fix(oauth): fix login failures and add provider icon_url config

- Fix FIND_OAUTH_LINKED_USER_SQL missing allowed_providers_mode columns
- Fix TOUCH_OAUTH_LINK_SQL json/jsonb type mismatch in COALESCE
- Add icon_url field to OAuth provider config (DB, API, frontend)
- Fix admin OAuth test: accept 404 as reachable, use system proxy

apps/aether-gateway/src/handlers/admin/auth/oauth_config.rs

@@ -28,6 +28,8 @@ pub(crate) struct AdminOAuthProviderUpsertRequest {
     #[serde(default)]
     pub(super) extra_config: Option<serde_json::Value>,
     #[serde(default)]
+    pub(super) icon_url: Option<String>,
+    #[serde(default)]
     pub(super) is_enabled: bool,
     #[serde(default)]
     pub(super) force: bool,
@@ -70,6 +72,7 @@ pub(super) fn build_admin_oauth_provider_payload(
         "frontend_callback_url": provider.frontend_callback_url,
         "attribute_mapping": provider.attribute_mapping,
         "extra_config": provider.extra_config,
+        "icon_url": provider.icon_url,
         "is_enabled": provider.is_enabled,
     })
 }
@@ -364,6 +367,10 @@ pub(super) fn build_admin_oauth_upsert_record(
         frontend_callback_url: frontend_callback_url.to_string(),
         attribute_mapping: payload.attribute_mapping,
         extra_config: payload.extra_config,
+        icon_url: payload.icon_url.and_then(|value| {
+            let value = value.trim().to_string();
+            (!value.is_empty()).then_some(value)
+        }),
         is_enabled: payload.is_enabled,
     })
 }

apps/aether-gateway/src/handlers/admin/auth/oauth_routes.rs

@@ -16,7 +16,7 @@ use axum::{
 use serde_json::json;
 use std::time::Duration;
 
-const ADMIN_OAUTH_TEST_TIMEOUT_SECS: u64 = 5;
+const ADMIN_OAUTH_TEST_TIMEOUT_SECS: u64 = 10;
 const LINUXDO_AUTHORIZATION_URL: &str = "https://connect.linux.do/oauth2/authorize";
 const LINUXDO_TOKEN_URL: &str = "https://connect.linux.do/oauth2/token";
 
@@ -54,10 +54,7 @@ async fn admin_oauth_endpoint_reachable(client: &reqwest::Client, url: &str) ->
         .send()
         .await
     {
-        Ok(response) => {
+        Ok(response) => response.status().as_u16() < 500,
-            let status = response.status();
-            status != reqwest::StatusCode::NOT_FOUND && status.as_u16() < 500
-        }
         Err(_) => false,
     }
 }
@@ -120,10 +117,16 @@ async fn build_admin_oauth_test_payload(
         }));
     };
 
-    let client = reqwest::Client::builder()
+    let proxy_snapshot = state.app().resolve_system_proxy_snapshot().await;
+    let mut client_builder = reqwest::Client::builder()
         .timeout(Duration::from_secs(ADMIN_OAUTH_TEST_TIMEOUT_SECS))
-        .redirect(reqwest::redirect::Policy::limited(3))
+        .redirect(reqwest::redirect::Policy::limited(3));
-        .build();
+    if let Some(proxy_url) = proxy_snapshot.as_ref().and_then(|p| p.url.as_deref()) {
+        if let Ok(proxy) = reqwest::Proxy::all(proxy_url) {
+            client_builder = client_builder.proxy(proxy);
+        }
+    }
+    let client = client_builder.build();
     let Ok(client) = client else {
         return Ok(json!({
             "authorization_url_reachable": false,

apps/aether-gateway/src/handlers/admin/request/system/import.rs

@@ -1885,6 +1885,7 @@ impl<'a> AdminAppState<'a> {
                         oauth_provider.extra_config,
                         "extra_config",
                     )),
+                    icon_url: None,
                     is_enabled: oauth_provider.is_enabled,
                 };
                 invalid!(record.validate().map_err(|err| err.to_string()));

apps/aether-gateway/src/oauth/identity_repo.rs

@@ -16,6 +16,8 @@ const LINUXDO_USERINFO_URL: &str = "https://connect.linux.do/api/user";
 pub(crate) struct IdentityOAuthProviderSummary {
     pub(crate) provider_type: String,
     pub(crate) display_name: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub(crate) icon_url: Option<String>,
 }
 
