feat: backend core - auth, user, role, permission, device, webhook, monitoring, cache, repository, service, middleware, API handlers

2026-04-02 11:19:50 +08:00
parent e59a77bc49
commit dcc1f186f8
298 changed files with 62603 additions and 0 deletions
--- a/internal/auth/errors.go
+++ b/internal/auth/errors.go
@@ -0,0 +1,26 @@
+package auth
+
+import "errors"
+
+var (
+	// ErrOAuthProviderNotSupported OAuth提供商不支持
+	ErrOAuthProviderNotSupported = errors.New("OAuth provider not supported")
+
+	// ErrOAuthCodeInvalid OAuth授权码无效
+	ErrOAuthCodeInvalid = errors.New("OAuth authorization code is invalid")
+
+	// ErrOAuthTokenExpired OAuth令牌已过期
+	ErrOAuthTokenExpired = errors.New("OAuth token has expired")
+
+	// ErrOAuthUserInfoFailed 获取OAuth用户信息失败
+	ErrOAuthUserInfoFailed = errors.New("failed to get OAuth user info")
+
+	// ErrOAuthStateInvalid OAuth状态验证失败
+	ErrOAuthStateInvalid = errors.New("OAuth state validation failed")
+
+	// ErrOAuthAlreadyBound 社交账号已绑定
+	ErrOAuthAlreadyBound = errors.New("social account already bound")
+
+	// ErrOAuthNotFound 未找到绑定的社交账号
+	ErrOAuthNotFound = errors.New("social account not found")
+)
--- a/internal/auth/jwt.go
+++ b/internal/auth/jwt.go
@@ -0,0 +1,507 @@
+package auth
+
+import (
+	cryptorand "crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+const (
+	jwtAlgorithmHS256 = "HS256"
+	jwtAlgorithmRS256 = "RS256"
+)
+
+// JWTOptions controls JWT signing behavior.
+type JWTOptions struct {
+	Algorithm              string
+	HS256Secret            string
+	RSAPrivateKeyPEM       string
+	RSAPublicKeyPEM        string
+	RSAPrivateKeyPath      string
+	RSAPublicKeyPath       string
+	RequireExistingRSAKeys bool
+	AccessTokenExpire      time.Duration
+	RefreshTokenExpire     time.Duration
+	RememberLoginExpire    time.Duration // 记住登录时的refresh token有效期
+}
+
+// JWT JWT管理器
+type JWT struct {
+	algorithm              string
+	secret                 []byte
+	privateKey             *rsa.PrivateKey
+	publicKey              *rsa.PublicKey
+	accessTokenExpire      time.Duration
+	refreshTokenExpire     time.Duration
+	rememberLoginExpire    time.Duration
+	initErr                error
+}
+
+// Claims JWT声明
+type Claims struct {
+	UserID   int64  `json:"user_id"`
+	Username string `json:"username"`
+	Type     string `json:"type"` // access, refresh
+	Remember bool   `json:"remember,omitempty"` // 记住登录标记
+	JTI      string `json:"jti"`  // JWT ID，用于黑名单
+	jwt.RegisteredClaims
+}
+
+// generateJTI 生成唯一的 JWT ID
+// 使用 crypto/rand 生成密码学安全的随机数，仅使用随机数不包含时间戳
+func generateJTI() (string, error) {
+	// 生成 16 字节的密码学安全随机数
+	b := make([]byte, 16)
+	if _, err := cryptorand.Read(b); err != nil {
+		return "", fmt.Errorf("generate jwt jti failed: %w", err)
+	}
+	// 使用十六进制编码，仅使用随机数确保不可预测
+	return fmt.Sprintf("%x", b), nil
+}
+
+// NewJWT creates a legacy HS256 JWT manager for compatibility in tests and callers
+// that still only provide a shared secret.
+func NewJWT(secret string, accessTokenExpire, refreshTokenExpire time.Duration) *JWT {
+	manager, err := NewJWTWithOptions(JWTOptions{
+		Algorithm:          jwtAlgorithmHS256,
+		HS256Secret:        secret,
+		AccessTokenExpire:  accessTokenExpire,
+		RefreshTokenExpire: refreshTokenExpire,
+	})
+	if err != nil {
+		return &JWT{
+			algorithm:           jwtAlgorithmHS256,
+			accessTokenExpire:  accessTokenExpire,
+			refreshTokenExpire:  refreshTokenExpire,
+			initErr:             err,
+		}
+	}
+	return manager
+}
+
+func (j *JWT) ensureReady() error {
+	if j == nil {
+		return errors.New("jwt manager is nil")
+	}
+	if j.initErr != nil {
+		return j.initErr
+	}
+	return nil
+}
+
+// NewJWTWithOptions creates a JWT manager from explicit signing options.
+func NewJWTWithOptions(opts JWTOptions) (*JWT, error) {
+	algorithm := strings.ToUpper(strings.TrimSpace(opts.Algorithm))
+	if algorithm == "" {
+		if opts.HS256Secret != "" && opts.RSAPrivateKeyPEM == "" && opts.RSAPrivateKeyPath == "" {
+			algorithm = jwtAlgorithmHS256
+		} else {
+			algorithm = jwtAlgorithmRS256
+		}
+	}
+
+	manager := &JWT{
+		algorithm:           algorithm,
+		accessTokenExpire:   opts.AccessTokenExpire,
+		refreshTokenExpire:  opts.RefreshTokenExpire,
+		rememberLoginExpire: opts.RememberLoginExpire,
+	}
+
+	switch algorithm {
+	case jwtAlgorithmHS256:
+		if opts.HS256Secret == "" {
+			return nil, errors.New("jwt secret is required for HS256")
+		}
+		manager.secret = []byte(opts.HS256Secret)
+	case jwtAlgorithmRS256:
+		if err := manager.loadRSAKeys(opts); err != nil {
+			return nil, err
+		}
+	default:
+		return nil, fmt.Errorf("unsupported jwt algorithm: %s", algorithm)
+	}
+
+	return manager, nil
+}
+
+func (j *JWT) loadRSAKeys(opts JWTOptions) error {
+	privatePEM, err := readPEM(opts.RSAPrivateKeyPEM, opts.RSAPrivateKeyPath)
+	if err != nil {
+		return fmt.Errorf("load jwt private key failed: %w", err)
+	}
+	publicPEM, err := readPEM(opts.RSAPublicKeyPEM, opts.RSAPublicKeyPath)
+	if err != nil {
+		return fmt.Errorf("load jwt public key failed: %w", err)
+	}
+
+	if privatePEM == "" && publicPEM == "" {
+		if strings.TrimSpace(opts.RSAPrivateKeyPath) == "" || strings.TrimSpace(opts.RSAPublicKeyPath) == "" {
+			return errors.New("rsa private/public key paths or inline pem are required for RS256")
+		}
+		if opts.RequireExistingRSAKeys {
+			return errors.New("existing rsa private/public key files or inline pem are required for RS256")
+		}
+		privatePEM, publicPEM, err = generateAndPersistRSAKeyPair(opts.RSAPrivateKeyPath, opts.RSAPublicKeyPath)
+		if err != nil {
+			return fmt.Errorf("generate rsa key pair failed: %w", err)
+		}
+	}
+
+	if privatePEM != "" {
+		privateKey, err := parseRSAPrivateKey(privatePEM)
+		if err != nil {
+			return err
+		}
+		j.privateKey = privateKey
+		j.publicKey = &privateKey.PublicKey
+	}
+
+	if publicPEM != "" {
+		publicKey, err := parseRSAPublicKey(publicPEM)
+		if err != nil {
+			return err
+		}
+		j.publicKey = publicKey
+	}
+
+	if j.privateKey == nil {
+		return errors.New("rsa private key is required for signing")
+	}
+	if j.publicKey == nil {
+		return errors.New("rsa public key is required for verification")
+	}
+
+	return nil
+}
+
+func generateAndPersistRSAKeyPair(privatePath, publicPath string) (string, string, error) {
+	privatePath = strings.TrimSpace(privatePath)
+	publicPath = strings.TrimSpace(publicPath)
+	if privatePath == "" || publicPath == "" {
+		return "", "", errors.New("rsa key paths must not be empty")
+	}
+
+	privateKey, err := rsa.GenerateKey(cryptorand.Reader, 2048)
+	if err != nil {
+		return "", "", err
+	}
+
+	privateDER := x509.MarshalPKCS1PrivateKey(privateKey)
+	privatePEM := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: privateDER})
+
+	publicDER, err := x509.MarshalPKIXPublicKey(&privateKey.PublicKey)
+	if err != nil {
+		return "", "", err
+	}
+	publicPEM := pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: publicDER})
+
+	if err := os.MkdirAll(filepath.Dir(privatePath), 0o700); err != nil {
+		return "", "", err
+	}
+	if err := os.MkdirAll(filepath.Dir(publicPath), 0o700); err != nil {
+		return "", "", err
+	}
+	if err := os.WriteFile(privatePath, privatePEM, 0o600); err != nil {
+		return "", "", err
+	}
+	if err := os.WriteFile(publicPath, publicPEM, 0o644); err != nil {
+		return "", "", err
+	}
+
+	return string(privatePEM), string(publicPEM), nil
+}
+
+func readPEM(inlinePEM, path string) (string, error) {
+	inlinePEM = strings.TrimSpace(inlinePEM)
+	if inlinePEM != "" {
+		return inlinePEM, nil
+	}
+	path = strings.TrimSpace(path)
+	if path == "" {
+		return "", nil
+	}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return "", nil
+		}
+		return "", err
+	}
+	return string(data), nil
+}
+
+func parseRSAPrivateKey(pemValue string) (*rsa.PrivateKey, error) {
+	block, _ := pem.Decode([]byte(pemValue))
+	if block == nil {
+		return nil, errors.New("invalid rsa private key pem")
+	}
+
+	if key, err := x509.ParsePKCS1PrivateKey(block.Bytes); err == nil {
+		return key, nil
+	}
+
+	key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
+	if err != nil {
+		return nil, fmt.Errorf("parse rsa private key failed: %w", err)
+	}
+
+	rsaKey, ok := key.(*rsa.PrivateKey)
+	if !ok {
+		return nil, errors.New("private key is not rsa")
+	}
+	return rsaKey, nil
+}
+
+func parseRSAPublicKey(pemValue string) (*rsa.PublicKey, error) {
+	block, _ := pem.Decode([]byte(pemValue))
+	if block == nil {
+		return nil, errors.New("invalid rsa public key pem")
+	}
+
+	if key, err := x509.ParsePKIXPublicKey(block.Bytes); err == nil {
+		rsaKey, ok := key.(*rsa.PublicKey)
+		if !ok {
+			return nil, errors.New("public key is not rsa")
+		}
+		return rsaKey, nil
+	}
+
+	if cert, err := x509.ParseCertificate(block.Bytes); err == nil {
+		rsaKey, ok := cert.PublicKey.(*rsa.PublicKey)
+		if !ok {
+			return nil, errors.New("certificate public key is not rsa")
+		}
+		return rsaKey, nil
+	}
+
+	return nil, errors.New("parse rsa public key failed")
+}
+
+func (j *JWT) signingMethod() jwt.SigningMethod {
+	if j.algorithm == jwtAlgorithmRS256 {
+		return jwt.SigningMethodRS256
+	}
+	return jwt.SigningMethodHS256
+}
+
+func (j *JWT) signingKey() interface{} {
+	if j.algorithm == jwtAlgorithmRS256 {
+		return j.privateKey
+	}
+	return j.secret
+}
+
+func (j *JWT) verifyKey(token *jwt.Token) (interface{}, error) {
+	if token.Method.Alg() != j.signingMethod().Alg() {
+		return nil, fmt.Errorf("unexpected signing method: %s", token.Method.Alg())
+	}
+	if j.algorithm == jwtAlgorithmRS256 {
+		return j.publicKey, nil
+	}
+	return j.secret, nil
+}
+
+// GetAlgorithm returns the configured JWT signing algorithm.
+func (j *JWT) GetAlgorithm() string {
+	return j.algorithm
+}
+
+// GenerateAccessToken 生成访问令牌（含JTI）
+func (j *JWT) GenerateAccessToken(userID int64, username string) (string, error) {
+	if err := j.ensureReady(); err != nil {
+		return "", err
+	}
+
+	now := time.Now()
+	jti, err := generateJTI()
+	if err != nil {
+		return "", err
+	}
+	claims := Claims{
+		UserID:   userID,
+		Username: username,
+		Type:     "access",
+		JTI:      jti,
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(now.Add(j.accessTokenExpire)),
+			IssuedAt:  jwt.NewNumericDate(now),
+			NotBefore: jwt.NewNumericDate(now),
+		},
+	}
+
+	token := jwt.NewWithClaims(j.signingMethod(), claims)
+	return token.SignedString(j.signingKey())
+}
+
+// GenerateRefreshToken 生成刷新令牌（含JTI）
+func (j *JWT) GenerateRefreshToken(userID int64, username string) (string, error) {
+	if err := j.ensureReady(); err != nil {
+		return "", err
+	}
+
+	now := time.Now()
+	jti, err := generateJTI()
+	if err != nil {
+		return "", err
+	}
+	claims := Claims{
+		UserID:   userID,
+		Username: username,
+		Type:     "refresh",
+		JTI:      jti,
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(now.Add(j.refreshTokenExpire)),
+			IssuedAt:  jwt.NewNumericDate(now),
+			NotBefore: jwt.NewNumericDate(now),
+		},
+	}
+
+	token := jwt.NewWithClaims(j.signingMethod(), claims)
+	return token.SignedString(j.signingKey())
+}
+
+// GetAccessTokenExpire 获取访问令牌有效期
+func (j *JWT) GetAccessTokenExpire() time.Duration {
+	return j.accessTokenExpire
+}
+
+// GetRefreshTokenExpire 获取刷新令牌有效期
+func (j *JWT) GetRefreshTokenExpire() time.Duration {
+	return j.refreshTokenExpire
+}
+
+// GenerateTokenPair 生成令牌对
+func (j *JWT) GenerateTokenPair(userID int64, username string) (accessToken, refreshToken string, err error) {
+	accessToken, err = j.GenerateAccessToken(userID, username)
+	if err != nil {
+		return "", "", err
+	}
+
+	refreshToken, err = j.GenerateRefreshToken(userID, username)
+	if err != nil {
+		return "", "", err
+	}
+
+	return accessToken, refreshToken, nil
+}
+
+// GenerateTokenPairWithRemember 生成令牌对（支持记住登录）
+func (j *JWT) GenerateTokenPairWithRemember(userID int64, username string, remember bool) (accessToken, refreshToken string, err error) {
+	accessToken, err = j.GenerateAccessToken(userID, username)
+	if err != nil {
+		return "", "", err
+	}
+
+	if remember {
+		refreshToken, err = j.GenerateLongLivedRefreshToken(userID, username)
+	} else {
+		refreshToken, err = j.GenerateRefreshToken(userID, username)
+	}
+	if err != nil {
+		return "", "", err
+	}
+
+	return accessToken, refreshToken, nil
+}
+
+// GenerateLongLivedRefreshToken 生成长期刷新令牌（记住登录时使用）
+func (j *JWT) GenerateLongLivedRefreshToken(userID int64, username string) (string, error) {
+	if err := j.ensureReady(); err != nil {
+		return "", err
+	}
+
+	now := time.Now()
+	jti, err := generateJTI()
+	if err != nil {
+		return "", err
+	}
+
+	// 使用rememberLoginExpire，如果未配置则使用默认的refreshTokenExpire
+	expireDuration := j.rememberLoginExpire
+	if expireDuration == 0 {
+		expireDuration = j.refreshTokenExpire
+	}
+
+	claims := Claims{
+		UserID:   userID,
+		Username: username,
+		Type:     "refresh",
+		Remember: true, // 长期会话标记
+		JTI:      jti,
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(now.Add(expireDuration)),
+			IssuedAt:  jwt.NewNumericDate(now),
+			NotBefore: jwt.NewNumericDate(now),
+		},
+	}
+
+	token := jwt.NewWithClaims(j.signingMethod(), claims)
+	return token.SignedString(j.signingKey())
+}
+
+// ParseToken 解析令牌
+func (j *JWT) ParseToken(tokenString string) (*Claims, error) {
+	if err := j.ensureReady(); err != nil {
+		return nil, err
+	}
+
+	token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) {
+		return j.verifyKey(token)
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	if claims, ok := token.Claims.(*Claims); ok && token.Valid {
+		return claims, nil
+	}
+
+	return nil, errors.New("invalid token")
+}
+
+// ValidateAccessToken 验证访问令牌
+func (j *JWT) ValidateAccessToken(tokenString string) (*Claims, error) {
+	claims, err := j.ParseToken(tokenString)
+	if err != nil {
+		return nil, err
+	}
+
+	if claims.Type != "access" {
+		return nil, errors.New("invalid token type")
+	}
+
+	return claims, nil
+}
+
+// ValidateRefreshToken 验证刷新令牌
+func (j *JWT) ValidateRefreshToken(tokenString string) (*Claims, error) {
+	claims, err := j.ParseToken(tokenString)
+	if err != nil {
+		return nil, err
+	}
+
+	if claims.Type != "refresh" {
+		return nil, errors.New("invalid token type")
+	}
+
+	return claims, nil
+}
+
+// RefreshAccessToken 刷新访问令牌
+func (j *JWT) RefreshAccessToken(refreshTokenString string) (string, error) {
+	claims, err := j.ValidateRefreshToken(refreshTokenString)
+	if err != nil {
+		return "", err
+	}
+
+	return j.GenerateAccessToken(claims.UserID, claims.Username)
+}
--- a/internal/auth/jwt_closure_test.go
+++ b/internal/auth/jwt_closure_test.go
@@ -0,0 +1,17 @@
+package auth
+
+import (
+	"testing"
+	"time"
+)
+
+func TestNewJWT_DoesNotPanicOnInvalidLegacyConfig(t *testing.T) {
+	manager := NewJWT("", 2*time.Hour, 7*24*time.Hour)
+	if manager == nil {
+		t.Fatal("expected manager instance")
+	}
+
+	if _, err := manager.GenerateAccessToken(1, "tester"); err == nil {
+		t.Fatal("expected invalid legacy manager to return error")
+	}
+}
--- a/internal/auth/jwt_password_test.go
+++ b/internal/auth/jwt_password_test.go
@@ -0,0 +1,126 @@
+package auth
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestHashPassword_UsesArgon2id(t *testing.T) {
+	hashed, err := HashPassword("StrongPass1!")
+	if err != nil {
+		t.Fatalf("hash password failed: %v", err)
+	}
+	if !strings.HasPrefix(hashed, "$argon2id$") {
+		t.Fatalf("expected argon2id hash, got %q", hashed)
+	}
+	if !VerifyPassword(hashed, "StrongPass1!") {
+		t.Fatal("expected argon2id password verification to succeed")
+	}
+}
+
+func TestVerifyPassword_SupportsLegacyBcrypt(t *testing.T) {
+	hashed, err := BcryptHash("LegacyPass1!")
