7 @@ export async function POST(request: Request): Promise<Response> {
       .values({
         name,
         email: normalizedEmail,
+        avatarUrl,
         passwordHash: passwordHash.hash,
         passwordSalt: passwordHash.salt,
         status: "active",
@@ -162,6 +164,7 @@ export async function POST(request: Request): Promise<Response> {
         oidcHasClientSecret: created.organization.oidcClientSecret.length > 0,
         oidcScopes: created.organization.oidcScopes,
         oidcRedirectUri: created.organization.oidcRedirectUri,
+        oidcAvatarClaim: created.organization.oidcAvatarClaim,
         oidcAutoProvision: created.organization.oidcAutoProvision,
         createdAt: created.organization.createdAt.toISOString(),
         updatedAt: created.organization.updatedAt.toISOString(),