 #[derive(Debug, Clone, PartialEq, Serialize)]
@@ -77,6 +79,7 @@ pub(crate) async fn list_enabled_identity_oauth_providers(
         .map(|provider| IdentityOAuthProviderSummary {
             provider_type: provider.provider_type,
             display_name: provider.display_name,
+            icon_url: provider.icon_url,
         })
         .collect::<Vec<_>>();
     providers.sort_by(|left, right| left.provider_type.cmp(&right.provider_type));

crates/aether-data/migrations/mysql/20260517000000_add_oauth_provider_icon_url.sql

@@ -0,0 +1 @@
+ALTER TABLE oauth_providers ADD COLUMN icon_url VARCHAR(500);

crates/aether-data/migrations/postgres/20260517000000_add_oauth_provider_icon_url.sql

@@ -0,0 +1 @@
+ALTER TABLE public.oauth_providers ADD COLUMN IF NOT EXISTS icon_url VARCHAR(500);

crates/aether-data/migrations/sqlite/20260517000000_add_oauth_provider_icon_url.sql

@@ -0,0 +1 @@
+ALTER TABLE oauth_providers ADD COLUMN icon_url TEXT;

crates/aether-data/src/repository/oauth_providers/memory.rs

@@ -100,6 +100,7 @@ impl OAuthProviderWriteRepository for InMemoryOAuthProviderRepository {
             record.scopes.clone(),
             record.attribute_mapping.clone(),
             record.extra_config.clone(),
+            record.icon_url.clone(),
             record.is_enabled,
         )
         .with_timestamps(created_at, now);
@@ -150,6 +151,7 @@ mod tests {
             frontend_callback_url: "https://frontend.example.com/auth/callback".to_string(),
             attribute_mapping: Some(serde_json::json!({"email": "email"})),
             extra_config: Some(serde_json::json!({"team": true})),
+            icon_url: None,
             is_enabled: true,
         }
     }

crates/aether-data/src/repository/oauth_providers/mysql.rs

@@ -46,6 +46,7 @@ SELECT
   frontend_callback_url,
   attribute_mapping,
   extra_config,
+  icon_url,
   is_enabled,
   created_at AS created_at_unix_ms,
   updated_at AS updated_at_unix_secs
@@ -67,6 +68,7 @@ SELECT
   frontend_callback_url,
   attribute_mapping,
   extra_config,
+  icon_url,
   is_enabled,
   created_at AS created_at_unix_ms,
   updated_at AS updated_at_unix_secs
@@ -176,13 +178,14 @@ INSERT INTO oauth_providers (
   frontend_callback_url,
   attribute_mapping,
   extra_config,
+  icon_url,
   is_enabled,
   created_at,
   updated_at
 ) VALUES (
   ?, ?, ?,
   CASE ? WHEN 'set' THEN ? WHEN 'clear' THEN NULL ELSE NULL END,
-  ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
+  ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
 )
 ON DUPLICATE KEY UPDATE
   display_name = VALUES(display_name),
@@ -200,6 +203,7 @@ ON DUPLICATE KEY UPDATE
   frontend_callback_url = VALUES(frontend_callback_url),
   attribute_mapping = VALUES(attribute_mapping),
   extra_config = VALUES(extra_config),
+  icon_url = VALUES(icon_url),
   is_enabled = VALUES(is_enabled),
   updated_at = VALUES(updated_at)
 "#,
@@ -217,6 +221,7 @@ ON DUPLICATE KEY UPDATE
         .bind(&record.frontend_callback_url)
         .bind(json_to_string(record.attribute_mapping.as_ref())?)
         .bind(json_to_string(record.extra_config.as_ref())?)
+        .bind(record.icon_url.as_deref())
         .bind(record.is_enabled)
         .bind(now as i64)
         .bind(now as i64)
@@ -361,6 +366,7 @@ fn map_oauth_provider_row(row: &MySqlRow) -> Result<StoredOAuthProviderConfig, D
             row.try_get("extra_config").map_sql_err()?,
             "oauth_providers.extra_config",
         )?,
+        row.try_get("icon_url").map_sql_err()?,
         row.try_get("is_enabled").map_sql_err()?,
     )
     .with_timestamps(

