🔖 chore(release): v1.158.0 [skip ci]

## [Version 1.158.0](https://github.com/jaworldwideorg/OneJA-Bot/compare/v1.157.1...v1.158.0)
<sup>Released on **2026-01-30**</sup>

#### ✨ Features

- **misc**: Add custom labels for oAuth SSO providers, refactor cron job UI and use runtime enableBusinessFeatures flag.

#### 🐛 Bug Fixes

- **misc**: Group publish to market should set local group market identifer.

#### 💄 Styles

- **misc**: Fix usage table display issues.

<br/>

<details>
<summary><kbd>Improvements and Fixes</kbd></summary>

#### What's improved

* **misc**: Add custom labels for oAuth SSO providers, closes [#9176](https://github.com/jaworldwideorg/OneJA-Bot/issues/9176) ([136721e](https://github.com/jaworldwideorg/OneJA-Bot/commit/136721e))
* **misc**: Refactor cron job UI and use runtime enableBusinessFeatures flag, closes [#11975](https://github.com/jaworldwideorg/OneJA-Bot/issues/11975) ([104a19a](https://github.com/jaworldwideorg/OneJA-Bot/commit/104a19a))

#### What's fixed

* **misc**: Group publish to market should set local group market identifer, closes [#11965](https://github.com/jaworldwideorg/OneJA-Bot/issues/11965) ([0bda4d9](https://github.com/jaworldwideorg/OneJA-Bot/commit/0bda4d9))

#### Styles

* **misc**: Fix usage table display issues, closes [#10108](https://github.com/jaworldwideorg/OneJA-Bot/issues/10108) ([4bd82c3](https://github.com/jaworldwideorg/OneJA-Bot/commit/4bd82c3))

</details>

<div align="right">

[![](https://img.shields.io/badge/-BACK_TO_TOP-151515?style=flat-square)](#readme-top)

</div>

.gitattributes

@@ -32,4 +32,23 @@
 *.mp4 binary
 *.mp3 binary
 *.zip binary
-*.gz binary
+*.gz binary
+
+# Merge strategies - Keep our customizations
+.github/workflows/lighthouse.yml merge=ours
+.github/workflows/pr-build-docker.yml merge=ours
+.github/workflows/release-docker.yml merge=ours
+.github/workflows/sync.yml merge=ours
+packages/business/const/src/branding.ts merge=ours
+public/icons/* merge=ours
+public/apple-touch-icon.png merge=ours
+public/favicon.ico merge=ours
+public/favicon-32x32.png merge=ours
+src/server/manifest.test.ts merge=ours
+src/server/metadata.test.ts merge=ours
+.releaserc.cjs merge=ours
+.gitattributes merge=ours
+
+# Always accept upstream changes
+CHANGELOG.md merge=theirs
+changelog/v2.json merge=theirs

.github/workflows/e2e.yml

@@ -1,6 +1,6 @@
 name: E2E CI
 
-on: [push, pull_request]
+on: [push, pull_request, workflow_dispatch]
 
 permissions:
   actions: write

.github/workflows/lighthouse.yml

@@ -2,7 +2,7 @@ name: Lighthouse Badger
 
 env:
   TOKEN_NAME: 'GH_TOKEN'
-  REPO_BRANCH: 'lobehub/lobe-chat lighthouse'
+  REPO_BRANCH: 'jaworldwideorg/OneJA-Bot lighthouse'
   USER_NAME: 'lobehubbot'
   USER_EMAIL: 'i@lobehub.com'
   AUDIT_TYPE: 'both'

.github/workflows/pr-build-docker.yml

@@ -15,7 +15,8 @@ permissions:
   pull-requests: write
 
 env:
-  REGISTRY_IMAGE: lobehub/lobehub
+  REGISTRY_URL: jaworldwide.azurecr.io
+  REGISTRY_IMAGE: jaworldwide.azurecr.io/oneja/ai/bot-database
   PR_TAG_PREFIX: pr-
 
 jobs:
@@ -68,8 +69,9 @@ jobs:
       - name: Docker login
         uses: docker/login-action@v3
         with:
-          username: ${{ secrets.DOCKER_REGISTRY_USER }}
-          password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
+          registry: ${{ env.REGISTRY_URL }}
+          username: ${{ secrets.CONTAINER_REGISTRY_USER }}
+          password: ${{ secrets.CONTAINER_REGISTRY_PASSWORD }}
 
       - name: Build and export
         id: build
@@ -142,8 +144,9 @@ jobs:
       - name: Docker login
         uses: docker/login-action@v3
         with:
-          username: ${{ secrets.DOCKER_REGISTRY_USER }}
-          password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
+          registry: ${{ env.REGISTRY_URL }}
+          username: ${{ secrets.CONTAINER_REGISTRY_USER }}
+          password: ${{ secrets.CONTAINER_REGISTRY_PASSWORD }}
 
       - name: Create manifest list and push
         working-directory: /tmp/digests

.github/workflows/release-docker.yml

@@ -12,7 +12,9 @@ concurrency:
   cancel-in-progress: false
 
 env:
-  REGISTRY_IMAGE: lobehub/lobehub
+  REGISTRY_URL: jaworldwide.azurecr.io
+  REGISTRY_IMAGE: jaworldwide.azurecr.io/oneja/ai/bot-database
+  PR_TAG_PREFIX: pr-
 
 jobs:
   build:
@@ -52,8 +54,9 @@ jobs:
       - name: Docker login
         uses: docker/login-action@v3
         with:
-          username: ${{ secrets.DOCKER_REGISTRY_USER }}
-          password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
+          registry: ${{ env.REGISTRY_URL }}
+          username: ${{ secrets.CONTAINER_REGISTRY_USER }}
+          password: ${{ secrets.CONTAINER_REGISTRY_PASSWORD }}
 
       - name: Get commit SHA
         if: github.ref == 'refs/heads/main'
@@ -119,8 +122,9 @@ jobs:
       - name: Docker login
         uses: docker/login-action@v3
         with:
-          username: ${{ secrets.DOCKER_REGISTRY_USER }}
-          password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
+          registry: ${{ env.REGISTRY_URL }}
+          username: ${{ secrets.CONTAINER_REGISTRY_USER }}
+          password: ${{ secrets.CONTAINER_REGISTRY_PASSWORD }}
 
       - name: Create manifest list and push
         working-directory: /tmp/digests

.github/workflows/release.yml

@@ -10,6 +10,7 @@ on:
     branches:
       - main
       - next
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

.github/workflows/sync.yml

@@ -25,6 +25,11 @@ jobs:
           actions: 'close-issues'
           labels: '🚨 Sync Fail'
 
+      - name: Configure Git merge strategies
+        run: |
+          git config merge.ours.driver true
+          git config merge.theirs.driver "git merge-file --theirs %O %A %B"
+
       - name: Sync upstream changes
         id: sync
         uses: aormsby/Fork-Sync-With-Upstream-action@v3.4
@@ -32,9 +37,44 @@ jobs:
           upstream_sync_repo: lobehub/lobehub
           upstream_sync_branch: main
           target_sync_branch: main
-          target_repo_token: ${{ secrets.GITHUB_TOKEN }} # automatically generated, no need to set
+          target_repo_token: ${{ secrets.GITHUB_TOKEN }}
           test_mode: false
 
+      - name: Trigger workflows after sync
+        if: success() && steps.sync.outputs.has_new_commits == 'true'
+        run: |
+          echo "Triggering workflows manually (scheduled runs don't auto-trigger push events)"
+
+          # Trigger Release CI
+          curl -L -X POST \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${{ secrets.GH_TOKEN }}" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://api.github.com/repos/${{ github.repository }}/actions/workflows/release.yml/dispatches \
+            -d '{"ref":"main"}'
+
+          echo "✓ Triggered release.yml"
+
+          # Trigger Test CI
+          curl -L -X POST \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${{ secrets.GH_TOKEN }}" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://api.github.com/repos/${{ github.repository }}/actions/workflows/test.yml/dispatches \
+            -d '{"ref":"main"}'
+
+          echo "✓ Triggered test.yml"
+
+          # Trigger E2E CI
+          curl -L -X POST \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${{ secrets.GH_TOKEN }}" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://api.github.com/repos/${{ github.repository }}/actions/workflows/e2e.yml/dispatches \
+            -d '{"ref":"main"}'
+
+          echo "✓ Triggered e2e.yml"
+
       - name: Sync check
         if: failure()
         uses: actions-cool/issues-helper@v3
@@ -52,3 +92,4 @@ jobs:
             [lobechat]: https://github.com/lobehub/lobe-chat
             [tutorial-zh-CN]: https://lobehub.com/zh/docs/self-hosting/advanced/upstream-sync
             [tutorial-en-US]: https://lobehub.com/docs/self-hosting/advanced/upstream-sync
+

.github/workflows/test.yml

@@ -1,6 +1,6 @@
 name: Test CI
 
-on: [push, pull_request]
+on: [push, pull_request, workflow_dispatch]
 
 permissions:
   actions: write

.releaserc.cjs

@@ -1,5 +1,10 @@
 const config = require('@lobehub/lint').semanticRelease;
 
+// Remove NPM publishing by excluding "@semantic-release/npm" plugin
+// Keep or add other plugins like GitHub Releases
+config.plugins = config.plugins.filter((plugin) => plugin !== '@semantic-release/npm');
+
+// Add GitHub only if required
 config.branches = [
   'main',
   {
@@ -15,4 +20,32 @@ config.plugins.push([
   },
 ]);
 
+// Override GitHub repository URL without modifying package.json
+// Make sure @semantic-release/github is present in the plugins
+if (!config.plugins.some(plugin => Array.isArray(plugin) ? plugin[0] === '@semantic-release/github' : plugin === '@semantic-release/github')) {
+  config.plugins.push([
+    '@semantic-release/github',
+    {
+      repositoryUrl: 'https://github.com/jaworldwideorg/OneJA-Bot.git'
+    }
+  ]);
+} else {
+  // Find and update the existing GitHub plugin configuration
+  config.plugins = config.plugins.map(plugin => {
+    if (Array.isArray(plugin) && plugin[0] === '@semantic-release/github') {
+      return [
+        '@semantic-release/github',
+        {
+          ...(plugin[1] || {}),
+          repositoryUrl: 'https://github.com/jaworldwideorg/OneJA-Bot.git'
+        }
+      ];
+    }
+    return plugin;
+  });
+}
+
+// Set repository URL in global config
+config.repositoryUrl = 'https://github.com/jaworldwideorg/OneJA-Bot.git';
+
 module.exports = config;

CHANGELOG.md

@@ -2,6 +2,48 @@
 
 # Changelog
 
+## [Version 1.158.0](https://github.com/jaworldwideorg/OneJA-Bot/compare/v1.157.1...v1.158.0)
+
+<sup>Released on **2026-01-30**</sup>
+
+#### ✨ Features
+
+- **misc**: Add custom labels for oAuth SSO providers, refactor cron job UI and use runtime enableBusinessFeatures flag.
+
+#### 🐛 Bug Fixes
+
+- **misc**: Group publish to market should set local group market identifer.
+
+#### 💄 Styles
+
+- **misc**: Fix usage table display issues.
+
+<br/>
+
+<details>
+<summary><kbd>Improvements and Fixes</kbd></summary>
+
+#### What's improved
+
+- **misc**: Add custom labels for oAuth SSO providers, closes [#9176](https://github.com/jaworldwideorg/OneJA-Bot/issues/9176) ([136721e](https://github.com/jaworldwideorg/OneJA-Bot/commit/136721e))
+- **misc**: Refactor cron job UI and use runtime enableBusinessFeatures flag, closes [#11975](https://github.com/jaworldwideorg/OneJA-Bot/issues/11975) ([104a19a](https://github.com/jaworldwideorg/OneJA-Bot/commit/104a19a))
+
+#### What's fixed
+
+- **misc**: Group publish to market should set local group market identifer, closes [#11965](https://github.com/jaworldwideorg/OneJA-Bot/issues/11965) ([0bda4d9](https://github.com/jaworldwideorg/OneJA-Bot/commit/0bda4d9))
+
+#### Styles
+
+- **misc**: Fix usage table display issues, closes [#10108](https://github.com/jaworldwideorg/OneJA-Bot/issues/10108) ([4bd82c3](https://github.com/jaworldwideorg/OneJA-Bot/commit/4bd82c3))
+
+</details>
+
+<div align="right">
+
+[![](https://img.shields.io/badge/-BACK_TO_TOP-151515?style=flat-square)](#readme-top)
+
+</div>
+
 ## [Version 2.1.0](https://github.com/lobehub/lobe-chat/compare/v2.0.13...v2.1.0)
 
