feat: add global auth settings and pending users

modules/settings/components/GlobalSettingsClient.tsx

@@ -0,0 +1,157 @@
+"use client";
+
+import { FormEvent, useState } from "react";
+import { Globe2, Save, ShieldCheck } from "lucide-react";
+import { useRouter } from "next/navigation";
+
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { Input } from "@/components/ui/input";
+import type { ApiResult } from "@/modules/core/server/api";
+import type { SystemSettings } from "@/modules/core/types";
+
+type GlobalSettingsClientProps = {
+  settings: SystemSettings;
+};
+
+export function GlobalSettingsClient({ settings }: GlobalSettingsClientProps): React.ReactElement {
+  const router = useRouter();
+  const [message, setMessage] = useState("");
+  const [isPending, setIsPending] = useState(false);
+
+  async function handleSubmit(event: FormEvent<HTMLFormElement>): Promise<void> {
+    event.preventDefault();
+    setMessage("");
+    setIsPending(true);
+
+    const formData = new FormData(event.currentTarget);
+    const response = await fetch("/api/settings/global", {
+      method: "PATCH",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        registrationEnabled: formData.get("registrationEnabled") === "on",
+        oidcEnabled: formData.get("oidcEnabled") === "on",
+        oidcIssuerUrl: String(formData.get("oidcIssuerUrl") ?? ""),
+        oidcClientId: String(formData.get("oidcClientId") ?? ""),
+        oidcClientSecret: String(formData.get("oidcClientSecret") ?? ""),
+        oidcScopes: String(formData.get("oidcScopes") ?? ""),
+        oidcRedirectUri: String(formData.get("oidcRedirectUri") ?? ""),
+        oidcAvatarClaim: String(formData.get("oidcAvatarClaim") ?? ""),
+        oidcAutoProvision: formData.get("oidcAutoProvision") === "on",
+      }),
+    });
+    const result = (await response.json()) as ApiResult<{ settings: SystemSettings }>;
+    setIsPending(false);
+
+    if (!result.success) {
+      setMessage(result.reason);
+      return;
+    }
+
+    setMessage(result.reason);
+    router.refresh();
+  }
+
+  return (
+    <form className="grid gap-5 xl:grid-cols-[0.9fr_1.1fr]" onSubmit={handleSubmit}>
+      <Card>
+        <CardHeader>
+          <div className="flex items-center gap-2">
+            <Globe2 className="size-5 text-primary" aria-hidden="true" />
+            <CardTitle>注册与入口</CardTitle>
+          </div>
+          <CardDescription>控制全站公开注册能力和 OIDC 登录入口总开关。</CardDescription>
+        </CardHeader>
+        <CardContent className="grid gap-4">
+          <label className="flex items-center justify-between gap-4 rounded-md border p-3 text-sm">
+            <span>
+              <span className="block font-medium">开放公开注册</span>
+              <span className="block text-xs text-muted-foreground">关闭后普通注册不可用；邀请链接仍可使用。</span>
+            </span>
+            <input defaultChecked={settings.registrationEnabled} name="registrationEnabled" type="checkbox" />
+          </label>
+
+          <label className="flex items-center justify-between gap-4 rounded-md border p-3 text-sm">
+            <span>
+              <span className="block font-medium">启用 OIDC 登录</span>
+              <span className="block text-xs text-muted-foreground">作为平台级总开关，机构级 OIDC 配置仍可单独管理。</span>
+            </span>
+            <input defaultChecked={settings.oidcEnabled} name="oidcEnabled" type="checkbox" />
+          </label>
+
+          <label className="flex items-center justify-between gap-4 rounded-md border p-3 text-sm">
+            <span>
+              <span className="block font-medium">OIDC 自动开户</span>
+              <span className="block text-xs text-muted-foreground">首次 OIDC 登录时按声明信息创建账号，默认进入等待分配。</span>
+            </span>
+            <input defaultChecked={settings.oidcAutoProvision} name="oidcAutoProvision" type="checkbox" />
+          </label>
+        </CardContent>
+      </Card>
+
+      <Card>
+        <CardHeader>
+          <div className="flex items-center gap-2">
+            <ShieldCheck className="size-5 text-primary" aria-hidden="true" />
+            <CardTitle>OIDC 默认配置</CardTitle>
+          </div>
+          <CardDescription>保存标准 OIDC issuer、client、scope 和头像 claim。</CardDescription>
+        </CardHeader>
+        <CardContent className="grid gap-4">
+          <div className="grid gap-3 md:grid-cols-2">
+            <label className="grid gap-2 text-sm">
+              <span className="font-medium">Issuer URL</span>
+              <Input defaultValue={settings.oidcIssuerUrl} name="oidcIssuerUrl" placeholder="https://idp.example.com" />
+            </label>
+            <label className="grid gap-2 text-sm">
+              <span className="font-medium">Client ID</span>
+              <Input defaultValue={settings.oidcClientId} name="oidcClientId" />
+            </label>
+          </div>
+
+          <label className="grid gap-2 text-sm">
+            <span className="font-medium">Client Secret</span>
+            <Input
+              name="oidcClientSecret"
+              placeholder={settings.oidcHasClientSecret ? "已配置，留空则不修改" : "未配置"}
+              type="password"
+            />
+          </label>
+
+          <div className="grid gap-3 md:grid-cols-2">
+            <label className="grid gap-2 text-sm">
+              <span className="font-medium">Scopes</span>
+              <Input defaultValue={settings.oidcScopes} name="oidcScopes" placeholder="openid profile email" />
+            </label>
+            <label className="grid gap-2 text-sm">
+              <span className="font-medium">Redirect URI</span>
+              <Input defaultValue={settings.oidcRedirectUri} name="oidcRedirectUri" placeholder="/api/auth/oidc/callback" />
+            </label>
+          </div>
+
+          <label className="grid gap-2 text-sm">
+            <span className="font-medium">Avatar Claim</span>
+            <Input defaultValue={settings.oidcAvatarClaim} name="oidcAvatarClaim" placeholder="picture" />
+          </label>
+
+          {message ? (
+            <p className="rounded-md bg-secondary px-3 py-2 text-sm text-secondary-foreground" role="status">
+              {message}
+            </p>
+          ) : null}
+
+          <div className="flex items-center justify-between gap-3 border-t pt-4">
+            <Badge variant={settings.oidcEnabled ? "success" : "secondary"}>
+              {settings.oidcEnabled ? "OIDC 已启用" : "OIDC 未启用"}
+            </Badge>
+            <Button disabled={isPending} type="submit">
+              <Save className="size-4" aria-hidden="true" />
+              保存配置
+            </Button>
+          </div>
+        </CardContent>
+      </Card>
+    </form>
+  );
+}