crates/aether-data/src/repository/oauth_providers/postgres.rs

@@ -22,6 +22,7 @@ SELECT
   frontend_callback_url,
   attribute_mapping,
   extra_config,
+  icon_url,
   is_enabled,
   EXTRACT(EPOCH FROM created_at)::bigint AS created_at_unix_ms,
   EXTRACT(EPOCH FROM updated_at)::bigint AS updated_at_unix_secs
@@ -43,6 +44,7 @@ SELECT
   frontend_callback_url,
   attribute_mapping,
   extra_config,
+  icon_url,
   is_enabled,
   EXTRACT(EPOCH FROM created_at)::bigint AS created_at_unix_ms,
   EXTRACT(EPOCH FROM updated_at)::bigint AS updated_at_unix_secs
@@ -100,6 +102,7 @@ INSERT INTO oauth_providers (
   frontend_callback_url,
   attribute_mapping,
   extra_config,
+  icon_url,
   is_enabled,
   created_at,
   updated_at
@@ -122,6 +125,7 @@ VALUES (
   $12,
   $13,
   $14,
+  $15,
   NOW(),
   NOW()
 )
@@ -141,6 +145,7 @@ SET display_name = EXCLUDED.display_name,
     frontend_callback_url = EXCLUDED.frontend_callback_url,
     attribute_mapping = EXCLUDED.attribute_mapping,
     extra_config = EXCLUDED.extra_config,
+    icon_url = EXCLUDED.icon_url,
     is_enabled = EXCLUDED.is_enabled,
     updated_at = NOW()
 RETURNING
@@ -156,6 +161,7 @@ RETURNING
   frontend_callback_url,
   attribute_mapping,
   extra_config,
+  icon_url,
   is_enabled,
   EXTRACT(EPOCH FROM created_at)::bigint AS created_at_unix_ms,
   EXTRACT(EPOCH FROM updated_at)::bigint AS updated_at_unix_secs
@@ -242,6 +248,7 @@ impl OAuthProviderWriteRepository for SqlxOAuthProviderRepository {
             .bind(&record.frontend_callback_url)
             .bind(record.attribute_mapping.as_ref())
             .bind(record.extra_config.as_ref())
+            .bind(record.icon_url.as_deref())
             .bind(record.is_enabled)
             .fetch_one(&self.pool)
             .await
@@ -342,6 +349,7 @@ fn map_oauth_provider_row(row: &PgRow) -> Result<StoredOAuthProviderConfig, Data
         parse_scopes(row.try_get("scopes").map_postgres_err()?)?,
         row.try_get("attribute_mapping").map_postgres_err()?,
         row.try_get("extra_config").map_postgres_err()?,
+        row.try_get("icon_url").map_postgres_err()?,
         row.try_get("is_enabled").map_postgres_err()?,
     )
     .with_timestamps(

crates/aether-data/src/repository/oauth_providers/sqlite.rs

@@ -46,6 +46,7 @@ SELECT
   frontend_callback_url,
   attribute_mapping,
   extra_config,
+  icon_url,
   is_enabled,
   created_at AS created_at_unix_ms,
   updated_at AS updated_at_unix_secs
@@ -67,6 +68,7 @@ SELECT
   frontend_callback_url,
   attribute_mapping,
   extra_config,
+  icon_url,
   is_enabled,
   created_at AS created_at_unix_ms,
   updated_at AS updated_at_unix_secs
@@ -176,13 +178,14 @@ INSERT INTO oauth_providers (
   frontend_callback_url,
   attribute_mapping,
   extra_config,
+  icon_url,
   is_enabled,
   created_at,
   updated_at
 ) VALUES (
   ?, ?, ?,
   CASE ? WHEN 'set' THEN ? WHEN 'clear' THEN NULL ELSE NULL END,
-  ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
+  ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
 )
 ON CONFLICT(provider_type) DO UPDATE SET
   display_name = excluded.display_name,
@@ -200,6 +203,7 @@ ON CONFLICT(provider_type) DO UPDATE SET
   frontend_callback_url = excluded.frontend_callback_url,
   attribute_mapping = excluded.attribute_mapping,
   extra_config = excluded.extra_config,
+  icon_url = excluded.icon_url,
   is_enabled = excluded.is_enabled,
   updated_at = excluded.updated_at
 "#,
@@ -217,6 +221,7 @@ ON CONFLICT(provider_type) DO UPDATE SET
         .bind(&record.frontend_callback_url)
         .bind(json_to_string(record.attribute_mapping.as_ref())?)
         .bind(json_to_string(record.extra_config.as_ref())?)
+        .bind(record.icon_url.as_deref())
         .bind(record.is_enabled)
         .bind(now as i64)
         .bind(now as i64)
@@ -364,6 +369,7 @@ fn map_oauth_provider_row(row: &SqliteRow) -> Result<StoredOAuthProviderConfig,
             row.try_get("extra_config").map_sql_err()?,
             "oauth_providers.extra_config",
         )?,
+        row.try_get("icon_url").map_sql_err()?,
         row.try_get("is_enabled").map_sql_err()?,
     )
     .with_timestamps(
@@ -395,6 +401,7 @@ mod tests {
             frontend_callback_url: "https://frontend.example.com/auth/callback".to_string(),
             attribute_mapping: Some(serde_json::json!({"email": "email"})),
             extra_config: Some(serde_json::json!({"team": true})),
+            icon_url: None,
             is_enabled: true,
         }
     }

