feat(comments): Artalk SSO 免二次登录进管理后台

- 新增 internal/commentssso:admin 签发短时(60s)opaque token,Artalk
  /sso/exchange 经 {issuer}/userinfo 兑换身份(无需 JWT/密钥/发现文档)
- SSO 路由仅 VANBLOG_COMMENTS_SSO_ENABLED=1 时注册,默认零攻击面;
  /token 端点仅 admin 可调用,/userinfo 只认有效 token
- main.go 注册 SSO 管理器;站点配置页新增「打开评论管理(免二次登录)」按钮:
  换票 → 写入 localStorage ArtalkUser → 跳转首页即具备管理员身份
- 附带 handler/manager 单元测试

Author: CornWorld

app/src/pages/admin/site.astro

@@ -164,6 +164,7 @@ const currentPalette = field('palette') || 'default';
           <input name="artalk_server" placeholder="https://comment.example.com" class="px-1.5 py-0.5" />
           <label>Artalk Site 名</label>
           <input name="artalk_site" placeholder="VanBlog" class="px-1.5 py-0.5" />
+          <button type="button" id="comments-manage-btn" class="col-span-2 justify-self-start">打开评论管理（免二次登录）</button>
         </div>
         <div id="comments-config-external" class="comments-config-group col-span-2 grid grid-cols-subgrid gap-2" style="display:none">
           <label>自定义脚本 / HTML</label>
@@ -275,6 +276,35 @@ const currentPalette = field('palette') || 'default';
         } catch (err) { alert('保存失败: ' + err.message); }
       });
 
+      // ── 评论 SSO：换票进 Artalk（免二次登录） ──
+      const manageBtn = document.getElementById('comments-manage-btn');
+      if (manageBtn) {
+        manageBtn.addEventListener('click', async () => {
+          const server = (document.querySelector('[name="artalk_server"]')?.value || '').replace(/\/+$/, '');
+          if (!server) { alert('请先填写 Artalk Server 并保存'); return; }
+          const authToken = pb.authStore?.token || '';
+          try {
+            const tokRes = await fetch('/api/vanblog/comments-sso/token', {
+              method: 'POST',
+              headers: authToken ? { 'Authorization': 'Bearer ' + authToken } : {},
+            });
+            if (!tokRes.ok) throw new Error('签发换票 token 失败');
+            const { token } = await tokRes.json();
+            const exRes = await fetch(`${server}/api/v2/sso/exchange`, {
+              method: 'POST',
+              headers: { 'Content-Type': 'application/json' },
+              body: JSON.stringify({ token }),
+            });
+            if (!exRes.ok) throw new Error('Artalk 换票失败');
+            const login = await exRes.json();
+            localStorage.setItem('ArtalkUser', JSON.stringify(login));
+            window.open('/', '_blank');
+          } catch (err) {
+            alert('评论管理登录失败：' + (err.message || err));
+          }
+        });
+      }
+
       // ── 重新加载主题：放入新主题后重扫 Caddy file_server 路由 ──
       const reloadBtn = document.getElementById('theme-reload-btn');
       const reloadStatus = document.getElementById('theme-reload-status');

vault/internal/commentssso/handler_test.go

@@ -0,0 +1,89 @@
+package commentssso
+
+import (
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+// TestUserinfoEndpoint exercises the /userinfo HTTP handler that Artalk's
+// /sso/exchange calls. It does not need a real admin auth record — the
+// handler only validates the opaque bearer token against the in-memory store.
+func TestUserinfoEndpoint(t *testing.T) {
+	scenarios := []tests.ApiScenario{
+		{
+			Name:           "valid token returns verified identity",
+			Method:         http.MethodGet,
+			URL:            ssoUserinfoRoute,
+			Headers:        map[string]string{"Authorization": "Bearer valid-token"},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"email":"admin@example.com"`,
+				`"name":"admin"`,
+				`"email_verified":true`,
+			},
+		},
+		{
+			Name:            "missing bearer token",
+			Method:          http.MethodGet,
+			URL:             ssoUserinfoRoute,
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"status":401`},
+		},
+		{
+			Name:            "invalid bearer token",
+			Method:          http.MethodGet,
+			URL:             ssoUserinfoRoute,
+			Headers:         map[string]string{"Authorization": "Bearer does-not-exist"},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"status":401`},
+		},
+		{
+			Name:            "expired bearer token",
+			Method:          http.MethodGet,
+			URL:             ssoUserinfoRoute,
+			Headers:         map[string]string{"Authorization": "Bearer expired-token"},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"status":401`},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario := scenario
+		scenario.BeforeTestFunc = func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			mgr := &Manager{app: app, store: newTokenStore()}
+			mgr.store.put("valid-token", tokenEntry{
+				email:     "admin@example.com",
+				name:      "admin",
+				expiresAt: time.Now().Add(time.Minute),
+			})
+			mgr.store.put("expired-token", tokenEntry{
+				email:     "expired@example.com",
+				name:      "expired",
+				expiresAt: time.Now().Add(-time.Second),
+			})
+			e.Router.GET(ssoUserinfoRoute, mgr.handleUserinfo)
+		}
+		scenario.Test(t)
+	}
+}
+
+// TestIssueTokenRequiresAdmin ensures the token-issuing endpoint is gated.
+// Without an Authorization header e.Auth is nil, so requireAdmin must reject.
+func TestIssueTokenRequiresAdmin(t *testing.T) {
+	scenario := tests.ApiScenario{
+		Name:            "unauthenticated is forbidden",
+		Method:          http.MethodPost,
+		URL:             ssoIssueRoute,
+		ExpectedStatus:  403,
+		ExpectedContent: []string{`"status":403`},
+		BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			mgr := &Manager{app: app, store: newTokenStore()}
+			e.Router.POST(ssoIssueRoute, mgr.handleIssueToken)
+		},
+	}
+	scenario.Test(t)
+}

