From c6c2c3b1f6069c47c6e8cbc24d2d462881e0917d Mon Sep 17 00:00:00 2001
From: Your Name <you@example.com>
Date: Thu, 16 Apr 2026 10:13:39 +0800
Subject: [PATCH] =?UTF-8?q?fix(oidc):=20=E4=BF=AE=E5=A4=8Dcreate=5Foidc=5F?=
 =?UTF-8?q?user=E4=B8=ADuse=5Fraw=5Fusername=E7=9B=B4=E6=8E=A5=E8=BF=94?=
 =?UTF-8?q?=E5=9B=9E=E7=8E=B0=E6=9C=89=E7=94=A8=E6=88=B7=E7=9A=84=E5=AE=89?=
 =?UTF-8?q?=E5=85=A8=E9=97=AE=E9=A2=98=20-=20=E9=AA=8C=E8=AF=81=E7=BB=91?=
 =?UTF-8?q?=E5=AE=9A=E5=85=B3=E7=B3=BB?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/package/yuxi/services/oidc_service.py | 23 +++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/backend/package/yuxi/services/oidc_service.py b/backend/package/yuxi/services/oidc_service.py
index 978afc8f..a6a4a3fb 100644
--- a/backend/package/yuxi/services/oidc_service.py
+++ b/backend/package/yuxi/services/oidc_service.py
@@ -590,10 +590,25 @@ async def create_oidc_user(db, user_info: dict, department_id: int | None = None
         result = await db.execute(select(User).filter(User.user_id == user_id, User.is_deleted == 0))
         existing_user = result.scalar_one_or_none()
         if existing_user:
-            # 如果用户已存在，先验证是否是同一个 sub 的旧用户（通过其他方式查找）
-            # 这里我们假设如果用户名已存在，就返回现有用户，让后续逻辑处理
-            logger.info(f"User with raw username {user_id} already exists, returning existing user")
-            return existing_user
+            # 用户已存在，必须验证当前sub是否已经绑定到这个用户
+            # 如果sub未绑定该用户，不能直接复用，存在账号冒用风险
+            user_by_sub = await find_user_by_oidc_sub(db, sub)
+            if user_by_sub and user_by_sub.id == existing_user.id:
+                # sub 已经正确绑定到该用户，允许返回
+                logger.info(f"User with raw username {user_id} already exists and bound to sub {sub}, returning existing user")
+                return existing_user
+            elif user_by_sub is None:
+                # sub 尚未绑定任何用户，可以将sub绑定到这个现有用户
+                logger.info(f"Binding new OIDC sub {sub} to existing user with raw username {user_id}")
+                await _create_oidc_binding_placeholder(db, sub, existing_user)
+                return existing_user
+            else:
+                # sub 已经绑定到另一个用户，冲突，拒绝创建
+                logger.warning(f"Cannot create OIDC user with raw username {user_id}: sub {sub} is already bound to another user {user_by_sub.id}, conflict")
+                raise HTTPException(
+                    status_code=status.HTTP_409_CONFLICT,
+                    detail=f"用户名 {user_id} 已存在且OIDC标识 {sub} 已绑定到其他账号，请联系管理员处理冲突",
+                )
     else:
         user_id = f"oidc:{sub}"