+	if err != nil {
+		t.Fatalf("hash legacy bcrypt password failed: %v", err)
+	}
+	if !VerifyPassword(hashed, "LegacyPass1!") {
+		t.Fatal("expected bcrypt compatibility verification to succeed")
+	}
+}
+
+func TestNewJWTWithOptions_RS256(t *testing.T) {
+	dir := t.TempDir()
+	jwtManager, err := NewJWTWithOptions(JWTOptions{
+		Algorithm:          jwtAlgorithmRS256,
+		RSAPrivateKeyPath:  filepath.Join(dir, "private.pem"),
+		RSAPublicKeyPath:   filepath.Join(dir, "public.pem"),
+		AccessTokenExpire:  2 * time.Hour,
+		RefreshTokenExpire: 24 * time.Hour,
+	})
+	if err != nil {
+		t.Fatalf("create rs256 jwt manager failed: %v", err)
+	}
+
+	accessToken, refreshToken, err := jwtManager.GenerateTokenPair(42, "rs256-user")
+	if err != nil {
+		t.Fatalf("generate token pair failed: %v", err)
+	}
+	if jwtManager.GetAlgorithm() != jwtAlgorithmRS256 {
+		t.Fatalf("unexpected algorithm: %s", jwtManager.GetAlgorithm())
+	}
+
+	accessClaims, err := jwtManager.ValidateAccessToken(accessToken)
+	if err != nil {
+		t.Fatalf("validate access token failed: %v", err)
+	}
+	if accessClaims.UserID != 42 || accessClaims.Username != "rs256-user" {
+		t.Fatalf("unexpected access claims: %+v", accessClaims)
+	}
+
+	refreshClaims, err := jwtManager.ValidateRefreshToken(refreshToken)
+	if err != nil {
+		t.Fatalf("validate refresh token failed: %v", err)
+	}
+	if refreshClaims.Type != "refresh" {
+		t.Fatalf("unexpected refresh claims: %+v", refreshClaims)
+	}
+}
+
+func TestNewJWTWithOptions_RS256_RequiresKeyMaterial(t *testing.T) {
+	_, err := NewJWTWithOptions(JWTOptions{
+		Algorithm:          jwtAlgorithmRS256,
+		AccessTokenExpire:  2 * time.Hour,
+		RefreshTokenExpire: 24 * time.Hour,
+	})
+	if err == nil {
+		t.Fatal("expected RS256 without key material to fail")
+	}
+}
+
+func TestNewJWTWithOptions_RS256_RequireExistingKeysRejectsMissingFiles(t *testing.T) {
+	dir := t.TempDir()
+	_, err := NewJWTWithOptions(JWTOptions{
+		Algorithm:              jwtAlgorithmRS256,
+		RSAPrivateKeyPath:      filepath.Join(dir, "missing-private.pem"),
+		RSAPublicKeyPath:       filepath.Join(dir, "missing-public.pem"),
+		RequireExistingRSAKeys: true,
+		AccessTokenExpire:      2 * time.Hour,
+		RefreshTokenExpire:     24 * time.Hour,
+	})
+	if err == nil {
+		t.Fatal("expected RS256 strict mode to reject missing key files")
+	}
+}
+
+func TestNewJWTWithOptions_RS256_RequireExistingKeysAllowsExistingFiles(t *testing.T) {
+	dir := t.TempDir()
+	privatePath := filepath.Join(dir, "private.pem")
+	publicPath := filepath.Join(dir, "public.pem")
+
+	if _, err := NewJWTWithOptions(JWTOptions{
+		Algorithm:          jwtAlgorithmRS256,
+		RSAPrivateKeyPath:  privatePath,
+		RSAPublicKeyPath:   publicPath,
+		AccessTokenExpire:  2 * time.Hour,
+		RefreshTokenExpire: 24 * time.Hour,
+	}); err != nil {
+		t.Fatalf("prepare key files failed: %v", err)
+	}
+
+	jwtManager, err := NewJWTWithOptions(JWTOptions{
+		Algorithm:              jwtAlgorithmRS256,
+		RSAPrivateKeyPath:      privatePath,
+		RSAPublicKeyPath:       publicPath,
+		RequireExistingRSAKeys: true,
+		AccessTokenExpire:      2 * time.Hour,
+		RefreshTokenExpire:     24 * time.Hour,
+	})
+	if err != nil {
+		t.Fatalf("expected strict mode to accept existing key files, got: %v", err)
+	}
+	if jwtManager.GetAlgorithm() != jwtAlgorithmRS256 {
+		t.Fatalf("unexpected algorithm: %s", jwtManager.GetAlgorithm())
+	}
+}
--- a/internal/auth/oauth.go
+++ b/internal/auth/oauth.go
@@ -0,0 +1,506 @@
+package auth
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/url"
+
+	"github.com/user-management-system/internal/auth/providers"
+)
+
+// OAuthProvider OAuth提供商类型
+type OAuthProvider string
+
+const (
+	OAuthProviderWeChat   OAuthProvider = "wechat"
+	OAuthProviderQQ       OAuthProvider = "qq"
+	OAuthProviderWeibo    OAuthProvider = "weibo"
+	OAuthProviderGoogle    OAuthProvider = "google"
+	OAuthProviderFacebook OAuthProvider = "facebook"
+	OAuthProviderTwitter  OAuthProvider = "twitter"
+	OAuthProviderGitHub   OAuthProvider = "github"
+	OAuthProviderAlipay   OAuthProvider = "alipay"
+	OAuthProviderDouyin   OAuthProvider = "douyin"
+)
+
+// OAuthUser OAuth用户信息
+type OAuthUser struct {
+	Provider OAuthProvider          `json:"provider"`
+	OpenID   string                 `json:"open_id"`
+	UnionID  string                 `json:"union_id,omitempty"`
+	Nickname string                 `json:"nickname"`
+	Avatar   string                 `json:"avatar"`
+	Gender   string                 `json:"gender,omitempty"`
+	Email    string                 `json:"email,omitempty"`
+	Phone    string                 `json:"phone,omitempty"`
+	Extra    map[string]interface{} `json:"extra,omitempty"`
+}
+
+// OAuthToken OAuth令牌
+type OAuthToken struct {
+	AccessToken  string `json:"access_token"`
+	RefreshToken string `json:"refresh_token,omitempty"`
+	ExpiresIn    int64  `json:"expires_in"`
+	TokenType    string `json:"token_type"`
+	OpenID       string `json:"open_id,omitempty"` // 微信等需要 openid
+}
+
+// OAuthConfig OAuth配置
+type OAuthConfig struct {
+	ClientID     string `json:"client_id"`
+	ClientSecret string `json:"client_secret"`
+	RedirectURI  string `json:"redirect_uri"`
+	Scope        string `json:"scope"`
+	AuthURL      string `json:"auth_url"`
+	TokenURL     string `json:"token_url"`
+	UserInfoURL  string `json:"user_info_url"`
+}
+
+// OAuthManager OAuth管理器接口
+type OAuthManager interface {
+	// GetAuthURL 获取授权URL
+	GetAuthURL(provider OAuthProvider, state string) (string, error)
+
+	// ExchangeCode 换取访问令牌
+	ExchangeCode(provider OAuthProvider, code string) (*OAuthToken, error)
+
+	// GetUserInfo 获取用户信息
+	GetUserInfo(provider OAuthProvider, token *OAuthToken) (*OAuthUser, error)
+
+	// ValidateToken 验证令牌
+	ValidateToken(token string) (bool, error)
+
+	// GetConfig 获取OAuth配置
+	GetConfig(provider OAuthProvider) (*OAuthConfig, bool)
+
+	// GetEnabledProviders 获取已启用的OAuth提供商
+	GetEnabledProviders() []OAuthProviderInfo
+}
+
+// OAuthProviderInfo OAuth提供商信息
+type OAuthProviderInfo struct {
+	Provider OAuthProvider `json:"provider"`
+	Enabled  bool          `json:"enabled"`
+	Name     string        `json:"name"`
+}
+
+// providerEntry 内部 provider 条目
+type providerEntry struct {
+	config      *OAuthConfig
+	google      *providers.GoogleProvider
+	wechat      *providers.WeChatProvider
+	wechatRedir string
+	qq          *providers.QQProvider
+	github      *providers.GitHubProvider
+	alipay      *providers.AlipayProvider
+	douyin      *providers.DouyinProvider
+}
+
+// DefaultOAuthManager 默认OAuth管理器（集成真实 provider HTTP 调用）
+type DefaultOAuthManager struct {
+	entries map[OAuthProvider]*providerEntry
+}
+
+// NewOAuthManager 创建OAuth管理器
+func NewOAuthManager() *DefaultOAuthManager {
+	return &DefaultOAuthManager{
+		entries: make(map[OAuthProvider]*providerEntry),
+	}
+}
+
+// RegisterProvider 注册OAuth提供商（保留旧接口，仅存储配置）
+func (m *DefaultOAuthManager) RegisterProvider(provider OAuthProvider, config *OAuthConfig) {
+	entry := &providerEntry{config: config}
+
+	switch provider {
+	case OAuthProviderGoogle:
+		entry.google = providers.NewGoogleProvider(config.ClientID, config.ClientSecret, config.RedirectURI)
+	case OAuthProviderWeChat:
+		entry.wechat = providers.NewWeChatProvider(config.ClientID, config.ClientSecret, "web")
+		entry.wechatRedir = config.RedirectURI
+	case OAuthProviderQQ:
+		entry.qq = providers.NewQQProvider(config.ClientID, config.ClientSecret, config.RedirectURI)
+	case OAuthProviderGitHub:
+		entry.github = providers.NewGitHubProvider(config.ClientID, config.ClientSecret, config.RedirectURI)
+	case OAuthProviderAlipay:
+		// 支付宝使用 ClientID 存储 AppID，ClientSecret 存储 RSA 私钥
+		entry.alipay = providers.NewAlipayProvider(config.ClientID, config.ClientSecret, config.RedirectURI, false)
+	case OAuthProviderDouyin:
+		entry.douyin = providers.NewDouyinProvider(config.ClientID, config.ClientSecret, config.RedirectURI)
+	}
+
+	m.entries[provider] = entry
+}
+
+// GetConfig 获取OAuth配置
+func (m *DefaultOAuthManager) GetConfig(provider OAuthProvider) (*OAuthConfig, bool) {
+	entry, ok := m.entries[provider]
+	if !ok {
+		return nil, false
+	}
+	return entry.config, true
+}
+
+// GetAuthURL 获取授权URL（使用真实 provider 实现）
+func (m *DefaultOAuthManager) GetAuthURL(provider OAuthProvider, state string) (string, error) {
+	entry, ok := m.entries[provider]
+	if !ok {
+		return "", ErrOAuthProviderNotSupported
+	}
+
+	switch provider {
+	case OAuthProviderGoogle:
+		if entry.google != nil {
+			resp, err := entry.google.GetAuthURL(state)
+			if err != nil {
+				return "", err
+			}
+			return resp.URL, nil
+		}
+	case OAuthProviderWeChat:
+		if entry.wechat != nil {
+			resp, err := entry.wechat.GetAuthURL(entry.wechatRedir, state)
+			if err != nil {
+				return "", err
+			}
+			return resp.URL, nil
+		}
+	case OAuthProviderQQ:
+		if entry.qq != nil {
+			resp, err := entry.qq.GetAuthURL(state)
+			if err != nil {
+				return "", err
+			}
+			return resp.URL, nil
+		}
+	case OAuthProviderGitHub:
+		if entry.github != nil {
+			return entry.github.GetAuthURL(state)
+		}
+	case OAuthProviderAlipay:
+		if entry.alipay != nil {
+			return entry.alipay.GetAuthURL(state)
+		}
+	case OAuthProviderDouyin:
+		if entry.douyin != nil {
+			return entry.douyin.GetAuthURL(state)
+		}
+	}
+
+	// 通用 fallback：按标准 OAuth2 拼接 URL（对 QQ/微博/Twitter/Facebook）
+	config := entry.config
+	if config == nil {
+		return "", ErrOAuthProviderNotSupported
+	}
+	return fmt.Sprintf("%s?client_id=%s&redirect_uri=%s&response_type=code&scope=%s&state=%s",
+		config.AuthURL,
+		url.QueryEscape(config.ClientID),
+		url.QueryEscape(config.RedirectURI),
+		url.QueryEscape(config.Scope),
+		url.QueryEscape(state),
+	), nil
+}
+
+// ExchangeCode 换取访问令牌（使用真实 provider 实现）
+func (m *DefaultOAuthManager) ExchangeCode(provider OAuthProvider, code string) (*OAuthToken, error) {
+	entry, ok := m.entries[provider]
+	if !ok {
+		return nil, ErrOAuthProviderNotSupported
+	}
+
+	ctx := context.Background()
+
+	switch provider {
+	case OAuthProviderGoogle:
+		if entry.google != nil {
+			resp, err := entry.google.ExchangeCode(ctx, code)
+			if err != nil {
+				return nil, err
+			}
+			return &OAuthToken{
+				AccessToken:  resp.AccessToken,
+				RefreshToken: resp.RefreshToken,
+				ExpiresIn:    int64(resp.ExpiresIn),
+				TokenType:    resp.TokenType,
+			}, nil
+		}
+	case OAuthProviderWeChat:
+		if entry.wechat != nil {
+			resp, err := entry.wechat.ExchangeCode(ctx, code)
+			if err != nil {
+				return nil, err
+			}
+			return &OAuthToken{
+				AccessToken:  resp.AccessToken,
+				RefreshToken: resp.RefreshToken,
+				ExpiresIn:    int64(resp.ExpiresIn),
+				TokenType:    "Bearer",
+				OpenID:       resp.OpenID,
+			}, nil
+		}
+	case OAuthProviderQQ:
+		if entry.qq != nil {
+			resp, err := entry.qq.ExchangeCode(ctx, code)
+			if err != nil {
+				return nil, err
+			}
+			openIDResp, err := entry.qq.GetOpenID(ctx, resp.AccessToken)
+			if err != nil {
+				return nil, err
+			}
+			return &OAuthToken{
+				AccessToken:  resp.AccessToken,
+				RefreshToken: resp.RefreshToken,
+				ExpiresIn:    int64(resp.ExpiresIn),
+				TokenType:    "Bearer",
+				OpenID:       openIDResp.OpenID,
+			}, nil
+		}
+	case OAuthProviderGitHub:
+		if entry.github != nil {
+			resp, err := entry.github.ExchangeCode(ctx, code)
+			if err != nil {
+				return nil, err
+			}
+			return &OAuthToken{
+				AccessToken: resp.AccessToken,
+				TokenType:   resp.TokenType,
+			}, nil
+		}
+	case OAuthProviderAlipay:
+		if entry.alipay != nil {
+			resp, err := entry.alipay.ExchangeCode(ctx, code)
+			if err != nil {
+				return nil, err
+			}
+			return &OAuthToken{
+				AccessToken:  resp.AccessToken,
+				RefreshToken: resp.RefreshToken,
+				ExpiresIn:    int64(resp.ExpiresIn),
+				TokenType:    "Bearer",
+				OpenID:       resp.UserID,
+			}, nil
+		}
+	case OAuthProviderDouyin:
+		if entry.douyin != nil {
+			resp, err := entry.douyin.ExchangeCode(ctx, code)
+			if err != nil {
+				return nil, err
+			}
+			return &OAuthToken{
+				AccessToken:  resp.Data.AccessToken,
+				RefreshToken: resp.Data.RefreshToken,
+				ExpiresIn:    int64(resp.Data.ExpiresIn),
+				TokenType:    "Bearer",
+				OpenID:       resp.Data.OpenID,
+			}, nil
+		}
+	}
+
+	return nil, fmt.Errorf("provider %s: real HTTP exchange not implemented yet", provider)
+}
+
+// GetUserInfo 获取用户信息（使用真实 provider 实现）
+func (m *DefaultOAuthManager) GetUserInfo(provider OAuthProvider, token *OAuthToken) (*OAuthUser, error) {
+	entry, ok := m.entries[provider]
+	if !ok {
+		return nil, ErrOAuthProviderNotSupported
+	}
+
+	ctx := context.Background()
+
+	switch provider {
+	case OAuthProviderGoogle:
+		if entry.google != nil {
+			info, err := entry.google.GetUserInfo(ctx, token.AccessToken)
+			if err != nil {
+				return nil, err
+			}
+			return &OAuthUser{
+				Provider: provider,
+				OpenID:   info.ID,
+				Nickname: info.Name,
+				Avatar:   info.Picture,
+				Email:    info.Email,
+			}, nil
+		}
+	case OAuthProviderWeChat:
+		if entry.wechat != nil {
+			openID := token.OpenID
+			info, err := entry.wechat.GetUserInfo(ctx, token.AccessToken, openID)
+			if err != nil {
+				return nil, err
+			}
+			gender := ""
+			switch info.Sex {
+			case 1:
+				gender = "male"
+			case 2:
+				gender = "female"
+			}
+			return &OAuthUser{
+				Provider: provider,
+				OpenID:   info.OpenID,
+				UnionID:  info.UnionID,
+				Nickname: info.Nickname,
+				Avatar:   info.HeadImgURL,
+				Gender:   gender,
+			}, nil
+		}
+	case OAuthProviderQQ:
+		if entry.qq != nil {
+			info, err := entry.qq.GetUserInfo(ctx, token.AccessToken, token.OpenID)
+			if err != nil {
+				return nil, err
+			}
+			avatar := info.FigureURL2
+			if avatar == "" {
+				avatar = info.FigureURL1
+			}
+			if avatar == "" {
+				avatar = info.FigureURL
+			}
+			return &OAuthUser{
+				Provider: provider,
+				OpenID:   token.OpenID,
+				Nickname: info.Nickname,
+				Avatar:   avatar,
+				Gender:   info.Gender,
+				Extra: map[string]interface{}{
+					"province": info.Province,
+					"city":     info.City,
+					"year":     info.Year,
+				},
+			}, nil
+		}
+	case OAuthProviderGitHub:
+		if entry.github != nil {
+			info, err := entry.github.GetUserInfo(ctx, token.AccessToken)
+			if err != nil {
+				return nil, err
+			}
+			nickname := info.Name
+			if nickname == "" {
+				nickname = info.Login
+			}
+			return &OAuthUser{
+				Provider: provider,
+				OpenID:   fmt.Sprintf("%d", info.ID),
+				Nickname: nickname,
+				Email:    info.Email,
+			}, nil
+		}
+	case OAuthProviderAlipay:
+		if entry.alipay != nil {
+			info, err := entry.alipay.GetUserInfo(ctx, token.AccessToken)
+			if err != nil {
+				return nil, err
+			}
+			return &OAuthUser{
+				Provider: provider,
+				OpenID:   info.UserID,
+				Nickname: info.Nickname,
+				Avatar:   info.Avatar,
+			}, nil
+		}
+	case OAuthProviderDouyin:
+		if entry.douyin != nil {
+			info, err := entry.douyin.GetUserInfo(ctx, token.AccessToken, token.OpenID)
+			if err != nil {
+				return nil, err
+			}
+			gender := ""
+			switch info.Data.Gender {
+			case 1:
+				gender = "male"
+			case 2:
+				gender = "female"
+			}
+			return &OAuthUser{
+				Provider: provider,
+				OpenID:   info.Data.OpenID,
+				UnionID:  info.Data.UnionID,
+				Nickname: info.Data.Nickname,
+				Avatar:   info.Data.Avatar,
+				Gender:   gender,
+			}, nil
+		}
+	}
+
+	return nil, fmt.Errorf("provider %s: real HTTP user info not implemented yet", provider)
+}
+
+// ValidateToken 验证令牌
+// 注意：由于 ValidateToken 不持有 provider 上下文，无法进行真正的 token 验证
+// 对于需要验证 token 的场景，应使用 GetUserInfo 通过 provider 的 userinfo 端点验证
+// 如果没有可用的 provider，返回错误
+func (m *DefaultOAuthManager) ValidateToken(token string) (bool, error) {
+	if len(token) == 0 {
+		return false, nil
+	}
+	// 由于缺乏 provider 上下文，无法进行有意义的验证
+	// 遍历所有已启用的 provider，尝试通过 GetUserInfo 验证
+	// 如果没有任何 provider 可用，返回错误而不是默认通过
+	providers := m.GetEnabledProviders()
+	if len(providers) == 0 {
+		return false, errors.New("no OAuth providers configured")
+	}
+	// 尝试任一 provider 的 userinfo 端点验证
+	tokenObj := &OAuthToken{AccessToken: token}
+	for _, p := range providers {
+		if _, err := m.GetUserInfo(p.Provider, tokenObj); err == nil {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+// ValidateTokenWithProvider 通过指定 provider 验证令牌
+func (m *DefaultOAuthManager) ValidateTokenWithProvider(provider OAuthProvider, token string) (bool, error) {
+	if token == "" {
+		return false, nil
+	}
+
+	cfg, ok := m.GetConfig(provider)
+	if !ok || cfg.ClientID == "" {
+		return false, fmt.Errorf("provider %s not configured", provider)
+	}
+
+	// 通过 provider 的 userinfo 端点验证 token
+	tokenObj := &OAuthToken{AccessToken: token}
+	_, err := m.GetUserInfo(provider, tokenObj)
+	if err != nil {
+		return false, err
+	}
+	return true, nil
+}
+
+// GetEnabledProviders 获取已启用的OAuth提供商
+func (m *DefaultOAuthManager) GetEnabledProviders() []OAuthProviderInfo {
+	providerNames := map[OAuthProvider]string{
+		OAuthProviderGoogle:       "Google",
+		OAuthProviderWeChat:   "微信",
+		OAuthProviderQQ:       "QQ",
+		OAuthProviderWeibo:    "微博",
+		OAuthProviderFacebook: "Facebook",
+		OAuthProviderTwitter:  "Twitter",
+		OAuthProviderGitHub:   "GitHub",
+		OAuthProviderAlipay:   "支付宝",
+		OAuthProviderDouyin:   "抖音",
+	}
+
+	var result []OAuthProviderInfo
+	for provider, entry := range m.entries {
+		name := providerNames[provider]
+		if name == "" {
+			name = string(provider)
+		}
+		result = append(result, OAuthProviderInfo{
+			Provider: provider,
+			Enabled:  entry.config != nil,
+			Name:     name,
+		})
+	}
+	return result
+}
--- a/internal/auth/oauth_config.go
+++ b/internal/auth/oauth_config.go
@@ -0,0 +1,233 @@
+package auth
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+
+	"gopkg.in/yaml.v3"
+)
+
+// OAuthConfigYAML OAuth配置结构 (从YAML文件加载)
+type OAuthConfigYAML struct {
+	Common   CommonConfig        `yaml:"common"`
+	WeChat   WeChatOAuthConfig   `yaml:"wechat"`
+	Google   GoogleOAuthConfig   `yaml:"google"`
+	Facebook FacebookOAuthConfig `yaml:"facebook"`
+	QQ       QQOAuthConfig       `yaml:"qq"`
+	Weibo    WeiboOAuthConfig    `yaml:"weibo"`
+	Twitter  TwitterOAuthConfig  `yaml:"twitter"`
+}
+
+// CommonConfig 通用配置
+type CommonConfig struct {
+	RedirectBaseURL string `yaml:"redirect_base_url"`
+	CallbackPath    string `yaml:"callback_path"`
+}
+
+// WeChatOAuthConfig 微信OAuth配置
+type WeChatOAuthConfig struct {
+	Enabled     bool              `yaml:"enabled"`
+	AppID       string            `yaml:"app_id"`
+	AppSecret   string            `yaml:"app_secret"`
+	Scopes      []string          `yaml:"scopes"`
+	AuthURL     string            `yaml:"auth_url"`
+	TokenURL    string            `yaml:"token_url"`
+	UserInfoURL string            `yaml:"user_info_url"`
+	MiniProgram MiniProgramConfig `yaml:"mini_program"`
+}
+
+// MiniProgramConfig 小程序配置
+type MiniProgramConfig struct {
+	Enabled   bool   `yaml:"enabled"`
+	AppID     string `yaml:"app_id"`
+	AppSecret string `yaml:"app_secret"`
+}
+
+// GoogleOAuthConfig Google OAuth配置
+type GoogleOAuthConfig struct {
+	Enabled      bool     `yaml:"enabled"`
+	ClientID     string   `yaml:"client_id"`
+	ClientSecret string   `yaml:"client_secret"`
+	Scopes       []string `yaml:"scopes"`
+	AuthURL      string   `yaml:"auth_url"`
+	TokenURL     string   `yaml:"token_url"`
+	UserInfoURL  string   `yaml:"user_info_url"`
+	JWTAuthURL   string   `yaml:"jwt_auth_url"`
+}
+
+// FacebookOAuthConfig Facebook OAuth配置
+type FacebookOAuthConfig struct {
+	Enabled     bool     `yaml:"enabled"`
+	AppID       string   `yaml:"app_id"`
+	AppSecret   string   `yaml:"app_secret"`
+	Scopes      []string `yaml:"scopes"`
+	AuthURL     string   `yaml:"auth_url"`
+	TokenURL    string   `yaml:"token_url"`
+	UserInfoURL string   `yaml:"user_info_url"`
+}
+
+// QQOAuthConfig QQ OAuth配置
+type QQOAuthConfig struct {
+	Enabled     bool     `yaml:"enabled"`
+	AppID       string   `yaml:"app_id"`
+	AppKey      string   `yaml:"app_key"`
+	AppSecret   string   `yaml:"app_secret"`
+	RedirectURI string   `yaml:"redirect_uri"`
+	Scopes      []string `yaml:"scopes"`
+	AuthURL     string   `yaml:"auth_url"`
+	TokenURL    string   `yaml:"token_url"`
+	OpenIDURL   string   `yaml:"openid_url"`
+	UserInfoURL string   `yaml:"user_info_url"`
+}
+
+// WeiboOAuthConfig 微博OAuth配置
+type WeiboOAuthConfig struct {
+	Enabled     bool     `yaml:"enabled"`
+	AppKey      string   `yaml:"app_key"`
+	AppSecret   string   `yaml:"app_secret"`
+	RedirectURI string   `yaml:"redirect_uri"`
+	Scopes      []string `yaml:"scopes"`
+	AuthURL     string   `yaml:"auth_url"`
+	TokenURL    string   `yaml:"token_url"`
+	UserInfoURL string   `yaml:"user_info_url"`
+}
+
+// TwitterOAuthConfig Twitter OAuth配置
+type TwitterOAuthConfig struct {
+	Enabled      bool     `yaml:"enabled"`
+	ClientID     string   `yaml:"client_id"`
+	ClientSecret string   `yaml:"client_secret"`
+	Scopes       []string `yaml:"scopes"`
+	AuthURL      string   `yaml:"auth_url"`
+	TokenURL     string   `yaml:"token_url"`
+	UserInfoURL  string   `yaml:"user_info_url"`
+}
+
+var (