vault/internal/commentssso/manager.go

@@ -0,0 +1,159 @@
+// Package commentssso implements a minimal OIDC-style SSO bridge for the
+// Artalk comment system. It lets a logged-in VanBlog admin exchange their
+// VanBlog session for a short-lived opaque token that Artalk's
+// POST /api/v2/sso/exchange endpoint can then redeem via GET /userinfo.
+//
+// Why so minimal: Artalk's /sso/exchange does NOT validate the token itself
+// (no JWT/JWKS verification) — it just forwards it as a Bearer token to
+// {issuer}/userinfo and trusts the JSON response. So the token can be an
+// opaque random string held in memory, with only the /userinfo endpoint
+// needing to recognise it. No JWT, no keys, no discovery document.
+//
+// Enabled by VANBLOG_COMMENTS_SSO_ENABLED=1 (default off). The /token
+// endpoint is admin-gated; /userinfo is unauthenticated by design (Artalk's
+// server calls it), but only returns data for a valid unexpired token.
+package commentssso
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"net/http"
+	"os"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+)
+
+const (
+	ssoIssueRoute    = "/api/vanblog/comments-sso/token"
+	ssoUserinfoRoute = "/api/vanblog/comments-sso/userinfo"
+	ssoTTL           = 60 * time.Second
+	ssoEnabledEnv    = "VANBLOG_COMMENTS_SSO_ENABLED"
+)
+
+type tokenEntry struct {
+	email     string
+	name      string
+	expiresAt time.Time
+}
+
+type tokenStore struct {
+	mu    sync.Mutex
+	items map[string]tokenEntry
+}
+
+func newTokenStore() *tokenStore {
+	return &tokenStore{items: make(map[string]tokenEntry)}
+}
+
+func (s *tokenStore) put(token string, entry tokenEntry) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	now := time.Now()
+	for k, v := range s.items {
+		if now.After(v.expiresAt) {
+			delete(s.items, k)
+		}
+	}
+	s.items[token] = entry
+}
+
+func (s *tokenStore) get(token string) (tokenEntry, bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	entry, ok := s.items[token]
+	if !ok || time.Now().After(entry.expiresAt) {
+		return tokenEntry{}, false
+	}
+	return entry, true
+}
+
+type Manager struct {
+	app   core.App
+	store *tokenStore
+}
+
+func New(app core.App) *Manager {
+	m := &Manager{app: app, store: newTokenStore()}
+	if !enabled() {
+		return m
+	}
+	app.OnServe().BindFunc(func(se *core.ServeEvent) error {
+		se.Router.POST(ssoIssueRoute, m.handleIssueToken)
+		se.Router.GET(ssoUserinfoRoute, m.handleUserinfo)
+		return se.Next()
+	})
+	return m
+}
+
+func enabled() bool {
+	v := os.Getenv(ssoEnabledEnv)
+	return v == "1" || v == "true"
+}
+
+// requireAdmin mirrors the strict admin gate used elsewhere for destructive
+// ops. The SSO bridge lets an admin impersonate themselves in Artalk, so it
+// must be admin-only — not content-manager.
+func requireAdmin(auth *core.Record) bool {
+	return auth != nil && auth.GetString("role") == "admin"
+}
+
+func (m *Manager) handleIssueToken(e *core.RequestEvent) error {
+	if !requireAdmin(e.Auth) {
+		return e.ForbiddenError("admin role required", "")
+	}
+	email := e.Auth.GetString("email")
+	if email == "" {
+		return e.BadRequestError("admin account has no email address", "")
+	}
+	name := e.Auth.GetString("name")
+	if name == "" {
+		name = strings.Split(email, "@")[0]
+	}
+	token, err := generateToken()
+	if err != nil {
+		return e.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to generate token"})
+	}
+	m.store.put(token, tokenEntry{
+		email:     email,
+		name:      name,
+		expiresAt: time.Now().Add(ssoTTL),
+	})
+	return e.JSON(http.StatusOK, map[string]string{"token": token})
+}
+
+func (m *Manager) handleUserinfo(e *core.RequestEvent) error {
+	token := bearerToken(e.Request)
+	if token == "" {
+		return e.UnauthorizedError("missing bearer token", "")
+	}
+	entry, ok := m.store.get(token)
+	if !ok {
+		return e.UnauthorizedError("invalid or expired token", "")
+	}
+	return e.JSON(http.StatusOK, map[string]any{
+		"sub":            entry.email,
+		"name":           entry.name,
+		"email":          entry.email,
+		"email_verified": true,
+	})
+}
+
+func generateToken() (string, error) {
+	b := make([]byte, 32)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(b), nil
+}
+
+func bearerToken(r *http.Request) string {
+	h := r.Header.Get("Authorization")
+	const prefix = "Bearer "
+	if len(h) > len(prefix) && strings.EqualFold(h[:len(prefix)], prefix) {
+		return strings.TrimSpace(h[len(prefix):])
+	}
+	return ""
+}