 <sup>Released on **2026-01-30**</sup>

changelog/v2.json

@@ -1,11 +1,4 @@
 [
-  {
-    "children": {
-      "features": ["Refactor cron job UI and use runtime enableBusinessFeatures flag."]
-    },
-    "date": "2026-01-30",
-    "version": "2.1.0"
-  },
   {
     "children": {
       "improvements": ["Fix usage table display issues."]
@@ -2037,5 +2030,13 @@
     "children": {},
     "date": "2025-10-30",
     "version": "2.0.0-next.1"
+  },
+  {
+    "children": {
+      "fixes": ["Add ExtendParamsTypeSchema for enhanced model settings."],
+      "improvements": ["Fix group task render."]
+    },
+    "date": "2026-01-29",
+    "version": "1.157.1"
   }
 ]

docs/self-hosting/advanced/auth.mdx

@@ -49,25 +49,43 @@ To enable Better Auth in LobeHub, set the following environment variables:
 
 ## Supported SSO Providers
 
-| Provider              | Value                   | Environment Variables                                                                                              |
-| --------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------ |
-| Google                | `google`                | `AUTH_GOOGLE_ID`, `AUTH_GOOGLE_SECRET`                                                                             |
-| GitHub                | `github`                | `AUTH_GITHUB_ID`, `AUTH_GITHUB_SECRET`                                                                             |
-| Microsoft             | `microsoft`             | `AUTH_MICROSOFT_ID`, `AUTH_MICROSOFT_SECRET`                                                                       |
-| Apple                 | `apple`                 | `AUTH_APPLE_CLIENT_ID`, `AUTH_APPLE_CLIENT_SECRET`                                                                 |
-| AWS Cognito           | `cognito`               | `AUTH_COGNITO_ID`, `AUTH_COGNITO_SECRET`, `AUTH_COGNITO_DOMAIN`, `AUTH_COGNITO_REGION`, `AUTH_COGNITO_USERPOOL_ID` |
-| Auth0                 | `auth0`                 | `AUTH_AUTH0_ID`, `AUTH_AUTH0_SECRET`, `AUTH_AUTH0_ISSUER`                                                          |
-| Authelia              | `authelia`              | `AUTH_AUTHELIA_ID`, `AUTH_AUTHELIA_SECRET`, `AUTH_AUTHELIA_ISSUER`                                                 |
-| Authentik             | `authentik`             | `AUTH_AUTHENTIK_ID`, `AUTH_AUTHENTIK_SECRET`, `AUTH_AUTHENTIK_ISSUER`                                              |
-| Casdoor               | `casdoor`               | `AUTH_CASDOOR_ID`, `AUTH_CASDOOR_SECRET`, `AUTH_CASDOOR_ISSUER`                                                    |
-| Cloudflare Zero Trust | `cloudflare-zero-trust` | `AUTH_CLOUDFLARE_ZERO_TRUST_ID`, `AUTH_CLOUDFLARE_ZERO_TRUST_SECRET`, `AUTH_CLOUDFLARE_ZERO_TRUST_ISSUER`          |
-| Keycloak              | `keycloak`              | `AUTH_KEYCLOAK_ID`, `AUTH_KEYCLOAK_SECRET`, `AUTH_KEYCLOAK_ISSUER`                                                 |
-| Logto                 | `logto`                 | `AUTH_LOGTO_ID`, `AUTH_LOGTO_SECRET`, `AUTH_LOGTO_ISSUER`                                                          |
-| Okta                  | `okta`                  | `AUTH_OKTA_ID`, `AUTH_OKTA_SECRET`, `AUTH_OKTA_ISSUER`                                                             |
-| ZITADEL               | `zitadel`               | `AUTH_ZITADEL_ID`, `AUTH_ZITADEL_SECRET`, `AUTH_ZITADEL_ISSUER`                                                    |
-| Generic OIDC          | `generic-oidc`          | `AUTH_GENERIC_OIDC_ID`, `AUTH_GENERIC_OIDC_SECRET`, `AUTH_GENERIC_OIDC_ISSUER`                                     |
-| Feishu                | `feishu`                | `AUTH_FEISHU_APP_ID`, `AUTH_FEISHU_APP_SECRET`                                                                     |
-| WeChat                | `wechat`                | `AUTH_WECHAT_ID`, `AUTH_WECHAT_SECRET`                                                                             |
+| Provider              | Value                   | Environment Variables                                                                                                                                    |
+| --------------------- | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Google                | `google`                | `AUTH_GOOGLE_ID`, `AUTH_GOOGLE_SECRET`, `AUTH_GOOGLE_LABEL` (optional)                                                                                   |
+| GitHub                | `github`                | `AUTH_GITHUB_ID`, `AUTH_GITHUB_SECRET`, `AUTH_GITHUB_LABEL` (optional)                                                                                   |
+| Microsoft             | `microsoft`             | `AUTH_MICROSOFT_ID`, `AUTH_MICROSOFT_SECRET`, `AUTH_MICROSOFT_LABEL` (optional)                                                                          |
+| Apple                 | `apple`                 | `AUTH_APPLE_CLIENT_ID`, `AUTH_APPLE_CLIENT_SECRET`, `AUTH_APPLE_LABEL` (optional)                                                                        |
+| AWS Cognito           | `cognito`               | `AUTH_COGNITO_ID`, `AUTH_COGNITO_SECRET`, `AUTH_COGNITO_DOMAIN`, `AUTH_COGNITO_REGION`, `AUTH_COGNITO_USERPOOL_ID`, `AUTH_COGNITO_LABEL` (optional)      |
+| Auth0                 | `auth0`                 | `AUTH_AUTH0_ID`, `AUTH_AUTH0_SECRET`, `AUTH_AUTH0_ISSUER`, `AUTH_AUTH0_LABEL` (optional)                                                                 |
+| Authelia              | `authelia`              | `AUTH_AUTHELIA_ID`, `AUTH_AUTHELIA_SECRET`, `AUTH_AUTHELIA_ISSUER`, `AUTH_AUTHELIA_LABEL` (optional)                                                     |
+| Authentik             | `authentik`             | `AUTH_AUTHENTIK_ID`, `AUTH_AUTHENTIK_SECRET`, `AUTH_AUTHENTIK_ISSUER`, `AUTH_AUTHENTIK_LABEL` (optional)                                                 |
+| Casdoor               | `casdoor`               | `AUTH_CASDOOR_ID`, `AUTH_CASDOOR_SECRET`, `AUTH_CASDOOR_ISSUER`, `AUTH_CASDOOR_LABEL` (optional)                                                         |
+| Cloudflare Zero Trust | `cloudflare-zero-trust` | `AUTH_CLOUDFLARE_ZERO_TRUST_ID`, `AUTH_CLOUDFLARE_ZERO_TRUST_SECRET`, `AUTH_CLOUDFLARE_ZERO_TRUST_ISSUER`, `AUTH_CLOUDFLARE_ZERO_TRUST_LABEL` (optional) |
+| Keycloak              | `keycloak`              | `AUTH_KEYCLOAK_ID`, `AUTH_KEYCLOAK_SECRET`, `AUTH_KEYCLOAK_ISSUER`, `AUTH_KEYCLOAK_LABEL` (optional)                                                     |
+| Logto                 | `logto`                 | `AUTH_LOGTO_ID`, `AUTH_LOGTO_SECRET`, `AUTH_LOGTO_ISSUER`, `AUTH_LOGTO_LABEL` (optional)                                                                 |
+| Okta                  | `okta`                  | `AUTH_OKTA_ID`, `AUTH_OKTA_SECRET`, `AUTH_OKTA_ISSUER`, `AUTH_OKTA_LABEL` (optional)                                                                     |
+| ZITADEL               | `zitadel`               | `AUTH_ZITADEL_ID`, `AUTH_ZITADEL_SECRET`, `AUTH_ZITADEL_ISSUER`, `AUTH_ZITADEL_LABEL` (optional)                                                         |
+| Generic OIDC          | `generic-oidc`          | `AUTH_GENERIC_OIDC_ID`, `AUTH_GENERIC_OIDC_SECRET`, `AUTH_GENERIC_OIDC_ISSUER`, `AUTH_GENERIC_OIDC_LABEL` (optional)                                     |
+| Feishu                | `feishu`                | `AUTH_FEISHU_APP_ID`, `AUTH_FEISHU_APP_SECRET`, `AUTH_FEISHU_LABEL` (optional)                                                                           |
+| WeChat                | `wechat`                | `AUTH_WECHAT_ID`, `AUTH_WECHAT_SECRET`, `AUTH_WECHAT_LABEL` (optional)                                                                                   |
+
+### Custom Provider Labels
+
+You can customize the display name of each SSO provider on the login page by setting the `AUTH_{PROVIDER}_LABEL` environment variable. This is useful for:
+
+- Using custom branding (e.g., "Company SSO" instead of "Okta")
+- Localizing provider names for your organization
+- Making the login page more user-friendly
+
+**Example:**
+
+```bash
+AUTH_OKTA_LABEL="Corporate SSO"
+AUTH_KEYCLOAK_LABEL="Employee Login"
+AUTH_GOOGLE_LABEL="Sign in with Google"
+```
+
+This will display "Continue with Corporate SSO" instead of "Continue with Okta" on the login page.
 
 Click on a provider below for detailed configuration guides:
 
@@ -152,10 +170,13 @@ Send emails via SMTP protocol, suitable for users with existing email services.
 