+	oauthConfig     *OAuthConfigYAML
+	oauthConfigOnce sync.Once
+)
+
+// LoadOAuthConfig 加载OAuth配置
+func LoadOAuthConfig(configPath string) (*OAuthConfigYAML, error) {
+	var err error
+	oauthConfigOnce.Do(func() {
+		// 如果未指定配置文件，尝试默认路径
+		if configPath == "" {
+			configPath = filepath.Join("configs", "oauth_config.yaml")
+		}
+
+		// 如果配置文件不存在，尝试从环境变量加载
+		if _, statErr := os.Stat(configPath); os.IsNotExist(statErr) {
+			oauthConfig = loadFromEnv()
+			return
+		}
+
+		// 从文件加载配置
+		data, readErr := os.ReadFile(configPath)
+		if readErr != nil {
+			oauthConfig = loadFromEnv()
+			err = fmt.Errorf("failed to read oauth config file: %w", readErr)
+			return
+		}
+
+		oauthConfig = &OAuthConfigYAML{}
+		if unmarshalErr := yaml.Unmarshal(data, oauthConfig); unmarshalErr != nil {
+			oauthConfig = loadFromEnv()
+			err = fmt.Errorf("failed to parse oauth config file: %w", unmarshalErr)
+			return
+		}
+	})
+
+	return oauthConfig, err
+}
+
+// loadFromEnv 从环境变量加载配置
+func loadFromEnv() *OAuthConfigYAML {
+	return &OAuthConfigYAML{
+		Common: CommonConfig{
+			RedirectBaseURL: getEnv("OAUTH_REDIRECT_BASE_URL", "http://localhost:8080"),
+			CallbackPath:    getEnv("OAUTH_CALLBACK_PATH", "/api/v1/auth/oauth/callback"),
+		},
+		WeChat: WeChatOAuthConfig{
+			Enabled:     getEnvBool("WECHAT_OAUTH_ENABLED", false),
+			AppID:       getEnv("WECHAT_APP_ID", ""),
+			AppSecret:   getEnv("WECHAT_APP_SECRET", ""),
+			AuthURL:     "https://open.weixin.qq.com/connect/qrconnect",
+			TokenURL:    "https://api.weixin.qq.com/sns/oauth2/access_token",
+			UserInfoURL: "https://api.weixin.qq.com/sns/userinfo",
+		},
+		Google: GoogleOAuthConfig{
+			Enabled:      getEnvBool("GOOGLE_OAUTH_ENABLED", false),
+			ClientID:     getEnv("GOOGLE_CLIENT_ID", ""),
+			ClientSecret: getEnv("GOOGLE_CLIENT_SECRET", ""),
+			AuthURL:      "https://accounts.google.com/o/oauth2/v2/auth",
+			TokenURL:     "https://oauth2.googleapis.com/token",
+			UserInfoURL:  "https://www.googleapis.com/oauth2/v2/userinfo",
+			JWTAuthURL:   "https://oauth2.googleapis.com/tokeninfo",
+		},
+		Facebook: FacebookOAuthConfig{
+			Enabled:     getEnvBool("FACEBOOK_OAUTH_ENABLED", false),
+			AppID:       getEnv("FACEBOOK_APP_ID", ""),
+			AppSecret:   getEnv("FACEBOOK_APP_SECRET", ""),
+			AuthURL:     "https://www.facebook.com/v18.0/dialog/oauth",
+			TokenURL:    "https://graph.facebook.com/v18.0/oauth/access_token",
+			UserInfoURL: "https://graph.facebook.com/v18.0/me?fields=id,name,email,picture",
+		},
+		QQ: QQOAuthConfig{
+			Enabled:     getEnvBool("QQ_OAUTH_ENABLED", false),
+			AppID:       getEnv("QQ_APP_ID", ""),
+			AppKey:      getEnv("QQ_APP_KEY", ""),
+			AppSecret:   getEnv("QQ_APP_SECRET", ""),
+			RedirectURI: getEnv("QQ_REDIRECT_URI", ""),
+			AuthURL:     "https://graph.qq.com/oauth2.0/authorize",
+			TokenURL:    "https://graph.qq.com/oauth2.0/token",
+			OpenIDURL:   "https://graph.qq.com/oauth2.0/me",
+			UserInfoURL: "https://graph.qq.com/user/get_user_info",
+		},
+		Weibo: WeiboOAuthConfig{
+			Enabled:     getEnvBool("WEIBO_OAUTH_ENABLED", false),
+			AppKey:      getEnv("WEIBO_APP_KEY", ""),
+			AppSecret:   getEnv("WEIBO_APP_SECRET", ""),
+			RedirectURI: getEnv("WEIBO_REDIRECT_URI", ""),
+			AuthURL:     "https://api.weibo.com/oauth2/authorize",
+			TokenURL:    "https://api.weibo.com/oauth2/access_token",
+			UserInfoURL: "https://api.weibo.com/2/users/show.json",
+		},
+		Twitter: TwitterOAuthConfig{
+			Enabled:      getEnvBool("TWITTER_OAUTH_ENABLED", false),
+			ClientID:     getEnv("TWITTER_CLIENT_ID", ""),
+			ClientSecret: getEnv("TWITTER_CLIENT_SECRET", ""),
+			AuthURL:      "https://twitter.com/i/oauth2/authorize",
+			TokenURL:     "https://api.twitter.com/2/oauth2/token",
+			UserInfoURL:  "https://api.twitter.com/2/users/me",
+		},
+	}
+}
+
+// GetOAuthConfig 获取OAuth配置
+func GetOAuthConfig() *OAuthConfigYAML {
+	if oauthConfig == nil {
+		_, _ = LoadOAuthConfig("")
+	}
+	return oauthConfig
+}
+
+// getEnv 获取环境变量
+func getEnv(key, defaultValue string) string {
+	if value := os.Getenv(key); value != "" {
+		return value
+	}
+	return defaultValue
+}
+
+// getEnvBool 获取布尔型环境变量
+func getEnvBool(key string, defaultValue bool) bool {
+	if value := os.Getenv(key); value != "" {
+		return strings.ToLower(value) == "true" || value == "1"
+	}
+	return defaultValue
+}
--- a/internal/auth/oauth_utils.go
+++ b/internal/auth/oauth_utils.go
@@ -0,0 +1,196 @@
+package auth
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+	"sync"
+	"time"
+
+	"golang.org/x/oauth2"
+)
+
+// StateStore OAuth状态存储
+type StateStore struct {
+	states map[string]time.Time
+	mu     sync.RWMutex
+}
+
+var stateStore = &StateStore{
+	states: make(map[string]time.Time),
+}
+
+// GenerateState 生成OAuth状态参数
+func GenerateState() (string, error) {
+	b := make([]byte, 32)
+	if _, err := rand.Read(b); err != nil {
+		return "", fmt.Errorf("generate state failed: %w", err)
+	}
+	state := base64.URLEncoding.EncodeToString(b)
+
+	// 存储状态，10分钟过期
+	stateStore.mu.Lock()
+	stateStore.states[state] = time.Now().Add(10 * time.Minute)
+	stateStore.mu.Unlock()
+
+	return state, nil
+}
+
+// ValidateState 验证OAuth状态参数
+func ValidateState(state string) bool {
+	stateStore.mu.Lock()
+	defer stateStore.mu.Unlock()
+
+	expireTime, ok := stateStore.states[state]
+	if !ok {
+		return false
+	}
+
+	// 检查是否过期
+	if time.Now().After(expireTime) {
+		delete(stateStore.states, state)
+		return false
+	}
+
+	// 使用后删除
+	delete(stateStore.states, state)
+
+	return true
+}
+
+// CleanupStates 清理过期的状态
+func CleanupStates() {
+	stateStore.mu.Lock()
+	defer stateStore.mu.Unlock()
+
+	now := time.Now()
+	for state, expireTime := range stateStore.states {
+		if now.After(expireTime) {
+			delete(stateStore.states, state)
+		}
+	}
+}
+
+// HTTPClient OAuth HTTP客户端
+var HTTPClient = &http.Client{
+	Timeout: 30 * time.Second,
+}
+
+// Get 发送GET请求
+func Get(url string) (*http.Response, error) {
+	return HTTPClient.Get(url)
+}
+
+// PostForm 发送POST表单请求
+func PostForm(url string, data url.Values) (*http.Response, error) {
+	return HTTPClient.PostForm(url, data)
+}
+
+// GetJSON 发送GET请求并解析JSON响应
+func GetJSON(url string, result interface{}) error {
+	resp, err := Get(url)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("HTTP request failed with status %d", resp.StatusCode)
+	}
+
+	return json.NewDecoder(resp.Body).Decode(result)
+}
+
+// PostFormJSON 发送POST表单请求并解析JSON响应
+func PostFormJSON(url string, data url.Values, result interface{}) error {
+	resp, err := PostForm(url, data)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("HTTP request failed with status %d", resp.StatusCode)
+	}
+
+	return json.NewDecoder(resp.Body).Decode(result)
+}
+
+// BuildAuthURL 构建标准OAuth授权URL
+func BuildAuthURL(baseURL, clientID, redirectURI, scope, state string) string {
+	u, _ := url.Parse(baseURL)
+	q := u.Query()
+	q.Set("client_id", clientID)
+	q.Set("redirect_uri", redirectURI)
+	q.Set("scope", scope)
+	q.Set("state", state)
+	q.Set("response_type", "code")
+	u.RawQuery = q.Encode()
+	return u.String()
+}
+
+// ParseAccessTokenResponse 解析访问令牌响应
+func ParseAccessTokenResponse(resp []byte) (*OAuthToken, error) {
+	var result struct {
+		AccessToken  string `json:"access_token"`
+		RefreshToken string `json:"refresh_token"`
+		ExpiresIn    int64  `json:"expires_in"`
+		TokenType    string `json:"token_type"`
+	}
+
+	if err := json.Unmarshal(resp, &result); err != nil {
+		return nil, err
+	}
+
+	return &OAuthToken{
+		AccessToken:  result.AccessToken,
+		RefreshToken: result.RefreshToken,
+		ExpiresIn:    result.ExpiresIn,
+		TokenType:    result.TokenType,
+	}, nil
+}
+
+// ParseQueryAccessToken 解析查询字符串形式的访问令牌（用于某些返回text/plain的API）
+func ParseQueryAccessToken(body string) (accessToken string, err error) {
+	values, err := url.ParseQuery(body)
+	if err != nil {
+		return "", err
+	}
+	return values.Get("access_token"), nil
+}
+
+// ParseJSONPResponse 解析JSONP响应（用于QQ等平台）
+func ParseJSONPResponse(jsonp string) (map[string]interface{}, error) {
+	// 移除callback包装
+	start := strings.Index(jsonp, "(")
+	end := strings.LastIndex(jsonp, ")")
+	if start == -1 || end == -1 {
+		return nil, fmt.Errorf("invalid JSONP format")
+	}
+
+	jsonStr := jsonp[start+1 : end]
+	var result map[string]interface{}
+	if err := json.Unmarshal([]byte(jsonStr), &result); err != nil {
+		return nil, err
+	}
+
+	return result, nil
+}
+
+// ToOAuth2Config 转换为oauth2.Config
+func ToOAuth2Config(config *OAuthConfig) *oauth2.Config {
+	return &oauth2.Config{
+		ClientID:     config.ClientID,
+		ClientSecret: config.ClientSecret,
+		RedirectURL:  config.RedirectURI,
+		Scopes:       strings.Split(config.Scope, ","),
+		Endpoint: oauth2.Endpoint{
+			AuthURL:  config.AuthURL,
+			TokenURL: config.TokenURL,
+		},
+	}
+}
--- a/internal/auth/password.go
+++ b/internal/auth/password.go
@@ -0,0 +1,160 @@
+package auth
+
+import (
+	"crypto/rand"
+	"crypto/subtle"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+
+	"golang.org/x/crypto/argon2"
+	"golang.org/x/crypto/bcrypt"
+)
+
+var defaultPasswordManager = NewPassword()
+
+// Password 密码管理器（Argon2id）
+type Password struct {
+	memory      uint32
+	iterations  uint32
+	parallelism uint8
+	saltLength  uint32
+	keyLength   uint32
+}
+
+// NewPassword 创建密码管理器
+func NewPassword() *Password {
+	return &Password{
+		memory:      64 * 1024, // 64MB（符合 OWASP 建议）
+		iterations:  5,         // 5 次迭代（保守值，高于 OWASP 建议的 3）
+		parallelism: 4,         // 4 并行（符合 OWASP 建议，防御 GPU 破解）
+		saltLength:  16,        // 16 字节盐（符合 OWASP 最低要求）
+		keyLength:   32,        // 32 字节密钥
+	}
+}
+
+// Hash 哈希密码（使用Argon2id + 随机盐）
+func (p *Password) Hash(password string) (string, error) {
+	// 使用 crypto/rand 生成真正随机的盐
+	salt := make([]byte, p.saltLength)
+	if _, err := rand.Read(salt); err != nil {
+		return "", fmt.Errorf("生成随机盐失败: %w", err)
+	}
+
+	// 使用Argon2id哈希密码
+	hash := argon2.IDKey(
+		[]byte(password),
+		salt,
+		p.iterations,
+		p.memory,
+		p.parallelism,
+		p.keyLength,
+	)
+
+	// 格式: $argon2id$v=<version>$m=<memory>,t=<iterations>,p=<parallelism>$<salt_hex>$<hash_hex>
+	encoded := fmt.Sprintf("$argon2id$v=%d$m=%d,t=%d,p=%d$%s$%s",
+		argon2.Version,
+		p.memory,
+		p.iterations,
+		p.parallelism,
+		hex.EncodeToString(salt),
+		hex.EncodeToString(hash),
+	)
+
+	return encoded, nil
+}
+
+// Verify 验证密码
+func (p *Password) Verify(hashedPassword, password string) bool {
+	// 支持 bcrypt 格式（兼容旧数据）
+	if strings.HasPrefix(hashedPassword, "$2a$") || strings.HasPrefix(hashedPassword, "$2b$") {
+		err := bcrypt.CompareHashAndPassword([]byte(hashedPassword), []byte(password))
+		return err == nil
+	}
+
+	// 解析 Argon2id 格式
+	parts := strings.Split(hashedPassword, "$")
+	// 格式: ["", "argon2id", "v=<version>", "m=<mem>,t=<iter>,p=<par>", "<salt_hex>", "<hash_hex>"]
+	if len(parts) != 6 || parts[1] != "argon2id" {
+		return false
+	}
+
+	// 解析参数
+	var memory, iterations uint32
+	var parallelism uint8
+	params := strings.Split(parts[3], ",")
+	if len(params) != 3 {
+		return false
+	}
+	for _, param := range params {
+		kv := strings.SplitN(param, "=", 2)
+		if len(kv) != 2 {
+			return false
+		}
+		val, err := strconv.ParseUint(kv[1], 10, 64)
+		if err != nil {
+			return false
+		}
+		switch kv[0] {
+		case "m":
+			memory = uint32(val)
+		case "t":
+			iterations = uint32(val)
+		case "p":
+			parallelism = uint8(val)
+		}
+	}
+
+	// 解码盐和存储的哈希
+	salt, err := hex.DecodeString(parts[4])
+	if err != nil {
+		return false
+	}
+	storedHash, err := hex.DecodeString(parts[5])
+	if err != nil {
+		return false
+	}
+
+	// 用相同参数重新计算哈希
+	computedHash := argon2.IDKey(
+		[]byte(password),
+		salt,
+		iterations,
+		memory,
+		parallelism,
+		uint32(len(storedHash)),
+	)
+
+	// 常数时间比较，防止时序攻击
+	return subtle.ConstantTimeCompare(storedHash, computedHash) == 1
+}
+
+// HashPassword hashes passwords with Argon2id for new credentials.
+func HashPassword(password string) (string, error) {
+	return defaultPasswordManager.Hash(password)
+}
+
+// VerifyPassword verifies both Argon2id and legacy bcrypt password hashes.
+func VerifyPassword(hashedPassword, password string) bool {
+	return defaultPasswordManager.Verify(hashedPassword, password)
+}
+
+// ErrInvalidPassword 密码无效错误
+var ErrInvalidPassword = errors.New("密码无效")
+
+// BcryptHash 使用bcrypt哈希密码（兼容性支持）
+func BcryptHash(password string) (string, error) {
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return "", fmt.Errorf("bcrypt加密失败: %w", err)
+	}
+	return string(hash), nil
+}
+
+// BcryptVerify 使用bcrypt验证密码
+func BcryptVerify(hashedPassword, password string) bool {
+	err := bcrypt.CompareHashAndPassword([]byte(hashedPassword), []byte(password))
+	return err == nil
+}
--- a/internal/auth/providers/alipay.go
+++ b/internal/auth/providers/alipay.go
@@ -0,0 +1,256 @@
+package providers
+
+import (
+	"context"
+	"crypto"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/json"
+	"encoding/pem"
+	"fmt"
+	"net/http"
+	"net/url"
+	"sort"
+	"strings"
+	"time"
+)
+
+// AlipayProvider 支付宝 OAuth提供者
+// 支付宝使用 RSA2 签名（SHA256withRSA）
+type AlipayProvider struct {
+	AppID       string
+	PrivateKey  string // RSA2 私钥（PKCS#8 PEM格式）
+	RedirectURI string
+	IsSandbox   bool
+}
+
+// AlipayTokenResponse 支付宝 Token响应
+type AlipayTokenResponse struct {
+	UserID       string `json:"user_id"`
+	AccessToken  string `json:"access_token"`
+	ExpiresIn    int    `json:"expires_in"`
+	RefreshToken string `json:"refresh_token"`
+}
+
+// AlipayUserInfo 支付宝用户信息
+type AlipayUserInfo struct {
+	UserID   string `json:"user_id"`
+	Nickname string `json:"nick_name"`
+	Avatar   string `json:"avatar"`
+	Gender   string `json:"gender"`
+}
+
+// NewAlipayProvider 创建支付宝 OAuth提供者
+func NewAlipayProvider(appID, privateKey, redirectURI string, isSandbox bool) *AlipayProvider {
+	return &AlipayProvider{
+		AppID:       appID,
+		PrivateKey:  privateKey,
+		RedirectURI: redirectURI,
+		IsSandbox:   isSandbox,
+	}
+}
+
+func (a *AlipayProvider) getGateway() string {
+	if a.IsSandbox {
+		return "https://openapi-sandbox.dl.alipaydev.com/gateway.do"
+	}
+	return "https://openapi.alipay.com/gateway.do"
+}
+
+// GetAuthURL 获取支付宝授权URL
+func (a *AlipayProvider) GetAuthURL(state string) (string, error) {
+	authURL := fmt.Sprintf(
+		"https://openauth.alipay.com/oauth2/publicAppAuthorize.htm?app_id=%s&scope=auth_user&redirect_uri=%s&state=%s",
+		a.AppID,
+		url.QueryEscape(a.RedirectURI),
+		url.QueryEscape(state),
+	)
+	return authURL, nil
+}
+
+// ExchangeCode 用授权码换取 access_token
+func (a *AlipayProvider) ExchangeCode(ctx context.Context, code string) (*AlipayTokenResponse, error) {
+	params := map[string]string{
+		"app_id":     a.AppID,
+		"method":     "alipay.system.oauth.token",
+		"charset":    "UTF-8",
+		"sign_type":  "RSA2",
+		"timestamp":  time.Now().Format("2006-01-02 15:04:05"),
+		"version":    "1.0",
+		"grant_type": "authorization_code",
+		"code":       code,
+	}
+
+	if a.PrivateKey != "" {
+		sign, err := a.signParams(params)
+		if err != nil {
+			return nil, fmt.Errorf("sign failed: %w", err)
+		}
+		params["sign"] = sign
+	}
+
+	form := url.Values{}
+	for k, v := range params {
+		form.Set(k, v)
+	}
+
+	req, err := http.NewRequestWithContext(ctx, "POST", a.getGateway(),
+		strings.NewReader(form.Encode()))
+	if err != nil {
+		return nil, fmt.Errorf("create request failed: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return nil, fmt.Errorf("read response failed: %w", err)
+	}
+
+	var rawResp map[string]json.RawMessage
+	if err := json.Unmarshal(body, &rawResp); err != nil {
+		return nil, fmt.Errorf("parse response failed: %w", err)
+	}
+
+	tokenData, ok := rawResp["alipay_system_oauth_token_response"]
+	if !ok {
+		return nil, fmt.Errorf("invalid alipay response structure")
+	}
+
+	var tokenResp AlipayTokenResponse
+	if err := json.Unmarshal(tokenData, &tokenResp); err != nil {
+		return nil, fmt.Errorf("parse token response failed: %w", err)
+	}
+
+	return &tokenResp, nil
+}
+
+// GetUserInfo 获取支付宝用户信息
+func (a *AlipayProvider) GetUserInfo(ctx context.Context, accessToken string) (*AlipayUserInfo, error) {
+	params := map[string]string{
+		"app_id":     a.AppID,
+		"method":     "alipay.user.info.share",
+		"charset":    "UTF-8",
+		"sign_type":  "RSA2",
+		"timestamp":  time.Now().Format("2006-01-02 15:04:05"),
+		"version":    "1.0",
+		"auth_token": accessToken,
+	}
+
+	if a.PrivateKey != "" {
+		sign, err := a.signParams(params)
+		if err != nil {
+			return nil, fmt.Errorf("sign failed: %w", err)
+		}
+		params["sign"] = sign
+	}
+
+	form := url.Values{}
+	for k, v := range params {
+		form.Set(k, v)
+	}
+
+	req, err := http.NewRequestWithContext(ctx, "POST", a.getGateway(),
+		strings.NewReader(form.Encode()))
+	if err != nil {
+		return nil, fmt.Errorf("create request failed: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return nil, fmt.Errorf("read response failed: %w", err)
+	}
+
+	var rawResp map[string]json.RawMessage
+	if err := json.Unmarshal(body, &rawResp); err != nil {
+		return nil, fmt.Errorf("parse response failed: %w", err)
+	}
+
+	userData, ok := rawResp["alipay_user_info_share_response"]
+	if !ok {
+		return nil, fmt.Errorf("invalid alipay user info response")
+	}
+
+	var userInfo AlipayUserInfo
+	if err := json.Unmarshal(userData, &userInfo); err != nil {
+		return nil, fmt.Errorf("parse user info failed: %w", err)
+	}
+
+	return &userInfo, nil
+}
+
+// signParams 使用 RSA2（SHA256withRSA）对参数签名
+func (a *AlipayProvider) signParams(params map[string]string) (string, error) {
+	// 按字典序排列参数
+	keys := make([]string, 0, len(params))
+	for k := range params {
+		if k != "sign" {
+			keys = append(keys, k)
+		}
+	}
+	sort.Strings(keys)
+
+	var parts []string
+	for _, k := range keys {
+		parts = append(parts, k+"="+params[k])
+	}
+	signContent := strings.Join(parts, "&")
+
+	// 解析私钥
+	privKey, err := parseAlipayPrivateKey(a.PrivateKey)
+	if err != nil {
+		return "", fmt.Errorf("parse private key: %w", err)
+	}
+
+	// SHA256withRSA 签名
+	hash := sha256.Sum256([]byte(signContent))
+	signature, err := rsa.SignPKCS1v15(rand.Reader, privKey, crypto.SHA256, hash[:])
+	if err != nil {
+		return "", fmt.Errorf("rsa sign: %w", err)
+	}
+
+	return base64.StdEncoding.EncodeToString(signature), nil
+}
+
+// parseAlipayPrivateKey 解析支付宝私钥（支持 PKCS#8 和 PKCS#1）
+func parseAlipayPrivateKey(pemStr string) (*rsa.PrivateKey, error) {
+	// 如果没有 PEM 头，添加 PKCS#8 头
+	if !strings.Contains(pemStr, "-----BEGIN") {
+		pemStr = "-----BEGIN PRIVATE KEY-----\n" + pemStr + "\n-----END PRIVATE KEY-----"
+	}
+
+	block, _ := pem.Decode([]byte(pemStr))
+	if block == nil {
+		return nil, fmt.Errorf("failed to decode PEM block")
+	}
+
+	// 尝试 PKCS#8
+	key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
+	if err == nil {
+		rsaKey, ok := key.(*rsa.PrivateKey)
+		if !ok {
+			return nil, fmt.Errorf("not an RSA private key")
+		}
+		return rsaKey, nil
+	}
+
+	// 尝试 PKCS#1
+	return x509.ParsePKCS1PrivateKey(block.Bytes)
+}
--- a/internal/auth/providers/douyin.go
+++ b/internal/auth/providers/douyin.go
@@ -0,0 +1,138 @@
+package providers
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+)
+
+// DouyinProvider 抖音 OAuth提供者
+// 抖音 OAuth 文档：https://developer.open-douyin.com/docs/resource/zh-CN/dop/develop/openapi/account-permission/get-access-token
+type DouyinProvider struct {
+	ClientKey    string // 抖音开放平台 client_key
+	ClientSecret string // 抖音开放平台 client_secret
+	RedirectURI  string
+}
+
+// DouyinTokenResponse 抖音 Token响应
+type DouyinTokenResponse struct {
+	Data struct {
+		AccessToken      string `json:"access_token"`
+		ExpiresIn        int    `json:"expires_in"`
+		RefreshToken     string `json:"refresh_token"`
+		RefreshExpiresIn int    `json:"refresh_expires_in"`
+		OpenID           string `json:"open_id"`
+		Scope            string `json:"scope"`
+	} `json:"data"`
+	Message string `json:"message"`
+}
+
+// DouyinUserInfo 抖音用户信息
+type DouyinUserInfo struct {
+	Data struct {
+		OpenID   string `json:"open_id"`
+		UnionID  string `json:"union_id"`
+		Nickname string `json:"nickname"`
+		Avatar   string `json:"avatar"`
+		Gender   int    `json:"gender"` // 0:未知 1:男 2:女
+		Country  string `json:"country"`
+		Province string `json:"province"`
+		City     string `json:"city"`
+	} `json:"data"`
+	Message string `json:"message"`
+}
+
+// NewDouyinProvider 创建抖音 OAuth提供者
+func NewDouyinProvider(clientKey, clientSecret, redirectURI string) *DouyinProvider {
+	return &DouyinProvider{
+		ClientKey:    clientKey,
+		ClientSecret: clientSecret,
+		RedirectURI:  redirectURI,
+	}
+}
+
+// GetAuthURL 获取抖音授权URL
+func (d *DouyinProvider) GetAuthURL(state string) (string, error) {
+	authURL := fmt.Sprintf(
+		"https://open.douyin.com/platform/oauth/connect?client_key=%s&redirect_uri=%s&response_type=code&scope=user_info&state=%s",
+		d.ClientKey,
+		url.QueryEscape(d.RedirectURI),
+		url.QueryEscape(state),
+	)
+	return authURL, nil
+}
+
+// ExchangeCode 用授权码换取 access_token
+func (d *DouyinProvider) ExchangeCode(ctx context.Context, code string) (*DouyinTokenResponse, error) {
+	tokenURL := "https://open.douyin.com/oauth/access_token/"
+
+	data := url.Values{}
