From 5aedfe2695518de4cdb4fc300c13847abeda11d9 Mon Sep 17 00:00:00 2001
From: wxg0103 <727495428@qq.com>
Date: Tue, 3 Nov 2026 14:15:18 +0800
Subject: [PATCH] chore: enhance access token handling and improve query
 parameter management

---
 apps/common/auth/constants/group_constants.py        |  2 +-
 .../access-restriction/AccessRestrictionDrawer.vue   |  8 ++++++--
 .../access-restriction/ButtonAccessRestriction.vue   |  5 ++++-
 ui/src/views/application-detail/overview/index.vue   |  7 ++++++-
 ui/src/views/chat/login/index.vue                    | 12 +++++++++---
 .../authentication/components/CAS.vue                |  2 +-
 .../authentication/components/LoginSetting.vue       |  2 +-
 7 files changed, 28 insertions(+), 10 deletions(-)

diff --git a/apps/common/auth/constants/group_constants.py b/apps/common/auth/constants/group_constants.py
index d57d2165fea..66c56f46fe8 100644
--- a/apps/common/auth/constants/group_constants.py
+++ b/apps/common/auth/constants/group_constants.py
@@ -67,7 +67,7 @@ class Group(Enum):
     # 对话相关
     CHAT_USER_GROUP = ("CHAT_USER_GROUP", _("Chat User Group"))
     CHAT_USER_AUTH = ("CHAT_USER_AUTH", _("Chat User Auth"))
-    PORTAL = ("PORTAL", _("portal"))
+    PORTAL = ("PORTAL", _("Portal Setting"))
     # 其他
     OTHER = ("OTHER", _("Other"))
     HOMEPAGE = ("HOMEPAGE", _("Home page"))
diff --git a/ui/src/views/application-detail/overview/access-restriction/AccessRestrictionDrawer.vue b/ui/src/views/application-detail/overview/access-restriction/AccessRestrictionDrawer.vue
index d0a66cd9ead..fa773e428a5 100644
--- a/ui/src/views/application-detail/overview/access-restriction/AccessRestrictionDrawer.vue
+++ b/ui/src/views/application-detail/overview/access-restriction/AccessRestrictionDrawer.vue
@@ -9,9 +9,11 @@ import { LOGIN_METHOD_LABELS } from '@/constants/auth'
 import { useStore } from '@/stores/admin'
 import { MsgSuccess } from '@/utils/message'
 import { useApplicationDetailContext } from '../../context'
+import type { ApplicationAccessToken } from '@/api/types'
 
 defineOptions({ name: 'AccessRestrictionDrawer' })
 
+const props = defineProps<{ initialConfig?: ApplicationAccessToken }>()
 const emit = defineEmits<{ closed: [] }>()
 const { auth } = useStore()
 const { applicationId, resourceApi } = useApplicationDetailContext()
@@ -49,8 +51,10 @@ function handleLoginMethodsChange() {
 function loadAccessRestriction() {
   if (loading.value) return
   loading.value = true
-  return resourceApi.application
-    .getAccessToken(applicationId.value)
+  // 优先复用概览页已获取的配置，避免重复请求 access_token 接口。
+  const fetchConfig = () =>
+    props.initialConfig ? Promise.resolve(props.initialConfig) : resourceApi.application.getAccessToken(applicationId.value)
+  return fetchConfig()
     .then((config) => {
       Object.assign(form, {
         language: config.language,
diff --git a/ui/src/views/application-detail/overview/access-restriction/ButtonAccessRestriction.vue b/ui/src/views/application-detail/overview/access-restriction/ButtonAccessRestriction.vue
index a22a98136c3..e3b8434641d 100644
--- a/ui/src/views/application-detail/overview/access-restriction/ButtonAccessRestriction.vue
+++ b/ui/src/views/application-detail/overview/access-restriction/ButtonAccessRestriction.vue
@@ -1,6 +1,9 @@
 <script setup lang="ts">
 import { ref } from 'vue'
 import AccessRestrictionDrawer from './AccessRestrictionDrawer.vue'
+import type { ApplicationAccessToken } from '@/api/types'
+
+defineProps<{ accessTokenConfig?: ApplicationAccessToken }>()
 
 defineOptions({ name: 'ButtonAccessRestriction' })
 
@@ -17,5 +20,5 @@ function handleOpenAccessRestriction() {
     <MkIcon name="icon-lock" />
     <span>访问限制</span>
   </el-button>
-  <AccessRestrictionDrawer v-if="drawerVisible" @closed="drawerVisible = false" />
+  <AccessRestrictionDrawer v-if="drawerVisible" :initial-config="accessTokenConfig" @closed="drawerVisible = false" />
 </template>
diff --git a/ui/src/views/application-detail/overview/index.vue b/ui/src/views/application-detail/overview/index.vue
index 3e06e633708..f0d16070a91 100644
--- a/ui/src/views/application-detail/overview/index.vue
+++ b/ui/src/views/application-detail/overview/index.vue
@@ -14,6 +14,7 @@ import ButtonDisplaySetting from './display-setting/ButtonDisplaySetting.vue'
 import ButtonApiKey from './api-key/ButtonApiKey.vue'
 import perm from '@/permission/index.ts'
 import { isSystemResource } from '@/utils/resource-context.ts'
+import type { ApplicationAccessToken } from '@/api/types'
 
 defineOptions({ name: 'ApplicationOverviewView' })
 defineProps<ResourceDetailPageProps>()
@@ -31,6 +32,7 @@ function applicationOverviewPermission(method: ApplicationOverviewPermissionMeth
 }
 
