feat: add global auth settings and pending users

modules/core/server/auth.ts

@@ -16,6 +16,7 @@ import {
   roles,
   sessions,
 } from "@/modules/core/server/schema";
+import { getSystemSettings } from "@/modules/core/server/system-settings";
 import type { Account, AuthContext, Membership, Organization, Permission, PublicAccount, Session } from "@/modules/core/types";
 
 const SESSION_COOKIE = "teatea_session";
@@ -48,6 +49,7 @@ function toOrganization(row: OrganizationRow): Organization {
     oidcHasClientSecret: row.oidcClientSecret.length > 0,
     oidcScopes: row.oidcScopes,
     oidcRedirectUri: row.oidcRedirectUri,
+    oidcAvatarClaim: row.oidcAvatarClaim,
     oidcAutoProvision: row.oidcAutoProvision,
     createdAt: toIsoString(row.createdAt),
     updatedAt: toIsoString(row.updatedAt),
@@ -88,6 +90,7 @@ export function toPublicAccount(account: AccountRow | Account, roleKey?: string,
     platformRoleId: "platformRoleId" in account ? account.platformRoleId ?? undefined : undefined,
     name: account.name,
     email: account.email,
+    avatarUrl: "avatarUrl" in account ? account.avatarUrl : "",
     role: roleKey ?? fallbackRole,
     organization: organization?.name ?? fallbackOrganization,
     organizationId: organization?.id ?? fallbackOrganizationId,
@@ -272,6 +275,7 @@ export async function createRegistration(input: {
   const database = getDatabase();
   const password = hashPassword(input.password);
   const expiresAt = new Date(Date.now() + SESSION_MAX_AGE_SECONDS * 1000);
+  const settings = await getSystemSettings();
 
   const created = await database.transaction(async (transaction) => {
     const normalizedEmail = normalizeEmail(input.email);
@@ -296,6 +300,9 @@ export async function createRegistration(input: {
     if (invitation && (invitation.invitation.status !== "active" || invitation.invitation.expiresAt < new Date())) {
       throw new Error("邀请链接已失效");
     }
+    if (!invitation && !settings.registrationEnabled) {
+      throw new Error("系统暂未开放注册");
+    }
 
     const targetOrganizationId = invitation?.invitation.organizationId ?? input.organizationId;
     if (targetOrganizationId && !invitation) {
@@ -320,7 +327,7 @@ export async function createRegistration(input: {
         email: normalizedEmail,
         passwordHash: password.hash,
         passwordSalt: password.salt,
-        status: targetOrganizationId && !invitation ? "pending" : "active",
+        status: "active",
       })
       .returning();
     const account = accountRows[0];
@@ -346,16 +353,14 @@ export async function createRegistration(input: {
         .where(eq(organizationInvitations.id, invitation.invitation.id));
     }
 
-    const sessionRows = targetOrganizationId && !invitation
-      ? []
-      : await transaction
-          .insert(sessions)
-          .values({
-            accountId: account.id,
-            activeOrganizationId: invitation?.invitation.organizationId,
-            expiresAt,
-          })
-          .returning();
+    const sessionRows = await transaction
+      .insert(sessions)
+      .values({
+        accountId: account.id,
+        activeOrganizationId: invitation?.invitation.organizationId,
+        expiresAt,
+      })
+      .returning();
     const session = sessionRows[0];
 
     if (targetOrganizationId && !invitation) {