Support OIDC authentication

app/appearance/langs/en_US.json

@@ -87,7 +87,7 @@
   "removeButKeepRelationField": "Remove only this field, keep bidirectional relation field",
   "exportPDFLowMemory": "Insufficient available memory to export this PDF, please reduce the content or increase available memory and try exporting again",
   "exportConf": "Export settings",
-  "exportConfTip": "Account, access authorization code, synchronization, API token and data repo key will not be exported",
+  "exportConfTip": "Account, auth settings, synchronization, API token and data repo key will not be exported",
   "importConf": "Import settings",
   "importConfTip": "After importing, the current settings will be overwritten and the application will be automatically closed, please restart manually",
   "jumpToPage": "Jump to the specified page: 1 ~ ${x}",
@@ -1281,7 +1281,55 @@
   "about3": "Please use the Chrome browser and keep it in the same network as the computer, port <code class='fn__code'>${port}</code>(In addition to the random port, the first started workspace will also automatically listen to <code class='fn__code'>6806</code> as a fixed port, so that it is convenient for the browser to clip extensions or other external programs to call the kernel interface), the addresses that may be connected are as follows: ",
   "about4": "Open browser",
   "about5": "Access authorization code",
-  "about6": "After configuration, it will be used as the access authentication password, leave it blank to close the authentication",
+  "about6": "After configuration, it enables access-code authentication; leave empty to disable this method",
+  "accessAuthCodeDisableWarning": "If you want to disable access-code authentication and only keep OIDC, make sure OIDC is configured first, otherwise you may lose a fallback access method",
+  "accessAuthBypass": "Bypass access authentication",
+  "accessAuthBypassTip": "Skip all access code, OIDC checks and mandatory safety checks (not recommended)",
+  "accessAuthBypassConfirm": "Are you sure you want to bypass all access authentication and security checks? This will allow anyone to access without credentials.",
+  "accessAuthBypassAuthCodeDisabledTip": "Access authorization code is disabled because bypass is enabled.",
+  "accessAuthBypassOIDCDisabledTip": "OIDC settings are disabled because bypass is enabled.",
+  "oidc": "OIDC Login",
+  "oidcTip": "Configure OIDC login authentication",
+  "oidcEnabled": "Enable OIDC",
+  "oidcEnabledTip": "Keep configuration even when disabled",
+  "oidcProvider": "Provider",
+  "oidcProviderTip": "Select a provider or choose Disable to turn off OIDC",
+  "oidcProviderCustom": "Custom OIDC",
+  "oidcProviderConfig": "Provider configuration",
+  "oidcProviderLabel": "Button label",
+  "oidcProviderLabelTip": "Text shown on the login button",
+  "oidcClientID": "Client ID",
+  "oidcClientIDTip": "From your provider application settings",
+  "oidcClientSecret": "Client Secret",
+  "oidcClientSecretTip": "From your provider application settings",
+  "oidcPKCETip": "Use PKCE instead of client secret",
+  "oidcIssuerURL": "Issuer URL",
+  "oidcIssuerURLTip": "Issuer/Discovery URL from the provider",
+  "oidcRedirectURL": "Redirect URL",
+  "oidcRedirectURLTip": "Optional; leave empty to use the local callback",
+  "oidcScopes": "Scopes",
+  "oidcScopesTip": "Separate with commas or spaces",
+  "oidcTenant": "Tenant",
+  "oidcTenantTip": "Tenant ID for Microsoft (optional)",
+  "oidcClaimMap": "Claim map",
+  "oidcClaimMapTip": "Optional: map provider claim fields to SiYuan standard claim fields",
