From d95652469053022a9a8531e9cd398a711da5e381 Mon Sep 17 00:00:00 2001
From: chengcheng <chengcheng@emath.top>
Date: Mon, 20 Jul 2026 15:26:44 +0800
Subject: [PATCH] =?UTF-8?q?fix(web):=20=E4=BF=AE=E5=A4=8D=E7=9B=B8?=
 =?UTF-8?q?=E5=AF=B9=20OIDC=20=E7=99=BB=E5=BD=95=E5=9C=B0=E5=9D=80?=
 =?UTF-8?q?=E8=B7=B3=E8=BD=AC?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 apps/web/src/lib/oidc.test.ts | 26 ++++++++++++++++++++++++++
 apps/web/src/lib/oidc.ts      |  2 +-
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/apps/web/src/lib/oidc.test.ts b/apps/web/src/lib/oidc.test.ts
index 8a04a9c..78810c7 100644
--- a/apps/web/src/lib/oidc.test.ts
+++ b/apps/web/src/lib/oidc.test.ts
@@ -26,6 +26,32 @@ describe('OIDC BFF navigation', () => {
     expect(target.searchParams.has('code_challenge')).toBe(false);
   });
 
+  it('resolves the production relative API base against the browser origin', async () => {
+    vi.stubEnv('VITE_GATEWAY_API_BASE_URL', '/gateway-api');
+    vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
+      ok: true,
+      json: async () => ({
+        enabled: true,
+        oidcLogin: true,
+        loginUrl: '/api/v1/auth/oidc/login',
+        logoutUrl: '/api/v1/auth/oidc/logout',
+        status: 'active',
+      }),
+    }));
+    const assign = vi.fn();
+    vi.stubGlobal('window', {
+      location: { origin: 'https://ai.51easyai.com', pathname: '/workspace/overview', search: '', hash: '', assign },
+    });
+
+    const { startOIDCLogin } = await import('./oidc');
+    await startOIDCLogin();
+
+    const target = new URL(String(assign.mock.calls[0]?.[0]));
+    expect(target.origin).toBe('https://ai.51easyai.com');
+    expect(target.pathname).toBe('/gateway-api/api/v1/auth/oidc/login');
+    expect(target.searchParams.get('returnTo')).toBe('/workspace/overview');
+  });
+
   it('submits logout as a top-level POST without exposing tokens', async () => {
     vi.stubEnv('VITE_GATEWAY_API_BASE_URL', 'https://gateway.example.com/gateway-api');
 		vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
diff --git a/apps/web/src/lib/oidc.ts b/apps/web/src/lib/oidc.ts
index 5c39cd0..40a0a89 100644
--- a/apps/web/src/lib/oidc.ts
+++ b/apps/web/src/lib/oidc.ts
@@ -77,7 +77,7 @@ export async function startOIDCLogin() {
 	const configuration = await loadOIDCRuntimeConfiguration(true);
   if (!configuration.enabled || !configuration.oidcLogin || !configuration.loginUrl) throw new Error('统一认证未配置');
   const returnTo = `${window.location.pathname}${window.location.search}${window.location.hash}` || '/';
-	const loginURL = new URL(identityEndpointURL(configuration.loginUrl));
+	const loginURL = new URL(identityEndpointURL(configuration.loginUrl), window.location.origin);
   loginURL.searchParams.set('returnTo', returnTo.startsWith('/') ? returnTo : '/');
   window.location.assign(loginURL.toString());
 }