+	data.Set("client_key", d.ClientKey)
+	data.Set("client_secret", d.ClientSecret)
+	data.Set("code", code)
+	data.Set("grant_type", "authorization_code")
+
+	req, err := http.NewRequestWithContext(ctx, "POST", tokenURL,
+		strings.NewReader(data.Encode()))
+	if err != nil {
+		return nil, fmt.Errorf("create request failed: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return nil, fmt.Errorf("read response failed: %w", err)
+	}
+
+	var tokenResp DouyinTokenResponse
+	if err := json.Unmarshal(body, &tokenResp); err != nil {
+		return nil, fmt.Errorf("parse token response failed: %w", err)
+	}
+
+	if tokenResp.Data.AccessToken == "" {
+		return nil, fmt.Errorf("抖音 OAuth: %s", tokenResp.Message)
+	}
+
+	return &tokenResp, nil
+}
+
+// GetUserInfo 获取抖音用户信息
+func (d *DouyinProvider) GetUserInfo(ctx context.Context, accessToken, openID string) (*DouyinUserInfo, error) {
+	userInfoURL := fmt.Sprintf("https://open.douyin.com/oauth/userinfo/?open_id=%s&access_token=%s",
+		url.QueryEscape(openID), url.QueryEscape(accessToken))
+
+	req, err := http.NewRequestWithContext(ctx, "GET", userInfoURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("create request failed: %w", err)
+	}
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return nil, fmt.Errorf("read response failed: %w", err)
+	}
+
+	var userInfo DouyinUserInfo
+	if err := json.Unmarshal(body, &userInfo); err != nil {
+		return nil, fmt.Errorf("parse user info failed: %w", err)
+	}
+
+	return &userInfo, nil
+}
--- a/internal/auth/providers/facebook.go
+++ b/internal/auth/providers/facebook.go
@@ -0,0 +1,207 @@
+package providers
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"time"
+)
+
+// FacebookProvider Facebook OAuth提供者
+type FacebookProvider struct {
+	AppID       string
+	AppSecret   string
+	RedirectURI string
+}
+
+// FacebookAuthURLResponse Facebook授权URL响应
+type FacebookAuthURLResponse struct {
+	URL      string `json:"url"`
+	State    string `json:"state"`
+	Redirect string `json:"redirect,omitempty"`
+}
+
+// FacebookTokenResponse Facebook Token响应
+type FacebookTokenResponse struct {
+	AccessToken string `json:"access_token"`
+	TokenType   string `json:"token_type"`
+	ExpiresIn   int    `json:"expires_in"`
+}
+
+// FacebookUserInfo Facebook用户信息
+type FacebookUserInfo struct {
+	ID      string `json:"id"`
+	Name    string `json:"name"`
+	Email   string `json:"email"`
+	Picture struct {
+		Data struct {
+			URL          string `json:"url"`
+			Width        int    `json:"width"`
+			Height       int    `json:"height"`
+			IsSilhouette bool   `json:"is_silhouette"`
+		} `json:"data"`
+	} `json:"picture"`
+}
+
+// NewFacebookProvider 创建Facebook OAuth提供者
+func NewFacebookProvider(appID, appSecret, redirectURI string) *FacebookProvider {
+	return &FacebookProvider{
+		AppID:       appID,
+		AppSecret:   appSecret,
+		RedirectURI: redirectURI,
+	}
+}
+
+// GenerateState 生成随机状态码
+func (f *FacebookProvider) GenerateState() (string, error) {
+	b := make([]byte, 32)
+	_, err := rand.Read(b)
+	if err != nil {
+		return "", err
+	}
+	return base64.URLEncoding.EncodeToString(b), nil
+}
+
+// GetAuthURL 获取Facebook授权URL
+func (f *FacebookProvider) GetAuthURL(state string) (*FacebookAuthURLResponse, error) {
+	authURL := fmt.Sprintf(
+		"https://www.facebook.com/v18.0/dialog/oauth?client_id=%s&redirect_uri=%s&scope=email,public_profile&response_type=code&state=%s",
+		f.AppID,
+		url.QueryEscape(f.RedirectURI),
+		state,
+	)
+
+	return &FacebookAuthURLResponse{
+		URL:      authURL,
+		State:    state,
+		Redirect: f.RedirectURI,
+	}, nil
+}
+
+// ExchangeCode 用授权码换取访问令牌
+func (f *FacebookProvider) ExchangeCode(ctx context.Context, code string) (*FacebookTokenResponse, error) {
+	tokenURL := fmt.Sprintf(
+		"https://graph.facebook.com/v18.0/oauth/access_token?client_id=%s&client_secret=%s&redirect_uri=%s&code=%s",
+		f.AppID,
+		f.AppSecret,
+		url.QueryEscape(f.RedirectURI),
+		code,
+	)
+
+	req, err := http.NewRequestWithContext(ctx, "GET", tokenURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("create request failed: %w", err)
+	}
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return nil, fmt.Errorf("read response failed: %w", err)
+	}
+
+	var tokenResp FacebookTokenResponse
+	if err := json.Unmarshal(body, &tokenResp); err != nil {
+		return nil, fmt.Errorf("parse token response failed: %w", err)
+	}
+
+	return &tokenResp, nil
+}
+
+// GetUserInfo 获取Facebook用户信息
+func (f *FacebookProvider) GetUserInfo(ctx context.Context, accessToken string) (*FacebookUserInfo, error) {
+	// 请求用户信息（包括头像）
+	userInfoURL := fmt.Sprintf(
+		"https://graph.facebook.com/v18.0/me?fields=id,name,email,picture&access_token=%s",
+		accessToken,
+	)
+
+	req, err := http.NewRequestWithContext(ctx, "GET", userInfoURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("create request failed: %w", err)
+	}
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return nil, fmt.Errorf("read response failed: %w", err)
+	}
+
+	// Facebook错误响应
+	var errResp struct {
+		Error struct {
+			Message      string `json:"message"`
+			Type         string `json:"type"`
+			Code         int    `json:"code"`
+			ErrorSubcode int    `json:"error_subcode,omitempty"`
+		} `json:"error"`
+	}
+	if err := json.Unmarshal(body, &errResp); err == nil && errResp.Error.Message != "" {
+		return nil, fmt.Errorf("facebook api error: %s", errResp.Error.Message)
+	}
+
+	var userInfo FacebookUserInfo
+	if err := json.Unmarshal(body, &userInfo); err != nil {
+		return nil, fmt.Errorf("parse user info failed: %w", err)
+	}
+
+	return &userInfo, nil
+}
+
+// ValidateToken 验证访问令牌是否有效
+func (f *FacebookProvider) ValidateToken(ctx context.Context, accessToken string) (bool, error) {
+	userInfo, err := f.GetUserInfo(ctx, accessToken)
+	if err != nil {
+		return false, err
+	}
+	return userInfo != nil && userInfo.ID != "", nil
+}
+
+// GetLongLivedToken 获取长期有效的访问令牌（60天）
+func (f *FacebookProvider) GetLongLivedToken(ctx context.Context, shortLivedToken string) (*FacebookTokenResponse, error) {
+	tokenURL := fmt.Sprintf(
+		"https://graph.facebook.com/v18.0/oauth/access_token?grant_type=fb_exchange_token&client_id=%s&client_secret=%s&fb_exchange_token=%s",
+		f.AppID,
+		f.AppSecret,
+		shortLivedToken,
+	)
+
+	req, err := http.NewRequestWithContext(ctx, "GET", tokenURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("create request failed: %w", err)
+	}
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return nil, fmt.Errorf("read response failed: %w", err)
+	}
+
+	var tokenResp FacebookTokenResponse
+	if err := json.Unmarshal(body, &tokenResp); err != nil {
+		return nil, fmt.Errorf("parse token response failed: %w", err)
+	}
+
+	return &tokenResp, nil
+}
--- a/internal/auth/providers/github.go
+++ b/internal/auth/providers/github.go
@@ -0,0 +1,172 @@
+package providers
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+)
+
+// GitHubProvider GitHub OAuth提供者
+type GitHubProvider struct {
+	ClientID     string
+	ClientSecret string
+	RedirectURI  string
+}
+
+// GitHubTokenResponse GitHub Token响应
+type GitHubTokenResponse struct {
+	AccessToken string `json:"access_token"`
+	TokenType   string `json:"token_type"`
+	Scope       string `json:"scope"`
+}
+
+// GitHubUserInfo GitHub用户信息
+type GitHubUserInfo struct {
+	ID        int64  `json:"id"`
+	Login     string `json:"login"`
+	Name      string `json:"name"`
+	Email     string `json:"email"`
+	AvatarURL string `json:"avatar_url"`
+	Bio       string `json:"bio"`
+	Location  string `json:"location"`
+}
+
+// NewGitHubProvider 创建GitHub OAuth提供者
+func NewGitHubProvider(clientID, clientSecret, redirectURI string) *GitHubProvider {
+	return &GitHubProvider{
+		ClientID:     clientID,
+		ClientSecret: clientSecret,
+		RedirectURI:  redirectURI,
+	}
+}
+
+// GetAuthURL 获取GitHub授权URL
+func (g *GitHubProvider) GetAuthURL(state string) (string, error) {
+	authURL := fmt.Sprintf(
+		"https://github.com/login/oauth/authorize?client_id=%s&redirect_uri=%s&scope=read:user,user:email&state=%s",
+		g.ClientID,
+		url.QueryEscape(g.RedirectURI),
+		url.QueryEscape(state),
+	)
+	return authURL, nil
+}
+
+// ExchangeCode 用授权码换取访问令牌
+func (g *GitHubProvider) ExchangeCode(ctx context.Context, code string) (*GitHubTokenResponse, error) {
+	tokenURL := "https://github.com/login/oauth/access_token"
+
+	data := url.Values{}
+	data.Set("client_id", g.ClientID)
+	data.Set("client_secret", g.ClientSecret)
+	data.Set("code", code)
+	data.Set("redirect_uri", g.RedirectURI)
+
+	req, err := http.NewRequestWithContext(ctx, "POST", tokenURL,
+		strings.NewReader(data.Encode()))
+	if err != nil {
+		return nil, fmt.Errorf("create request failed: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("Accept", "application/json")
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return nil, fmt.Errorf("read response failed: %w", err)
+	}
+
+	var tokenResp GitHubTokenResponse
+	if err := json.Unmarshal(body, &tokenResp); err != nil {
+		return nil, fmt.Errorf("parse token response failed: %w", err)
+	}
+
+	if tokenResp.AccessToken == "" {
+		return nil, fmt.Errorf("GitHub OAuth: empty access token in response")
+	}
+
+	return &tokenResp, nil
+}
+
+// GetUserInfo 获取GitHub用户信息
+func (g *GitHubProvider) GetUserInfo(ctx context.Context, accessToken string) (*GitHubUserInfo, error) {
+	req, err := http.NewRequestWithContext(ctx, "GET", "https://api.github.com/user", nil)
+	if err != nil {
+		return nil, fmt.Errorf("create request failed: %w", err)
+	}
+	req.Header.Set("Authorization", "Bearer "+accessToken)
+	req.Header.Set("Accept", "application/vnd.github+json")
+	req.Header.Set("X-GitHub-Api-Version", "2022-11-28")
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return nil, fmt.Errorf("read response failed: %w", err)
+	}
+
+	var userInfo GitHubUserInfo
+	if err := json.Unmarshal(body, &userInfo); err != nil {
+		return nil, fmt.Errorf("parse user info failed: %w", err)
+	}
+
+	// 如果用户信息中的邮箱为空，尝试通过邮箱 API 获取主要邮箱
+	if userInfo.Email == "" {
+		email, _ := g.getPrimaryEmail(ctx, accessToken)
+		userInfo.Email = email
+	}
+
+	return &userInfo, nil
+}
+
+// getPrimaryEmail 获取用户的主要邮箱
+func (g *GitHubProvider) getPrimaryEmail(ctx context.Context, accessToken string) (string, error) {
+	req, err := http.NewRequestWithContext(ctx, "GET", "https://api.github.com/user/emails", nil)
+	if err != nil {
+		return "", err
+	}
+	req.Header.Set("Authorization", "Bearer "+accessToken)
+	req.Header.Set("Accept", "application/vnd.github+json")
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return "", err
+	}
+
+	var emails []struct {
+		Email    string `json:"email"`
+		Primary  bool   `json:"primary"`
+		Verified bool   `json:"verified"`
+	}
+	if err := json.Unmarshal(body, &emails); err != nil {
+		return "", err
+	}
+
+	for _, e := range emails {
+		if e.Primary && e.Verified {
+			return e.Email, nil
+		}
+	}
+	return "", nil
+}
--- a/internal/auth/providers/google.go
+++ b/internal/auth/providers/google.go
@@ -0,0 +1,182 @@
+package providers
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"time"
+)
+
+// GoogleProvider Google OAuth提供者
+type GoogleProvider struct {
+	ClientID     string
+	ClientSecret string
+	RedirectURI  string
+}
+
+// GoogleAuthURLResponse Google授权URL响应
+type GoogleAuthURLResponse struct {
+	URL      string `json:"url"`
+	State    string `json:"state"`
+	Redirect string `json:"redirect,omitempty"`
+}
+
+// GoogleTokenResponse Google Token响应
+type GoogleTokenResponse struct {
+	AccessToken  string `json:"access_token"`
+	ExpiresIn    int    `json:"expires_in"`
+	RefreshToken string `json:"refresh_token"`
+	IDToken      string `json:"id_token"`
+	TokenType    string `json:"token_type"`
+	Scope        string `json:"scope"`
+}
+
+// GoogleUserInfo Google用户信息
+type GoogleUserInfo struct {
+	ID            string `json:"id"`
+	Email         string `json:"email"`
+	VerifiedEmail bool   `json:"verified_email"`
+	Name          string `json:"name"`
+	GivenName     string `json:"given_name"`
+	FamilyName    string `json:"family_name"`
+	Picture       string `json:"picture"`
+	Locale        string `json:"locale"`
+}
+
+// NewGoogleProvider 创建Google OAuth提供者
+func NewGoogleProvider(clientID, clientSecret, redirectURI string) *GoogleProvider {
+	return &GoogleProvider{
+		ClientID:     clientID,
+		ClientSecret: clientSecret,
+		RedirectURI:  redirectURI,
+	}
+}
+
+// GenerateState 生成随机状态码
+func (g *GoogleProvider) GenerateState() (string, error) {
+	b := make([]byte, 32)
+	_, err := rand.Read(b)
+	if err != nil {
+		return "", err
+	}
+	return base64.URLEncoding.EncodeToString(b), nil
+}
+
+// GetAuthURL 获取Google授权URL
+func (g *GoogleProvider) GetAuthURL(state string) (*GoogleAuthURLResponse, error) {
+	authURL := fmt.Sprintf(
+		"https://accounts.google.com/o/oauth2/v2/auth?client_id=%s&redirect_uri=%s&response_type=code&scope=openid+email+profile&state=%s",
+		g.ClientID,
+		url.QueryEscape(g.RedirectURI),
+		state,
+	)
+
+	return &GoogleAuthURLResponse{
+		URL:      authURL,
+		State:    state,
+		Redirect: g.RedirectURI,
+	}, nil
+}
+
+// ExchangeCode 用授权码换取访问令牌
+func (g *GoogleProvider) ExchangeCode(ctx context.Context, code string) (*GoogleTokenResponse, error) {
+	tokenURL := "https://oauth2.googleapis.com/token"
+
+	data := url.Values{}
+	data.Set("code", code)
+	data.Set("client_id", g.ClientID)
+	data.Set("client_secret", g.ClientSecret)
+	data.Set("redirect_uri", g.RedirectURI)
+	data.Set("grant_type", "authorization_code")
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := postFormWithContext(ctx, client, tokenURL, data)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return nil, fmt.Errorf("read response failed: %w", err)
+	}
+
+	var tokenResp GoogleTokenResponse
+	if err := json.Unmarshal(body, &tokenResp); err != nil {
+		return nil, fmt.Errorf("parse token response failed: %w", err)
+	}
+
+	return &tokenResp, nil
+}
+
+// GetUserInfo 获取Google用户信息
+func (g *GoogleProvider) GetUserInfo(ctx context.Context, accessToken string) (*GoogleUserInfo, error) {
+	userInfoURL := fmt.Sprintf("https://www.googleapis.com/oauth2/v2/userinfo?access_token=%s", accessToken)
+
+	req, err := http.NewRequestWithContext(ctx, "GET", userInfoURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("create request failed: %w", err)
+	}
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return nil, fmt.Errorf("read response failed: %w", err)
+	}
+
+	var userInfo GoogleUserInfo
+	if err := json.Unmarshal(body, &userInfo); err != nil {
+		return nil, fmt.Errorf("parse user info failed: %w", err)
+	}
+
+	return &userInfo, nil
+}
+
+// RefreshToken 刷新访问令牌
+func (g *GoogleProvider) RefreshToken(ctx context.Context, refreshToken string) (*GoogleTokenResponse, error) {
+	tokenURL := "https://oauth2.googleapis.com/token"
+
+	data := url.Values{}
+	data.Set("refresh_token", refreshToken)
+	data.Set("client_id", g.ClientID)
+	data.Set("client_secret", g.ClientSecret)
+	data.Set("grant_type", "refresh_token")
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := postFormWithContext(ctx, client, tokenURL, data)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return nil, fmt.Errorf("read response failed: %w", err)
+	}
+
+	var tokenResp GoogleTokenResponse
+	if err := json.Unmarshal(body, &tokenResp); err != nil {
+		return nil, fmt.Errorf("parse token response failed: %w", err)
+	}
+
+	return &tokenResp, nil
+}
+
+// ValidateToken 验证访问令牌是否有效
+func (g *GoogleProvider) ValidateToken(ctx context.Context, accessToken string) (bool, error) {
+	userInfo, err := g.GetUserInfo(ctx, accessToken)
+	if err != nil {
+		return false, err
+	}
+	return userInfo != nil, nil
+}
--- a/internal/auth/providers/http.go
+++ b/internal/auth/providers/http.go
@@ -0,0 +1,43 @@
+package providers
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+)
+
+const maxOAuthResponseBodyBytes = 1 << 20
+
+func postFormWithContext(ctx context.Context, client *http.Client, endpoint string, data url.Values) (*http.Response, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, strings.NewReader(data.Encode()))
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	return client.Do(req)
+}
+
+func readOAuthResponseBody(resp *http.Response) ([]byte, error) {
+	limited := io.LimitReader(resp.Body, maxOAuthResponseBodyBytes+1)
+	body, err := io.ReadAll(limited)
+	if err != nil {
+		return nil, err
+	}
+	if len(body) > maxOAuthResponseBodyBytes {
+		return nil, fmt.Errorf("oauth response body exceeded %d bytes", maxOAuthResponseBodyBytes)
+	}
+	if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusMultipleChoices {
+		snippet := strings.TrimSpace(string(body))
+		if len(snippet) > 256 {
+			snippet = snippet[:256]
+		}
+		if snippet == "" {
+			return nil, fmt.Errorf("oauth request failed with status %d", resp.StatusCode)
+		}
+		return nil, fmt.Errorf("oauth request failed with status %d: %s", resp.StatusCode, snippet)
+	}
+	return body, nil
+}
--- a/internal/auth/providers/http_test.go
+++ b/internal/auth/providers/http_test.go
@@ -0,0 +1,66 @@
+package providers
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+func TestReadOAuthResponseBodyRejectsOversizedResponse(t *testing.T) {
+	resp := &http.Response{
+		StatusCode: http.StatusOK,
+		Body: io.NopCloser(bytes.NewReader(
+			bytes.Repeat([]byte("a"), maxOAuthResponseBodyBytes+1),
+		)),
+	}
+
+	_, err := readOAuthResponseBody(resp)
+	if err == nil || !strings.Contains(err.Error(), "exceeded") {
+		t.Fatalf("expected oversized response error, got %v", err)
+	}
+}
+
+func TestReadOAuthResponseBodyRejectsNonSuccessStatus(t *testing.T) {
+	resp := &http.Response{
+		StatusCode: http.StatusBadGateway,
+		Body:       io.NopCloser(strings.NewReader("provider unavailable")),
+	}
+
+	_, err := readOAuthResponseBody(resp)
+	if err == nil || !strings.Contains(err.Error(), "502") {
+		t.Fatalf("expected status error, got %v", err)
+	}
+}
+
+func TestReadOAuthResponseBodyHandlesEmptyErrorBody(t *testing.T) {
+	resp := &http.Response{
+		StatusCode: http.StatusServiceUnavailable,
+		Body:       io.NopCloser(strings.NewReader("   ")),
+	}
+
+	_, err := readOAuthResponseBody(resp)
+	if err == nil || !strings.Contains(err.Error(), "503") {
+		t.Fatalf("expected empty-body status error, got %v", err)
+	}
+}
+
+func TestReadOAuthResponseBodyTruncatesLongErrorSnippet(t *testing.T) {
+	longBody := strings.Repeat("x", 400)
+	resp := &http.Response{
+		StatusCode: http.StatusBadRequest,
+		Body:       io.NopCloser(strings.NewReader(longBody)),
+	}
+
+	_, err := readOAuthResponseBody(resp)
+	if err == nil {
+		t.Fatal("expected long error body to produce status error")
+	}
+	if !strings.Contains(err.Error(), "400") {
+		t.Fatalf("expected status code in error, got %v", err)
+	}
+	if strings.Contains(err.Error(), strings.Repeat("x", 300)) {
+		t.Fatalf("expected error snippet to be truncated, got %v", err)
+	}
+}
--- a/internal/auth/providers/provider_crypto_test.go
+++ b/internal/auth/providers/provider_crypto_test.go
@@ -0,0 +1,169 @@
+package providers
+
+import (
+	"crypto"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/pem"
+	"net/url"
+	"strings"
+	"testing"
+)
+
+func generateRSAKeyForTest(t *testing.T) *rsa.PrivateKey {
+	t.Helper()
+
+	key, err := rsa.GenerateKey(rand.Reader, 1024)
+	if err != nil {
+		t.Fatalf("generate rsa key failed: %v", err)
+	}
+	return key
+}
+
+func marshalPKCS8PEMForTest(t *testing.T, key *rsa.PrivateKey) string {
+	t.Helper()
+
+	der, err := x509.MarshalPKCS8PrivateKey(key)
+	if err != nil {
+		t.Fatalf("marshal PKCS#8 failed: %v", err)
+	}
+
+	return string(pem.EncodeToMemory(&pem.Block{
+		Type:  "PRIVATE KEY",
+		Bytes: der,
+	}))
+}
+
+func TestParseAlipayPrivateKeySupportsRawPKCS8AndPKCS1(t *testing.T) {
+	key := generateRSAKeyForTest(t)
+
+	pkcs8DER, err := x509.MarshalPKCS8PrivateKey(key)
+	if err != nil {
+		t.Fatalf("marshal PKCS#8 failed: %v", err)
+	}
+
+	rawPKCS8 := base64.StdEncoding.EncodeToString(pkcs8DER)
+	parsedPKCS8, err := parseAlipayPrivateKey(rawPKCS8)
+	if err != nil {
+		t.Fatalf("parse raw PKCS#8 key failed: %v", err)
+	}
+	if parsedPKCS8.N.Cmp(key.N) != 0 || parsedPKCS8.D.Cmp(key.D) != 0 {
+		t.Fatal("parsed raw PKCS#8 key does not match original key")
+	}
+
+	pkcs1PEM := string(pem.EncodeToMemory(&pem.Block{
+		Type:  "RSA PRIVATE KEY",
+		Bytes: x509.MarshalPKCS1PrivateKey(key),
+	}))
+	parsedPKCS1, err := parseAlipayPrivateKey(pkcs1PEM)
+	if err != nil {
+		t.Fatalf("parse PKCS#1 key failed: %v", err)
+	}
+	if parsedPKCS1.N.Cmp(key.N) != 0 || parsedPKCS1.D.Cmp(key.D) != 0 {
+		t.Fatal("parsed PKCS#1 key does not match original key")
+	}
+}
+
+func TestParseAlipayPrivateKeyRejectsInvalidPEM(t *testing.T) {
+	if _, err := parseAlipayPrivateKey("not-a-valid-private-key"); err == nil {
+		t.Fatal("expected invalid private key parsing to fail")
+	}
+}
+
+func TestAlipayProviderSignParamsProducesVerifiableSignature(t *testing.T) {
+	key := generateRSAKeyForTest(t)
+	provider := NewAlipayProvider(
+		"app-id",
+		marshalPKCS8PEMForTest(t, key),
+		"https://admin.example.com/login/oauth/callback",
+		false,
+	)
+
