* feat(auth): add SSO token exchange endpoint
Adds POST /api/v2/sso/exchange — accepts an access token from an
external OIDC IdP (verified by calling the IdP's /userinfo) and issues
an Artalk session JWT for the user identified by the email claim.
Use case: a surrounding application that already runs OIDC (e.g. an
Auth0 SPA) can drive Artalk sign-in without showing Artalk's own popup
login UI. The widget reads the resulting JWT from
localStorage["ArtalkUser"].token and treats the user as fully
authenticated for is_login/is_admin checks.
Implementation:
- One new handler at server/handler/auth_sso_exchange.go (~110 lines)
- Reuses dao.FindCreateUser + common.LoginGetUserToken; same JWT
format as /user/access_token, so no client-side changes needed
- Validation by calling {issuer}/userinfo with Authorization: Bearer
— OIDC-standard, no JWKS dep added
- Gated by auth.enabled && auth.sso.enabled (404 otherwise)
- Returns the same ResponseUserLogin shape as /auth/email/login
Config additions (conf/artalk.example.yml):
auth:
sso:
enabled: false
issuer: "" # e.g. "tenant.auth0.com"
Route registered alongside the existing social-login routes in
server/server.go.
Verified by go build ./... (clean).
* chore(config): regenerate env-path cache with auth.sso entries
Required so koanf actually maps ATK_AUTH_SSO_ENABLED/ISSUER env vars
to the new auth.sso config block introduced in feat: add SSO token
exchange endpoint. Without this regen the env vars are silently
ignored and the endpoint stays in its disabled state.
* docs: add sso token exchange section for auth docs
---------
Co-authored-by: qwqcode <qwqcode@gmail.com>
A new HTTP API endpoint `GET /votes/:target_name/:target_id` is now available. (See https://artalk.js.org/http-api.html#tag/Vote/operation/GetVote)
- Implement GET endpoint for retrieving vote status
- Add tests for vote functionality
Related to: #997
This is a prerequisite PR for #983.
The original `POST /votes/:type/:target_id` endpoint for creating votes has been updated to `POST /votes/:target_name/:target_id/:choice`. The `target_name` can be either `comment` or `page`, the `target_id` is a numeric value, and the `choice` can be `up` or `down`. (https://artalk.js.org/http-api.html#tag/Vote/operation/CreateVote)
The HTTP response now includes two additional fields: `is_up` and `is_down`, which indicate the user's current voting state. The `up` and `down` fields remain unchanged and continue to be of numeric type, ensuring backward compatibility with existing clients.
- Change vote endpoint to include `{target_name}` and `{choice}`
- Update vote logic to handle `up` and `down` choices
- Modify request data models and API interfaces for new vote structure
- Ensure backward compatibility with existing vote response data
- Improve vote handling and response structure
BREAKING CHANGE: Vote HTTP API endpoint have been updated. (See #997)
BREAKING CHANGE: The original Go module name was `github.com/ArtalkJS/Artalk`, which has now been modified to `github.com/artalkjs/artalk/v2` (all lowercase). This change may affect the CI pipeline or other areas if you are compiling the Artalk server and have specified the fixed Go module name. Regarding the original `-ldflags -X github.com/ArtalkJS/Artalk/internal/config.Version` and `CommitHash` definitions, please remove them, as they are now obsolete. The `Version` has been hardcoded into the Go code, and the `CommitHash` is now read from the Go build info via runtime/debug’s vcs.revision value. This change only affects the server developers and does not impact the frontend UI client.
Add function to delete all foreign key constraints when migration.
Leave relationship maintenance to the program and reduce the difficulty of database management. Because there are many different DBs and the implementation of foreign keys may be different, and the DB may not support foreign keys, so don't rely on the foreign key function of the DB system.
BREAKING CHANGE: For UpGit users: Due to security reasons, Artalk no longer allows configuring the executable file path (img_upload.upgit.exec) for upgit. Please add it to system environment variables instead.
* refactor(api): refactor HTTP API to version 2
* refactor: remove forced site_origin check
* refactor: update http client
* fix
* add more api description and error code
* reduce nestings in response structures
* separate unread
* refactor(api/comments): get comments
* refactor: frontend api module
* chore: remove vite temporary file
* chore: restore swagger file
* update
* 移除为管理员分配站点名的站点隔离功能，简化实现
* refactor pagesAllFetch
* fix ci
* remove useless codes
* limiter protected paths
* add test for version endpoint
* rename handler code files
* code file separate
* fix some bug of interacting with backend
* add fetch error class for handling
* fix and rename
* refactor: checker support both `Promise` and callback fn
* fix new checker captcha iframe url
* rename and add swagger id field
* replace tab with spaces in go comment
* chore: refine
* complete the validate tag for request fields and enable `--defaultRequired`
90% of the request fields of our API are required，100% of response fields in our API are required.
Each field add validate:"required" is easy to miss.
* replace original api client with auto-generated codes
* artalk pkg apply new api client
* artalk-sidebar pkg apply new api client
* fix issues
* fix sidebar locale conf and refactor user login
* fix and refactor captcha and limiter
* fix ui testing
* add script to build http client by swagger.json
qwqcode