vault/internal/commentssso/manager_test.go

@@ -0,0 +1,92 @@
+package commentssso
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+	"time"
+)
+
+func TestTokenStorePutGet(t *testing.T) {
+	s := newTokenStore()
+	s.put("tok1", tokenEntry{email: "a@b.c", name: "a", expiresAt: time.Now().Add(time.Minute)})
+	got, ok := s.get("tok1")
+	if !ok || got.email != "a@b.c" || got.name != "a" {
+		t.Fatalf("get: got=%+v ok=%v", got, ok)
+	}
+}
+
+func TestTokenStoreExpired(t *testing.T) {
+	s := newTokenStore()
+	s.put("tok1", tokenEntry{email: "a@b.c", expiresAt: time.Now().Add(-time.Second)})
+	if _, ok := s.get("tok1"); ok {
+		t.Fatal("expired token unexpectedly returned")
+	}
+}
+
+func TestTokenStoreCleanupOnPut(t *testing.T) {
+	s := newTokenStore()
+	s.put("expired", tokenEntry{email: "x@y.z", expiresAt: time.Now().Add(-time.Second)})
+	s.put("fresh", tokenEntry{email: "a@b.c", expiresAt: time.Now().Add(time.Minute)})
+	if _, ok := s.get("expired"); ok {
+		t.Fatal("expired token should have been cleaned up on put")
+	}
+	if _, ok := s.get("fresh"); !ok {
+		t.Fatal("fresh token missing after cleanup")
+	}
+}
+
+func TestBearerToken(t *testing.T) {
+	r := httptest.NewRequest(http.MethodGet, "/", nil)
+	r.Header.Set("Authorization", "Bearer abc123")
+	if got := bearerToken(r); got != "abc123" {
+		t.Fatalf("got %q, want abc123", got)
+	}
+}
+
+func TestBearerTokenMissing(t *testing.T) {
+	r := httptest.NewRequest(http.MethodGet, "/", nil)
+	if got := bearerToken(r); got != "" {
+		t.Fatalf("expected empty, got %q", got)
+	}
+}
+
+func TestGenerateToken(t *testing.T) {
+	a, err := generateToken()
+	if err != nil {
+		t.Fatal(err)
+	}
+	b, err := generateToken()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if a == b {
+		t.Fatal("tokens should be unique")
+	}
+	if len(a) != 64 { // 32 random bytes hex-encoded
+		t.Fatalf("unexpected token length %d", len(a))
+	}
+}
+
+func TestEnabled(t *testing.T) {
+	old := os.Getenv(ssoEnabledEnv)
+	defer os.Setenv(ssoEnabledEnv, old)
+
+	os.Unsetenv(ssoEnabledEnv)
+	if enabled() {
+		t.Fatal("should be disabled by default")
+	}
+	os.Setenv(ssoEnabledEnv, "1")
+	if !enabled() {
+		t.Fatal("should be enabled with 1")
+	}
+	os.Setenv(ssoEnabledEnv, "true")
+	if !enabled() {
+		t.Fatal("should be enabled with true")
+	}
+	os.Setenv(ssoEnabledEnv, "0")
+	if enabled() {
+		t.Fatal("should be disabled with 0")
+	}
+}