+	params := map[string]string{
+		"method": "alipay.system.oauth.token",
+		"app_id": "app-id",
+		"code":   "auth-code",
+		"sign":   "should-be-ignored",
+	}
+
+	signature, err := provider.signParams(params)
+	if err != nil {
+		t.Fatalf("signParams failed: %v", err)
+	}
+	if signature == "" {
+		t.Fatal("expected non-empty signature")
+	}
+
+	signatureBytes, err := base64.StdEncoding.DecodeString(signature)
+	if err != nil {
+		t.Fatalf("decode signature failed: %v", err)
+	}
+
+	signContent := "app_id=app-id&code=auth-code&method=alipay.system.oauth.token"
+	hash := sha256.Sum256([]byte(signContent))
+	if err := rsa.VerifyPKCS1v15(&key.PublicKey, crypto.SHA256, hash[:], signatureBytes); err != nil {
+		t.Fatalf("signature verification failed: %v", err)
+	}
+}
+
+func TestTwitterProviderPKCEHelpersAndAuthURL(t *testing.T) {
+	provider := NewTwitterProvider("twitter-client", "https://admin.example.com/login/oauth/callback")
+
+	verifierA, err := provider.GenerateCodeVerifier()
+	if err != nil {
+		t.Fatalf("GenerateCodeVerifier(first) failed: %v", err)
+	}
+	verifierB, err := provider.GenerateCodeVerifier()
+	if err != nil {
+		t.Fatalf("GenerateCodeVerifier(second) failed: %v", err)
+	}
+
+	if verifierA == "" || verifierB == "" {
+		t.Fatal("expected non-empty code verifiers")
+	}
+	if verifierA == verifierB {
+		t.Fatal("expected code verifiers to differ across calls")
+	}
+	if strings.Contains(verifierA, "=") || strings.Contains(verifierB, "=") {
+		t.Fatal("expected code verifiers to be base64url values without padding")
+	}
+	if provider.GenerateCodeChallenge(verifierA) != verifierA {
+		t.Fatal("expected current code challenge implementation to mirror the verifier")
+	}
+
+	authURL, err := provider.GetAuthURL()
+	if err != nil {
+		t.Fatalf("GetAuthURL failed: %v", err)
+	}
+	if authURL.CodeVerifier == "" || authURL.State == "" {
+		t.Fatal("expected auth url response to include verifier and state")
+	}
+	if authURL.Redirect != provider.RedirectURI {
+		t.Fatalf("expected redirect %q, got %q", provider.RedirectURI, authURL.Redirect)
+	}
+
+	parsed, err := url.Parse(authURL.URL)
+	if err != nil {
+		t.Fatalf("parse auth url failed: %v", err)
+	}
+	query := parsed.Query()
+
+	if query.Get("client_id") != "twitter-client" {
+		t.Fatalf("expected twitter client_id, got %q", query.Get("client_id"))
+	}
+	if query.Get("redirect_uri") != provider.RedirectURI {
+		t.Fatalf("expected redirect_uri %q, got %q", provider.RedirectURI, query.Get("redirect_uri"))
+	}
+	if query.Get("code_challenge") != authURL.CodeVerifier {
+		t.Fatalf("expected code challenge to equal verifier, got %q", query.Get("code_challenge"))
+	}
+	if query.Get("code_challenge_method") != "plain" {
+		t.Fatalf("expected code_challenge_method plain, got %q", query.Get("code_challenge_method"))
+	}
+	if query.Get("state") != authURL.State {
+		t.Fatalf("expected state %q, got %q", authURL.State, query.Get("state"))
+	}
+}
--- a/internal/auth/providers/provider_http_roundtrip_additional_test.go
+++ b/internal/auth/providers/provider_http_roundtrip_additional_test.go
@@ -0,0 +1,649 @@
+package providers
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"testing"
+)
+
+func parseRequestForm(t *testing.T, req *http.Request) url.Values {
+	t.Helper()
+
+	body, err := io.ReadAll(req.Body)
+	if err != nil {
+		t.Fatalf("read request body failed: %v", err)
+	}
+	values, err := url.ParseQuery(string(body))
+	if err != nil {
+		t.Fatalf("parse request body failed: %v", err)
+	}
+	return values
+}
+
+func TestPostFormWithContextSendsEncodedBody(t *testing.T) {
+	client := &http.Client{
+		Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.Method != http.MethodPost {
+				t.Fatalf("expected POST request, got %s", req.Method)
+			}
+			if req.URL.String() != "https://oauth.example.com/token" {
+				t.Fatalf("unexpected endpoint: %s", req.URL.String())
+			}
+			if req.Header.Get("Content-Type") != "application/x-www-form-urlencoded" {
+				t.Fatalf("unexpected content type: %s", req.Header.Get("Content-Type"))
+			}
+
+			form := parseRequestForm(t, req)
+			if form.Get("code") != "auth-code" || form.Get("grant_type") != "authorization_code" {
+				t.Fatalf("unexpected form payload: %#v", form)
+			}
+
+			return oauthResponse(`{"ok":true}`), nil
+		}),
+	}
+
+	resp, err := postFormWithContext(context.Background(), client, "https://oauth.example.com/token", url.Values{
+		"code":       {"auth-code"},
+		"grant_type": {"authorization_code"},
+	})
+	if err != nil {
+		t.Fatalf("postFormWithContext failed: %v", err)
+	}
+	defer resp.Body.Close()
+}
+
+func TestAlipayProviderExchangeCodeAndGetUserInfo(t *testing.T) {
+	ctx := context.Background()
+	provider := NewAlipayProvider("alipay-app", "", "https://example.com/callback", false)
+
+	t.Run("exchange code success", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "openapi.alipay.com" || req.URL.Path != "/gateway.do" {
+				t.Fatalf("unexpected request: %s", req.URL.String())
+			}
+			form := parseRequestForm(t, req)
+			if form.Get("method") != "alipay.system.oauth.token" || form.Get("code") != "auth-code" {
+				t.Fatalf("unexpected exchange payload: %#v", form)
+			}
+			return oauthResponse(`{"alipay_system_oauth_token_response":{"user_id":"2088","access_token":"ali-token","expires_in":3600}}`), nil
+		}))
+
+		tokenResp, err := provider.ExchangeCode(ctx, "auth-code")
+		if err != nil {
+			t.Fatalf("expected exchange success, got error %v", err)
+		}
+		if tokenResp.AccessToken != "ali-token" || tokenResp.UserID != "2088" {
+			t.Fatalf("unexpected alipay token response: %#v", tokenResp)
+		}
+	})
+
+	t.Run("exchange code rejects invalid structure", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			return oauthResponse(`{"unexpected":{}}`), nil
+		}))
+
+		_, err := provider.ExchangeCode(ctx, "auth-code")
+		if err == nil || !strings.Contains(err.Error(), "invalid alipay response structure") {
+			t.Fatalf("expected invalid structure error, got %v", err)
+		}
+	})
+
+	t.Run("get user info success", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "openapi.alipay.com" || req.URL.Path != "/gateway.do" {
+				t.Fatalf("unexpected request: %s", req.URL.String())
+			}
+			form := parseRequestForm(t, req)
+			if form.Get("method") != "alipay.user.info.share" || form.Get("auth_token") != "ali-token" {
+				t.Fatalf("unexpected user-info payload: %#v", form)
+			}
+			return oauthResponse(`{"alipay_user_info_share_response":{"user_id":"2088","nick_name":"Ali User","avatar":"https://cdn.example.com/avatar.png"}}`), nil
+		}))
+
+		userInfo, err := provider.GetUserInfo(ctx, "ali-token")
+		if err != nil {
+			t.Fatalf("expected user info success, got error %v", err)
+		}
+		if userInfo.UserID != "2088" || userInfo.Nickname != "Ali User" {
+			t.Fatalf("unexpected alipay user info: %#v", userInfo)
+		}
+	})
+
+	t.Run("get user info rejects invalid structure", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			return oauthResponse(`{"unexpected":{}}`), nil
+		}))
+
+		_, err := provider.GetUserInfo(ctx, "ali-token")
+		if err == nil || !strings.Contains(err.Error(), "invalid alipay user info response") {
+			t.Fatalf("expected invalid user info response error, got %v", err)
+		}
+	})
+}
+
+func TestDouyinProviderExchangeCodeAndGetUserInfo(t *testing.T) {
+	ctx := context.Background()
+	provider := NewDouyinProvider("douyin-key", "douyin-secret", "https://example.com/callback")
+
+	t.Run("exchange code success", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "open.douyin.com" || req.URL.Path != "/oauth/access_token/" {
+				t.Fatalf("unexpected request: %s", req.URL.String())
+			}
+			form := parseRequestForm(t, req)
+			if form.Get("client_key") != "douyin-key" || form.Get("code") != "auth-code" {
+				t.Fatalf("unexpected exchange payload: %#v", form)
+			}
+			return oauthResponse(`{"data":{"access_token":"douyin-token","open_id":"open-1"},"message":"success"}`), nil
+		}))
+
+		tokenResp, err := provider.ExchangeCode(ctx, "auth-code")
+		if err != nil {
+			t.Fatalf("expected exchange success, got error %v", err)
+		}
+		if tokenResp.Data.AccessToken != "douyin-token" || tokenResp.Data.OpenID != "open-1" {
+			t.Fatalf("unexpected douyin token response: %#v", tokenResp)
+		}
+	})
+
+	t.Run("exchange code rejects empty access token", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			return oauthResponse(`{"data":{},"message":"invalid code"}`), nil
+		}))
+
+		_, err := provider.ExchangeCode(ctx, "auth-code")
+		if err == nil || !strings.Contains(err.Error(), "invalid code") {
+			t.Fatalf("expected douyin api error, got %v", err)
+		}
+	})
+
+	t.Run("get user info success", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "open.douyin.com" || req.URL.Path != "/oauth/userinfo/" {
+				t.Fatalf("unexpected request: %s", req.URL.String())
+			}
+			if req.URL.Query().Get("open_id") != "open-1" {
+				t.Fatalf("unexpected open_id: %s", req.URL.Query().Get("open_id"))
+			}
+			return oauthResponse(`{"data":{"open_id":"open-1","union_id":"union-1","nickname":"Douyin User"}}`), nil
+		}))
+
+		userInfo, err := provider.GetUserInfo(ctx, "douyin-token", "open-1")
+		if err != nil {
+			t.Fatalf("expected user info success, got error %v", err)
+		}
+		if userInfo.Data.OpenID != "open-1" || userInfo.Data.Nickname != "Douyin User" {
+			t.Fatalf("unexpected douyin user info: %#v", userInfo)
+		}
+	})
+}
+
+func TestGitHubProviderExchangeCodeAndGetUserInfo(t *testing.T) {
+	ctx := context.Background()
+	provider := NewGitHubProvider("github-client", "github-secret", "https://example.com/callback")
+
+	t.Run("exchange code success", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "github.com" || req.URL.Path != "/login/oauth/access_token" {
+				t.Fatalf("unexpected request: %s", req.URL.String())
+			}
+			form := parseRequestForm(t, req)
+			if form.Get("client_id") != "github-client" || form.Get("code") != "auth-code" {
+				t.Fatalf("unexpected exchange payload: %#v", form)
+			}
+			return oauthResponse(`{"access_token":"gh-token","token_type":"bearer","scope":"read:user"}`), nil
+		}))
+
+		tokenResp, err := provider.ExchangeCode(ctx, "auth-code")
+		if err != nil {
+			t.Fatalf("expected exchange success, got error %v", err)
+		}
+		if tokenResp.AccessToken != "gh-token" {
+			t.Fatalf("unexpected github token response: %#v", tokenResp)
+		}
+	})
+
+	t.Run("exchange code rejects empty token", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			return oauthResponse(`{"token_type":"bearer"}`), nil
+		}))
+
+		_, err := provider.ExchangeCode(ctx, "auth-code")
+		if err == nil || !strings.Contains(err.Error(), "empty access token") {
+			t.Fatalf("expected empty access token error, got %v", err)
+		}
+	})
+
+	t.Run("get user info falls back to primary email", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			switch req.URL.Host + req.URL.Path {
+			case "api.github.com/user":
+				if req.Header.Get("Authorization") != "Bearer gh-token" {
+					t.Fatalf("unexpected auth header: %s", req.Header.Get("Authorization"))
+				}
+				return oauthResponse(`{"id":101,"login":"octocat","name":"The Octocat","email":"","avatar_url":"https://cdn.example.com/octocat.png"}`), nil
+			case "api.github.com/user/emails":
+				return oauthResponse(`[{"email":"secondary@example.com","primary":false,"verified":true},{"email":"primary@example.com","primary":true,"verified":true}]`), nil
+			default:
+				t.Fatalf("unexpected request: %s", req.URL.String())
+				return nil, nil
+			}
+		}))
+
+		userInfo, err := provider.GetUserInfo(ctx, "gh-token")
+		if err != nil {
+			t.Fatalf("expected user info success, got error %v", err)
+		}
+		if userInfo.Login != "octocat" || userInfo.Email != "primary@example.com" {
+			t.Fatalf("unexpected github user info: %#v", userInfo)
+		}
+	})
+}
+
+func TestGoogleProviderExchangeCodeAndRefreshToken(t *testing.T) {
+	ctx := context.Background()
+	provider := NewGoogleProvider("google-client", "google-secret", "https://example.com/callback")
+
+	t.Run("exchange code success", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "oauth2.googleapis.com" || req.URL.Path != "/token" {
+				t.Fatalf("unexpected request: %s", req.URL.String())
+			}
+			form := parseRequestForm(t, req)
+			if form.Get("grant_type") != "authorization_code" || form.Get("code") != "auth-code" {
+				t.Fatalf("unexpected exchange payload: %#v", form)
+			}
+			return oauthResponse(`{"access_token":"google-token","expires_in":3600,"refresh_token":"refresh-1","token_type":"Bearer"}`), nil
+		}))
+
+		tokenResp, err := provider.ExchangeCode(ctx, "auth-code")
+		if err != nil {
+			t.Fatalf("expected exchange success, got error %v", err)
+		}
+		if tokenResp.AccessToken != "google-token" || tokenResp.RefreshToken != "refresh-1" {
+			t.Fatalf("unexpected google token response: %#v", tokenResp)
+		}
+	})
+
+	t.Run("refresh token success", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "oauth2.googleapis.com" || req.URL.Path != "/token" {
+				t.Fatalf("unexpected request: %s", req.URL.String())
+			}
+			form := parseRequestForm(t, req)
+			if form.Get("grant_type") != "refresh_token" || form.Get("refresh_token") != "refresh-1" {
+				t.Fatalf("unexpected refresh payload: %#v", form)
+			}
+			return oauthResponse(`{"access_token":"google-token-2","expires_in":3600,"token_type":"Bearer"}`), nil
+		}))
+
+		tokenResp, err := provider.RefreshToken(ctx, "refresh-1")
+		if err != nil {
+			t.Fatalf("expected refresh success, got error %v", err)
+		}
+		if tokenResp.AccessToken != "google-token-2" {
+			t.Fatalf("unexpected google refresh response: %#v", tokenResp)
+		}
+	})
+}
+
+func TestQQProviderExchangeCodeAndValidateToken(t *testing.T) {
+	ctx := context.Background()
+	provider := NewQQProvider("qq-app", "qq-secret", "https://example.com/callback")
+
+	t.Run("exchange code success", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "graph.qq.com" || req.URL.Path != "/oauth2.0/token" {
+				t.Fatalf("unexpected request: %s", req.URL.String())
+			}
+			if req.URL.Query().Get("code") != "auth-code" {
+				t.Fatalf("unexpected code: %s", req.URL.Query().Get("code"))
+			}
+			return oauthResponse(`{"access_token":"qq-token","expires_in":3600,"refresh_token":"qq-refresh"}`), nil
+		}))
+
+		tokenResp, err := provider.ExchangeCode(ctx, "auth-code")
+		if err != nil {
+			t.Fatalf("expected exchange success, got error %v", err)
+		}
+		if tokenResp.AccessToken != "qq-token" || tokenResp.RefreshToken != "qq-refresh" {
+			t.Fatalf("unexpected qq token response: %#v", tokenResp)
+		}
+	})
+
+	t.Run("validate token success", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "graph.qq.com" || req.URL.Path != "/oauth2.0/me" {
+				t.Fatalf("unexpected request: %s", req.URL.String())
+			}
+			return oauthResponse(`{"client_id":"qq-app","openid":"openid-1"}`), nil
+		}))
+
+		valid, err := provider.ValidateToken(ctx, "qq-token")
+		if err != nil {
+			t.Fatalf("expected validate success, got error %v", err)
+		}
+		if !valid {
+			t.Fatal("expected qq token to be valid")
+		}
+	})
+}
+
+func TestTwitterProviderNetworkMethods(t *testing.T) {
+	ctx := context.Background()
+	provider := NewTwitterProvider("twitter-client", "https://example.com/callback")
+
+	t.Run("exchange code rejects twitter error response", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "api.twitter.com" || req.URL.Path != "/2/oauth2/token" {
+				t.Fatalf("unexpected request: %s", req.URL.String())
+			}
+			form := parseRequestForm(t, req)
+			if form.Get("grant_type") != "authorization_code" || form.Get("code_verifier") != "verifier-1" {
+				t.Fatalf("unexpected exchange payload: %#v", form)
+			}
+			return oauthResponse(`{"title":"Unauthorized","detail":"invalid verifier","status":401}`), nil
+		}))
+
+		_, err := provider.ExchangeCode(ctx, "auth-code", "verifier-1")
+		if err == nil || !strings.Contains(err.Error(), "invalid verifier") {
+			t.Fatalf("expected twitter api error, got %v", err)
+		}
+	})
+
+	t.Run("exchange code success", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			return oauthResponse(`{"access_token":"twitter-token","refresh_token":"twitter-refresh","token_type":"bearer"}`), nil
+		}))
+
+		tokenResp, err := provider.ExchangeCode(ctx, "auth-code", "verifier-1")
+		if err != nil {
+			t.Fatalf("expected exchange success, got error %v", err)
+		}
+		if tokenResp.AccessToken != "twitter-token" {
+			t.Fatalf("unexpected twitter token response: %#v", tokenResp)
+		}
+	})
+
+	t.Run("get user info rejects twitter error response", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "api.twitter.com" || req.URL.Path != "/2/users/me" {
+				t.Fatalf("unexpected request: %s", req.URL.String())
+			}
+			return oauthResponse(`{"title":"Unauthorized","detail":"token expired","status":401}`), nil
+		}))
+
+		_, err := provider.GetUserInfo(ctx, "twitter-token")
+		if err == nil || !strings.Contains(err.Error(), "token expired") {
+			t.Fatalf("expected twitter user info error, got %v", err)
+		}
+	})
+
+	t.Run("get user info success", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			return oauthResponse(`{"data":{"id":"user-1","name":"Twitter User","username":"tw-user"}}`), nil
+		}))
+
+		userInfo, err := provider.GetUserInfo(ctx, "twitter-token")
+		if err != nil {
+			t.Fatalf("expected user info success, got error %v", err)
+		}
+		if userInfo.Data.ID != "user-1" || userInfo.Data.Username != "tw-user" {
+			t.Fatalf("unexpected twitter user info: %#v", userInfo)
+		}
+	})
+
+	t.Run("refresh token success", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			form := parseRequestForm(t, req)
+			if form.Get("grant_type") != "refresh_token" || form.Get("refresh_token") != "twitter-refresh" {
+				t.Fatalf("unexpected refresh payload: %#v", form)
+			}
+			return oauthResponse(`{"access_token":"twitter-token-2","refresh_token":"twitter-refresh-2","token_type":"bearer"}`), nil
+		}))
+
+		tokenResp, err := provider.RefreshToken(ctx, "twitter-refresh")
+		if err != nil {
+			t.Fatalf("expected refresh success, got error %v", err)
+		}
+		if tokenResp.AccessToken != "twitter-token-2" {
+			t.Fatalf("unexpected twitter refresh response: %#v", tokenResp)
+		}
+	})
+
+	t.Run("validate token returns false when user id is empty", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			return oauthResponse(`{"data":{"id":"","username":"anonymous"}}`), nil
+		}))
+
+		valid, err := provider.ValidateToken(ctx, "twitter-token")
+		if err != nil {
+			t.Fatalf("expected no error, got %v", err)
+		}
+		if valid {
+			t.Fatal("expected twitter token to be reported invalid")
+		}
+	})
+
+	t.Run("revoke token success", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "api.twitter.com" || req.URL.Path != "/2/oauth2/revoke" {
+				t.Fatalf("unexpected request: %s", req.URL.String())
+			}
+			form := parseRequestForm(t, req)
+			if form.Get("token") != "twitter-token" || form.Get("token_type_hint") != "access_token" {
+				t.Fatalf("unexpected revoke payload: %#v", form)
+			}
+			return oauthResponse(`{}`), nil
+		}))
+
+		if err := provider.RevokeToken(ctx, "twitter-token"); err != nil {
+			t.Fatalf("expected revoke success, got error %v", err)
+		}
+	})
+}
+
+func TestWeChatProviderExchangeUserInfoAndRefreshToken(t *testing.T) {
+	ctx := context.Background()
+	provider := NewWeChatProvider("wx-app", "wx-secret", "web")
+
+	t.Run("exchange code rejects api error", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "api.weixin.qq.com" || req.URL.Path != "/sns/oauth2/access_token" {
+				t.Fatalf("unexpected request: %s", req.URL.String())
+			}
+			return oauthResponse(`{"errcode":40029,"errmsg":"invalid code"}`), nil
+		}))
+
+		_, err := provider.ExchangeCode(ctx, "auth-code")
+		if err == nil || !strings.Contains(err.Error(), "wechat api error: 40029 - invalid code") {
+			t.Fatalf("expected wechat api error, got %v", err)
+		}
+	})
+
+	t.Run("exchange code success", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			return oauthResponse(`{"access_token":"wx-token","refresh_token":"wx-refresh","openid":"openid-1","scope":"snsapi_login"}`), nil
+		}))
+
+		tokenResp, err := provider.ExchangeCode(ctx, "auth-code")
+		if err != nil {
+			t.Fatalf("expected exchange success, got error %v", err)
+		}
+		if tokenResp.AccessToken != "wx-token" || tokenResp.OpenID != "openid-1" {
+			t.Fatalf("unexpected wechat token response: %#v", tokenResp)
+		}
+	})
+
+	t.Run("get user info rejects api error", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "api.weixin.qq.com" || req.URL.Path != "/sns/userinfo" {
+				t.Fatalf("unexpected request: %s", req.URL.String())
+			}
+			return oauthResponse(`{"errcode":40003,"errmsg":"invalid openid"}`), nil
+		}))
+
+		_, err := provider.GetUserInfo(ctx, "wx-token", "openid-1")
+		if err == nil || !strings.Contains(err.Error(), "wechat api error: 40003 - invalid openid") {
+			t.Fatalf("expected wechat user info error, got %v", err)
+		}
+	})
+