 /* 基本信息：Web 访问链接与访问开关 */
+const accessTokenConfig = ref<ApplicationAccessToken>()
 const accessToken = ref('')
 const webAccessActive = ref(false)
 const loading = ref(false)
@@ -57,6 +59,7 @@ function handleChangeWebAccess() {
     .then((config) => {
       webAccessActive.value = config.is_active
       accessToken.value = config.access_token
+      accessTokenConfig.value = config
       MsgSuccess(config.is_active ? '已启用' : '已禁用')
       return true
     })
@@ -79,6 +82,7 @@ function handleResetAccessToken() {
         .then((config) => {
           accessToken.value = config.access_token
           webAccessActive.value = config.is_active
+          accessTokenConfig.value = config
           MsgSuccess('刷新成功')
         })
         .finally(() => {
@@ -106,6 +110,7 @@ function handleChangeApiKeyAccess() {
 
 onMounted(() => {
   return resourceApi.application.getAccessToken(applicationId.value).then((config) => {
+    accessTokenConfig.value = config
     accessToken.value = config.access_token
     webAccessActive.value = config.is_active
     apiKeyEnabled.value = config.enable_api_key ?? false
@@ -155,7 +160,7 @@ onMounted(() => {
             <!-- 嵌入第三方 -->
             <ButtonEmbedThirdParty v-if="applicationOverviewPermission('overviewEmbed')" :share-url="accessUrl" :access-token="accessToken" />
             <!-- 访问限制 -->
-            <ButtonAccessRestriction v-if="applicationOverviewPermission('overviewAccess')" />
+            <ButtonAccessRestriction v-if="applicationOverviewPermission('overviewAccess')" :access-token-config="accessTokenConfig" />
             <!-- 显示设置 -->
             <ButtonDisplaySetting v-if="applicationOverviewPermission('overviewDisplay')" />
           </div>
diff --git a/ui/src/views/chat/login/index.vue b/ui/src/views/chat/login/index.vue
index bdb8bac7bee..941658e784a 100644
--- a/ui/src/views/chat/login/index.vue
+++ b/ui/src/views/chat/login/index.vue
@@ -49,8 +49,14 @@ const getExternalLoginUrl = (authType: LoginMethod): Promise<string> => {
     if (!config) return ''
 
     const { accessToken } = auth
-    const queryString = getRouteQueryString()
-    const callbackUrl = `${config.redirectUrl}${accessToken ? `/${accessToken}` : ''}${queryString ? `?${queryString}` : ''}`
+    // accessToken 统一放到回调地址的 query 参数中，不再拼接路径段
+    const params = new URLSearchParams()
+    if (accessToken) params.set('accessToken', accessToken)
+    new URLSearchParams(getRouteQueryString()).forEach((value, key) => {
+      if (key !== 'accessToken') params.append(key, value)
+    })
+    const queryString = params.toString()
+    const callbackUrl = `${config.redirectUrl}${queryString ? `?${queryString}` : ''}`
     if (authType === LOGIN_METHOD.CAS) {
       if (!config.ldpUri) return ''
       const separator = config.ldpUri.includes('?') ? '&' : '?'
@@ -66,7 +72,7 @@ const getExternalLoginUrl = (authType: LoginMethod): Promise<string> => {
 
     // OAuth2 通过 state 透传 accessToken
     if (!config.authEndpoint || !config.clientId) return ''
-    const redirectUrl = `${config.redirectUrl}${queryString ? `&${queryString}` : ''}`
+    const redirectUrl = `${config.redirectUrl}${queryString ? `?${queryString}` : ''}`
     const state = accessToken ? `${uuidv7()}_${accessToken}` : uuidv7()
     let url = `${config.authEndpoint}?client_id=${config.clientId}&response_type=code&redirect_uri=${redirectUrl}&state=${state}`
     if (config.scope) url += `&scope=${config.scope}`
diff --git a/ui/src/views/system/chat-management/authentication/components/CAS.vue b/ui/src/views/system/chat-management/authentication/components/CAS.vue
index a5f6e953ca7..b23bc1a9e19 100644
--- a/ui/src/views/system/chat-management/authentication/components/CAS.vue
+++ b/ui/src/views/system/chat-management/authentication/components/CAS.vue
@@ -56,7 +56,7 @@ function submit() {
   })
 }
 
-onMounted(() => loadSetting)
+onMounted(() => loadSetting())
 </script>
 
 <template>
diff --git a/ui/src/views/system/settings/authentication/components/LoginSetting.vue b/ui/src/views/system/settings/authentication/components/LoginSetting.vue
index a8826888967..aae724083c6 100644
--- a/ui/src/views/system/settings/authentication/components/LoginSetting.vue
+++ b/ui/src/views/system/settings/authentication/components/LoginSetting.vue
@@ -254,7 +254,7 @@ onActivated(() => {
           <el-option v-for="workspace in workspaceOptions" :key="workspace.id" :label="workspace.name" :value="workspace.id" />
         </el-select>
       </el-form-item>
-      <el-form-item label="用户组" v-if="form.workspace_id">
+      <el-form-item label="用户组" v-if="form.workspace_id && selectedRoleType === ROLE_TYPE.USER">
         <el-select filterable clearable multiple v-model="form.group_ids" :loading="loadingGroups" placeholder="请选择用户组" class="w-240">
           <el-option v-for="userGroup in userGroups" :key="userGroup.id" :label="userGroup.name" :value="userGroup.id" />
         </el-select>