 ### Common Configuration
 
+## Password Login Configuration
 Before using Better Auth, please set the following variables in LobeHub's environment variables:
+| Environment Variable         | Type     | Description                                                                                     |
+| ---------------------------- | -------- | ----------------------------------------------------------------------------------------------- |
+| `AUTH_ENABLE_EMAIL_PASSWORD` | Optional | Set to `0` to disable email/password authentication, keeping only social login (on by default)  |
 
 ## Email Verification
-
 Enable email verification to ensure users own the email addresses they register with (off by default):
 
 | Environment Variable      | Type     | Description                                                 |
@@ -170,9 +191,9 @@ Enable email verification to ensure users own the email addresses they register
 
 Enable magic-link login (depends on a working email provider above, off by default):
 
-| Environment Variable     | Type     | Description                                                         |
-| ------------------------ | -------- | ------------------------------------------------------------------- |
-| `AUTH_ENABLE_MAGIC_LINK` | Optional | Set to `1` to enable passwordless magic-link login (off by default) |
+| Environment Variable         | Type     | Description                                                                                     |
+| ---------------------------- | -------- | ----------------------------------------------------------------------------------------------- |
+| `AUTH_ENABLE_MAGIC_LINK`     | Optional | Set to `1` to enable passwordless magic-link login (off by default)                             |
 
 <Callout type={'tip'}>
   Go to [Environment Variables](/docs/self-hosting/environment-variables/auth#better-auth) for detailed information on all Better Auth variables.

docs/self-hosting/advanced/auth.zh-CN.mdx

@@ -154,6 +154,12 @@ LobeHub 与 Clerk 做了深度集成，能够为用户提供一个更加安全
 
 在使用 Better Auth 之前，请先在 LobeHub 的环境变量中设置以下变量：
 
+## 密码登录配置
+
+| 环境变量                         | 类型 | 描述                                 |
+| ---------------------------- | -- | ---------------------------------- |
+| `AUTH_ENABLE_EMAIL_PASSWORD` | 可选 | 设置为 `0` 以禁用邮箱 / 密码认证，仅保留社交登录（默认启用） |
+
 ## 邮箱验证
 
 启用邮箱验证以确保用户拥有其注册的邮箱地址（默认关闭）：

docs/self-hosting/advanced/auth/legacy.mdx

@@ -42,13 +42,13 @@ By setting the environment variables `NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY` and `CL
 
 Before using NextAuth, please set the following variables in LobeChat's environment variables:
 
-| Environment Variable             | Type     | Description                                                                                                                                                                                                                                |
-| -------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Environment Variable             | Type     | Description                                                                                                                                                                                                                     |
+| -------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `NEXT_PUBLIC_ENABLE_NEXT_AUTH`   | Required | This is used to enable the NextAuth service. Set it to `1` to enable it; changing this setting requires recompiling the application. Users deploying with the `lobehub/lobehub` image have this configuration added by default. |
-| `AUTH_SECRET`                    | Required | The key used to encrypt Auth.js session tokens. You can use the following command: `openssl rand -base64 32`, or visit `https://generate-secret.vercel.app/32` to generate the key.                                                        |
-| `AUTH_URL`                       | Required | This URL specifies the callback address for Auth.js when performing OAuth verification. Set this only if the default generated redirect address is incorrect. `https://example.com/api/auth`                                               |
-| `NEXT_AUTH_SSO_PROVIDERS`        | Optional | This environment variable is used to enable multiple identity verification sources simultaneously, separated by commas, for example, `auth0,microsoft-entra-id,authentik`.                                                                 |
-| `NEXT_AUTH_SSO_SESSION_STRATEGY` | Optional | The session strategy for Auth.js. Options are `jwt` or `database`. Default is `jwt`.                                                                                                                                                       |
+| `AUTH_SECRET`                    | Required | The key used to encrypt Auth.js session tokens. You can use the following command: `openssl rand -base64 32`, or visit `https://generate-secret.vercel.app/32` to generate the key.                                             |
+| `AUTH_URL`                       | Required | This URL specifies the callback address for Auth.js when performing OAuth verification. Set this only if the default generated redirect address is incorrect. `https://example.com/api/auth`                                    |
+| `NEXT_AUTH_SSO_PROVIDERS`        | Optional | This environment variable is used to enable multiple identity verification sources simultaneously, separated by commas, for example, `auth0,microsoft-entra-id,authentik`.                                                      |
+| `NEXT_AUTH_SSO_SESSION_STRATEGY` | Optional | The session strategy for Auth.js. Options are `jwt` or `database`. Default is `jwt`.                                                                                                                                            |
 
 Currently supported identity verification services include:
 

docs/self-hosting/advanced/auth/legacy.zh-CN.mdx

@@ -42,7 +42,7 @@ LobeChat 与 Clerk 做了深度集成，能够为用户提供安全、便捷的
 
 | 环境变量                             | 类型 | 描述                                                                                                           |
 | -------------------------------- | -- | ------------------------------------------------------------------------------------------------------------ |
-| `NEXT_PUBLIC_ENABLE_NEXT_AUTH`   | 必选 | 用于启用 NextAuth 服务，设置为 `1` 以启用，更改此项需要重新编译应用。使用 `lobehub/lobehub` 镜像部署的用户已经默认添加了该项配置。                |
+| `NEXT_PUBLIC_ENABLE_NEXT_AUTH`   | 必选 | 用于启用 NextAuth 服务，设置为 `1` 以启用，更改此项需要重新编译应用。使用 `lobehub/lobehub` 镜像部署的用户已经默认添加了该项配置。                           |
 | `NEXT_AUTH_SECRET`               | 必选 | 用于加密 Auth.js 会话令牌的密钥。您可以使用以下命令： `openssl rand -base64 32`，或者访问 `https://generate-secret.vercel.app/32` 生成秘钥。 |
 | `AUTH_URL`                       | 必选 | 该 URL 用于指定 Auth.js 在执行 OAuth 验证时的回调地址，当默认生成的重定向地址发生不正确时才需要设置。`https://example.com/api/auth`                  |
 | `NEXT_AUTH_SSO_PROVIDERS`        | 可选 | 该环境变量用于同时启用多个身份验证源，以逗号 `,` 分割，例如 `auth0,microsoft-entra-id,authentik`。                                       |

docs/self-hosting/advanced/auth/providers/okta.mdx

@@ -44,13 +44,26 @@ tags:
 
   When deploying LobeChat, you need to configure the following environment variables:
 
-  | Environment Variable             | Type     | Description                                                                   |
-  | -------------------------------- | -------- | ----------------------------------------------------------------------------- |
-  | `AUTH_SECRET`                    | Required | Key used to encrypt session tokens. Generate using: `openssl rand -base64 32` |
-  | `AUTH_SSO_PROVIDERS`             | Required | SSO provider for LobeChat. Use `okta` for Okta                                |
-  | `AUTH_OKTA_ID`                   | Required | Client ID from Okta application                                               |
-  | `AUTH_OKTA_SECRET`               | Required | Client Secret from Okta application                                           |
-  | `AUTH_OKTA_ISSUER`               | Required | Okta issuer URL (e.g., `https://your-okta-domain.okta.com`)                   |
+  | Environment Variable | Type     | Description                                                                   |
+  | -------------------- | -------- | ----------------------------------------------------------------------------- |
+  | `AUTH_SECRET`        | Required | Key used to encrypt session tokens. Generate using: `openssl rand -base64 32` |
+  | `AUTH_SSO_PROVIDERS` | Required | SSO provider for LobeChat. Use `okta` for Okta                                |
+  | `AUTH_OKTA_ID`       | Required | Client ID from Okta application                                               |
+  | `AUTH_OKTA_SECRET`   | Required | Client Secret from Okta application                                           |
+  | `AUTH_OKTA_ISSUER`   | Required | Okta issuer URL (e.g., `https://your-okta-domain.okta.com`)                   |
+  | `AUTH_OKTA_LABEL`    | Optional | Custom display label for the login button (e.g., `Corporate SSO`)             |
+
+  ### Custom Login Button Label
+
+  You can customize the text displayed on the Okta login button by setting the `AUTH_OKTA_LABEL` environment variable. This is useful for branding or making the login experience more user-friendly.
+
+  **Example:**
+
+  ```bash
+  AUTH_OKTA_LABEL="Corporate SSO"
+  ```
+
+  This will display "Continue with Corporate SSO" instead of "Continue with Okta" on the login page.
 
   <Callout type={'tip'}>
     Go to [📘 Environment Variables](/docs/self-hosting/environment-variables/auth#okta) for detailed information on these variables.

docs/self-hosting/environment-variables/auth.mdx

@@ -32,6 +32,20 @@ LobeHub provides a complete authentication service capability when deployed. The
 - Default: `0`
 - Example: `1`
 
+#### `AUTH_ENABLE_MAGIC_LINK`
+
+- Type: Optional
+- Description: Set to `1` to enable passwordless magic-link login via email. Requires a configured email service (SMTP or Resend).
+- Default: `0`
+- Example: `1`
+
+#### `AUTH_ENABLE_EMAIL_PASSWORD`
+
+- Type: Optional
+- Description: Set to `0` to disable email/password authentication, keeping only social login. When disabled, the email/password forms will be hidden from login and signup pages.
+- Default: `1` (enabled)
+- Example: `0`
+
 #### `AUTH_SSO_PROVIDERS`
 
 - Type: Optional
@@ -123,6 +137,13 @@ These settings are required for email verification and password reset features.
 - Default: `-`
 - Example: `GOCSPX-xxxxxxxxxxxxxxxxxxxx`
 
+#### `AUTH_GOOGLE_LABEL`
+
+- Type: Optional
+- Description: Custom display label for the Google login button. When set, the login page will show "Continue with \[label]" instead of "Continue with Google".
+- Default: `-`
+- Example: `Work Account`
+
 ### GitHub
 
 #### `AUTH_GITHUB_ID`
@@ -139,6 +160,13 @@ These settings are required for email verification and password reset features.
 - Default: `-`
 - Example: `xxxxxxxxxxxxxxxxxxxxxxxxxxxxx`
 
+#### `AUTH_GITHUB_LABEL`
+
+- Type: Optional
+- Description: Custom display label for the GitHub login button. When set, the login page will show "Continue with \[label]" instead of "Continue with GitHub".
+- Default: `-`
+- Example: `Company GitHub`
+
 ### Microsoft
 
 #### `AUTH_MICROSOFT_ID`
@@ -155,6 +183,13 @@ These settings are required for email verification and password reset features.
 - Default: `-`
 - Example: `xxxxxxxxxxxxxxxxxxxxxxxxxxxxx`
 
+#### `AUTH_MICROSOFT_LABEL`
+
+- Type: Optional
+- Description: Custom display label for the Microsoft login button. When set, the login page will show "Continue with \[label]" instead of "Continue with Microsoft".
+- Default: `-`
+- Example: `Corporate Login`
+
 ### AWS Cognito
 
 #### `AUTH_COGNITO_ID`
@@ -178,6 +213,13 @@ These settings are required for email verification and password reset features.
 - Default: `-`
 - Example: `https://cognito-idp.us-east-1.amazonaws.com/us-east-1_xxxxxxxxx`
 
+#### `AUTH_COGNITO_LABEL`
+
+- Type: Optional
+- Description: Custom display label for the AWS Cognito login button. When set, the login page will show "Continue with \[label]" instead of "Continue with AWS Cognito".
+- Default: `-`
+- Example: `Enterprise SSO`
+
 ### Feishu
 
 #### `AUTH_FEISHU_APP_ID`
@@ -194,6 +236,13 @@ These settings are required for email verification and password reset features.
 - Default: `-`
 - Example: `xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx`
 
+#### `AUTH_FEISHU_LABEL`
+
+- Type: Optional
+- Description: Custom display label for the Feishu login button. When set, the login page will show "Continue with \[label]" instead of "Continue with Feishu".
+- Default: `-`
+- Example: `飞书登录`
+
 ### WeChat
 
 #### `AUTH_WECHAT_ID`
@@ -209,3 +258,10 @@ These settings are required for email verification and password reset features.
 - Description: App Secret of the WeChat application.
 - Default: `-`
 - Example: `xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx`
+
+#### `AUTH_WECHAT_LABEL`
+
+- Type: Optional
+- Description: Custom display label for the WeChat login button. When set, the login page will show "Continue with \[label]" instead of "Continue with WeChat".
+- Default: `-`
+- Example: `微信`

docs/self-hosting/environment-variables/auth.zh-CN.mdx

@@ -30,6 +30,20 @@ LobeHub 在部署时提供了完善的身份验证服务能力，以下是相关
 - 默认值：`0`
 - 示例：`1`
 
+#### `AUTH_ENABLE_MAGIC_LINK`
+
+- 类型：可选
+- 描述：设置为 `1` 以启用通过邮件的魔法链接登录（免密登录）。需要配置邮件服务（SMTP 或 Resend）。
+- 默认值：`0`
+- 示例：`1`
+
+#### `AUTH_ENABLE_EMAIL_PASSWORD`
+
+- 类型：可选
+- 描述：设置为 `0` 以禁用邮箱 / 密码认证，仅保留社交登录。禁用后，登录和注册页面将隐藏邮箱 / 密码表单。
+- 默认值：`1`（启用）
+- 示例：`0`
+
 #### `AUTH_SSO_PROVIDERS`
 
 - 类型：可选

packages/business/const/src/branding.ts

@@ -2,27 +2,27 @@
 // if you want to use it in the commercial usage
 // please contact us for more information: hello@lobehub.com
 