+	t.Run("get user info success", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			return oauthResponse(`{"openid":"openid-1","nickname":"WeChat User","province":"Shanghai"}`), nil
+		}))
+
+		userInfo, err := provider.GetUserInfo(ctx, "wx-token", "openid-1")
+		if err != nil {
+			t.Fatalf("expected user info success, got error %v", err)
+		}
+		if userInfo.OpenID != "openid-1" || userInfo.Nickname != "WeChat User" {
+			t.Fatalf("unexpected wechat user info: %#v", userInfo)
+		}
+	})
+
+	t.Run("refresh token rejects api error", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "api.weixin.qq.com" || req.URL.Path != "/sns/oauth2/refresh_token" {
+				t.Fatalf("unexpected request: %s", req.URL.String())
+			}
+			return oauthResponse(`{"errcode":40030,"errmsg":"invalid refresh token"}`), nil
+		}))
+
+		_, err := provider.RefreshToken(ctx, "wx-refresh")
+		if err == nil || !strings.Contains(err.Error(), "wechat api error: 40030 - invalid refresh token") {
+			t.Fatalf("expected wechat refresh error, got %v", err)
+		}
+	})
+
+	t.Run("refresh token success", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			return oauthResponse(`{"access_token":"wx-token-2","refresh_token":"wx-refresh-2","openid":"openid-1"}`), nil
+		}))
+
+		tokenResp, err := provider.RefreshToken(ctx, "wx-refresh")
+		if err != nil {
+			t.Fatalf("expected refresh success, got error %v", err)
+		}
+		if tokenResp.AccessToken != "wx-token-2" {
+			t.Fatalf("unexpected wechat refresh response: %#v", tokenResp)
+		}
+	})
+}
+
+func TestWeiboProviderExchangeCodeAndGetUserInfo(t *testing.T) {
+	ctx := context.Background()
+	provider := NewWeiboProvider("weibo-app", "weibo-secret", "https://example.com/callback")
+
+	t.Run("exchange code success", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "api.weibo.com" || req.URL.Path != "/oauth2/access_token" {
+				t.Fatalf("unexpected request: %s", req.URL.String())
+			}
+			form := parseRequestForm(t, req)
+			if form.Get("client_id") != "weibo-app" || form.Get("code") != "auth-code" {
+				t.Fatalf("unexpected exchange payload: %#v", form)
+			}
+			return oauthResponse(`{"access_token":"weibo-token","expires_in":3600,"uid":"1001"}`), nil
+		}))
+
+		tokenResp, err := provider.ExchangeCode(ctx, "auth-code")
+		if err != nil {
+			t.Fatalf("expected exchange success, got error %v", err)
+		}
+		if tokenResp.AccessToken != "weibo-token" || tokenResp.UID != "1001" {
+			t.Fatalf("unexpected weibo token response: %#v", tokenResp)
+		}
+	})
+
+	t.Run("get user info rejects api error", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "api.weibo.com" || req.URL.Path != "/2/users/show.json" {
+				t.Fatalf("unexpected request: %s", req.URL.String())
+			}
+			return oauthResponse(`{"error":1,"error_code":21315,"request":"/2/users/show.json"}`), nil
+		}))
+
+		_, err := provider.GetUserInfo(ctx, "weibo-token", "1001")
+		if err == nil || !strings.Contains(err.Error(), "weibo api error: code=21315") {
+			t.Fatalf("expected weibo api error, got %v", err)
+		}
+	})
+
+	t.Run("get user info success", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			return oauthResponse(`{"id":1001,"idstr":"1001","screen_name":"weibo-user","name":"Weibo User"}`), nil
+		}))
+
+		userInfo, err := provider.GetUserInfo(ctx, "weibo-token", "1001")
+		if err != nil {
+			t.Fatalf("expected user info success, got error %v", err)
+		}
+		if userInfo.ID != 1001 || userInfo.ScreenName != "weibo-user" {
+			t.Fatalf("unexpected weibo user info: %#v", userInfo)
+		}
+	})
+}
+
+func TestFacebookProviderExchangeValidateAndLongLivedToken(t *testing.T) {
+	ctx := context.Background()
+	provider := NewFacebookProvider("facebook-app", "facebook-secret", "https://example.com/callback")
+
+	t.Run("exchange code success", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "graph.facebook.com" || req.URL.Path != "/v18.0/oauth/access_token" {
+				t.Fatalf("unexpected request: %s", req.URL.String())
+			}
+			if req.URL.Query().Get("code") != "auth-code" {
+				t.Fatalf("unexpected code: %s", req.URL.Query().Get("code"))
+			}
+			return oauthResponse(`{"access_token":"fb-token","token_type":"bearer","expires_in":3600}`), nil
+		}))
+
+		tokenResp, err := provider.ExchangeCode(ctx, "auth-code")
+		if err != nil {
+			t.Fatalf("expected exchange success, got error %v", err)
+		}
+		if tokenResp.AccessToken != "fb-token" {
+			t.Fatalf("unexpected facebook token response: %#v", tokenResp)
+		}
+	})
+
+	t.Run("validate token returns false for empty id", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Path != "/v18.0/me" {
+				t.Fatalf("unexpected request: %s", req.URL.String())
+			}
+			return oauthResponse(`{"id":"","name":"No ID User"}`), nil
+		}))
+
+		valid, err := provider.ValidateToken(ctx, "fb-token")
+		if err != nil {
+			t.Fatalf("expected validate success, got error %v", err)
+		}
+		if valid {
+			t.Fatal("expected facebook token to be reported invalid")
+		}
+	})
+
+	t.Run("get long lived token success", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Path != "/v18.0/oauth/access_token" || req.URL.Query().Get("grant_type") != "fb_exchange_token" {
+				t.Fatalf("unexpected request: %s", req.URL.String())
+			}
+			return oauthResponse(`{"access_token":"fb-long-lived","token_type":"bearer","expires_in":5184000}`), nil
+		}))
+
+		tokenResp, err := provider.GetLongLivedToken(ctx, "fb-token")
+		if err != nil {
+			t.Fatalf("expected long-lived token success, got error %v", err)
+		}
+		if tokenResp.AccessToken != "fb-long-lived" {
+			t.Fatalf("unexpected facebook long-lived token response: %#v", tokenResp)
+		}
+	})
+}
--- a/internal/auth/providers/provider_http_roundtrip_test.go
+++ b/internal/auth/providers/provider_http_roundtrip_test.go
@@ -0,0 +1,284 @@
+package providers
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+type roundTripFunc func(*http.Request) (*http.Response, error)
+
+func (fn roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return fn(req)
+}
+
+func useDefaultTransport(t *testing.T, fn roundTripFunc) {
+	t.Helper()
+
+	originalTransport := http.DefaultTransport
+	http.DefaultTransport = fn
+	t.Cleanup(func() {
+		http.DefaultTransport = originalTransport
+	})
+}
+
+func oauthResponse(body string) *http.Response {
+	return &http.Response{
+		StatusCode: http.StatusOK,
+		Body:       io.NopCloser(strings.NewReader(body)),
+		Header:     make(http.Header),
+	}
+}
+
+func TestQQProviderGetOpenIDAndUserInfoWithDefaultTransport(t *testing.T) {
+	ctx := context.Background()
+	provider := NewQQProvider("qq-app", "qq-secret", "https://example.com/callback")
+
+	t.Run("get openid success", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "graph.qq.com" || req.URL.Path != "/oauth2.0/me" {
+				return nil, fmt.Errorf("unexpected request: %s", req.URL.String())
+			}
+			return oauthResponse(`{"client_id":"qq-app","openid":"openid-123"}`), nil
+		}))
+
+		resp, err := provider.GetOpenID(ctx, "access-token")
+		if err != nil {
+			t.Fatalf("expected openid success, got error %v", err)
+		}
+		if resp.OpenID != "openid-123" || resp.ClientID != "qq-app" {
+			t.Fatalf("unexpected openid response: %#v", resp)
+		}
+	})
+
+	t.Run("get openid parse error", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "graph.qq.com" || req.URL.Path != "/oauth2.0/me" {
+				return nil, fmt.Errorf("unexpected request: %s", req.URL.String())
+			}
+			return oauthResponse(`not-json`), nil
+		}))
+
+		_, err := provider.GetOpenID(ctx, "access-token")
+		if err == nil || !strings.Contains(err.Error(), "parse openid response failed") {
+			t.Fatalf("expected openid parse error, got %v", err)
+		}
+	})
+
+	t.Run("get user info api error", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "graph.qq.com" || req.URL.Path != "/user/get_user_info" {
+				return nil, fmt.Errorf("unexpected request: %s", req.URL.String())
+			}
+			return oauthResponse(`{"ret":1001,"msg":"invalid token"}`), nil
+		}))
+
+		_, err := provider.GetUserInfo(ctx, "access-token", "openid-123")
+		if err == nil || !strings.Contains(err.Error(), "qq api error: invalid token") {
+			t.Fatalf("expected qq api error, got %v", err)
+		}
+	})
+
+	t.Run("get user info success", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "graph.qq.com" || req.URL.Path != "/user/get_user_info" {
+				return nil, fmt.Errorf("unexpected request: %s", req.URL.String())
+			}
+			return oauthResponse(`{"ret":0,"msg":"","nickname":"tester","gender":"male","city":"Shanghai"}`), nil
+		}))
+
+		info, err := provider.GetUserInfo(ctx, "access-token", "openid-123")
+		if err != nil {
+			t.Fatalf("expected user info success, got error %v", err)
+		}
+		if info.Nickname != "tester" || info.City != "Shanghai" {
+			t.Fatalf("unexpected user info response: %#v", info)
+		}
+	})
+}
+
+func TestWeiboProviderValidateTokenWithDefaultTransport(t *testing.T) {
+	ctx := context.Background()
+	provider := NewWeiboProvider("weibo-app", "weibo-secret", "https://example.com/callback")
+
+	tests := []struct {
+		name            string
+		body            string
+		wantValid       bool
+		wantErrContains string
+	}{
+		{
+			name:      "rejects error response",
+			body:      `{"error":"invalid_token"}`,
+			wantValid: false,
+		},
+		{
+			name:      "accepts expire_in response",
+			body:      `{"expire_in":3600}`,
+			wantValid: true,
+		},
+		{
+			name:      "rejects ambiguous response",
+			body:      `{"uid":"123"}`,
+			wantValid: false,
+		},
+		{
+			name:            "returns parse error",
+			body:            `not-json`,
+			wantErrContains: "parse response failed",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+				if req.URL.Host != "api.weibo.com" || req.URL.Path != "/oauth2/get_token_info" {
+					return nil, fmt.Errorf("unexpected request: %s", req.URL.String())
+				}
+				return oauthResponse(tt.body), nil
+			}))
+
+			valid, err := provider.ValidateToken(ctx, "access-token")
+			if tt.wantErrContains != "" {
+				if err == nil || !strings.Contains(err.Error(), tt.wantErrContains) {
+					t.Fatalf("expected error containing %q, got %v", tt.wantErrContains, err)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("expected no error, got %v", err)
+			}
+			if valid != tt.wantValid {
+				t.Fatalf("expected valid=%v, got %v", tt.wantValid, valid)
+			}
+		})
+	}
+}
+
+func TestWeChatProviderValidateTokenWithDefaultTransport(t *testing.T) {
+	ctx := context.Background()
+	provider := NewWeChatProvider("wx-app", "wx-secret", "web")
+
+	tests := []struct {
+		name            string
+		body            string
+		wantValid       bool
+		wantErrContains string
+	}{
+		{
+			name:      "accepts errcode zero",
+			body:      `{"errcode":0,"errmsg":"ok"}`,
+			wantValid: true,
+		},
+		{
+			name:      "rejects non-zero errcode",
+			body:      `{"errcode":40003,"errmsg":"invalid openid"}`,
+			wantValid: false,
+		},
+		{
+			name:            "returns parse error",
+			body:            `not-json`,
+			wantErrContains: "parse response failed",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+				if req.URL.Host != "api.weixin.qq.com" || req.URL.Path != "/sns/auth" {
+					return nil, fmt.Errorf("unexpected request: %s", req.URL.String())
+				}
+				return oauthResponse(tt.body), nil
+			}))
+
+			valid, err := provider.ValidateToken(ctx, "access-token", "openid-123")
+			if tt.wantErrContains != "" {
+				if err == nil || !strings.Contains(err.Error(), tt.wantErrContains) {
+					t.Fatalf("expected error containing %q, got %v", tt.wantErrContains, err)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("expected no error, got %v", err)
+			}
+			if valid != tt.wantValid {
+				t.Fatalf("expected valid=%v, got %v", tt.wantValid, valid)
+			}
+		})
+	}
+}
+
+func TestGoogleProviderValidateTokenWithDefaultTransport(t *testing.T) {
+	ctx := context.Background()
+	provider := NewGoogleProvider("google-client", "google-secret", "https://example.com/callback")
+
+	t.Run("validate token success", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "www.googleapis.com" || req.URL.Path != "/oauth2/v2/userinfo" {
+				return nil, fmt.Errorf("unexpected request: %s", req.URL.String())
+			}
+			return oauthResponse(`{"id":"user-1","email":"user@example.com","name":"Google User"}`), nil
+		}))
+
+		valid, err := provider.ValidateToken(ctx, "access-token")
+		if err != nil {
+			t.Fatalf("expected success, got error %v", err)
+		}
+		if !valid {
+			t.Fatal("expected token to be valid")
+		}
+	})
+
+	t.Run("validate token parse error", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "www.googleapis.com" || req.URL.Path != "/oauth2/v2/userinfo" {
+				return nil, fmt.Errorf("unexpected request: %s", req.URL.String())
+			}
+			return oauthResponse(`not-json`), nil
+		}))
+
+		valid, err := provider.ValidateToken(ctx, "access-token")
+		if err == nil || !strings.Contains(err.Error(), "parse user info failed") {
+			t.Fatalf("expected user info parse error, got valid=%v err=%v", valid, err)
+		}
+	})
+}
+
+func TestFacebookProviderGetUserInfoWithDefaultTransport(t *testing.T) {
+	ctx := context.Background()
+	provider := NewFacebookProvider("facebook-app", "facebook-secret", "https://example.com/callback")
+
+	t.Run("facebook api error", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "graph.facebook.com" || req.URL.Path != "/v18.0/me" {
+				return nil, fmt.Errorf("unexpected request: %s", req.URL.String())
+			}
+			return oauthResponse(`{"error":{"message":"token expired","type":"OAuthException","code":190}}`), nil
+		}))
+
+		_, err := provider.GetUserInfo(ctx, "access-token")
+		if err == nil || !strings.Contains(err.Error(), "facebook api error: token expired") {
+			t.Fatalf("expected facebook api error, got %v", err)
+		}
+	})
+
+	t.Run("facebook success", func(t *testing.T) {
+		useDefaultTransport(t, roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if req.URL.Host != "graph.facebook.com" || req.URL.Path != "/v18.0/me" {
+				return nil, fmt.Errorf("unexpected request: %s", req.URL.String())
+			}
+			return oauthResponse(`{"id":"user-1","name":"Facebook User","email":"fb@example.com","picture":{"data":{"url":"https://cdn.example.com/a.png"}}}`), nil
+		}))
+
+		info, err := provider.GetUserInfo(ctx, "access-token")
+		if err != nil {
+			t.Fatalf("expected user info success, got error %v", err)
+		}
+		if info.ID != "user-1" || info.Picture.Data.URL == "" {
+			t.Fatalf("unexpected facebook user info response: %#v", info)
+		}
+	})
+}
--- a/internal/auth/providers/provider_urls_additional_test.go
+++ b/internal/auth/providers/provider_urls_additional_test.go
@@ -0,0 +1,191 @@
+package providers
+
+import (
+	"net/url"
+	"strings"
+	"testing"
+)
+
+func TestAdditionalProviderStateGeneratorsProduceDistinctTokens(t *testing.T) {
+	tests := []struct {
+		name          string
+		generateState func() (string, error)
+	}{
+		{
+			name: "facebook",
+			generateState: func() (string, error) {
+				return NewFacebookProvider("app-id", "secret", "https://admin.example.com/callback").GenerateState()
+			},
+		},
+		{
+			name: "qq",
+			generateState: func() (string, error) {
+				return NewQQProvider("app-id", "secret", "https://admin.example.com/callback").GenerateState()
+			},
+		},
+		{
+			name: "weibo",
+			generateState: func() (string, error) {
+				return NewWeiboProvider("app-id", "secret", "https://admin.example.com/callback").GenerateState()
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			stateA, err := tc.generateState()
+			if err != nil {
+				t.Fatalf("GenerateState(first) failed: %v", err)
+			}
+			stateB, err := tc.generateState()
+			if err != nil {
+				t.Fatalf("GenerateState(second) failed: %v", err)
+			}
+			if stateA == "" || stateB == "" {
+				t.Fatal("expected non-empty generated states")
+			}
+			if stateA == stateB {
+				t.Fatal("expected generated states to differ between calls")
+			}
+		})
+	}
+}
+
+func TestAdditionalProviderAuthURLs(t *testing.T) {
+	tests := []struct {
+		name           string
+		buildURL       func(t *testing.T) (string, string)
+		expectedHost   string
+		expectedPath   string
+		expectedKey    string
+		expectedValue  string
+		expectedClause string
+	}{
+		{
+			name: "facebook",
+			buildURL: func(t *testing.T) (string, string) {
+				t.Helper()
+				redirectURI := "https://admin.example.com/login/oauth/callback?from=fb"
+				authURL, err := NewFacebookProvider("fb-app-id", "fb-secret", redirectURI).GetAuthURL("fb-state")
+				if err != nil {
+					t.Fatalf("GetAuthURL failed: %v", err)
+				}
+				return authURL.URL, redirectURI
+			},
+			expectedHost:   "www.facebook.com",
+			expectedPath:   "/v18.0/dialog/oauth",
+			expectedKey:    "client_id",
+			expectedValue:  "fb-app-id",
+			expectedClause: "scope=email,public_profile",
+		},
+		{
+			name: "qq",
+			buildURL: func(t *testing.T) (string, string) {
+				t.Helper()
+				redirectURI := "https://admin.example.com/login/oauth/callback?from=qq"
+				authURL, err := NewQQProvider("qq-app-id", "qq-secret", redirectURI).GetAuthURL("qq-state")
+				if err != nil {
+					t.Fatalf("GetAuthURL failed: %v", err)
+				}
+				return authURL.URL, redirectURI
+			},
+			expectedHost:   "graph.qq.com",
+			expectedPath:   "/oauth2.0/authorize",
+			expectedKey:    "client_id",
+			expectedValue:  "qq-app-id",
+			expectedClause: "scope=get_user_info",
+		},
+		{
+			name: "weibo",
+			buildURL: func(t *testing.T) (string, string) {
+				t.Helper()
+				redirectURI := "https://admin.example.com/login/oauth/callback?from=weibo"
+				authURL, err := NewWeiboProvider("wb-app-id", "wb-secret", redirectURI).GetAuthURL("wb-state")
+				if err != nil {
+					t.Fatalf("GetAuthURL failed: %v", err)
+				}
+				return authURL.URL, redirectURI
+			},
+			expectedHost:   "api.weibo.com",
+			expectedPath:   "/oauth2/authorize",
+			expectedKey:    "client_id",
+			expectedValue:  "wb-app-id",
+			expectedClause: "response_type=code",
+		},
+		{
+			name: "douyin",
+			buildURL: func(t *testing.T) (string, string) {
+				t.Helper()
+				redirectURI := "https://admin.example.com/login/oauth/callback?from=douyin"
+				authURL, err := NewDouyinProvider("dy-client", "dy-secret", redirectURI).GetAuthURL("dy-state")
+				if err != nil {
+					t.Fatalf("GetAuthURL failed: %v", err)
+				}
+				return authURL, redirectURI
+			},
+			expectedHost:   "open.douyin.com",
+			expectedPath:   "/platform/oauth/connect",
+			expectedKey:    "client_key",
+			expectedValue:  "dy-client",
+			expectedClause: "scope=user_info",
+		},
+		{
+			name: "alipay",
+			buildURL: func(t *testing.T) (string, string) {
+				t.Helper()
+				redirectURI := "https://admin.example.com/login/oauth/callback?from=alipay"
+				authURL, err := NewAlipayProvider("ali-app-id", "private-key", redirectURI, false).GetAuthURL("ali-state")
+				if err != nil {
+					t.Fatalf("GetAuthURL failed: %v", err)
+				}
+				return authURL, redirectURI
+			},
+			expectedHost:   "openauth.alipay.com",
+			expectedPath:   "/oauth2/publicAppAuthorize.htm",
+			expectedKey:    "app_id",
+			expectedValue:  "ali-app-id",
+			expectedClause: "scope=auth_user",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			authURL, redirectURI := tc.buildURL(t)
+
+			parsed, err := url.Parse(authURL)
+			if err != nil {
+				t.Fatalf("parse auth url failed: %v", err)
+			}
+
+			if parsed.Host != tc.expectedHost {
+				t.Fatalf("expected host %q, got %q", tc.expectedHost, parsed.Host)
+			}
+			if parsed.Path != tc.expectedPath {
+				t.Fatalf("expected path %q, got %q", tc.expectedPath, parsed.Path)
+			}
+
+			query := parsed.Query()
+			if query.Get(tc.expectedKey) != tc.expectedValue {
+				t.Fatalf("expected %s=%q, got %q", tc.expectedKey, tc.expectedValue, query.Get(tc.expectedKey))
+			}
+			if query.Get("redirect_uri") != redirectURI {
+				t.Fatalf("expected redirect_uri %q, got %q", redirectURI, query.Get("redirect_uri"))
+			}
+			if !strings.Contains(authURL, tc.expectedClause) {
+				t.Fatalf("expected auth url to contain %q, got %q", tc.expectedClause, authURL)
+			}
+		})
+	}
+}
+
+func TestAlipayProviderUsesExpectedGatewayForSandboxAndProduction(t *testing.T) {
+	productionProvider := NewAlipayProvider("prod-app-id", "private-key", "https://admin.example.com/callback", false)
+	if gateway := productionProvider.getGateway(); gateway != "https://openapi.alipay.com/gateway.do" {
+		t.Fatalf("expected production gateway, got %q", gateway)
+	}
+
+	sandboxProvider := NewAlipayProvider("sandbox-app-id", "private-key", "https://admin.example.com/callback", true)
+	if gateway := sandboxProvider.getGateway(); gateway != "https://openapi-sandbox.dl.alipaydev.com/gateway.do" {
+		t.Fatalf("expected sandbox gateway, got %q", gateway)
+	}
+}
--- a/internal/auth/providers/provider_urls_test.go
+++ b/internal/auth/providers/provider_urls_test.go
@@ -0,0 +1,124 @@
+package providers
+
+import (
+	"net/url"
+	"strings"
+	"testing"
+)
+
+func TestGitHubProviderGetAuthURLEscapesRedirectAndState(t *testing.T) {
