灵策中台接入指南：灵策账号登录（OIDC）与模型调用

 你的产品(浏览器)            你的后端                 灵策中台 {issuer}                 灵策网页版
      │ 点「用灵策账号登录」     │                         │                                 │
      │──────────────────────▶│ 生成 state / nonce /     │                                 │
      │                        │ code_verifier，存会话     │                                 │
      │◀──── 302 授权地址 ──────│                         │                                 │
      │──── GET /api/oauth/site/authorize?... ─────────▶│ 校验 client_id + 回调白名单      │
      │◀──────────────────────── 302 ───────────────────│──────────── 带票据 ────────────▶│
      │──────────────────────────── 用户登录（微信/手机号/邮箱）并确认授权 ─────────────────▶│
      │◀──────────────── 302 {redirect_uri}?code=ssoc_...&state=... ───────────────────────│
      │──── 回调 ─────────────▶│ 核对 state               │                                 │
      │                        │── POST /token (code + code_verifier) ──▶│               │
      │                        │◀── access_token + user + id_token (+ refresh_token) ──│  │
      │                        │ 验 id_token（签名/iss/aud/exp/nonce）                     │
      │                        │ 用 sub 绑定本地账号，建立你自己的会话                     │
      │◀──── 登录完成 ─────────│                         │                                 │
      │                        │── 之后：POST /token (refresh_token) 续期 / GET /userinfo ─▶│

curl -s https://center.lynxce.cn/api/oauth/site/token \
  -d grant_type=authorization_code \
  -d code=ssoc_xxx \
  -d redirect_uri=https://your-app.example.com/auth/lynxce/callback \
  -d code_verifier=<发起登录时生成的 verifier> \
  -d client_id=your-app

{
  "token_type": "Bearer",
  "access_token": "ssot.…",
  "expires_in": 3600,
  "scope": "openid profile org offline_access",
  "id_token": "eyJhbGciOiJSUzI1NiIs…",
  "refresh_token": "ssorf.…",
  "user": { "id": "cm…", "displayName": "张三", "avatarUrl": "https://…", "isMember": true }
}

curl -s https://center.lynxce.cn/api/oauth/site/token \
  -d grant_type=refresh_token \
  -d refresh_token=ssorf.xxx \
  -d client_id=your-app

curl -s https://center.lynxce.cn/api/oauth/site/userinfo \
  -H "Authorization: Bearer ssot.xxx"

{ "sub": "cm…", "name": "张三", "picture": "https://…", "org_id": "…", "org_kind": "enterprise", "org_role": "admin",
  "user": { "id": "cm…", "displayName": "张三", "avatarUrl": "https://…", "isMember": true } }

https://center.lynxce.cn/api/oauth/site/logout?id_token_hint=eyJ...&post_logout_redirect_uri=https%3A%2F%2Fapp.example.com%2F&state=abc

await clearLocalSession();
res.redirect(center.logout({ idTokenHint: session.idToken, postLogoutRedirectUri: "https://app.example.com/", state }));

npm install /path/to/ai-employee-center-sdk-0.1.0.tgz

import { CenterClient, CenterOAuthError, CenterSdkError } from "@ai-employee/center-sdk";

const center = new CenterClient({
  issuer: "https://center.lynxce.cn",
  clientId: "your-app",
  redirectUri: "https://your-app.example.com/auth/lynxce/callback",
  scope: "openid profile org offline_access",
});

app.get("/auth/lynxce/login", async (req, res) => {
  const login = await center.createLoginRequest();
  req.session.lynxce = { state: login.state, nonce: login.nonce, codeVerifier: login.codeVerifier };
  res.redirect(login.url);
});

app.get("/auth/lynxce/callback", async (req, res) => {
  const pending = req.session.lynxce;
  delete req.session.lynxce; // 一次性
  if (!pending) return res.status(400).send("登录已过期，请重新登录");
  try {
    const { tokens, claims } = await center.handleCallback({
      callback: new URL(req.originalUrl, "https://your-app.example.com"),
      expectedState: pending.state,
      codeVerifier: pending.codeVerifier,
      nonce: pending.nonce,
    });
    const user = await upsertLocalUser({ lynxceId: claims!.sub, name: claims!.name, orgRole: claims!.org_role });
    await saveRefreshToken(user.id, tokens.refresh_token); // 加密存储
    req.session.userId = user.id;
    res.redirect("/");
  } catch (error) {
    if (error instanceof CenterOAuthError && error.error === "access_denied") return res.redirect("/login?cancelled=1");
    if (error instanceof CenterSdkError) return res.status(400).send(`登录失败：${error.message}`);
    throw error;
  }
});

// 续期：必须保存新的 refresh_token
async function renew(userId: string, refreshToken: string) {
  try {
    const next = await center.refresh(refreshToken);
    await saveRefreshToken(userId, next.refresh_token);
    return next;
  } catch (error) {
    if (error instanceof CenterOAuthError && error.error === "invalid_grant") {
      await clearLocalSession(userId); // 令牌已用过 / 用户退出所有设备 / 改了密码：要求重新登录
      return null;
    }
    throw error;
  }
}

import { CenterClient } from "@ai-employee/center-sdk";

const center = new CenterClient({
  issuer: "https://center.lynxce.cn",
  clientId: "your-spa",
  redirectUri: `${location.origin}/auth/callback`,
  scope: "openid profile",
});

export async function login() {
  const req = await center.createLoginRequest();
  sessionStorage.setItem("lynxce_login", JSON.stringify(req)); // 只放 sessionStorage，不放 localStorage
  location.assign(req.url);
}

export async function handleCallback() {
  const pending = JSON.parse(sessionStorage.getItem("lynxce_login") ?? "null");
  sessionStorage.removeItem("lynxce_login");
  if (!pending) throw new Error("登录已过期");
  const { tokens, claims } = await center.handleCallback({
    callback: location.href,
    expectedState: pending.state,
    codeVerifier: pending.codeVerifier,
    nonce: pending.nonce,
  });
  history.replaceState(null, "", "/"); // 把 code 从地址栏清掉
  return { user: tokens.user, claims };
}

import OpenAI from "openai";

const client = new OpenAI({
  apiKey: process.env.LYNXCE_API_KEY, // sk-...
  baseURL: "https://api.lynxce.cn/api/v1",
});

const models = await client.models.list(); // 该密钥可用的模型
const completion = await client.chat.completions.create({
  model: models.data[0]!.id,
  messages: [{ role: "user", content: "你好" }],
});

curl -s https://api.lynxce.cn/api/v1/chat/completions \
  -H "Authorization: Bearer $LYNXCE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"<模型 id>","messages":[{"role":"user","content":"你好"}]}'