From 3b6f52da80d2814798688ab37f7f5f9fff2f86c5 Mon Sep 17 00:00:00 2001
From: Your Name <you@example.com>
Date: Thu, 16 Apr 2026 14:56:15 +0800
Subject: [PATCH] =?UTF-8?q?fix(oidc):=20=E4=BF=AE=E5=A4=8D=5Fcreate=5Foidc?=
 =?UTF-8?q?=5Fbinding=5Fplaceholder=E8=B7=A8session=E4=B8=80=E8=87=B4?=
 =?UTF-8?q?=E6=80=A7=E9=97=AE=E9=A2=98=20-=20=E4=BD=BF=E7=94=A8=E5=90=8C?=
 =?UTF-8?q?=E4=B8=80=E4=B8=AAdb=20session=E5=88=9B=E5=BB=BA=E5=8D=A0?=
 =?UTF-8?q?=E4=BD=8D=E8=AE=B0=E5=BD=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/package/yuxi/services/oidc_service.py | 32 ++++++++++---------
 1 file changed, 17 insertions(+), 15 deletions(-)

diff --git a/backend/package/yuxi/services/oidc_service.py b/backend/package/yuxi/services/oidc_service.py
index 9d3f81eb..aeed2a23 100644
--- a/backend/package/yuxi/services/oidc_service.py
+++ b/backend/package/yuxi/services/oidc_service.py
@@ -556,10 +556,9 @@ async def _create_oidc_binding_placeholder(db, sub: str, target_user: User) -> N
     占位用户标记为 is_deleted=1（不参与实际登录），仅用于存储绑定关系，
     find_user_by_oidc_sub 查询时会读取该占位记录并解析出绑定的真实用户，
     这样就能在不修改User表结构的前提下，保持绑定关系可验证，防止账号冒用。
-    """
-    from yuxi.repositories.user_repository import UserRepository
-    user_repo = UserRepository()
 
+    使用传入的同一个 db session，避免跨session一致性问题。
+    """
     # 占位用户格式: oidc:{sub}:{target_user_id}，这样find_user_by_oidc_sub可以解析出目标用户ID
     oidc_placeholder_id = f"oidc:{sub}:{target_user.id}"
     # 占位用户标记为 deleted，查询时需要特别包括deleted才能找到
@@ -572,21 +571,24 @@ async def _create_oidc_binding_placeholder(db, sub: str, target_user: User) -> N
     random_password = secrets.token_urlsafe(32)
     password_hash = AuthUtils.hash_password(random_password)
 
+    placeholder_user = User(
+        username=f"oidc-binding-{sub[:8]}",
+        user_id=oidc_placeholder_id,
+        phone_number=None,
+        avatar=None,
+        password_hash=password_hash,
+        role=target_user.role,
+        department_id=target_user.department_id,
+        is_deleted=1,  # 标记为deleted，不参与实际登录
+        last_login=utc_now_naive(),
+    )
+
     try:
-        await user_repo.create({
-            "username": f"oidc-binding-{sub[:8]}",
-            "user_id": oidc_placeholder_id,
-            "phone_number": None,
-            "avatar": None,
-            "password_hash": password_hash,
-            "role": target_user.role,
-            "department_id": target_user.department_id,
-            "is_deleted": 1,  # 标记为deleted，不参与实际登录
-            "last_login": utc_now_naive(),
-        })
+        db.add(placeholder_user)
+        await db.commit()
         logger.info(f"Created OIDC binding placeholder (deleted) for sub {sub} -> user {target_user.id} ({target_user.user_id})")
     except IntegrityError:
-        # 并发创建冲突，忽略
+        # 并发创建冲突，回滚后忽略
         await db.rollback()
         logger.info(f"OIDC binding placeholder already exists for sub {sub}")