+	provider := NewGitHubProvider("client-id", "client-secret", "https://admin.example.com/login/oauth/callback")
+
+	authURL, err := provider.GetAuthURL("state value")
+	if err != nil {
+		t.Fatalf("GetAuthURL failed: %v", err)
+	}
+
+	parsed, err := url.Parse(authURL)
+	if err != nil {
+		t.Fatalf("parse auth url failed: %v", err)
+	}
+
+	query := parsed.Query()
+	if query.Get("client_id") != "client-id" {
+		t.Fatalf("expected client_id to be propagated, got %q", query.Get("client_id"))
+	}
+	if query.Get("redirect_uri") != "https://admin.example.com/login/oauth/callback" {
+		t.Fatalf("expected redirect_uri to be propagated, got %q", query.Get("redirect_uri"))
+	}
+	if query.Get("state") != "state value" {
+		t.Fatalf("expected state to be propagated, got %q", query.Get("state"))
+	}
+	if !strings.Contains(query.Get("scope"), "read:user") {
+		t.Fatalf("expected GitHub scope to include read:user, got %q", query.Get("scope"))
+	}
+}
+
+func TestGoogleProviderGenerateStateAndBuildAuthURL(t *testing.T) {
+	provider := NewGoogleProvider("google-client", "google-secret", "https://admin.example.com/login/oauth/callback")
+
+	stateA, err := provider.GenerateState()
+	if err != nil {
+		t.Fatalf("GenerateState failed: %v", err)
+	}
+	stateB, err := provider.GenerateState()
+	if err != nil {
+		t.Fatalf("GenerateState failed: %v", err)
+	}
+
+	if stateA == "" || stateB == "" {
+		t.Fatal("expected non-empty generated states")
+	}
+	if stateA == stateB {
+		t.Fatal("expected generated states to be unique across calls")
+	}
+
+	authURL, err := provider.GetAuthURL("redirect-state")
+	if err != nil {
+		t.Fatalf("GetAuthURL failed: %v", err)
+	}
+	if authURL.State != "redirect-state" {
+		t.Fatalf("expected auth url state to be preserved, got %q", authURL.State)
+	}
+	if authURL.Redirect != provider.RedirectURI {
+		t.Fatalf("expected redirect uri to be preserved, got %q", authURL.Redirect)
+	}
+	if !strings.Contains(authURL.URL, "response_type=code") {
+		t.Fatalf("expected google auth url to request authorization code flow, got %q", authURL.URL)
+	}
+}
+
+func TestWeChatProviderGetAuthURLSupportsKnownTypes(t *testing.T) {
+	tests := []struct {
+		name         string
+		oauthType    string
+		expectedHost string
+		expectedPath string
+	}{
+		{
+			name:         "web login",
+			oauthType:    "web",
+			expectedHost: "open.weixin.qq.com",
+			expectedPath: "/connect/qrconnect",
+		},
+		{
+			name:         "public account login",
+			oauthType:    "mp",
+			expectedHost: "open.weixin.qq.com",
+			expectedPath: "/connect/oauth2/authorize",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			provider := NewWeChatProvider("wx-app-id", "wx-app-secret", tc.oauthType)
+			authURL, err := provider.GetAuthURL("https://admin.example.com/login/oauth/callback", "wechat-state")
+			if err != nil {
+				t.Fatalf("GetAuthURL failed: %v", err)
+			}
+
+			parsed, err := url.Parse(authURL.URL)
+			if err != nil {
+				t.Fatalf("parse auth url failed: %v", err)
+			}
+
+			if parsed.Host != tc.expectedHost {
+				t.Fatalf("expected host %q, got %q", tc.expectedHost, parsed.Host)
+			}
+			if parsed.Path != tc.expectedPath {
+				t.Fatalf("expected path %q, got %q", tc.expectedPath, parsed.Path)
+			}
+			if authURL.State != "wechat-state" {
+				t.Fatalf("expected state to be preserved, got %q", authURL.State)
+			}
+		})
+	}
+}
+
+func TestWeChatProviderRejectsUnsupportedOAuthType(t *testing.T) {
+	provider := NewWeChatProvider("wx-app-id", "wx-app-secret", "mini")
+
+	if _, err := provider.GetAuthURL("https://admin.example.com/login/oauth/callback", "state"); err == nil {
+		t.Fatal("expected unsupported oauth type error")
+	}
+}
--- a/internal/auth/providers/qq.go
+++ b/internal/auth/providers/qq.go
@@ -0,0 +1,202 @@
+package providers
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"time"
+)
+
+// QQProvider QQ OAuth提供者
+type QQProvider struct {
+	AppID       string
+	AppKey      string
+	RedirectURI string
+}
+
+// QQAuthURLResponse QQ授权URL响应
+type QQAuthURLResponse struct {
+	URL      string `json:"url"`
+	State    string `json:"state"`
+	Redirect string `json:"redirect,omitempty"`
+}
+
+// QQTokenResponse QQ Token响应
+type QQTokenResponse struct {
+	AccessToken  string `json:"access_token"`
+	ExpiresIn    int    `json:"expires_in"`
+	RefreshToken string `json:"refresh_token"`
+}
+
+// QQOpenIDResponse QQ OpenID响应
+type QQOpenIDResponse struct {
+	ClientID string `json:"client_id"`
+	OpenID   string `json:"openid"`
+}
+
+// QQUserInfo QQ用户信息
+type QQUserInfo struct {
+	Ret        int    `json:"ret"`
+	Msg        string `json:"msg"`
+	Nickname   string `json:"nickname"`
+	Gender     string `json:"gender"` // 男, 女
+	Province   string `json:"province"`
+	City       string `json:"city"`
+	Year       string `json:"year"`
+	FigureURL  string `json:"figureurl"`
+	FigureURL1 string `json:"figureurl_1"`
+	FigureURL2 string `json:"figureurl_2"`
+}
+
+// NewQQProvider 创建QQ OAuth提供者
+func NewQQProvider(appID, appKey, redirectURI string) *QQProvider {
+	return &QQProvider{
+		AppID:       appID,
+		AppKey:      appKey,
+		RedirectURI: redirectURI,
+	}
+}
+
+// GenerateState 生成随机状态码
+func (q *QQProvider) GenerateState() (string, error) {
+	b := make([]byte, 32)
+	_, err := rand.Read(b)
+	if err != nil {
+		return "", err
+	}
+	return base64.URLEncoding.EncodeToString(b), nil
+}
+
+// GetAuthURL 获取QQ授权URL
+func (q *QQProvider) GetAuthURL(state string) (*QQAuthURLResponse, error) {
+	authURL := fmt.Sprintf(
+		"https://graph.qq.com/oauth2.0/authorize?response_type=code&client_id=%s&redirect_uri=%s&scope=get_user_info&state=%s",
+		q.AppID,
+		url.QueryEscape(q.RedirectURI),
+		state,
+	)
+
+	return &QQAuthURLResponse{
+		URL:      authURL,
+		State:    state,
+		Redirect: q.RedirectURI,
+	}, nil
+}
+
+// ExchangeCode 用授权码换取访问令牌
+func (q *QQProvider) ExchangeCode(ctx context.Context, code string) (*QQTokenResponse, error) {
+	tokenURL := fmt.Sprintf(
+		"https://graph.qq.com/oauth2.0/token?grant_type=authorization_code&client_id=%s&client_secret=%s&code=%s&redirect_uri=%s&fmt=json",
+		q.AppID,
+		q.AppKey,
+		code,
+		url.QueryEscape(q.RedirectURI),
+	)
+
+	req, err := http.NewRequestWithContext(ctx, "GET", tokenURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("create request failed: %w", err)
+	}
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return nil, fmt.Errorf("read response failed: %w", err)
+	}
+
+	var tokenResp QQTokenResponse
+	if err := json.Unmarshal(body, &tokenResp); err != nil {
+		return nil, fmt.Errorf("parse token response failed: %w", err)
+	}
+
+	return &tokenResp, nil
+}
+
+// GetOpenID 用访问令牌获取OpenID
+func (q *QQProvider) GetOpenID(ctx context.Context, accessToken string) (*QQOpenIDResponse, error) {
+	openIDURL := fmt.Sprintf(
+		"https://graph.qq.com/oauth2.0/me?access_token=%s&fmt=json",
+		accessToken,
+	)
+
+	req, err := http.NewRequestWithContext(ctx, "GET", openIDURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("create request failed: %w", err)
+	}
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return nil, fmt.Errorf("read response failed: %w", err)
+	}
+
+	var openIDResp QQOpenIDResponse
+	if err := json.Unmarshal(body, &openIDResp); err != nil {
+		return nil, fmt.Errorf("parse openid response failed: %w", err)
+	}
+
+	return &openIDResp, nil
+}
+
+// GetUserInfo 获取QQ用户信息
+func (q *QQProvider) GetUserInfo(ctx context.Context, accessToken, openID string) (*QQUserInfo, error) {
+	userInfoURL := fmt.Sprintf(
+		"https://graph.qq.com/user/get_user_info?access_token=%s&oauth_consumer_key=%s&openid=%s&format=json",
+		accessToken,
+		q.AppID,
+		openID,
+	)
+
+	req, err := http.NewRequestWithContext(ctx, "GET", userInfoURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("create request failed: %w", err)
+	}
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return nil, fmt.Errorf("read response failed: %w", err)
+	}
+
+	var userInfo QQUserInfo
+	if err := json.Unmarshal(body, &userInfo); err != nil {
+		return nil, fmt.Errorf("parse user info failed: %w", err)
+	}
+
+	if userInfo.Ret != 0 {
+		return nil, fmt.Errorf("qq api error: %s", userInfo.Msg)
+	}
+
+	return &userInfo, nil
+}
+
+// ValidateToken 验证访问令牌是否有效
+func (q *QQProvider) ValidateToken(ctx context.Context, accessToken string) (bool, error) {
+	_, err := q.GetOpenID(ctx, accessToken)
+	if err != nil {
+		return false, err
+	}
+	return true, nil
+}
--- a/internal/auth/providers/twitter.go
+++ b/internal/auth/providers/twitter.go
@@ -0,0 +1,264 @@
+package providers
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"time"
+)
+
+// TwitterProvider Twitter OAuth提供者 (OAuth 2.0 with PKCE)
+type TwitterProvider struct {
+	ClientID    string
+	RedirectURI string
+}
+
+// TwitterAuthURLResponse Twitter授权URL响应
+type TwitterAuthURLResponse struct {
+	URL          string `json:"url"`
+	CodeVerifier string `json:"code_verifier"`
+	State        string `json:"state"`
+	Redirect     string `json:"redirect,omitempty"`
+}
+
+// TwitterTokenResponse Twitter Token响应
+type TwitterTokenResponse struct {
+	AccessToken  string `json:"access_token"`
+	TokenType    string `json:"token_type"`
+	ExpiresIn    int    `json:"expires_in"`
+	RefreshToken string `json:"refresh_token"`
+	Scope        string `json:"scope"`
+}
+
+// TwitterUserInfo Twitter用户信息
+type TwitterUserInfo struct {
+	Data struct {
+		ID            string `json:"id"`
+		Name          string `json:"name"`
+		Username      string `json:"username"`
+		CreatedAt     string `json:"created_at"`
+		Description   string `json:"description"`
+		PublicMetrics struct {
+			FollowersCount int `json:"followers_count"`
+			FollowingCount int `json:"following_count"`
+			TweetCount     int `json:"tweet_count"`
+			ListedCount    int `json:"listed_count"`
+		} `json:"public_metrics"`
+		ProfileImageURL string `json:"profile_image_url"`
+	} `json:"data"`
+}
+
+// TwitterErrorResponse Twitter错误响应
+type TwitterErrorResponse struct {
+	Title  string `json:"title"`
+	Detail string `json:"detail"`
+	Type   string `json:"type"`
+	Status int    `json:"status"`
+}
+
+// NewTwitterProvider 创建Twitter OAuth提供者
+func NewTwitterProvider(clientID, redirectURI string) *TwitterProvider {
+	return &TwitterProvider{
+		ClientID:    clientID,
+		RedirectURI: redirectURI,
+	}
+}
+
+// GenerateCodeVerifier 生成PKCE Code Verifier
+func (t *TwitterProvider) GenerateCodeVerifier() (string, error) {
+	b := make([]byte, 32)
+	_, err := rand.Read(b)
+	if err != nil {
+		return "", err
+	}
+	return base64.URLEncoding.WithPadding(base64.NoPadding).EncodeToString(b), nil
+}
+
+// GenerateCodeChallenge 从Code Verifier生成Code Challenge
+func (t *TwitterProvider) GenerateCodeChallenge(verifier string) string {
+	// 简化的base64编码（实际应用中应该使用SHA256哈希）
+	return verifier
+}
+
+// GenerateState 生成随机状态码
+func (t *TwitterProvider) GenerateState() (string, error) {
+	b := make([]byte, 32)
+	_, err := rand.Read(b)
+	if err != nil {
+		return "", err
+	}
+	return base64.URLEncoding.EncodeToString(b), nil
+}
+
+// GetAuthURL 获取Twitter授权URL (OAuth 2.0 with PKCE)
+func (t *TwitterProvider) GetAuthURL() (*TwitterAuthURLResponse, error) {
+	verifier, err := t.GenerateCodeVerifier()
+	if err != nil {
+		return nil, fmt.Errorf("generate code verifier failed: %w", err)
+	}
+
+	challenge := t.GenerateCodeChallenge(verifier)
+
+	state, err := t.GenerateState()
+	if err != nil {
+		return nil, fmt.Errorf("generate state failed: %w", err)
+	}
+
+	authURL := fmt.Sprintf(
+		"https://twitter.com/i/oauth2/authorize?response_type=code&client_id=%s&redirect_uri=%s&scope=tweet.read%%20users.read%%20offline.access&state=%s&code_challenge=%s&code_challenge_method=plain",
+		t.ClientID,
+		url.QueryEscape(t.RedirectURI),
+		state,
+		challenge,
+	)
+
+	return &TwitterAuthURLResponse{
+		URL:          authURL,
+		CodeVerifier: verifier,
+		State:        state,
+		Redirect:     t.RedirectURI,
+	}, nil
+}
+
+// ExchangeCode 用授权码换取访问令牌
+func (t *TwitterProvider) ExchangeCode(ctx context.Context, code, codeVerifier string) (*TwitterTokenResponse, error) {
+	tokenURL := "https://api.twitter.com/2/oauth2/token"
+
+	data := url.Values{}
+	data.Set("code", code)
+	data.Set("grant_type", "authorization_code")
+	data.Set("client_id", t.ClientID)
+	data.Set("redirect_uri", t.RedirectURI)
+	data.Set("code_verifier", codeVerifier)
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := postFormWithContext(ctx, client, tokenURL, data)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return nil, fmt.Errorf("read response failed: %w", err)
+	}
+
+	// 检查错误响应
+	var errResp TwitterErrorResponse
+	if err := json.Unmarshal(body, &errResp); err == nil && errResp.Detail != "" {
+		return nil, fmt.Errorf("twitter api error: %s - %s", errResp.Title, errResp.Detail)
+	}
+
+	var tokenResp TwitterTokenResponse
+	if err := json.Unmarshal(body, &tokenResp); err != nil {
+		return nil, fmt.Errorf("parse token response failed: %w", err)
+	}
+
+	return &tokenResp, nil
+}
+
+// GetUserInfo 获取Twitter用户信息
+func (t *TwitterProvider) GetUserInfo(ctx context.Context, accessToken string) (*TwitterUserInfo, error) {
+	userInfoURL := "https://api.twitter.com/2/users/me?user.fields=created_at,description,public_metrics,profile_image_url"
+
+	req, err := http.NewRequestWithContext(ctx, "GET", userInfoURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("create request failed: %w", err)
+	}
+	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", accessToken))
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return nil, fmt.Errorf("read response failed: %w", err)
+	}
+
+	// 检查错误响应
+	var errResp TwitterErrorResponse
+	if err := json.Unmarshal(body, &errResp); err == nil && errResp.Detail != "" {
+		return nil, fmt.Errorf("twitter api error: %s - %s", errResp.Title, errResp.Detail)
+	}
+
+	var userInfo TwitterUserInfo
+	if err := json.Unmarshal(body, &userInfo); err != nil {
+		return nil, fmt.Errorf("parse user info failed: %w", err)
+	}
+
+	return &userInfo, nil
+}
+
+// RefreshToken 刷新访问令牌
+func (t *TwitterProvider) RefreshToken(ctx context.Context, refreshToken string) (*TwitterTokenResponse, error) {
+	tokenURL := "https://api.twitter.com/2/oauth2/token"
+
+	data := url.Values{}
+	data.Set("refresh_token", refreshToken)
+	data.Set("grant_type", "refresh_token")
+	data.Set("client_id", t.ClientID)
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := postFormWithContext(ctx, client, tokenURL, data)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return nil, fmt.Errorf("read response failed: %w", err)
+	}
+
+	var errResp TwitterErrorResponse
+	if err := json.Unmarshal(body, &errResp); err == nil && errResp.Detail != "" {
+		return nil, fmt.Errorf("twitter api error: %s - %s", errResp.Title, errResp.Detail)
+	}
+
+	var tokenResp TwitterTokenResponse
+	if err := json.Unmarshal(body, &tokenResp); err != nil {
+		return nil, fmt.Errorf("parse token response failed: %w", err)
+	}
+
+	return &tokenResp, nil
+}
+
+// ValidateToken 验证访问令牌是否有效
+func (t *TwitterProvider) ValidateToken(ctx context.Context, accessToken string) (bool, error) {
+	userInfo, err := t.GetUserInfo(ctx, accessToken)
+	if err != nil {
+		return false, err
+	}
+	return userInfo != nil && userInfo.Data.ID != "", nil
+}
+
+// RevokeToken 撤销访问令牌
+func (t *TwitterProvider) RevokeToken(ctx context.Context, accessToken string) error {
+	revokeURL := "https://api.twitter.com/2/oauth2/revoke"
+
+	data := url.Values{}
+	data.Set("token", accessToken)
+	data.Set("client_id", t.ClientID)
+	data.Set("token_type_hint", "access_token")
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := postFormWithContext(ctx, client, revokeURL, data)
+	if err != nil {
+		return fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if _, err := readOAuthResponseBody(resp); err != nil {
+		return fmt.Errorf("revoke token failed: %w", err)
+	}
+
+	return nil
+}
--- a/internal/auth/providers/wechat.go
+++ b/internal/auth/providers/wechat.go
@@ -0,0 +1,258 @@
+package providers
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"time"
+)
+
+// WeChatProvider 微信OAuth提供者
+type WeChatProvider struct {
+	AppID     string
+	AppSecret string
+	Type      string // "web" for 扫码登录, "mp" for 公众号, "mini" for 小程序
+}
+
+// WeChatAuthURLResponse 获取授权URL响应
+type WeChatAuthURLResponse struct {
+	URL      string `json:"url"`
+	State    string `json:"state"`
+	Redirect string `json:"redirect,omitempty"`
+}
+
+// WeChatTokenResponse 微信Token响应
+type WeChatTokenResponse struct {
+	AccessToken  string `json:"access_token"`
+	ExpiresIn    int    `json:"expires_in"`
+	RefreshToken string `json:"refresh_token"`
+	OpenID       string `json:"openid"`
+	Scope        string `json:"scope"`
+	UnionID      string `json:"unionid,omitempty"`
+}
+
+// WeChatUserInfo 微信用户信息
+type WeChatUserInfo struct {
+	OpenID     string `json:"openid"`
+	Nickname   string `json:"nickname"`
+	Sex        int    `json:"sex"` // 1男性, 2女性, 0未知
+	Province   string `json:"province"`
+	City       string `json:"city"`
+	Country    string `json:"country"`
+	HeadImgURL string `json:"headimgurl"`
+	UnionID    string `json:"unionid,omitempty"`
+}
+
+// WeChatErrorCode 微信错误码
+type WeChatErrorCode struct {
+	ErrCode int    `json:"errcode"`
+	ErrMsg  string `json:"errmsg"`
+}
+
+// NewWeChatProvider 创建微信OAuth提供者
+func NewWeChatProvider(appID, appSecret, oAuthType string) *WeChatProvider {
+	return &WeChatProvider{
+		AppID:     appID,
+		AppSecret: appSecret,
+		Type:      oAuthType,
+	}
+}
+
+// GenerateState 生成随机状态码
+func (w *WeChatProvider) GenerateState() (string, error) {
+	b := make([]byte, 32)
+	_, err := rand.Read(b)
+	if err != nil {
+		return "", err
+	}
+	return base64.URLEncoding.EncodeToString(b), nil
+}
+
+// GetAuthURL 获取微信授权URL
+func (w *WeChatProvider) GetAuthURL(redirectURI, state string) (*WeChatAuthURLResponse, error) {
+	var authURL string
+
+	switch w.Type {
+	case "web":
+		// 微信扫码登录 (开放平台)
+		authURL = fmt.Sprintf(
+			"https://open.weixin.qq.com/connect/qrconnect?appid=%s&redirect_uri=%s&response_type=code&scope=snsapi_login&state=%s#wechat_redirect",
+			w.AppID,
+			url.QueryEscape(redirectURI),
+			state,
+		)
+	case "mp":
+		// 微信公众号登录
+		authURL = fmt.Sprintf(
+			"https://open.weixin.qq.com/connect/oauth2/authorize?appid=%s&redirect_uri=%s&response_type=code&scope=snsapi_userinfo&state=%s#wechat_redirect",
+			w.AppID,
+			url.QueryEscape(redirectURI),
+			state,
+		)
+	default:
+		return nil, fmt.Errorf("unsupported wechat oauth type: %s", w.Type)
+	}
+
+	return &WeChatAuthURLResponse{
+		URL:      authURL,
+		State:    state,
+		Redirect: redirectURI,
+	}, nil
+}
+
+// ExchangeCode 用授权码换取访问令牌
+func (w *WeChatProvider) ExchangeCode(ctx context.Context, code string) (*WeChatTokenResponse, error) {
+	tokenURL := fmt.Sprintf(
+		"https://api.weixin.qq.com/sns/oauth2/access_token?appid=%s&secret=%s&code=%s&grant_type=authorization_code",
+		w.AppID,
+		w.AppSecret,
+		code,
+	)
+
+	req, err := http.NewRequestWithContext(ctx, "GET", tokenURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("create request failed: %w", err)
+	}
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return nil, fmt.Errorf("read response failed: %w", err)
+	}
+
+	// 检查是否返回错误
+	var errResp WeChatErrorCode
+	if err := json.Unmarshal(body, &errResp); err == nil && errResp.ErrCode != 0 {
+		return nil, fmt.Errorf("wechat api error: %d - %s", errResp.ErrCode, errResp.ErrMsg)
+	}
+
+	var tokenResp WeChatTokenResponse
+	if err := json.Unmarshal(body, &tokenResp); err != nil {
+		return nil, fmt.Errorf("parse token response failed: %w", err)
+	}
+
+	return &tokenResp, nil
+}
+
+// GetUserInfo 获取微信用户信息
+func (w *WeChatProvider) GetUserInfo(ctx context.Context, accessToken, openID string) (*WeChatUserInfo, error) {
+	userInfoURL := fmt.Sprintf(
+		"https://api.weixin.qq.com/sns/userinfo?access_token=%s&openid=%s&lang=zh_CN",
+		accessToken,
+		openID,
+	)
+
+	req, err := http.NewRequestWithContext(ctx, "GET", userInfoURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("create request failed: %w", err)
+	}
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return nil, fmt.Errorf("read response failed: %w", err)
+	}
+
+	// 检查是否返回错误
+	var errResp WeChatErrorCode
+	if err := json.Unmarshal(body, &errResp); err == nil && errResp.ErrCode != 0 {
+		return nil, fmt.Errorf("wechat api error: %d - %s", errResp.ErrCode, errResp.ErrMsg)
+	}
+
+	var userInfo WeChatUserInfo
+	if err := json.Unmarshal(body, &userInfo); err != nil {
+		return nil, fmt.Errorf("parse user info failed: %w", err)
+	}
+
+	return &userInfo, nil
+}
+
+// RefreshToken 刷新访问令牌
+func (w *WeChatProvider) RefreshToken(ctx context.Context, refreshToken string) (*WeChatTokenResponse, error) {
+	refreshURL := fmt.Sprintf(
+		"https://api.weixin.qq.com/sns/oauth2/refresh_token?appid=%s&grant_type=refresh_token&refresh_token=%s",
+		w.AppID,
+		refreshToken,
+	)
+
+	req, err := http.NewRequestWithContext(ctx, "GET", refreshURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("create request failed: %w", err)
+	}
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return nil, fmt.Errorf("read response failed: %w", err)