-export const LOBE_CHAT_CLOUD = 'LobeHub Cloud';
+export const LOBE_CHAT_CLOUD = 'OneAI';
 
-export const BRANDING_NAME = 'LobeHub';
-export const BRANDING_LOGO_URL = '';
+export const BRANDING_NAME = 'OneAI';
+export const BRANDING_LOGO_URL = '/icons/icon-512x512.png';
 
-export const ORG_NAME = 'LobeHub';
+export const ORG_NAME = 'JA Worldwide';
 
 export const BRANDING_URL = {
-  help: undefined,
-  privacy: undefined,
+  help: 'mailto:support@jaworldwide.org',
+  privacy: 'https://www.jaworldwide.org/terms',
   subscription: undefined,
   support: undefined,
-  terms: undefined,
+  terms: 'https://www.jaworldwide.org/terms',
 };
 
 export const SOCIAL_URL = {
-  discord: 'https://discord.gg/AYFPHvv2jT',
-  github: 'https://github.com/lobehub',
-  medium: 'https://medium.com/@lobehub',
-  x: 'https://x.com/lobehub',
-  youtube: 'https://www.youtube.com/@lobehub',
+  discord: 'https://discord.gg/',
+  github: 'https://github.com/jaworldwideorg',
+  medium: 'https://medium.com/',
+  x: 'https://x.com/jaworldwide',
+  youtube: 'https://www.youtube.com/@jaworldwide',
 };
 
 export const FILE_URL = {
@@ -30,11 +30,11 @@ export const FILE_URL = {
 };
 
 export const BRANDING_EMAIL = {
-  business: 'hello@lobehub.com',
-  support: 'support@lobehub.com',
+  business: 'contact@jaworldwide.org',
+  support: 'support@jaworldwide.org',
 };
 
-export const BRANDING_PROVIDER = 'lobehub';
+export const BRANDING_PROVIDER = 'jaworldwideorg';
 
 export const COPYRIGHT = `© ${new Date().getFullYear()} ${ORG_NAME}`;
 export const COPYRIGHT_FULL = `${COPYRIGHT}. All rights reserved.`;

packages/database/src/models/agentCronJob.ts

@@ -85,10 +85,11 @@ export class AgentCronJobModel {
 
     if (data?.cronPattern !== undefined || data?.timezone !== undefined) {
       const existing = await this.findById(id);
-      if (existing && (
-        (data?.cronPattern !== undefined && data?.cronPattern !== existing.cronPattern) ||
-        (data?.timezone !== undefined && data?.timezone !== existing.timezone)
-      )) {
+      if (
+        existing &&
+        ((data?.cronPattern !== undefined && data?.cronPattern !== existing.cronPattern) ||
+          (data?.timezone !== undefined && data?.timezone !== existing.timezone))
+      ) {
         shouldResetLastExecuted = true;
       }
     }

packages/database/src/models/topicShare.ts

@@ -130,7 +130,12 @@ export class TopicShareModel {
 
     // Fetch group members if this is a group topic
     let groupMembers:
-      | { avatar: string | null; backgroundColor: string | null; id: string; title: string | null }[]
+      | {
+          avatar: string | null;
+          backgroundColor: string | null;
+          id: string;
+          title: string | null;
+        }[]
       | undefined;
     if (share.groupId) {
       const members = await db

packages/types/src/serverConfig.ts

@@ -50,6 +50,7 @@ export interface GlobalServerConfig {
   aiProvider: ServerLanguageModel;
   defaultAgent?: PartialDeep<UserDefaultAgent>;
   enableBusinessFeatures?: boolean;
+  enableEmailPassword?: boolean;
   enableEmailVerification?: boolean;
   enableKlavis?: boolean;
   enableLobehubSkill?: boolean;
@@ -62,6 +63,7 @@ export interface GlobalServerConfig {
   enabledOAuthSSO?: boolean;
   image?: PartialDeep<UserImageConfig>;
   memory?: GlobalMemoryConfig;
+  oAuthSSOProviderLabels?: Record<string, string | undefined>;
   oAuthSSOProviders?: string[];
   systemAgent?: PartialDeep<UserSystemAgentConfig>;
   telemetry: {

packages/types/src/topic/topic.ts

@@ -156,7 +156,12 @@ export interface SharedTopicData {
     avatar?: string | null;
     backgroundColor?: string | null;
     createdAt?: Date | null;
-    members?: { avatar: string | null; backgroundColor: string | null; id: string; title: string | null }[];
+    members?: {
+      avatar: string | null;
+      backgroundColor: string | null;
+      id: string;
+      title: string | null;
+    }[];
     title?: string | null;
     updatedAt?: Date | null;
     userId?: string | null;

scripts/_shared/checkDeprecatedAuth.js

@@ -213,7 +213,11 @@ function printIssueBlock(name, vars, message, docUrl, formatVar, severity = 'err
 
   log(`\n${icon} ${name}`);
   log('─'.repeat(50));
-  log(isWarning ? 'Missing recommended environment variables:' : 'Detected deprecated environment variables:');
+  log(
+    isWarning
+      ? 'Missing recommended environment variables:'
+      : 'Detected deprecated environment variables:',
+  );
   for (const envVar of vars) {
     log(`  • ${formatVar ? formatVar(envVar) : envVar}`);
   }
@@ -253,7 +257,14 @@ function checkDeprecatedAuth(options = {}) {
     console.warn('═'.repeat(70));
 
     for (const issue of warnings) {
-      printIssueBlock(issue.name, issue.foundVars, issue.message, issue.docUrl, issue.formatVar, 'warning');
+      printIssueBlock(
+        issue.name,
+        issue.foundVars,
+        issue.message,
+        issue.docUrl,
+        issue.formatVar,
+        'warning',
+      );
     }
 
     console.warn('\n' + '═'.repeat(70));
@@ -264,13 +275,18 @@ function checkDeprecatedAuth(options = {}) {
   // Print errors and exit (blocking)
   if (errors.length > 0) {
     console.error('\n' + '═'.repeat(70));
-    console.error(
-      `❌ ERROR: Found ${errors.length} deprecated environment variable issue(s)!`,
-    );
+    console.error(`❌ ERROR: Found ${errors.length} deprecated environment variable issue(s)!`);
     console.error('═'.repeat(70));
 
     for (const issue of errors) {
-      printIssueBlock(issue.name, issue.foundVars, issue.message, issue.docUrl, issue.formatVar, 'error');
+      printIssueBlock(
+        issue.name,
+        issue.foundVars,
+        issue.message,
+        issue.docUrl,
+        issue.formatVar,
+        'error',
+      );
     }
 
     console.error('\n' + '═'.repeat(70));

src/app/[variants]/(auth)/signin/SignInEmailStep.tsx

@@ -24,9 +24,11 @@ export const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 export const USERNAME_REGEX = /^\w+$/;
 
 export interface SignInEmailStepProps {
+  enableEmailPassword: boolean;
   form: FormInstance<{ email: string }>;
   isSocialOnly: boolean;
   loading: boolean;
+  oAuthSSOProviderLabels?: Record<string, string | undefined>;
   oAuthSSOProviders: string[];
   onCheckUser: (values: { email: string }) => Promise<void>;
   onSetPassword: () => void;
@@ -36,9 +38,11 @@ export interface SignInEmailStepProps {
 }
 
 export const SignInEmailStep = ({
+  enableEmailPassword,
   form,
   isSocialOnly,
   loading,
+  oAuthSSOProviderLabels,
   oAuthSSOProviders,
   serverConfigInit,
   socialLoading,
@@ -62,6 +66,12 @@ export const SignInEmailStep = ({
   );
 
   const getProviderLabel = (provider: string) => {
+    // Use custom label if provided
+    if (oAuthSSOProviderLabels?.[provider]) {
+      return `Continue with ${oAuthSSOProviderLabels[provider]}`;
+    }
+
+    // Fallback to i18n or default label generation
     const normalized = provider
       .toLowerCase()
       .replaceAll(/(^|[_-])([a-z])/g, (_, __, c) => c.toUpperCase());
@@ -133,59 +143,61 @@ export const SignInEmailStep = ({
               {getProviderLabel(provider)}
             </Button>
           ))}
-          {divider}
+          {enableEmailPassword && divider}
         </Flexbox>
       )}
-      <Form
-        form={form}
-        layout="vertical"
-        onFinish={(values) => onCheckUser(values as { email: string })}
-      >
-        <Form.Item
-          name="email"
-          rules={[
-            { message: t('betterAuth.errors.emailRequired'), required: true },
-            {
-              validator: (_, value) => {
-                if (!value) return Promise.resolve();
-                const trimmedValue = (value as string).trim();
-                if (EMAIL_REGEX.test(trimmedValue) || USERNAME_REGEX.test(trimmedValue)) {
-                  return Promise.resolve();
-                }
-                return Promise.reject(new Error(t('betterAuth.errors.emailInvalid')));
-              },
-            },
-          ]}
-          style={{ marginBottom: 0 }}
+      {enableEmailPassword && (
+        <Form
+          form={form}
+          layout="vertical"
+          onFinish={(values) => onCheckUser(values as { email: string })}
         >
-          <Input
-            placeholder={t('betterAuth.signin.emailPlaceholder')}
-            prefix={
-              <Icon
-                icon={Mail}
-                style={{
-                  marginInline: 6,
-                }}
-              />
-            }
-            ref={emailInputRef}
-            size="large"
-            style={{
-              padding: 6,
-            }}
-            suffix={
-              <Button
-                icon={ChevronRight}
-                loading={loading}
-                onClick={() => form.submit()}
-                title={t('betterAuth.signin.nextStep')}
-                variant={'filled'}
-              />
-            }
-          />
-        </Form.Item>
-      </Form>
-      {isSocialOnly && (
+          <Form.Item
+            name="email"
+            rules={[
+              { message: t('betterAuth.errors.emailRequired'), required: true },
+              {
+                validator: (_, value) => {
+                  if (!value) return Promise.resolve();
+                  const trimmedValue = (value as string).trim();
+                  if (EMAIL_REGEX.test(trimmedValue) || USERNAME_REGEX.test(trimmedValue)) {
+                    return Promise.resolve();
+                  }
+                  return Promise.reject(new Error(t('betterAuth.errors.emailInvalid')));
+                },
+              },
+            ]}
+            style={{ marginBottom: 0 }}
+          >
+            <Input
+              placeholder={t('betterAuth.signin.emailPlaceholder')}
+              prefix={
+                <Icon
+                  icon={Mail}
+                  style={{
+                    marginInline: 6,
+                  }}
+                />
+              }
+              ref={emailInputRef}
+              size="large"
+              style={{
+                padding: 6,
+              }}
+              suffix={
+                <Button
+                  icon={ChevronRight}
+                  loading={loading}
+                  onClick={() => form.submit()}
+                  title={t('betterAuth.signin.nextStep')}
+                  variant={'filled'}
+                />
+              }
+            />
+          </Form.Item>
+        </Form>
+      )}
+      {enableEmailPassword && isSocialOnly && (
         <Alert
           description={
             <>

src/app/[variants]/(auth)/signin/page.tsx

@@ -11,6 +11,7 @@ import { useSignIn } from './useSignIn';
 const SignInPage = () => {
   const {
     email,
+    enableEmailPassword,
     form,
     handleBackToEmail,
     handleCheckUser,
@@ -19,6 +20,7 @@ const SignInPage = () => {
     handleSocialSignIn,
     isSocialOnly,
     loading,
+    oAuthSSOProviderLabels,
     oAuthSSOProviders,
     serverConfigInit,
     socialLoading,
@@ -29,9 +31,11 @@ const SignInPage = () => {
     <Suspense fallback={<Loading debugId={'Signin'} />}>
       {step === 'email' ? (
         <SignInEmailStep
+          enableEmailPassword={enableEmailPassword}
           form={form as any}
           isSocialOnly={isSocialOnly}
           loading={loading}
+          oAuthSSOProviderLabels={oAuthSSOProviderLabels}
           oAuthSSOProviders={oAuthSSOProviders}
           onCheckUser={handleCheckUser}
           onSetPassword={handleForgotPassword}