crates/aether-data/src/repository/oauth_providers/types.rs

@@ -14,6 +14,7 @@ pub struct StoredOAuthProviderConfig {
     pub frontend_callback_url: String,
     pub attribute_mapping: Option<serde_json::Value>,
     pub extra_config: Option<serde_json::Value>,
+    pub icon_url: Option<String>,
     pub is_enabled: bool,
     pub created_at_unix_ms: Option<u64>,
     pub updated_at_unix_secs: Option<u64>,
@@ -66,6 +67,7 @@ impl StoredOAuthProviderConfig {
             frontend_callback_url,
             attribute_mapping: None,
             extra_config: None,
+            icon_url: None,
             is_enabled: false,
             created_at_unix_ms: None,
             updated_at_unix_secs: None,
@@ -82,6 +84,7 @@ impl StoredOAuthProviderConfig {
         scopes: Option<Vec<String>>,
         attribute_mapping: Option<serde_json::Value>,
         extra_config: Option<serde_json::Value>,
+        icon_url: Option<String>,
         is_enabled: bool,
     ) -> Self {
         self.client_secret_encrypted = client_secret_encrypted;
@@ -91,6 +94,7 @@ impl StoredOAuthProviderConfig {
         self.scopes = scopes;
         self.attribute_mapping = attribute_mapping;
         self.extra_config = extra_config;
+        self.icon_url = icon_url;
         self.is_enabled = is_enabled;
         self
     }
@@ -145,6 +149,7 @@ pub struct UpsertOAuthProviderConfigRecord {
     pub frontend_callback_url: String,
     pub attribute_mapping: Option<serde_json::Value>,
     pub extra_config: Option<serde_json::Value>,
+    pub icon_url: Option<String>,
     pub is_enabled: bool,
 }
 

crates/aether-data/src/repository/users/postgres.rs

@@ -336,8 +336,11 @@ SELECT
   users.role::text AS role,
   users.auth_source::text AS auth_source,
   users.allowed_providers,
+  users.allowed_providers_mode,
   users.allowed_api_formats,
+  users.allowed_api_formats_mode,
   users.allowed_models,
+  users.allowed_models_mode,
   users.is_active,
   users.is_deleted,
   users.created_at,
@@ -353,7 +356,7 @@ const TOUCH_OAUTH_LINK_SQL: &str = r#"
 UPDATE user_oauth_links
 SET provider_username = COALESCE($3, provider_username),
     provider_email = COALESCE($4, provider_email),
-    extra_data = COALESCE($5, extra_data),
+    extra_data = COALESCE($5::json, extra_data),
     last_login_at = $6
 WHERE provider_type = $1
   AND provider_user_id = $2

frontend/src/api/oauth.ts

@@ -3,6 +3,7 @@ import apiClient from './client'
 export interface OAuthProviderInfo {
   provider_type: string
   display_name: string
+  icon_url?: string | null
 }
 
 export interface OAuthProvidersResponse {
@@ -46,6 +47,7 @@ export interface OAuthProviderAdminConfig {
   frontend_callback_url: string
   attribute_mapping?: Record<string, unknown> | null
   extra_config?: Record<string, unknown> | null
+  icon_url?: string | null
   is_enabled: boolean
 }
 
@@ -61,6 +63,7 @@ export interface OAuthProviderUpsertRequest {
   frontend_callback_url: string
   attribute_mapping?: Record<string, unknown> | null
   extra_config?: Record<string, unknown> | null
+  icon_url?: string | null
   is_enabled: boolean
   force?: boolean
 }

frontend/src/features/auth/components/LoginDialog.vue

@@ -63,7 +63,7 @@
             <!-- eslint-disable vue/no-v-html -->
             <span
               class="oauth-icon"
-              v-html="getOAuthIcon(oauthProviders[0].provider_type)"
+              v-html="getOAuthIcon(oauthProviders[0].provider_type, oauthProviders[0].icon_url)"
             />
             <!-- eslint-enable vue/no-v-html -->
             <span>使用 {{ oauthProviders[0].display_name }} 登录</span>
@@ -88,7 +88,7 @@
               <!-- eslint-disable vue/no-v-html -->
               <span
                 class="oauth-icon-lg"
-                v-html="getOAuthIcon(p.provider_type)"
+                v-html="getOAuthIcon(p.provider_type, p.icon_url)"
               />
               <!-- eslint-enable vue/no-v-html -->
             </button>

frontend/src/utils/oauth-icons.ts

@@ -9,6 +9,9 @@ export const OAUTH_ICONS: Record<string, string> = {
 // Default icon when provider type is not found
 const DEFAULT_ICON = OAUTH_ICONS.github
 