+	}
+
+	var errResp WeChatErrorCode
+	if err := json.Unmarshal(body, &errResp); err == nil && errResp.ErrCode != 0 {
+		return nil, fmt.Errorf("wechat api error: %d - %s", errResp.ErrCode, errResp.ErrMsg)
+	}
+
+	var tokenResp WeChatTokenResponse
+	if err := json.Unmarshal(body, &tokenResp); err != nil {
+		return nil, fmt.Errorf("parse token response failed: %w", err)
+	}
+
+	return &tokenResp, nil
+}
+
+// ValidateToken 验证访问令牌是否有效
+func (w *WeChatProvider) ValidateToken(ctx context.Context, accessToken, openID string) (bool, error) {
+	validateURL := fmt.Sprintf(
+		"https://api.weixin.qq.com/sns/auth?access_token=%s&openid=%s",
+		accessToken,
+		openID,
+	)
+
+	req, err := http.NewRequestWithContext(ctx, "GET", validateURL, nil)
+	if err != nil {
+		return false, fmt.Errorf("create request failed: %w", err)
+	}
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return false, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return false, fmt.Errorf("read response failed: %w", err)
+	}
+
+	var result struct {
+		ErrCode int    `json:"errcode"`
+		ErrMsg  string `json:"errmsg"`
+	}
+	if err := json.Unmarshal(body, &result); err != nil {
+		return false, fmt.Errorf("parse response failed: %w", err)
+	}
+
+	return result.ErrCode == 0, nil
+}
--- a/internal/auth/providers/weibo.go
+++ b/internal/auth/providers/weibo.go
@@ -0,0 +1,201 @@
+package providers
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"time"
+)
+
+// WeiboProvider 微博OAuth提供者
+type WeiboProvider struct {
+	AppKey      string
+	AppSecret   string
+	RedirectURI string
+}
+
+// WeiboAuthURLResponse 微博授权URL响应
+type WeiboAuthURLResponse struct {
+	URL      string `json:"url"`
+	State    string `json:"state"`
+	Redirect string `json:"redirect,omitempty"`
+}
+
+// WeiboTokenResponse 微博Token响应
+type WeiboTokenResponse struct {
+	AccessToken string `json:"access_token"`
+	ExpiresIn   int    `json:"expires_in"`
+	RemindIn    string `json:"remind_in"`
+	UID         string `json:"uid"`
+}
+
+// WeiboUserInfo 微博用户信息
+type WeiboUserInfo struct {
+	ID              int64  `json:"id"`
+	IDStr           string `json:"idstr"`
+	ScreenName      string `json:"screen_name"`
+	Name            string `json:"name"`
+	Province        string `json:"province"`
+	City            string `json:"city"`
+	Location        string `json:"location"`
+	Description     string `json:"description"`
+	URL             string `json:"url"`
+	ProfileImageURL string `json:"profile_image_url"`
+	Gender          string `json:"gender"` // m:男, f:女, n:未知
+	FollowersCount  int    `json:"followers_count"`
+	FriendsCount    int    `json:"friends_count"`
+	StatusesCount   int    `json:"statuses_count"`
+}
+
+// NewWeiboProvider 创建微博OAuth提供者
+func NewWeiboProvider(appKey, appSecret, redirectURI string) *WeiboProvider {
+	return &WeiboProvider{
+		AppKey:      appKey,
+		AppSecret:   appSecret,
+		RedirectURI: redirectURI,
+	}
+}
+
+// GenerateState 生成随机状态码
+func (w *WeiboProvider) GenerateState() (string, error) {
+	b := make([]byte, 32)
+	_, err := rand.Read(b)
+	if err != nil {
+		return "", err
+	}
+	return base64.URLEncoding.EncodeToString(b), nil
+}
+
+// GetAuthURL 获取微博授权URL
+func (w *WeiboProvider) GetAuthURL(state string) (*WeiboAuthURLResponse, error) {
+	authURL := fmt.Sprintf(
+		"https://api.weibo.com/oauth2/authorize?client_id=%s&redirect_uri=%s&response_type=code&state=%s",
+		w.AppKey,
+		url.QueryEscape(w.RedirectURI),
+		state,
+	)
+
+	return &WeiboAuthURLResponse{
+		URL:      authURL,
+		State:    state,
+		Redirect: w.RedirectURI,
+	}, nil
+}
+
+// ExchangeCode 用授权码换取访问令牌
+func (w *WeiboProvider) ExchangeCode(ctx context.Context, code string) (*WeiboTokenResponse, error) {
+	tokenURL := "https://api.weibo.com/oauth2/access_token"
+
+	data := url.Values{}
+	data.Set("client_id", w.AppKey)
+	data.Set("client_secret", w.AppSecret)
+	data.Set("grant_type", "authorization_code")
+	data.Set("code", code)
+	data.Set("redirect_uri", w.RedirectURI)
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := postFormWithContext(ctx, client, tokenURL, data)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return nil, fmt.Errorf("read response failed: %w", err)
+	}
+
+	var tokenResp WeiboTokenResponse
+	if err := json.Unmarshal(body, &tokenResp); err != nil {
+		return nil, fmt.Errorf("parse token response failed: %w", err)
+	}
+
+	return &tokenResp, nil
+}
+
+// GetUserInfo 获取微博用户信息
+func (w *WeiboProvider) GetUserInfo(ctx context.Context, accessToken, uid string) (*WeiboUserInfo, error) {
+	userInfoURL := fmt.Sprintf(
+		"https://api.weibo.com/2/users/show.json?access_token=%s&uid=%s",
+		accessToken,
+		uid,
+	)
+
+	req, err := http.NewRequestWithContext(ctx, "GET", userInfoURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("create request failed: %w", err)
+	}
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return nil, fmt.Errorf("read response failed: %w", err)
+	}
+
+	// 微博错误响应
+	var errResp struct {
+		Error     int    `json:"error"`
+		ErrorCode int    `json:"error_code"`
+		Request   string `json:"request"`
+	}
+	if err := json.Unmarshal(body, &errResp); err == nil && errResp.Error != 0 {
+		return nil, fmt.Errorf("weibo api error: code=%d", errResp.ErrorCode)
+	}
+
+	var userInfo WeiboUserInfo
+	if err := json.Unmarshal(body, &userInfo); err != nil {
+		return nil, fmt.Errorf("parse user info failed: %w", err)
+	}
+
+	return &userInfo, nil
+}
+
+// ValidateToken 验证访问令牌是否有效
+func (w *WeiboProvider) ValidateToken(ctx context.Context, accessToken string) (bool, error) {
+	// 微博没有专门的token验证接口，通过获取API token信息来验证
+	tokenInfoURL := fmt.Sprintf("https://api.weibo.com/oauth2/get_token_info?access_token=%s", accessToken)
+
+	req, err := http.NewRequestWithContext(ctx, "GET", tokenInfoURL, nil)
+	if err != nil {
+		return false, fmt.Errorf("create request failed: %w", err)
+	}
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return false, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := readOAuthResponseBody(resp)
+	if err != nil {
+		return false, fmt.Errorf("read response failed: %w", err)
+	}
+
+	var result map[string]interface{}
+	if err := json.Unmarshal(body, &result); err != nil {
+		return false, fmt.Errorf("parse response failed: %w", err)
+	}
+
+	// 如果返回了错误，说明token无效
+	if _, ok := result["error"]; ok {
+		return false, nil
+	}
+
+	// 如果有expire_in字段，说明token有效
+	if _, ok := result["expire_in"]; ok {
+		return true, nil
+	}
+
+	return false, nil
+}
--- a/internal/auth/sso.go
+++ b/internal/auth/sso.go
@@ -0,0 +1,233 @@
+package auth
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"time"
+)
+
+// SSOOAuth2Config SSO OAuth2 配置
+type SSOOAuth2Config struct {
+	ClientID     string
+	ClientSecret string
+	RedirectURI  string
+	Scope        string
+}
+
+// SSOProvider SSO 提供者接口
+type SSOProvider interface {
+	// Authorize 处理授权请求
+	Authorize(ctx context.Context, req *SSOAuthorizeRequest) (*SSOAuthorizeResponse, error)
+	// Introspect 验证 access token
+	Introspect(ctx context.Context, token string) (*SSOTokenInfo, error)
+	// Revoke 撤销 token
+	Revoke(ctx context.Context, token string) error
+}
+
+// SSOAuthorizeRequest 授权请求
+type SSOAuthorizeRequest struct {
+	ClientID     string
+	RedirectURI  string
+	ResponseType string // "code" 或 "token"
+	Scope        string
+	State        string
+	UserID       int64
+}
+
+// SSOAuthorizeResponse 授权响应
+type SSOAuthorizeResponse struct {
+	Code  string // 授权码（authorization_code 模式）
+	State string
+}
+
+// SSOTokenInfo Token 信息
+type SSOTokenInfo struct {
+	Active    bool
+	UserID    int64
+	Username  string
+	ExpiresAt time.Time
+	Scope     string
+	ClientID  string
+}
+
+// SSOSession SSO Session
+type SSOSession struct {
+	SessionID  string
+	UserID     int64
+	Username   string
+	ClientID   string
+	CreatedAt  time.Time
+	ExpiresAt  time.Time
+	Scope      string
+}
+
+// SSOManager SSO 管理器
+type SSOManager struct {
+	sessions map[string]*SSOSession
+}
+
+// NewSSOManager 创建 SSO 管理器
+func NewSSOManager() *SSOManager {
+	return &SSOManager{
+		sessions: make(map[string]*SSOSession),
+	}
+}
+
+// GenerateAuthorizationCode 生成授权码
+func (m *SSOManager) GenerateAuthorizationCode(clientID, redirectURI, scope string, userID int64, username string) (string, error) {
+	code := generateSecureToken(32)
+
+	session := &SSOSession{
+		SessionID: generateSecureToken(16),
+		UserID:    userID,
+		Username:  username,
+		ClientID:  clientID,
+		CreatedAt: time.Now(),
+		ExpiresAt: time.Now().Add(10 * time.Minute), // 授权码 10 分钟有效期
+		Scope:     scope,
+	}
+
+	m.sessions[code] = session
+
+	return code, nil
+}
+
+// ValidateAuthorizationCode 验证授权码
+func (m *SSOManager) ValidateAuthorizationCode(code string) (*SSOSession, error) {
+	session, ok := m.sessions[code]
+	if !ok {
+		return nil, errors.New("invalid authorization code")
+	}
+
+	if time.Now().After(session.ExpiresAt) {
+		delete(m.sessions, code)
+		return nil, errors.New("authorization code expired")
+	}
+
+	// 使用后删除
+	delete(m.sessions, code)
+
+	return session, nil
+}
+
+// GenerateAccessToken 生成访问令牌
+func (m *SSOManager) GenerateAccessToken(clientID string, session *SSOSession) (string, time.Time) {
+	token := generateSecureToken(32)
+	expiresAt := time.Now().Add(2 * time.Hour) // Access token 2 小时有效期
+
+	accessSession := &SSOSession{
+		SessionID:  token,
+		UserID:     session.UserID,
+		Username:   session.Username,
+		ClientID:   clientID,
+		CreatedAt:  time.Now(),
+		ExpiresAt:  expiresAt,
+		Scope:      session.Scope,
+	}
+
+	m.sessions[token] = accessSession
+
+	return token, expiresAt
+}
+
+// IntrospectToken 验证 token
+func (m *SSOManager) IntrospectToken(token string) (*SSOTokenInfo, error) {
+	session, ok := m.sessions[token]
+	if !ok {
+		return &SSOTokenInfo{Active: false}, nil
+	}
+
+	if time.Now().After(session.ExpiresAt) {
+		delete(m.sessions, token)
+		return &SSOTokenInfo{Active: false}, nil
+	}
+
+	return &SSOTokenInfo{
+		Active:    true,
+		UserID:    session.UserID,
+		Username:  session.Username,
+		ExpiresAt: session.ExpiresAt,
+		Scope:     session.Scope,
+		ClientID:  session.ClientID,
+	}, nil
+}
+
+// RevokeToken 撤销 token
+func (m *SSOManager) RevokeToken(token string) error {
+	delete(m.sessions, token)
+	return nil
+}
+
+// CleanupExpired 清理过期的 session（可由后台 goroutine 定期调用）
+func (m *SSOManager) CleanupExpired() {
+	now := time.Now()
+	for key, session := range m.sessions {
+		if now.After(session.ExpiresAt) {
+			delete(m.sessions, key)
+		}
+	}
+}
+
+// generateSecureToken 生成安全随机 token
+func generateSecureToken(length int) string {
+	bytes := make([]byte, length)
+	rand.Read(bytes)
+	return base64.URLEncoding.EncodeToString(bytes)[:length]
+}
+
+// SSOClient SSO 客户端配置存储
+type SSOClient struct {
+	ClientID     string
+	ClientSecret string
+	Name         string
+	RedirectURIs []string
+}
+
+// SSOClientsStore SSO 客户端存储接口
+type SSOClientsStore interface {
+	GetByClientID(clientID string) (*SSOClient, error)
+}
+
+// DefaultSSOClientsStore 默认内存存储
+type DefaultSSOClientsStore struct {
+	clients map[string]*SSOClient
+}
+
+// NewDefaultSSOClientsStore 创建默认客户端存储
+func NewDefaultSSOClientsStore() *DefaultSSOClientsStore {
+	return &DefaultSSOClientsStore{
+		clients: make(map[string]*SSOClient),
+	}
+}
+
+// RegisterClient 注册客户端
+func (s *DefaultSSOClientsStore) RegisterClient(client *SSOClient) {
+	s.clients[client.ClientID] = client
+}
+
+// GetByClientID 根据 ClientID 获取客户端
+func (s *DefaultSSOClientsStore) GetByClientID(clientID string) (*SSOClient, error) {
+	client, ok := s.clients[clientID]
+	if !ok {
+		return nil, fmt.Errorf("client not found: %s", clientID)
+	}
+	return client, nil
+}
+
+// ValidateClientRedirectURI 验证客户端的 RedirectURI
+func (s *DefaultSSOClientsStore) ValidateClientRedirectURI(clientID, redirectURI string) bool {
+	client, err := s.GetByClientID(clientID)
+	if err != nil {
+		return false
+	}
+
+	for _, uri := range client.RedirectURIs {
+		if uri == redirectURI {
+			return true
+		}
+	}
+	return false
+}
--- a/internal/auth/state.go
+++ b/internal/auth/state.go
@@ -0,0 +1,113 @@
+package auth
+
+import (
+	"sync"
+	"time"
+)
+
+// StateManager OAuth状态管理器
+type StateManager struct {
+	states map[string]time.Time
+	mu     sync.RWMutex
+	ttl    time.Duration
+}
+
+var (
+	// 全局状态管理器
+	stateManager = &StateManager{
+		states: make(map[string]time.Time),
+		ttl:    10 * time.Minute, // 10分钟过期
+	}
+)
+
+// Note: GenerateState and ValidateState are defined in oauth_utils.go
+// to avoid duplication, please use those implementations
+
+// Store 存储state
+func (sm *StateManager) Store(state string) {
+	sm.mu.Lock()
+	defer sm.mu.Unlock()
+	sm.states[state] = time.Now()
+}
+
+// Validate 验证state
+func (sm *StateManager) Validate(state string) bool {
+	sm.mu.RLock()
+	defer sm.mu.RUnlock()
+	
+	expiredAt, exists := sm.states[state]
+	if !exists {
+		return false
+	}
+	
+	// 检查是否过期
+	return time.Now().Before(expiredAt.Add(sm.ttl))
+}
+
+// Delete 删除state（使用后删除）
+func (sm *StateManager) Delete(state string) {
+	sm.mu.Lock()
+	defer sm.mu.Unlock()
+	delete(sm.states, state)
+}
+
+// Cleanup 清理过期的state
+func (sm *StateManager) Cleanup() {
+	sm.mu.Lock()
+	defer sm.mu.Unlock()
+	
+	now := time.Now()
+	for state, expiredAt := range sm.states {
+		if now.After(expiredAt.Add(sm.ttl)) {
+			delete(sm.states, state)
+		}
+	}
+}
+
+// StartCleanupRoutine 启动定期清理goroutine
+// stop channel 关闭时，清理goroutine将优雅退出
+func (sm *StateManager) StartCleanupRoutine(stop <-chan struct{}) {
+	ticker := time.NewTicker(5 * time.Minute)
+	go func() {
+		for {
+			select {
+			case <-ticker.C:
+				sm.Cleanup()
+			case <-stop:
+				ticker.Stop()
+				return
+			}
+		}
+	}()
+}
+
+// CleanupRoutineManager 管理清理goroutine的生命周期
+type CleanupRoutineManager struct {
+	stopChan chan struct{}
+}
+
+var cleanupRoutineManager *CleanupRoutineManager
+
+// StartCleanupRoutineWithManager 使用管理器启动清理goroutine
+func StartCleanupRoutineWithManager() {
+	if cleanupRoutineManager != nil {
+		return // 已经启动
+	}
+	cleanupRoutineManager = &CleanupRoutineManager{
+		stopChan: make(chan struct{}),
+	}
+	stateManager.StartCleanupRoutine(cleanupRoutineManager.stopChan)
+}
+
+// StopCleanupRoutine 停止清理goroutine（用于优雅关闭）
+func StopCleanupRoutine() {
+	if cleanupRoutineManager != nil {
+		close(cleanupRoutineManager.stopChan)
+		cleanupRoutineManager = nil
+	}
+}
+
+// GetStateManager 获取全局状态管理器
+func GetStateManager() *StateManager {
+	return stateManager
+}
--- a/internal/auth/totp.go
+++ b/internal/auth/totp.go
@@ -0,0 +1,149 @@
+package auth
+
+import (
+	"bytes"
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/base32"
+	"encoding/base64"
+	"encoding/hex"
+	"fmt"
+	"image/png"
+	"strings"
+	"time"
+
+	"github.com/pquerna/otp"
+	"github.com/pquerna/otp/totp"
+)
+
+const (
+	// TOTPIssuer 应用名称（显示在 Authenticator App 中）
+	TOTPIssuer = "UserManagementSystem"
+	// TOTPPeriod TOTP 时间步长（秒）
+	TOTPPeriod = 30
+	// TOTPDigits TOTP 位数
+	TOTPDigits = 6
+	// TOTPAlgorithm TOTP 算法（使用 SHA256 更安全）
+	TOTPAlgorithm = otp.AlgorithmSHA256
+	// RecoveryCodeCount 恢复码数量
+	RecoveryCodeCount = 8
+	// RecoveryCodeLength 每个恢复码的字节长度（生成后编码为 hex 字符串）
+	RecoveryCodeLength = 5
+)
+
+// TOTPManager TOTP 管理器
+type TOTPManager struct{}
+
+// NewTOTPManager 创建 TOTP 管理器
+func NewTOTPManager() *TOTPManager {
+	return &TOTPManager{}
+}
+
+// TOTPSetup TOTP 初始化结果
+type TOTPSetup struct {
+	Secret        string   `json:"secret"`          // Base32 密钥（用户备用）
+	QRCodeBase64  string   `json:"qr_code_base64"`  // Base64 编码的 PNG 二维码图片
+	RecoveryCodes []string `json:"recovery_codes"`  // 一次性恢复码列表
+}
+
+// GenerateSecret 为指定用户生成 TOTP 密钥及二维码
+func (m *TOTPManager) GenerateSecret(username string) (*TOTPSetup, error) {
+	key, err := totp.Generate(totp.GenerateOpts{
+		Issuer:      TOTPIssuer,
+		AccountName: username,
+		Period:      TOTPPeriod,
+		Digits:      otp.DigitsSix,
+		Algorithm:   TOTPAlgorithm,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("generate totp key failed: %w", err)
+	}
+
+	// 生成二维码图片
+	img, err := key.Image(200, 200)
+	if err != nil {
+		return nil, fmt.Errorf("generate qr image failed: %w", err)
+	}
+	var buf bytes.Buffer
+	if err := png.Encode(&buf, img); err != nil {
+		return nil, fmt.Errorf("encode qr image failed: %w", err)
+	}
+	qrBase64 := base64.StdEncoding.EncodeToString(buf.Bytes())
+
+	// 生成恢复码
+	codes, err := generateRecoveryCodes(RecoveryCodeCount)
+	if err != nil {
+		return nil, fmt.Errorf("generate recovery codes failed: %w", err)
+	}
+
+	return &TOTPSetup{
+		Secret:        key.Secret(),
+		QRCodeBase64:  qrBase64,
+		RecoveryCodes: codes,
+	}, nil
+}
+
+// ValidateCode 验证用户输入的 TOTP 码（允许 ±1 个时间窗口的时钟偏差）
+func (m *TOTPManager) ValidateCode(secret, code string) bool {
+	// 注意：pquerna/otp 库的 ValidateCustom 与 GenerateCode 存在算法不匹配 bug（GenerateCode 固定用 SHA1）
+	// 因此使用 totp.Validate() 代替，它内部正确处理算法检测
+	return totp.Validate(strings.TrimSpace(code), secret)
+}
+
+// GenerateCurrentCode 生成当前时间的 TOTP 码（用于测试）
+func (m *TOTPManager) GenerateCurrentCode(secret string) (string, error) {
+	return totp.GenerateCode(secret, time.Now().UTC())
+}
+
+// ValidateRecoveryCode 验证恢复码（传入哈希后的已存储恢复码列表，返回匹配索引）
+// 注意：调用方负责在验证后将该恢复码标记为已使用
+// 使用恒定时间比较防止时序攻击
+func ValidateRecoveryCode(inputCode string, storedCodes []string) (int, bool) {
+	normalized := strings.ToUpper(strings.ReplaceAll(strings.TrimSpace(inputCode), "-", ""))
+	for i, stored := range storedCodes {
+		storedNormalized := strings.ToUpper(strings.ReplaceAll(stored, "-", ""))
+		// 使用恒定时间比较防止时序攻击
+		if subtle.ConstantTimeCompare([]byte(normalized), []byte(storedNormalized)) == 1 {
+			return i, true
+		}
+	}
+	return -1, false
+}
+
+// HashRecoveryCode 使用 SHA256 哈希恢复码（用于存储）
+func HashRecoveryCode(code string) (string, error) {
+	h := sha256.Sum256([]byte(code))
+	return hex.EncodeToString(h[:]), nil
+}
+
+// VerifyRecoveryCode 验证恢复码（自动哈希后比较）
+func VerifyRecoveryCode(inputCode string, hashedCodes []string) (int, bool) {
+	hashedInput, err := HashRecoveryCode(inputCode)
+	if err != nil {
+		return -1, false
+	}
+	for i, hashed := range hashedCodes {
+		if hmac.Equal([]byte(hashedInput), []byte(hashed)) {
+			return i, true
+		}
+	}
+	return -1, false
+}
+
+// generateRecoveryCodes 生成 N 个随机恢复码（格式：XXXXX-XXXXX）
+func generateRecoveryCodes(count int) ([]string, error) {
+	codes := make([]string, count)
+	for i := 0; i < count; i++ {
+		b := make([]byte, RecoveryCodeLength*2)
+		if _, err := rand.Read(b); err != nil {
+			return nil, err
+		}
+		encoded := base32.StdEncoding.EncodeToString(b)
+		// 格式化为 XXXXX-XXXXX
+		part := strings.ToUpper(encoded[:10])
+		codes[i] = part[:5] + "-" + part[5:]
+	}
+	return codes, nil
+}
--- a/internal/auth/totp_test.go
+++ b/internal/auth/totp_test.go
@@ -0,0 +1,101 @@
+package auth
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestTOTPManager_GenerateAndValidate(t *testing.T) {
+	m := NewTOTPManager()
+
+	// 生成密钥
+	setup, err := m.GenerateSecret("testuser@example.com")
+	if err != nil {
+		t.Fatalf("GenerateSecret 失败: %v", err)
+	}
+
+	if setup.Secret == "" {
+		t.Fatal("生成的 Secret 不应为空")
+	}
+	if setup.QRCodeBase64 == "" {
+		t.Fatal("QRCode Base64 不应为空")
+	}
+	if len(setup.RecoveryCodes) != RecoveryCodeCount {
+		t.Fatalf("恢复码数量期望 %d，实际 %d", RecoveryCodeCount, len(setup.RecoveryCodes))
+	}
+	t.Logf("生成 Secret: %s", setup.Secret)
+	t.Logf("恢复码示例: %s", setup.RecoveryCodes[0])
+
+	// 用生成的密钥生成当前 TOTP 码，再验证
+	code, err := m.GenerateCurrentCode(setup.Secret)
+	if err != nil {
+		t.Fatalf("GenerateCurrentCode 失败: %v", err)
+	}
+	if !m.ValidateCode(setup.Secret, code) {
+		t.Fatalf("有效 TOTP 码应该通过验证，code=%s", code)
+	}
+	t.Logf("TOTP 验证通过，code=%s", code)
+}
+
+func TestTOTPManager_InvalidCode(t *testing.T) {
+	m := NewTOTPManager()
+	setup, err := m.GenerateSecret("user")
+	if err != nil {
+		t.Fatalf("GenerateSecret 失败: %v", err)
+	}
+
+	// 错误的验证码
+	if m.ValidateCode(setup.Secret, "000000") {
+		// 偶尔可能恰好正确，跳过而不是 fatal
+		t.Skip("000000 碰巧是有效码，跳过测试")
+	}
+	t.Log("无效验证码正确拒绝")
+}
+
+func TestTOTPManager_RecoveryCodeFormat(t *testing.T) {
+	m := NewTOTPManager()
+	setup, err := m.GenerateSecret("user2")
+	if err != nil {
+		t.Fatalf("GenerateSecret 失败: %v", err)
+	}
+
+	for i, code := range setup.RecoveryCodes {
+		parts := strings.Split(code, "-")
+		if len(parts) != 2 {
+			t.Errorf("恢复码 [%d] 格式错误（期望 XXXXX-XXXXX）: %s", i, code)
+		}
+		if len(parts[0]) != 5 || len(parts[1]) != 5 {
+			t.Errorf("恢复码 [%d] 各部分长度应为 5: %s", i, code)
+		}
+	}
+}
+
+func TestValidateRecoveryCode(t *testing.T) {
+	codes := []string{"ABCDE-FGHIJ", "KLMNO-PQRST", "UVWXY-ZABCD"}
+
+	// 正确匹配
+	idx, ok := ValidateRecoveryCode("ABCDE-FGHIJ", codes)
+	if !ok || idx != 0 {
+		t.Fatalf("有效恢复码应该匹配，idx=%d ok=%v", idx, ok)
+	}
+
+	// 大小写不敏感
+	idx2, ok2 := ValidateRecoveryCode("klmno-pqrst", codes)
+	if !ok2 || idx2 != 1 {
+		t.Fatalf("大小写不敏感匹配失败，idx=%d ok=%v", idx2, ok2)
+	}
+
+	// 去除空格
+	idx3, ok3 := ValidateRecoveryCode("  UVWXY-ZABCD  ", codes)
+	if !ok3 || idx3 != 2 {
+		t.Fatalf("去除空格匹配失败，idx=%d ok=%v", idx3, ok3)
+	}
+
+	// 不匹配
+	_, ok4 := ValidateRecoveryCode("XXXXX-YYYYY", codes)
+	if ok4 {
+		t.Fatal("无效恢复码不应该匹配")
+	}
+
+	t.Log("恢复码验证全部通过")
+}