Logto：面向 SaaS 和 AI 应用的现代化开源身份认证基础设施

// packages/core/src/oidc/routes/authorization.ts (概念性代码)
router.get('/oidc/auth', async (ctx) => {
  const { client_id, redirect_uri, scope, response_type } = ctx.query;
  
  // 1. 验证 Client 合法性
  const client = await validateClient(client_id, redirect_uri);
  
  // 2. 用户认证（跳转登录页 or 会话复用）
  const user = await authenticateUser(ctx);
  
  // 3. 授权确认（首次授权时显示 Consent 页面）
  const consent = await getOrCreateConsent(user.id, client.id, scope);
  
  // 4. 生成 Authorization Code
  const code = await issueAuthorizationCode({
    client, user, scope, ...
  });
  
  // 5. 重定向回 RP (Relying Party)
  ctx.redirect(`${redirect_uri}?code=${code}&state=${state}`);
});

-- Organization 表（简化）
CREATE TABLE organizations (
  id VARCHAR(21) PRIMARY KEY,
  tenant_id VARCHAR(21) NOT NULL,
  name VARCHAR(128) NOT NULL,
  description TEXT,
  branding JSONB,  -- Logo, colors, favicon
  created_at TIMESTAMPTZ DEFAULT NOW()
);

-- 用户-组织关联
CREATE TABLE organization_members (
  id VARCHAR(21) PRIMARY KEY,
  organization_id VARCHAR(21) REFERENCES organizations(id),
  user_id VARCHAR(21) REFERENCES users(id),
  roles VARCHAR(21)[],  -- 组织角色数组
  created_at TIMESTAMPTZ DEFAULT NOW()
);

// 概念代码：生成 Access Token 时注入权限
async function issueAccessToken(userId, clientId, organizationId) {
  const roles = await getUserRolesInOrganization(userId, organizationId);
  const scopes = roles.flatMap(role => role.scopes.map(s => s.name));
  
  return signJWT({
    sub: userId,
    aud: clientId,
    scope: scopes.join(' '),  // "read:order write:order"
    organization_id: organizationId,
  });
}

// Agent 使用 Token Exchange 模拟用户
const response = await fetch('https://auth.example.com/oidc/token', {
  method: 'POST',
  body: new URLSearchParams({
    grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
    subject_token: agentAccessToken,
    subject_token_type: 'urn:ietf:params:oauth:token-type:access_token',
    actor_token: userConsentToken,  // 用户授权
    scope: 'read:profile write:order',
  }),
});

# 下载 docker-compose.yml
curl -fsSL https://raw.githubusercontent.com/logto-io/logto/HEAD/docker-compose.yml | \
  docker compose -p logto -f - up

# 访问 http://localhost:3001 完成初始化设置

# docker-compose.yml（简化）
services:
  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_PASSWORD: password
      POSTGRES_DB: logto

  redis:
    image: redis:7-alpine

  logto:
    image: svhd/logto:latest
    depends_on: [postgres, redis]
    ports:
      - "3001:3001"
      - "3002:3002"  # Management Console
    environment:
      DB_URL: postgresql://postgres:password@postgres:5432/logto
      REDIS_URL: redis://redis:6379

# 1. Fork & Clone 仓库
git clone https://github.com/logto-io/logto.git
cd logto

# 2. 安装依赖（使用 pnpm）
pnpm install

# 3. 配置环境变量
cp .env.example .env

# 4. 启动 PostgreSQL 和 Redis（本地或 Docker）
# 确保 .env 中的 DB_URL 和 REDIS_URL 正确

# 5. 运行数据库迁移
pnpm cli db migrate

# 6. 启动开发服务器
pnpm dev

pnpm add @logto/next

// app/logto.ts
import { UserScope, LogtoNextConfig } from '@logto/next';

export const logtoConfig: LogtoNextConfig = {
  appId: process.env.LOGTO_APP_ID!,
  appSecret: process.env.LOGTO_APP_SECRET!,
  endpoint: 'http://localhost:3001',
  baseUrl: 'http://localhost:3000',
  cookieSecret: 'your-cookie-secret-32-chars-minimum',
  cookieSecure: process.env.NODE_ENV === 'production',
  scopes: [
    UserScope.Email,
    UserScope.Phone,
    UserScope.Profile,
    UserScope.Organizations,  // 如果需要多租户
  ],
};

// app/api/sign-in/route.ts
import { getLogtoContext, signIn } from '@logto/next/server-actions';
import { logtoConfig } from '@/app/logto';
import { redirect } from 'next/navigation';

export async function GET() {
  await signIn(logtoConfig);
  redirect('/');
}

// app/api/callback/route.ts
import { handleSignIn } from '@logto/next/server-actions';
import { logtoConfig } from '@/app/logto';

export async function GET(request: Request) {
  const url = new URL(request.url);
  await handleSignIn(logtoConfig, url.searchParams.toString());
  redirect('/dashboard');
}

// app/dashboard/page.tsx
import { getLogtoContext } from '@logto/next/server-actions';
import { logtoConfig } from '@/app/logto';

export default async function DashboardPage() {
  const { claims, isAuthenticated } = await getLogtoContext(logtoConfig);

  if (!isAuthenticated) {
    redirect('/');
  }

  return (
    <div>
      <h1>欢迎，{claims?.username}！</h1>
      <p>邮箱：{claims?.email}</p>
      <p>组织：{claims?.organizations?.join(', ')}</p>
    </div>
  );
}

// 1. 创建 Organization（通过 Management API）
await fetch('https://your-logto-endpoint/api/organizations', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${managementApiToken}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    name: 'Acme Corp',
    description: 'Acme Corporation Tenant',
    branding: {
      logoUrl: 'https://acme.com/logo.png',
      primaryColor: '#1a73e8',
    },
  }),
});

// 2. 邀请用户加入 Organization
await fetch(`/api/organizations/{org_id}/members`, {
  method: 'POST',
  body: JSON.stringify({
    email: '[email protected]',
    roleNames: ['admin'],
  }),
});

// 3. 用户登录时选择 Organization
// Logto Experience UI 会自动显示用户的 Organization 列表

// Next.js Middleware：验证 Access Token 和 Scope
import { verifyToken } from '@logto/next/middleware';

export async function middleware(request: NextRequest) {
  const token = request.headers.get('Authorization')?.replace('Bearer ', '');
  
  if (!token) {
    return new Response('Unauthorized', { status: 401 });
  }

  const payload = await verifyToken(token, {
    issuer: 'http://localhost:3001',
    audience: 'https://api.yourapp.com',
  });

  // 检查 Scope
  const scopes = payload.scope?.split(' ') || [];
  if (!scopes.includes('read:order')) {
    return new Response('Forbidden', { status: 403 });
  }

  // 检查 Organization
  if (payload.organization_id !== request.headers.get('X-Org-Id')) {
    return new Response('Invalid Organization', { status: 403 });
  }

  return NextResponse.next();
}

"preinstall": "npx only-allow pnpm"

npm install -g pnpm@^10.0.0
pnpm install

# 查看待执行的迁移脚本
pnpm cli db alteration list

# 执行迁移
pnpm cli db alter --revision <target_revision>

# .env
REDIS_URL=redis://your-redis-host:6379
REDIS_PASSWORD=your-redis-password

# 可选：会话 TTL（秒）
SESSION_TTL_IN_SECONDS=86400

DB_URL=postgresql://user:pass@host:5432/logto?pool_max=20&pool_idle_timeout=30000

// packages/experience 中可以通过环境变量注入自定义组件
// 具体参考官方文档：https://docs.logto.io/customization/override-experience