登录验证码接入

src/Jiaowu.Api/Controllers/SsoController.cs

@@ -22,6 +22,7 @@ public sealed class SsoController(
     UserManager<ApplicationUser> userManager,
     IAuthSessionService authSessionService,
     IDistributedCache cache,
+    ILoginCaptchaService loginCaptcha,
     IOptions<SsoOptions> options,
     ILogger<SsoController> logger) : ControllerBase
 {
@@ -46,12 +47,20 @@ public sealed class SsoController(
         [FromQuery] string? bindingIntent = null,
         [FromQuery] bool nativeApp = false,
         [FromQuery] string? nativeState = null,
+        [FromQuery] string? captchaTicket = null,
+        [FromQuery] string? deviceId = null,
         CancellationToken cancellationToken = default)
     {
         if (!_options.Enabled)
             return SsoProblem("统一身份认证尚未启用。", StatusCodes.Status404NotFound);
 
         var safeReturnUrl = NormalizeReturnUrl(returnUrl);
+        if (string.IsNullOrWhiteSpace(bindingIntent) &&
+            (string.IsNullOrWhiteSpace(captchaTicket) ||
+             !await loginCaptcha.ConsumeProofAsync(captchaTicket, deviceId, HttpContext, cancellationToken)))
+        {
+            return Unauthorized(AuthController.LoginCaptchaProblem());
+        }
         var properties = new AuthenticationProperties();
         if (nativeApp)
         {
@@ -407,7 +416,9 @@ public sealed class SsoController(
                 returnUrl = "/account",
                 bindingIntent = intentCode,
                 nativeApp,
-                nativeState
+                nativeState,
+                captchaTicket = (string?)null,
+                deviceId = (string?)null
             })!;
         return new SsoBindingStartResponse(loginUrl);
     }