src/app/[variants]/(auth)/signin/useSignIn.ts

@@ -32,6 +32,7 @@ export const useSignIn = () => {
   const router = useRouter();
   const searchParams = useSearchParams();
   const enableMagicLink = useServerConfigStore(serverConfigSelectors.enableMagicLink);
+  const enableEmailPassword = useServerConfigStore(serverConfigSelectors.enableEmailPassword);
   const [form] = Form.useForm<SignInFormValues>();
   const [loading, setLoading] = useState(false);
   const [socialLoading, setSocialLoading] = useState<string | null>(null);
@@ -40,6 +41,7 @@ export const useSignIn = () => {
   const [isSocialOnly, setIsSocialOnly] = useState(false);
   const serverConfigInit = useServerConfigStore((s) => s.serverConfigInit);
   const oAuthSSOProviders = useServerConfigStore((s) => s.serverConfig.oAuthSSOProviders) || [];
+  const oAuthSSOProviderLabels = useServerConfigStore(serverConfigSelectors.oAuthSSOProviderLabels);
   const { ssoProviders, preSocialSigninCheck, getAdditionalData } = useBusinessSignin();
 
   useEffect(() => {
@@ -243,6 +245,7 @@ export const useSignIn = () => {
 
   return {
     email,
+    enableEmailPassword,
     form,
     handleBackToEmail,
     handleCheckUser,
@@ -252,6 +255,7 @@ export const useSignIn = () => {
     handleSocialSignIn,
     isSocialOnly,
     loading,
+    oAuthSSOProviderLabels,
     oAuthSSOProviders: ENABLE_BUSINESS_FEATURES ? ssoProviders : oAuthSSOProviders,
     serverConfigInit: ENABLE_BUSINESS_FEATURES ? true : serverConfigInit,
     socialLoading,

src/app/[variants]/(auth)/signup/[[...signup]]/BetterAuthSignUpForm.tsx

@@ -3,17 +3,21 @@
 import { Button, Icon, Text } from '@lobehub/ui';
 import { Form, Input } from 'antd';
 import { Lock, Mail } from 'lucide-react';
-import Link from '@/libs/next/Link';
-import { useSearchParams } from '@/libs/next/navigation';
 import { useEffect } from 'react';
 import { useTranslation } from 'react-i18next';
 
+import Link from '@/libs/next/Link';
+import { useSearchParams } from '@/libs/next/navigation';
+import { useServerConfigStore } from '@/store/serverConfig';
+import { serverConfigSelectors } from '@/store/serverConfig/selectors';
+
 import { AuthCard } from '../../../../../features/AuthCard';
 import { type SignUpFormValues, useSignUp } from './useSignUp';
 
 const BetterAuthSignUpForm = () => {
   const [form] = Form.useForm<SignUpFormValues>();
   const { loading, onSubmit, businessElement } = useSignUp();
+  const enableEmailPassword = useServerConfigStore(serverConfigSelectors.enableEmailPassword);
 
   const { t } = useTranslation('auth');
   const searchParams = useSearchParams();
@@ -30,6 +34,20 @@ const BetterAuthSignUpForm = () => {
     </Text>
   );
 
+  if (!enableEmailPassword) {
+    return (
+      <AuthCard
+        footer={footer}
+        subtitle={t('betterAuth.signup.subtitle')}
+        title={t('betterAuth.signup.title')}
+      >
+        <Text type="secondary">
+          Password registration is disabled. Please use social login to create an account.
+        </Text>
+      </AuthCard>
+    );
+  }
+
   return (
     <AuthCard
       footer={footer}

src/envs/auth.ts

@@ -10,6 +10,7 @@ declare global {
       AUTH_SECRET?: string;
       AUTH_EMAIL_VERIFICATION?: string;
       AUTH_ENABLE_MAGIC_LINK?: string;
+      AUTH_ENABLE_EMAIL_PASSWORD?: string;
       AUTH_SSO_PROVIDERS?: string;
       AUTH_TRUSTED_ORIGINS?: string;
       AUTH_ALLOWED_EMAILS?: string;
@@ -17,13 +18,16 @@ declare global {
       // ===== Auth Provider Credentials ===== //
       AUTH_GOOGLE_ID?: string;
       AUTH_GOOGLE_SECRET?: string;
+      AUTH_GOOGLE_LABEL?: string;
 
       AUTH_APPLE_CLIENT_ID?: string;
       AUTH_APPLE_CLIENT_SECRET?: string;
       AUTH_APPLE_APP_BUNDLE_IDENTIFIER?: string;
+      AUTH_APPLE_LABEL?: string;
 
       AUTH_GITHUB_ID?: string;
       AUTH_GITHUB_SECRET?: string;
+      AUTH_GITHUB_LABEL?: string;
 
       AUTH_COGNITO_ID?: string;
       AUTH_COGNITO_SECRET?: string;
@@ -31,55 +35,69 @@ declare global {
       AUTH_COGNITO_DOMAIN?: string;
       AUTH_COGNITO_REGION?: string;
       AUTH_COGNITO_USERPOOL_ID?: string;
+      AUTH_COGNITO_LABEL?: string;
 
       AUTH_MICROSOFT_ID?: string;
       AUTH_MICROSOFT_SECRET?: string;
+      AUTH_MICROSOFT_LABEL?: string;
 
       AUTH_AUTH0_ID?: string;
       AUTH_AUTH0_SECRET?: string;
       AUTH_AUTH0_ISSUER?: string;
+      AUTH_AUTH0_LABEL?: string;
 
       AUTH_AUTHELIA_ID?: string;
       AUTH_AUTHELIA_SECRET?: string;
       AUTH_AUTHELIA_ISSUER?: string;
+      AUTH_AUTHELIA_LABEL?: string;
 
       AUTH_AUTHENTIK_ID?: string;
       AUTH_AUTHENTIK_SECRET?: string;
       AUTH_AUTHENTIK_ISSUER?: string;
+      AUTH_AUTHENTIK_LABEL?: string;
 
       AUTH_CASDOOR_ID?: string;
       AUTH_CASDOOR_SECRET?: string;
       AUTH_CASDOOR_ISSUER?: string;
+      AUTH_CASDOOR_LABEL?: string;
 
       AUTH_CLOUDFLARE_ZERO_TRUST_ID?: string;
       AUTH_CLOUDFLARE_ZERO_TRUST_SECRET?: string;
       AUTH_CLOUDFLARE_ZERO_TRUST_ISSUER?: string;
+      AUTH_CLOUDFLARE_ZERO_TRUST_LABEL?: string;
 
       AUTH_FEISHU_APP_ID?: string;
       AUTH_FEISHU_APP_SECRET?: string;
+      AUTH_FEISHU_LABEL?: string;
 
       AUTH_GENERIC_OIDC_ID?: string;
       AUTH_GENERIC_OIDC_SECRET?: string;
       AUTH_GENERIC_OIDC_ISSUER?: string;
+      AUTH_GENERIC_OIDC_LABEL?: string;
 
       AUTH_KEYCLOAK_ID?: string;
       AUTH_KEYCLOAK_SECRET?: string;
       AUTH_KEYCLOAK_ISSUER?: string;
+      AUTH_KEYCLOAK_LABEL?: string;
 
       AUTH_LOGTO_ID?: string;
       AUTH_LOGTO_SECRET?: string;
       AUTH_LOGTO_ISSUER?: string;
+      AUTH_LOGTO_LABEL?: string;
 
       AUTH_OKTA_ID?: string;
       AUTH_OKTA_SECRET?: string;
       AUTH_OKTA_ISSUER?: string;
+      AUTH_OKTA_LABEL?: string;
 
       AUTH_WECHAT_ID?: string;
       AUTH_WECHAT_SECRET?: string;
+      AUTH_WECHAT_LABEL?: string;
 
       AUTH_ZITADEL_ID?: string;
       AUTH_ZITADEL_SECRET?: string;
       AUTH_ZITADEL_ISSUER?: string;
+      AUTH_ZITADEL_LABEL?: string;
 
       // ===== JWKS Key ===== //
       /**
@@ -111,17 +129,21 @@ export const getAuthConfig = () => {
       AUTH_TRUSTED_ORIGINS: z.string().optional(),
       AUTH_EMAIL_VERIFICATION: z.boolean().optional().default(false),
       AUTH_ENABLE_MAGIC_LINK: z.boolean().optional().default(false),
+      AUTH_ENABLE_EMAIL_PASSWORD: z.boolean().optional().default(true),
       AUTH_ALLOWED_EMAILS: z.string().optional(),
 
       AUTH_GOOGLE_ID: z.string().optional(),
       AUTH_GOOGLE_SECRET: z.string().optional(),
+      AUTH_GOOGLE_LABEL: z.string().optional(),
 
       AUTH_APPLE_CLIENT_ID: z.string().optional(),
       AUTH_APPLE_CLIENT_SECRET: z.string().optional(),
       AUTH_APPLE_APP_BUNDLE_IDENTIFIER: z.string().optional(),
+      AUTH_APPLE_LABEL: z.string().optional(),
 
       AUTH_GITHUB_ID: z.string().optional(),
       AUTH_GITHUB_SECRET: z.string().optional(),
+      AUTH_GITHUB_LABEL: z.string().optional(),
 
       AUTH_COGNITO_ID: z.string().optional(),
       AUTH_COGNITO_SECRET: z.string().optional(),
@@ -129,55 +151,69 @@ export const getAuthConfig = () => {
       AUTH_COGNITO_DOMAIN: z.string().optional(),
       AUTH_COGNITO_REGION: z.string().optional(),
       AUTH_COGNITO_USERPOOL_ID: z.string().optional(),
+      AUTH_COGNITO_LABEL: z.string().optional(),
 
       AUTH_MICROSOFT_ID: z.string().optional(),
       AUTH_MICROSOFT_SECRET: z.string().optional(),
+      AUTH_MICROSOFT_LABEL: z.string().optional(),
 
       AUTH_AUTH0_ID: z.string().optional(),
       AUTH_AUTH0_SECRET: z.string().optional(),
       AUTH_AUTH0_ISSUER: z.string().optional(),
+      AUTH_AUTH0_LABEL: z.string().optional(),
 
       AUTH_AUTHELIA_ID: z.string().optional(),
       AUTH_AUTHELIA_SECRET: z.string().optional(),
       AUTH_AUTHELIA_ISSUER: z.string().optional(),
+      AUTH_AUTHELIA_LABEL: z.string().optional(),
 
       AUTH_AUTHENTIK_ID: z.string().optional(),
       AUTH_AUTHENTIK_SECRET: z.string().optional(),
       AUTH_AUTHENTIK_ISSUER: z.string().optional(),
+      AUTH_AUTHENTIK_LABEL: z.string().optional(),
 
       AUTH_CASDOOR_ID: z.string().optional(),
       AUTH_CASDOOR_SECRET: z.string().optional(),
       AUTH_CASDOOR_ISSUER: z.string().optional(),
+      AUTH_CASDOOR_LABEL: z.string().optional(),
 
       AUTH_CLOUDFLARE_ZERO_TRUST_ID: z.string().optional(),
       AUTH_CLOUDFLARE_ZERO_TRUST_SECRET: z.string().optional(),
       AUTH_CLOUDFLARE_ZERO_TRUST_ISSUER: z.string().optional(),
+      AUTH_CLOUDFLARE_ZERO_TRUST_LABEL: z.string().optional(),
 
       AUTH_FEISHU_APP_ID: z.string().optional(),
       AUTH_FEISHU_APP_SECRET: z.string().optional(),
+      AUTH_FEISHU_LABEL: z.string().optional(),
 