+  "oidcClaimMapInvalid": "Invalid claim map line: ${line}",
+  "oidcClaimMapRowInvalid": "Claim map rule is incomplete",
+  "oidcClaimMapAdd": "Add mapping",
+  "oidcClaimMapValuePlaceholder": "Provider claim key",
+  "oidcFilters": "Access filters",
+  "oidcFiltersTip": "Add rules to restrict which accounts can sign in.",
+  "oidcFiltersTipLine1": "1. Any rule under the same item can match",
+  "oidcFiltersTipLine2": "2. Different items must all match",
+  "oidcFiltersInvalid": "Invalid filter line: ${line}",
+  "oidcFiltersRowInvalid": "Filter rule is incomplete",
+  "oidcFilterAdd": "Add rule",
+  "oidcFilterClaimPlaceholder": "Claim",
+  "oidcFilterPatternPlaceholder": "Pattern",
+  "oidcFilterOpRegex": "Regex",
+  "oidcFilterOpRegexI": "Regex (ignore case)",
+  "oidcFilterOpString": "Equals (ignore case)",
+  "oidcFilterOpExact": "Equals",
   "about7": "Follow system lock screen",
   "about8": "When enabled, the application will be automatically locked when locking the system screen",
   "about11": "Network serving",
@@ -1610,7 +1658,7 @@
     "169": "Uploading data repo file %v/%v",
     "170": "Uploading data repo chunk %v/%v",
     "171": "Uploading data repo reference %s",
-    "172": "If you forget the authorization code, please find help <a href=\"https://liuyun.io/article/1686530886208\" target=\"_blank\">here</a>",
+    "172": "If you forget the authorization, please find help <a href=\"https://liuyun.io/article/1686530886208\" target=\"_blank\">here</a>",
     "173": "Please enter the access auth code",
     "174": "Unlock access",
     "175": "Please enter the verification code",
@@ -1713,6 +1761,22 @@
     "272": "Unnamed field",
     "273": "Do not create the workspace in the partition root path, please create a new folder as the workspace",
     "274": "This folder contains other files, please create a new folder as the workspace",
-    "275": "Cannot open documents created by a newer version. Please upgrade to the latest version and try again"
+    "275": "Cannot open documents created by a newer version. Please upgrade to the latest version and try again",
+    "276": "OIDC authentication failed, please start login again",
+    "277": "OIDC session is invalid, please start login again",
+    "278": "OIDC authentication was rejected by policy",
+    "279": "In Docker mode, you must enable at least one auth method, or enable access auth bypass",
+    "280": "OIDC is not enabled. Please enable it in Settings and try again",
+    "281": "OIDC provider [%s] failed to initialize. Please check the configuration",
+    "282": "Authentication Successful, you can now close this window and return to the application",
+    "283": "Authentication Failed, please return to SiYuan",
+    "284": "OIDC session has expired, please start login again",
+    "285": "OIDC session already handled, no further action is required",
+    "286": "OIDC callback parameters are missing, please start login again",
+    "287": "OIDC provider mismatch, please check the configuration",
+    "288": "Failed to save OIDC session, please retry or check storage permissions",
+    "289": "OIDC login failed, please retry",
+    "290": "OIDC login timed out, please retry",
+    "291": "Failed to fetch OIDC login status, please make sure your network connection is normal"
   }
 }

app/appearance/langs/zh_CN.json

@@ -87,7 +87,7 @@
   "removeButKeepRelationField": "仅删除本字段，保留双向关联字段",
   "exportPDFLowMemory": "系统可用内存不足，无法导出该 PDF，请减少内容或者增加可用内存后再尝试导出",
   "exportConf": "导出设置",
-  "exportConfTip": "账号、访问授权码、同步、API token 和数据仓库密钥不会被导出",
+  "exportConfTip": "账号、认证设置、同步、API token 和数据仓库密钥不会被导出",
   "importConf": "导入设置",