-export function getOAuthIcon(providerType: string): string {
+export function getOAuthIcon(providerType: string, iconUrl?: string | null): string {
-  return OAUTH_ICONS[providerType.toLowerCase()] || DEFAULT_ICON
+  const builtin = OAUTH_ICONS[providerType.toLowerCase()]
+  if (builtin) return builtin
+  if (iconUrl) return `<img src="${iconUrl}" alt="" style="width:100%;height:100%;object-fit:contain;" />`
+  return DEFAULT_ICON
 }

frontend/src/views/admin/OAuthSettings.vue

@@ -228,6 +228,20 @@
             </div>
           </div>
 
+          <!-- 图标 URL -->
+          <div>
+            <Label class="block text-sm font-medium">图标 URL</Label>
+            <Input
+              v-model="form.icon_url"
+              class="mt-1"
+              placeholder="https://example.com/icon.svg"
+              autocomplete="off"
+            />
+            <p class="mt-1 text-xs text-muted-foreground">
+              登录页显示的 Provider 图标，留空使用默认图标
+            </p>
+          </div>
+
           <!-- 高级选项（折叠） -->
           <details class="group">
             <summary class="cursor-pointer text-sm font-medium text-muted-foreground hover:text-foreground transition-colors">
@@ -308,6 +322,7 @@
                     自定义 OIDC 必填；填写 Authorization / Token / Userinfo URL 所属域名。
                   </p>
                 </div>
+
               </div>
             </div>
           </details>
@@ -394,6 +409,7 @@ interface OAuthConfigForm {
   frontend_callback_url: string
   attribute_mapping_json: string
   extra_config_json: string
+  icon_url: string
   new_provider_type: string
   new_display_name: string
 }
@@ -415,6 +431,7 @@ const form = ref<OAuthConfigForm>({
   frontend_callback_url: '',
   attribute_mapping_json: '',
   extra_config_json: '',
+  icon_url: '',
   new_provider_type: '',
   new_display_name: '',
 })
@@ -581,6 +598,7 @@ function handleClickAdd() {
     frontend_callback_url: defaultFrontendCallbackUrl(),
     attribute_mapping_json: '',
     extra_config_json: '',
+    icon_url: '',
     new_provider_type: providerType,
     new_display_name: '',
   }
@@ -625,6 +643,7 @@ function syncFormFromSelected() {
     frontend_callback_url: cfg?.frontend_callback_url || defaultFrontendCallbackUrl(),
     attribute_mapping_json: cfg?.attribute_mapping ? JSON.stringify(cfg.attribute_mapping, null, 2) : '',
     extra_config_json: cfg?.extra_config ? JSON.stringify(cfg.extra_config, null, 2) : '',
+    icon_url: cfg?.icon_url || '',
     new_provider_type: '',
     new_display_name: '',
   }
@@ -650,6 +669,7 @@ async function toggleProviderEnabled(providerType: string, enabled: boolean, for
       frontend_callback_url: cfg.frontend_callback_url,
       attribute_mapping: cfg.attribute_mapping || null,
       extra_config: cfg.extra_config || null,
+      icon_url: cfg.icon_url || null,
       is_enabled: enabled,
       force,
     }
@@ -724,6 +744,7 @@ async function handleSave() {
       frontend_callback_url: form.value.frontend_callback_url.trim(),
       attribute_mapping: parseJsonOrNull(form.value.attribute_mapping_json),
       extra_config: parseJsonOrNull(form.value.extra_config_json),
+      icon_url: form.value.icon_url.trim() || null,
       is_enabled: existingConfig?.is_enabled || false,
     }
 

frontend/src/views/user/Settings.vue

@@ -387,7 +387,7 @@
                   <!-- eslint-disable vue/no-v-html -->
                   <div
                     class="oauth-icon shrink-0"
-                    v-html="getOAuthIcon(p.provider_type)"
+                    v-html="getOAuthIcon(p.provider_type, p.icon_url)"
                   />
                   <!-- eslint-enable vue/no-v-html -->
                   <div class="min-w-0">