       AUTH_GENERIC_OIDC_ID: z.string().optional(),
       AUTH_GENERIC_OIDC_SECRET: z.string().optional(),
       AUTH_GENERIC_OIDC_ISSUER: z.string().optional(),
+      AUTH_GENERIC_OIDC_LABEL: z.string().optional(),
 
       AUTH_KEYCLOAK_ID: z.string().optional(),
       AUTH_KEYCLOAK_SECRET: z.string().optional(),
       AUTH_KEYCLOAK_ISSUER: z.string().optional(),
+      AUTH_KEYCLOAK_LABEL: z.string().optional(),
 
       AUTH_LOGTO_ID: z.string().optional(),
       AUTH_LOGTO_SECRET: z.string().optional(),
       AUTH_LOGTO_ISSUER: z.string().optional(),
+      AUTH_LOGTO_LABEL: z.string().optional(),
 
       AUTH_OKTA_ID: z.string().optional(),
       AUTH_OKTA_SECRET: z.string().optional(),
       AUTH_OKTA_ISSUER: z.string().optional(),
+      AUTH_OKTA_LABEL: z.string().optional(),
 
       AUTH_WECHAT_ID: z.string().optional(),
       AUTH_WECHAT_SECRET: z.string().optional(),
+      AUTH_WECHAT_LABEL: z.string().optional(),
 
       AUTH_ZITADEL_ID: z.string().optional(),
       AUTH_ZITADEL_SECRET: z.string().optional(),
       AUTH_ZITADEL_ISSUER: z.string().optional(),
+      AUTH_ZITADEL_LABEL: z.string().optional(),
 
       LOGTO_WEBHOOK_SIGNING_KEY: z.string().optional(),
 
@@ -195,6 +231,7 @@ export const getAuthConfig = () => {
     runtimeEnv: {
       AUTH_EMAIL_VERIFICATION: process.env.AUTH_EMAIL_VERIFICATION === '1',
       AUTH_ENABLE_MAGIC_LINK: process.env.AUTH_ENABLE_MAGIC_LINK === '1',
+      AUTH_ENABLE_EMAIL_PASSWORD: process.env.AUTH_ENABLE_EMAIL_PASSWORD !== '0',
       AUTH_SECRET: process.env.AUTH_SECRET,
       AUTH_SSO_PROVIDERS: process.env.AUTH_SSO_PROVIDERS,
       AUTH_TRUSTED_ORIGINS: process.env.AUTH_TRUSTED_ORIGINS,
@@ -208,66 +245,83 @@ export const getAuthConfig = () => {
       // Auth Provider Credentials
       AUTH_GOOGLE_ID: process.env.AUTH_GOOGLE_ID,
       AUTH_GOOGLE_SECRET: process.env.AUTH_GOOGLE_SECRET,
+      AUTH_GOOGLE_LABEL: process.env.AUTH_GOOGLE_LABEL,
 
       AUTH_APPLE_CLIENT_ID: process.env.AUTH_APPLE_CLIENT_ID,
       AUTH_APPLE_CLIENT_SECRET: process.env.AUTH_APPLE_CLIENT_SECRET,
       AUTH_APPLE_APP_BUNDLE_IDENTIFIER: process.env.AUTH_APPLE_APP_BUNDLE_IDENTIFIER,
+      AUTH_APPLE_LABEL: process.env.AUTH_APPLE_LABEL,
 
       AUTH_GITHUB_ID: process.env.AUTH_GITHUB_ID,
       AUTH_GITHUB_SECRET: process.env.AUTH_GITHUB_SECRET,
+      AUTH_GITHUB_LABEL: process.env.AUTH_GITHUB_LABEL,
 
       AUTH_MICROSOFT_ID: process.env.AUTH_MICROSOFT_ID,
       AUTH_MICROSOFT_SECRET: process.env.AUTH_MICROSOFT_SECRET,
+      AUTH_MICROSOFT_LABEL: process.env.AUTH_MICROSOFT_LABEL,
 
       AUTH_COGNITO_ID: process.env.AUTH_COGNITO_ID,
       AUTH_COGNITO_SECRET: process.env.AUTH_COGNITO_SECRET,
       AUTH_COGNITO_ISSUER: process.env.AUTH_COGNITO_ISSUER,
+      AUTH_COGNITO_LABEL: process.env.AUTH_COGNITO_LABEL,
 
       AUTH_AUTH0_ID: process.env.AUTH_AUTH0_ID,
       AUTH_AUTH0_SECRET: process.env.AUTH_AUTH0_SECRET,
       AUTH_AUTH0_ISSUER: process.env.AUTH_AUTH0_ISSUER,
+      AUTH_AUTH0_LABEL: process.env.AUTH_AUTH0_LABEL,
 
       AUTH_AUTHELIA_ID: process.env.AUTH_AUTHELIA_ID,
       AUTH_AUTHELIA_SECRET: process.env.AUTH_AUTHELIA_SECRET,
       AUTH_AUTHELIA_ISSUER: process.env.AUTH_AUTHELIA_ISSUER,
+      AUTH_AUTHELIA_LABEL: process.env.AUTH_AUTHELIA_LABEL,
 
       AUTH_AUTHENTIK_ID: process.env.AUTH_AUTHENTIK_ID,
       AUTH_AUTHENTIK_SECRET: process.env.AUTH_AUTHENTIK_SECRET,
       AUTH_AUTHENTIK_ISSUER: process.env.AUTH_AUTHENTIK_ISSUER,
+      AUTH_AUTHENTIK_LABEL: process.env.AUTH_AUTHENTIK_LABEL,
 
       AUTH_CASDOOR_ID: process.env.AUTH_CASDOOR_ID,
       AUTH_CASDOOR_SECRET: process.env.AUTH_CASDOOR_SECRET,
       AUTH_CASDOOR_ISSUER: process.env.AUTH_CASDOOR_ISSUER,
+      AUTH_CASDOOR_LABEL: process.env.AUTH_CASDOOR_LABEL,
 
       AUTH_CLOUDFLARE_ZERO_TRUST_ID: process.env.AUTH_CLOUDFLARE_ZERO_TRUST_ID,
       AUTH_CLOUDFLARE_ZERO_TRUST_SECRET: process.env.AUTH_CLOUDFLARE_ZERO_TRUST_SECRET,
       AUTH_CLOUDFLARE_ZERO_TRUST_ISSUER: process.env.AUTH_CLOUDFLARE_ZERO_TRUST_ISSUER,
+      AUTH_CLOUDFLARE_ZERO_TRUST_LABEL: process.env.AUTH_CLOUDFLARE_ZERO_TRUST_LABEL,
 
       AUTH_FEISHU_APP_ID: process.env.AUTH_FEISHU_APP_ID,
       AUTH_FEISHU_APP_SECRET: process.env.AUTH_FEISHU_APP_SECRET,
+      AUTH_FEISHU_LABEL: process.env.AUTH_FEISHU_LABEL,
 
       AUTH_GENERIC_OIDC_ID: process.env.AUTH_GENERIC_OIDC_ID,
       AUTH_GENERIC_OIDC_SECRET: process.env.AUTH_GENERIC_OIDC_SECRET,
       AUTH_GENERIC_OIDC_ISSUER: process.env.AUTH_GENERIC_OIDC_ISSUER,
+      AUTH_GENERIC_OIDC_LABEL: process.env.AUTH_GENERIC_OIDC_LABEL,
 
       AUTH_KEYCLOAK_ID: process.env.AUTH_KEYCLOAK_ID,
       AUTH_KEYCLOAK_SECRET: process.env.AUTH_KEYCLOAK_SECRET,
       AUTH_KEYCLOAK_ISSUER: process.env.AUTH_KEYCLOAK_ISSUER,
+      AUTH_KEYCLOAK_LABEL: process.env.AUTH_KEYCLOAK_LABEL,
 
       AUTH_LOGTO_ID: process.env.AUTH_LOGTO_ID,
       AUTH_LOGTO_SECRET: process.env.AUTH_LOGTO_SECRET,
       AUTH_LOGTO_ISSUER: process.env.AUTH_LOGTO_ISSUER,
+      AUTH_LOGTO_LABEL: process.env.AUTH_LOGTO_LABEL,
 
       AUTH_OKTA_ID: process.env.AUTH_OKTA_ID,
       AUTH_OKTA_SECRET: process.env.AUTH_OKTA_SECRET,
       AUTH_OKTA_ISSUER: process.env.AUTH_OKTA_ISSUER,
+      AUTH_OKTA_LABEL: process.env.AUTH_OKTA_LABEL,
 
       AUTH_WECHAT_ID: process.env.AUTH_WECHAT_ID,
       AUTH_WECHAT_SECRET: process.env.AUTH_WECHAT_SECRET,
+      AUTH_WECHAT_LABEL: process.env.AUTH_WECHAT_LABEL,
 
       AUTH_ZITADEL_ID: process.env.AUTH_ZITADEL_ID,
       AUTH_ZITADEL_SECRET: process.env.AUTH_ZITADEL_SECRET,
       AUTH_ZITADEL_ISSUER: process.env.AUTH_ZITADEL_ISSUER,
+      AUTH_ZITADEL_LABEL: process.env.AUTH_ZITADEL_LABEL,
 
       // LOGTO
       LOGTO_WEBHOOK_SIGNING_KEY: process.env.LOGTO_WEBHOOK_SIGNING_KEY,

src/features/ResourceManager/components/Explorer/ListView/index.tsx

@@ -330,8 +330,7 @@ const ListView = memo(function ListView() {
 
     // Leave some padding at the end when there are no more pages,
     // so users can clearly feel they've reached the end of the list.
-    if (hasMore === false && dataLength > 0)
-      return <div aria-hidden style={{ height: 96 }} />;
+    if (hasMore === false && dataLength > 0) return <div aria-hidden style={{ height: 96 }} />;
 
     return null;
   }, [columnWidths, dataLength, hasMore, isLoadingMore]);

src/features/ResourceManager/components/Header/AddButton.tsx

@@ -87,7 +87,16 @@ const AddButton = () => {
     // Switch to page view mode with real ID
     setCurrentViewItemId(realId);
     setMode('page');
-  }, [category, createResourceAndSync, currentFolderId, libraryId, setCategory, setCurrentViewItemId, setMode, t]);
+  }, [
+    category,
+    createResourceAndSync,
+    currentFolderId,
+    libraryId,
+    setCategory,
+    setCurrentViewItemId,
+    setMode,
+    t,
+  ]);
 
   const handleCreateFolder = useCallback(async () => {
     // Navigate to "All" category first if not already there
@@ -135,7 +144,15 @@ const AddButton = () => {
       message.error(t('header.actions.createFolderError'));
       console.error('Failed to create folder:', error);
     }
-  }, [category, createResourceAndSync, currentFolderId, libraryId, setCategory, setPendingRenameItemId, t]);
+  }, [
+    category,
+    createResourceAndSync,
+    currentFolderId,
+    libraryId,
+    setCategory,
+    setPendingRenameItemId,
+    t,
+  ]);
 
   const {
     handleCloseNotionGuide,

src/libs/better-auth/define-config.ts

@@ -79,6 +79,7 @@ const MAGIC_LINK_EXPIRES_IN = 900;
 // OTP expiration time (in seconds) - 5 minutes for mobile OTP verification
 const OTP_EXPIRES_IN = 300;
 const enableMagicLink = authEnv.AUTH_ENABLE_MAGIC_LINK;
+const enableEmailPassword = authEnv.AUTH_ENABLE_EMAIL_PASSWORD;
 const enabledSSOProviders = parseSSOProviders(authEnv.AUTH_SSO_PROVIDERS);
 
 const { socialProviders, genericOAuthProviders } = initBetterAuthSSOProviders();
@@ -107,7 +108,7 @@ export function defineConfig(customOptions: CustomBetterAuthOptions) {
 