   "importConfTip": "导入后会覆盖当前设置并自动关闭应用，请手动重启",
   "jumpToPage": "跳转到指定页：1 ~ ${x}",
@@ -1281,7 +1281,55 @@
   "about3": "请使用 Chrome 浏览器并保持和电脑在同一个网络内，端口 <code class='fn__code'>${port}</code>（第一个启动的工作空间除了随机端口外也会自动监听 <code class='fn__code'>6806</code> 作为固定端口，以方便浏览器剪藏扩展或者其他外部程序调用内核接口），可能连通的网络地址：",
   "about4": "打开浏览器",
   "about5": "访问授权码",
-  "about6": "配置后作为访问鉴权密码，留空则关闭鉴权",
+  "about6": "配置后开启授权码访问认证方式，留空则关闭该认证方式",
+  "accessAuthCodeDisableWarning": "如需关闭访问授权码方式，仅保留 OIDC 认证，请先确保 OIDC 已配置完成，否则可能失去后备访问方式",
+  "accessAuthBypass": "绕过访问认证",
+  "accessAuthBypassTip": "跳过访问授权码、OIDC 等所有认证和强制安全检查（不推荐）",
+  "accessAuthBypassConfirm": "确定要绕过所有访问认证和安全检查吗？这将允许任何人无需凭据即可访问。",
+  "accessAuthBypassAuthCodeDisabledTip": "已开启绕过访问认证，访问授权码设置已禁用。",
+  "accessAuthBypassOIDCDisabledTip": "已开启绕过访问认证，OIDC 设置已禁用。",
+  "oidc": "OIDC 登录",
+  "oidcTip": "配置 OIDC 登录认证方式",
+  "oidcEnabled": "启用 OIDC",
+  "oidcEnabledTip": "关闭后仍保留配置",
+  "oidcProvider": "提供方",
+  "oidcProviderTip": "选择提供方，选择禁用可关闭 OIDC 登录",
+  "oidcProviderCustom": "自定义 OIDC",
+  "oidcProviderConfig": "提供方配置",
+  "oidcProviderLabel": "按钮名称",
+  "oidcProviderLabelTip": "显示在登录页按钮上的文字",
+  "oidcClientID": "Client ID",
+  "oidcClientIDTip": "提供方应用配置中的 Client ID",
+  "oidcClientSecret": "Client Secret",
+  "oidcClientSecretTip": "提供方应用配置中的 Client Secret",
+  "oidcPKCETip": "启用 PKCE 代替 Client Secret",
+  "oidcIssuerURL": "Issuer URL",
+  "oidcIssuerURLTip": "提供方的 Issuer/Discovery 地址",
+  "oidcRedirectURL": "Redirect URL",
+  "oidcRedirectURLTip": "可选，留空默认回调本地",
+  "oidcScopes": "Scopes",
+  "oidcScopesTip": "可用逗号或空格分隔",
+  "oidcTenant": "Tenant",
+  "oidcTenantTip": "Microsoft 的租户 ID（可选）",
+  "oidcClaimMap": "Claim 映射",
+  "oidcClaimMapTip": "可选，将提供方的 Claim 字段映射到思源内部标准 Claim 字段",
+  "oidcClaimMapInvalid": "Claim 映射格式错误：${line}",
+  "oidcClaimMapRowInvalid": "Claim 映射未填写完整",
+  "oidcClaimMapAdd": "添加映射",
+  "oidcClaimMapValuePlaceholder": "提供方 Claim 字段",
+  "oidcFilters": "访问过滤规则",
+  "oidcFiltersTip": "按需添加规则，限制可登录账户。",
+  "oidcFiltersTipLine1": "1. 同一项多条规则，匹配任意一条即可",
+  "oidcFiltersTipLine2": "2. 不同项需要同时匹配",
+  "oidcFiltersInvalid": "过滤规则格式错误：${line}",
+  "oidcFiltersRowInvalid": "过滤规则未填写完整",
+  "oidcFilterAdd": "添加规则",
+  "oidcFilterClaimPlaceholder": "Claim",
+  "oidcFilterPatternPlaceholder": "规则",
+  "oidcFilterOpRegex": "正则",
+  "oidcFilterOpRegexI": "正则（忽略大小写）",
+  "oidcFilterOpString": "相等（忽略大小写）",
+  "oidcFilterOpExact": "相等",
   "about7": "跟随系统锁屏",
   "about8": "启用后将会在系统锁屏时自动锁定应用",
   "about11": "网络伺服",
@@ -1610,7 +1658,7 @@
     "169": "正在上传数据仓库文件 %v/%v",
     "170": "正在上传数据仓库分块 %v/%v",
     "171": "正在上传数据仓库引用 %s",
-    "172": "如果你忘记了授权码，请在<a href=\"https://ld246.com/article/1649901726096\" target=\"_blank\">这里</a>寻求帮助",
+    "172": "如果你忘记了认证方式，请在<a href=\"https://ld246.com/article/1649901726096\" target=\"_blank\">这里</a>寻求帮助",
     "173": "请输入访问授权码",
     "174": "解锁访问",
     "175": "请输入验证码",
@@ -1713,6 +1761,22 @@
     "272": "未命名字段",
     "273": "请勿在分区根路径上创建工作空间，请新建一个文件夹作为工作空间",
     "274": "该文件夹包含了其他文件，请新建一个文件夹作为工作空间",
-    "275": "无法打开新版本创建的文档，请升级到最新版本后再试"
+    "275": "无法打开新版本创建的文档，请升级到最新版本后再试",
+    "276": "OIDC 认证失败，请重新发起登录",
+    "277": "OIDC 会话无效，请重新发起登录",
+    "278": "OIDC 认证被策略拒绝",
+    "279": "Docker 模式下必须至少启用一种认证方式，或开启绕过访问认证",
+    "280": "OIDC 未启用，请在设置中开启后重试",
+    "281": "OIDC 提供方 [%s] 初始化失败，请检查配置",
+    "282": "认证成功，您现在可以关闭此窗口并返回应用",
+    "283": "认证失败，请返回思源笔记",
+    "284": "OIDC 会话已过期，请重新发起登录",
+    "285": "OIDC 会话已处理，无需重复操作",
+    "286": "OIDC 回调参数缺失，请重新发起登录",
+    "287": "OIDC 提供方不匹配，请检查配置",
+    "288": "OIDC 会话保存失败，请重试或检查存储权限",
+    "289": "OIDC 登录失败，请重试",
+    "290": "OIDC 登录超时，请重试",
+    "291": "OIDC 获取登录状态失败，请确保网络连接正常"
   }
 }