modules/settings/components/OrganizationDetailClient.tsx

@@ -44,6 +44,7 @@ export function OrganizationDetailClient({
         oidcClientSecret: String(formData.get("oidcClientSecret") ?? ""),
         oidcScopes: String(formData.get("oidcScopes") ?? ""),
         oidcRedirectUri: String(formData.get("oidcRedirectUri") ?? ""),
+        oidcAvatarClaim: String(formData.get("oidcAvatarClaim") ?? ""),
         oidcAutoProvision: formData.get("oidcAutoProvision") === "on",
       }),
     });
@@ -115,6 +116,11 @@ export function OrganizationDetailClient({
               </label>
             </div>
 
+            <label className="grid gap-2 text-sm">
+              <span className="font-medium">Avatar Claim</span>
+              <Input defaultValue={organization.oidcAvatarClaim} name="oidcAvatarClaim" placeholder="picture" />
+            </label>
+
             <label className="flex items-center justify-between gap-4 rounded-md border p-3 text-sm">
               <span>
                 <span className="block font-medium">OIDC 自动开户</span>

modules/settings/components/UserManagementClient.tsx

@@ -77,6 +77,7 @@ export function UserManagementClient({
         roleId: String(formData.get("roleId") ?? ""),
         name: String(formData.get("name") ?? ""),
         email: String(formData.get("email") ?? ""),
+        avatarUrl: String(formData.get("avatarUrl") ?? ""),
         password: String(formData.get("password") ?? ""),
       }),
     });
@@ -270,6 +271,10 @@ export function UserManagementClient({
             <span className="font-medium">邮箱</span>
             <Input name="email" required type="email" />
           </label>
+          <label className="grid gap-2 text-sm">
+            <span className="font-medium">头像 URL</span>
+            <Input name="avatarUrl" placeholder="https://example.com/avatar.png" type="url" />
+          </label>
           <label className="grid gap-2 text-sm">
             <span className="font-medium">初始密码</span>
             <Input minLength={6} name="password" required type="password" />
@@ -366,6 +371,7 @@ export function UserAccountActions({
     const formData = new FormData(event.currentTarget);
     await updateAccount({
       name: String(formData.get("name") ?? ""),
+      avatarUrl: String(formData.get("avatarUrl") ?? ""),
       status: String(formData.get("status") ?? ""),
       organizationId: String(formData.get("organizationId") ?? ""),
       roleId: String(formData.get("roleId") ?? ""),
@@ -412,6 +418,10 @@ export function UserAccountActions({
             <span className="font-medium">姓名</span>
             <Input defaultValue={account.name} name="name" required />
           </label>
+          <label className="grid gap-2 text-sm">
+            <span className="font-medium">头像 URL</span>
+            <Input defaultValue={account.avatarUrl} name="avatarUrl" placeholder="https://example.com/avatar.png" type="url" />
+          </label>
           <label className="grid gap-2 text-sm">
             <span className="font-medium">状态</span>
             <select