     emailAndPassword: {
       autoSignIn: true,
-      enabled: true,
+      enabled: enableEmailPassword,
       maxPasswordLength: 64,
       minPasswordLength: 8,
       requireEmailVerification: authEnv.AUTH_EMAIL_VERIFICATION,

src/libs/better-auth/sso/helpers.ts

@@ -13,6 +13,7 @@ type OIDCProviderInput = {
   clientId?: string;
   clientSecret?: string;
   issuer?: string;
+  label?: string;
   overrides?: Partial<GenericOAuthConfig>;
   pkce?: boolean;
   providerId: string;
@@ -24,10 +25,11 @@ export const buildOidcConfig = ({
   clientId,
   clientSecret,
   issuer,
+  label,
   scopes = DEFAULT_OIDC_SCOPES,
   pkce = true,
   overrides,
-}: OIDCProviderInput): GenericOAuthConfig => {
+}: OIDCProviderInput): GenericOAuthConfig & { label?: string } => {
   const sanitizedIssuer = issuer?.trim();
 
   if (!clientId || !clientSecret || !sanitizedIssuer) {
@@ -41,9 +43,10 @@ export const buildOidcConfig = ({
     clientId,
     clientSecret,
     discoveryUrl,
+    label,
     pkce,
     providerId,
     scopes,
     ...overrides,
-  } satisfies GenericOAuthConfig;
+  } satisfies GenericOAuthConfig & { label?: string };
 };

src/libs/better-auth/sso/index.ts

@@ -117,3 +117,23 @@ export const initBetterAuthSSOProviders = () => {
     socialProviders: socialProviders,
   };
 };
+
+export const getBetterAuthSSOProviderLabels = () => {
+  const enabledProviders = parseSSOProviders(authEnv.AUTH_SSO_PROVIDERS);
+  const providerLabels: Record<string, string | undefined> = {};
+
+  for (const rawProvider of enabledProviders) {
+    const definition = providerRegistry.get(rawProvider);
+
+    if (!definition) {
+      continue;
+    }
+
+    const env = definition.checkEnvs();
+    if (env && env.label) {
+      providerLabels[definition.id] = env.label;
+    }
+  }
+
+  return providerLabels;
+};

src/libs/better-auth/sso/providers/apple.ts

@@ -23,6 +23,7 @@ const provider: BuiltinProviderDefinition<
           AUTH_APPLE_APP_BUNDLE_IDENTIFIER: authEnv.AUTH_APPLE_APP_BUNDLE_IDENTIFIER,
           AUTH_APPLE_CLIENT_ID: authEnv.AUTH_APPLE_CLIENT_ID,
           AUTH_APPLE_CLIENT_SECRET: authEnv.AUTH_APPLE_CLIENT_SECRET,
+          label: authEnv.AUTH_APPLE_LABEL,
         }
       : false;
   },

src/libs/better-auth/sso/providers/auth0.ts

@@ -8,21 +8,21 @@ const provider: GenericProviderDefinition<{
   AUTH_AUTH0_ISSUER: string;
   AUTH_AUTH0_SECRET: string;
 }> = {
-  build: (env) => {
-    const config = buildOidcConfig({
+  build: (env) =>
+    buildOidcConfig({
       clientId: env.AUTH_AUTH0_ID,
       clientSecret: env.AUTH_AUTH0_SECRET,
       issuer: env.AUTH_AUTH0_ISSUER,
+      label: env.label,
       providerId: 'auth0',
-    });
-    return config;
-  },
+    }),
   checkEnvs: () => {
     return !!(authEnv.AUTH_AUTH0_ID && authEnv.AUTH_AUTH0_SECRET && authEnv.AUTH_AUTH0_ISSUER)
       ? {
           AUTH_AUTH0_ID: authEnv.AUTH_AUTH0_ID,
           AUTH_AUTH0_ISSUER: authEnv.AUTH_AUTH0_ISSUER,
           AUTH_AUTH0_SECRET: authEnv.AUTH_AUTH0_SECRET,
+          label: authEnv.AUTH_AUTH0_LABEL,
         }
       : false;
   },

src/libs/better-auth/sso/providers/authelia.ts

@@ -13,6 +13,7 @@ const provider: GenericProviderDefinition<{
       clientId: env.AUTH_AUTHELIA_ID,
       clientSecret: env.AUTH_AUTHELIA_SECRET,
       issuer: env.AUTH_AUTHELIA_ISSUER,
+      label: env.label,
       providerId: 'authelia',
     }),
   checkEnvs: () => {
@@ -25,6 +26,7 @@ const provider: GenericProviderDefinition<{
           AUTH_AUTHELIA_ID: authEnv.AUTH_AUTHELIA_ID,
           AUTH_AUTHELIA_ISSUER: authEnv.AUTH_AUTHELIA_ISSUER,
           AUTH_AUTHELIA_SECRET: authEnv.AUTH_AUTHELIA_SECRET,
+          label: authEnv.AUTH_AUTHELIA_LABEL,
         }
       : false;
   },

src/libs/better-auth/sso/providers/authentik.ts

@@ -13,6 +13,7 @@ const provider: GenericProviderDefinition<{
       clientId: env.AUTH_AUTHENTIK_ID,
       clientSecret: env.AUTH_AUTHENTIK_SECRET,
       issuer: env.AUTH_AUTHENTIK_ISSUER,
+      label: env.label,
       providerId: 'authentik',
     }),
   checkEnvs: () => {
@@ -25,6 +26,7 @@ const provider: GenericProviderDefinition<{
           AUTH_AUTHENTIK_ID: authEnv.AUTH_AUTHENTIK_ID,
           AUTH_AUTHENTIK_ISSUER: authEnv.AUTH_AUTHENTIK_ISSUER,
           AUTH_AUTHENTIK_SECRET: authEnv.AUTH_AUTHENTIK_SECRET,
+          label: authEnv.AUTH_AUTHENTIK_LABEL,
         }
       : false;
   },

src/libs/better-auth/sso/providers/casdoor.ts

@@ -13,6 +13,7 @@ const provider: GenericProviderDefinition<{
       clientId: env.AUTH_CASDOOR_ID,
       clientSecret: env.AUTH_CASDOOR_SECRET,
       issuer: env.AUTH_CASDOOR_ISSUER,
+      label: env.label,
       overrides: {
         mapProfileToUser: (profile) => {
           const composedName = [profile.firstName, profile.lastName]
@@ -38,6 +39,7 @@ const provider: GenericProviderDefinition<{
           AUTH_CASDOOR_ID: authEnv.AUTH_CASDOOR_ID,
           AUTH_CASDOOR_ISSUER: authEnv.AUTH_CASDOOR_ISSUER,
           AUTH_CASDOOR_SECRET: authEnv.AUTH_CASDOOR_SECRET,
+          label: authEnv.AUTH_CASDOOR_LABEL,
         }
       : false;
   },

src/libs/better-auth/sso/providers/cloudflare-zero-trust.ts

@@ -13,6 +13,7 @@ const provider: GenericProviderDefinition<{
       clientId: env.AUTH_CLOUDFLARE_ZERO_TRUST_ID,
       clientSecret: env.AUTH_CLOUDFLARE_ZERO_TRUST_SECRET,
       issuer: env.AUTH_CLOUDFLARE_ZERO_TRUST_ISSUER,
+      label: env.label,
       overrides: {
         mapProfileToUser: (profile) => ({
           email: profile.email,
@@ -31,6 +32,7 @@ const provider: GenericProviderDefinition<{
           AUTH_CLOUDFLARE_ZERO_TRUST_ID: authEnv.AUTH_CLOUDFLARE_ZERO_TRUST_ID,
           AUTH_CLOUDFLARE_ZERO_TRUST_ISSUER: authEnv.AUTH_CLOUDFLARE_ZERO_TRUST_ISSUER,
           AUTH_CLOUDFLARE_ZERO_TRUST_SECRET: authEnv.AUTH_CLOUDFLARE_ZERO_TRUST_SECRET,
+          label: authEnv.AUTH_CLOUDFLARE_ZERO_TRUST_LABEL,
         }
       : false;
   },

src/libs/better-auth/sso/providers/cognito.ts

@@ -35,6 +35,7 @@ const provider: BuiltinProviderDefinition<
           AUTH_COGNITO_REGION: authEnv.AUTH_COGNITO_REGION,
           AUTH_COGNITO_SECRET: authEnv.AUTH_COGNITO_SECRET,
           AUTH_COGNITO_USERPOOL_ID: authEnv.AUTH_COGNITO_USERPOOL_ID,
+          label: authEnv.AUTH_COGNITO_LABEL,
         }
       : false;
   },

src/libs/better-auth/sso/providers/feishu.ts

@@ -171,6 +171,7 @@ const provider: GenericProviderDefinition<{
       ? {
           AUTH_FEISHU_APP_ID: authEnv.AUTH_FEISHU_APP_ID,
           AUTH_FEISHU_APP_SECRET: authEnv.AUTH_FEISHU_APP_SECRET,
+          label: authEnv.AUTH_FEISHU_LABEL,
         }
       : false;
   },

src/libs/better-auth/sso/providers/generic-oidc.ts

@@ -13,6 +13,7 @@ const provider: GenericProviderDefinition<{
       clientId: env.AUTH_GENERIC_OIDC_ID,
       clientSecret: env.AUTH_GENERIC_OIDC_SECRET,
       issuer: env.AUTH_GENERIC_OIDC_ISSUER,
+      label: env.label,
       overrides: {
         /**
          * Mirror NextAuth's fallback that prefers name -> username -> email so Better Auth never
@@ -34,6 +35,7 @@ const provider: GenericProviderDefinition<{
           AUTH_GENERIC_OIDC_ID: authEnv.AUTH_GENERIC_OIDC_ID,
           AUTH_GENERIC_OIDC_ISSUER: authEnv.AUTH_GENERIC_OIDC_ISSUER,
           AUTH_GENERIC_OIDC_SECRET: authEnv.AUTH_GENERIC_OIDC_SECRET,
+          label: authEnv.AUTH_GENERIC_OIDC_LABEL,
         }
       : false;
   },

src/libs/better-auth/sso/providers/github.ts

@@ -20,6 +20,7 @@ const provider: BuiltinProviderDefinition<
       ? {
           AUTH_GITHUB_ID: authEnv.AUTH_GITHUB_ID,
           AUTH_GITHUB_SECRET: authEnv.AUTH_GITHUB_SECRET,
+          label: authEnv.AUTH_GITHUB_LABEL,
         }
       : false;
   },

src/libs/better-auth/sso/providers/google.ts

@@ -20,6 +20,7 @@ const provider: BuiltinProviderDefinition<
       ? {
           AUTH_GOOGLE_ID: authEnv.AUTH_GOOGLE_ID,
           AUTH_GOOGLE_SECRET: authEnv.AUTH_GOOGLE_SECRET,
+          label: authEnv.AUTH_GOOGLE_LABEL,
         }
       : false;
   },

src/libs/better-auth/sso/providers/keycloak.ts

@@ -13,6 +13,7 @@ const provider: GenericProviderDefinition<{
       clientId: env.AUTH_KEYCLOAK_ID,
       clientSecret: env.AUTH_KEYCLOAK_SECRET,
       issuer: env.AUTH_KEYCLOAK_ISSUER,
+      label: env.label,
       providerId: 'keycloak',
     }),
   checkEnvs: () => {
@@ -25,6 +26,7 @@ const provider: GenericProviderDefinition<{
           AUTH_KEYCLOAK_ID: authEnv.AUTH_KEYCLOAK_ID,
           AUTH_KEYCLOAK_ISSUER: authEnv.AUTH_KEYCLOAK_ISSUER,
           AUTH_KEYCLOAK_SECRET: authEnv.AUTH_KEYCLOAK_SECRET,
+          label: authEnv.AUTH_KEYCLOAK_LABEL,
         }
       : false;
   },

src/libs/better-auth/sso/providers/logto.ts

@@ -13,6 +13,7 @@ const provider: GenericProviderDefinition<{
       clientId: env.AUTH_LOGTO_ID,
       clientSecret: env.AUTH_LOGTO_SECRET,
       issuer: env.AUTH_LOGTO_ISSUER,
+      label: env.label,
       overrides: {
         mapProfileToUser: (profile) => ({
           email: profile.email,
@@ -28,6 +29,7 @@ const provider: GenericProviderDefinition<{
           AUTH_LOGTO_ID: authEnv.AUTH_LOGTO_ID,
           AUTH_LOGTO_ISSUER: authEnv.AUTH_LOGTO_ISSUER,
           AUTH_LOGTO_SECRET: authEnv.AUTH_LOGTO_SECRET,
+          label: authEnv.AUTH_LOGTO_LABEL,
         }
       : false;
   },

src/libs/better-auth/sso/providers/microsoft.ts

@@ -20,6 +20,7 @@ const provider: BuiltinProviderDefinition<MicrosoftEnv, 'microsoft'> = {
       ? {
           AUTH_MICROSOFT_ID: clientId,
           AUTH_MICROSOFT_SECRET: clientSecret,
+          label: authEnv.AUTH_MICROSOFT_LABEL,
         }
       : false;
   },

src/libs/better-auth/sso/providers/okta.ts

@@ -13,6 +13,7 @@ const provider: GenericProviderDefinition<{
       clientId: env.AUTH_OKTA_ID,
       clientSecret: env.AUTH_OKTA_SECRET,
       issuer: env.AUTH_OKTA_ISSUER,
+      label: env.label,
       overrides: {
         mapProfileToUser: (profile) => ({
           email: profile.email,
@@ -27,6 +28,7 @@ const provider: GenericProviderDefinition<{
           AUTH_OKTA_ID: authEnv.AUTH_OKTA_ID,
           AUTH_OKTA_ISSUER: authEnv.AUTH_OKTA_ISSUER,
           AUTH_OKTA_SECRET: authEnv.AUTH_OKTA_SECRET,
+          label: authEnv.AUTH_OKTA_LABEL,
         }
       : false;
   },

src/libs/better-auth/sso/providers/wechat.ts

@@ -130,6 +130,7 @@ const provider: GenericProviderDefinition<{
       ? {
           AUTH_WECHAT_ID: authEnv.AUTH_WECHAT_ID,
           AUTH_WECHAT_SECRET: authEnv.AUTH_WECHAT_SECRET,
+          label: authEnv.AUTH_WECHAT_LABEL,
         }
       : false;
   },

src/libs/better-auth/sso/providers/zitadel.ts

@@ -15,6 +15,7 @@ const provider: GenericProviderDefinition<ZitadelEnv> = {
       clientId: env.AUTH_ZITADEL_ID!,
       clientSecret: env.AUTH_ZITADEL_SECRET!,
       issuer: env.AUTH_ZITADEL_ISSUER!,
+      label: env.label,
       providerId: 'zitadel',
     }),
   checkEnvs: () => {
@@ -26,6 +27,7 @@ const provider: GenericProviderDefinition<ZitadelEnv> = {
           AUTH_ZITADEL_ID: clientId,
           AUTH_ZITADEL_ISSUER: issuer,
           AUTH_ZITADEL_SECRET: clientSecret,
+          label: authEnv.AUTH_ZITADEL_LABEL,
         }
       : false;
   },

src/libs/better-auth/sso/types.ts

@@ -7,16 +7,18 @@ export type BuiltinProviderDefinition<
 > = {
   aliases?: string[];
   build: (env: E) => SocialProviders[Id];
-  checkEnvs: () => E | false;
+  checkEnvs: () => (E & { label?: string }) | false;
   id: Id;
+  label?: string;
   type: 'builtin';
 };
 
 export type GenericProviderDefinition<E extends Record<string, string | undefined>> = {
   aliases?: string[];
-  build: (env: E) => GenericOAuthConfig;
-  checkEnvs: () => E | false;
+  build: (env: E & { label?: string }) => GenericOAuthConfig & { label?: string };
+  checkEnvs: () => (E & { label?: string }) | false;
   id: string;
+  label?: string;
   type: 'generic';
 };
 

src/libs/next/proxy/createRouteMatcher.test.ts

@@ -57,7 +57,6 @@ describe('createRouteMatcher', () => {
       expect(matcher(createMockRequest('/trpc/user.get'))).toBe(true);
       expect(matcher(createMockRequest('/trpc/chat.create'))).toBe(true);
     });
-
   });
 
   describe('multiple patterns', () => {

src/server/globalConfig/index.ts

@@ -8,6 +8,7 @@ import { fileEnv } from '@/envs/file';
 import { imageEnv } from '@/envs/image';
 import { knowledgeEnv } from '@/envs/knowledge';
 import { langfuseEnv } from '@/envs/langfuse';
+import { getBetterAuthSSOProviderLabels } from '@/libs/better-auth/sso';
 import { parseSSOProviders } from '@/libs/better-auth/utils/server';
 import { parseSystemAgent } from '@/server/globalConfig/parseSystemAgent';
 import { type GlobalServerConfig } from '@/types/serverConfig';
@@ -75,6 +76,7 @@ export const getServerGlobalConfig = async () => {
       config: parseAgentConfig(DEFAULT_AGENT_CONFIG),
     },
     enableBusinessFeatures: ENABLE_BUSINESS_FEATURES,
+    enableEmailPassword: authEnv.AUTH_ENABLE_EMAIL_PASSWORD,
     enableEmailVerification: authEnv.AUTH_EMAIL_VERIFICATION,
     enableKlavis: !!klavisEnv.KLAVIS_API_KEY,
     enableLobehubSkill: !!(appEnv.MARKET_TRUSTED_CLIENT_SECRET && appEnv.MARKET_TRUSTED_CLIENT_ID),
@@ -90,6 +92,7 @@ export const getServerGlobalConfig = async () => {
     memory: {
       userMemory: cleanObject(getPublicMemoryExtractionConfig()),
     },
+    oAuthSSOProviderLabels: getBetterAuthSSOProviderLabels(),
     oAuthSSOProviders: getBetterAuthSSOProviders(),
     systemAgent: parseSystemAgent(appEnv.SYSTEM_AGENT),
     telemetry: {

src/server/manifest.test.ts

@@ -131,7 +131,7 @@ describe('Manifest', () => {
         sizes: '1280x676',
         type: 'image/png',
       });
-      expect(result.src).toContain('v=4');
+      expect(result.src).toBe(qs.stringifyUrl({ query: { v: 4 }, url: BRANDING_LOGO_URL }));
     });
 
     it('should return correct screenshot object for narrow form factor', () => {
@@ -150,7 +150,7 @@ describe('Manifest', () => {
         immutable: 'true',
         max_age: 31536000,
         sizes: '1280x676',
-        src: 'https://example.com/screenshot.png?v=1',
+        src: qs.stringifyUrl({ query: { v: 1 }, url: BRANDING_LOGO_URL }),
         type: 'image/png',
       });
     });

src/server/metadata.test.ts

@@ -1,8 +1,10 @@
 // @vitest-environment node
-import { BRANDING_NAME } from '@lobechat/business-const';
+import { BRANDING_NAME, ORG_NAME } from '@lobechat/business-const';
 import { OG_URL } from '@lobechat/const';
 import { describe, expect, it } from 'vitest';
 
+import { isCustomORG } from '@/const/version';
+
 import { Meta } from './metadata';
 
 describe('Metadata', () => {
@@ -89,7 +91,7 @@ describe('Metadata', () => {
         title: 'Twitter Title',
         description: 'Twitter description',
         images: ['https://twitter-image.com'],
-        site: '@lobehub',
+        site: isCustomORG ? `@${ORG_NAME}` : '@lobehub',
         url: 'https://example.com/twitter',
       });
     });

src/server/routers/lambda/__tests__/integration/aiAgent.createClientTaskThread.integration.test.ts

@@ -1,6 +1,13 @@
 // @vitest-environment node
 import { LobeChatDatabase } from '@lobechat/database';
-import { agents, chatGroups, messages, sessions, threads, topics } from '@lobechat/database/schemas';
+import {
+  agents,
+  chatGroups,
+  messages,
+  sessions,
+  threads,
+  topics,
+} from '@lobechat/database/schemas';
 import { getTestDB } from '@lobechat/database/test-utils';
 import { ThreadStatus, ThreadType } from '@lobechat/types';
 import { eq } from 'drizzle-orm';
@@ -374,8 +381,14 @@ describe('createClientTaskThread Integration', () => {
       expect(result2.success).toBe(true);
 
       // Verify threads have different agentIds
-      const [thread1] = await serverDB.select().from(threads).where(eq(threads.id, result1.threadId));
-      const [thread2] = await serverDB.select().from(threads).where(eq(threads.id, result2.threadId));
+      const [thread1] = await serverDB
+        .select()
+        .from(threads)
+        .where(eq(threads.id, result1.threadId));
+      const [thread2] = await serverDB
+        .select()
+        .from(threads)
+        .where(eq(threads.id, result2.threadId));
 
       expect(thread1.agentId).toBe(testAgentId);
       expect(thread2.agentId).toBe(agent2.id);

src/server/services/discover/index.ts

@@ -574,9 +574,9 @@ export class DiscoverService {
 
         examples: Array.isArray((data as any).examples)
           ? (data as any).examples.map((example: any) => ({
-            content: typeof example === 'string' ? example : example.content || '',
-            role: example.role || 'user',
-          }))
+              content: typeof example === 'string' ? example : example.content || '',
+              role: example.role || 'user',
+            }))
           : [],
         forkCount: (data as any).forkCount,
         forkedFromAgentId: (data as any).forkedFromAgentId,
@@ -680,8 +680,7 @@ export class DiscoverService {
     try {
       const normalizedLocale = normalizeLocale(locale);
 
-      let apiSort: 'createdAt' | 'updatedAt' | 'name' | 'mostUsage' | 'recommended' =
-        'recommended';
+      let apiSort: 'createdAt' | 'updatedAt' | 'name' | 'mostUsage' | 'recommended' = 'recommended';
       let haveSkills: boolean | undefined = rest.haveSkills;
 
       switch (sort) {
@@ -831,7 +830,9 @@ export class DiscoverService {
     log('getMcpList: params=%O', params);
     const { category, locale, sort } = params;
     const normalizedLocale = normalizeLocale(locale);
-    const shouldOmitCategory = [McpCategory.All, McpCategory.Discover].includes(category as McpCategory)
+    const shouldOmitCategory = [McpCategory.All, McpCategory.Discover].includes(
+      category as McpCategory,
+    );
 
     const result = await this.market.plugins.getPluginList(
       {

src/store/serverConfig/selectors.ts

@@ -4,6 +4,7 @@ export const featureFlagsSelectors = (s: ServerConfigStore) => s.featureFlags;
 
 export const serverConfigSelectors = {
   enableBusinessFeatures: (s: ServerConfigStore) => s.serverConfig.enableBusinessFeatures || false,
+  enableEmailPassword: (s: ServerConfigStore) => s.serverConfig.enableEmailPassword ?? true,
   enableEmailVerification: (s: ServerConfigStore) =>
     s.serverConfig.enableEmailVerification || false,
   enableKlavis: (s: ServerConfigStore) => s.serverConfig.enableKlavis || false,
@@ -14,5 +15,6 @@ export const serverConfigSelectors = {
   enableUploadFileToServer: (s: ServerConfigStore) => s.serverConfig.enableUploadFileToServer,
   enabledTelemetryChat: (s: ServerConfigStore) => s.serverConfig.telemetry.langfuse || false,
   isMobile: (s: ServerConfigStore) => s.isMobile || false,
+  oAuthSSOProviderLabels: (s: ServerConfigStore) => s.serverConfig.oAuthSSOProviderLabels,
   oAuthSSOProviders: (s: ServerConfigStore) => s.serverConfig.oAuthSSOProviders,
 };