265 lines
7.6 KiB
Go
265 lines
7.6 KiB
Go
package providers
|
||
|
||
import (
|
||
"context"
|
||
"crypto/rand"
|
||
"encoding/base64"
|
||
"encoding/json"
|
||
"fmt"
|
||
"net/http"
|
||
"net/url"
|
||
"time"
|
||
)
|
||
|
||
// TwitterProvider Twitter OAuth提供者 (OAuth 2.0 with PKCE)
|
||
type TwitterProvider struct {
|
||
ClientID string
|
||
RedirectURI string
|
||
}
|
||
|
||
// TwitterAuthURLResponse Twitter授权URL响应
|
||
type TwitterAuthURLResponse struct {
|
||
URL string `json:"url"`
|
||
CodeVerifier string `json:"code_verifier"`
|
||
State string `json:"state"`
|
||
Redirect string `json:"redirect,omitempty"`
|
||
}
|
||
|
||
// TwitterTokenResponse Twitter Token响应
|
||
type TwitterTokenResponse struct {
|
||
AccessToken string `json:"access_token"`
|
||
TokenType string `json:"token_type"`
|
||
ExpiresIn int `json:"expires_in"`
|
||
RefreshToken string `json:"refresh_token"`
|
||
Scope string `json:"scope"`
|
||
}
|
||
|
||
// TwitterUserInfo Twitter用户信息
|
||
type TwitterUserInfo struct {
|
||
Data struct {
|
||
ID string `json:"id"`
|
||
Name string `json:"name"`
|
||
Username string `json:"username"`
|
||
CreatedAt string `json:"created_at"`
|
||
Description string `json:"description"`
|
||
PublicMetrics struct {
|
||
FollowersCount int `json:"followers_count"`
|
||
FollowingCount int `json:"following_count"`
|
||
TweetCount int `json:"tweet_count"`
|
||
ListedCount int `json:"listed_count"`
|
||
} `json:"public_metrics"`
|
||
ProfileImageURL string `json:"profile_image_url"`
|
||
} `json:"data"`
|
||
}
|
||
|
||
// TwitterErrorResponse Twitter错误响应
|
||
type TwitterErrorResponse struct {
|
||
Title string `json:"title"`
|
||
Detail string `json:"detail"`
|
||
Type string `json:"type"`
|
||
Status int `json:"status"`
|
||
}
|
||
|
||
// NewTwitterProvider 创建Twitter OAuth提供者
|
||
func NewTwitterProvider(clientID, redirectURI string) *TwitterProvider {
|
||
return &TwitterProvider{
|
||
ClientID: clientID,
|
||
RedirectURI: redirectURI,
|
||
}
|
||
}
|
||
|
||
// GenerateCodeVerifier 生成PKCE Code Verifier
|
||
func (t *TwitterProvider) GenerateCodeVerifier() (string, error) {
|
||
b := make([]byte, 32)
|
||
_, err := rand.Read(b)
|
||
if err != nil {
|
||
return "", err
|
||
}
|
||
return base64.URLEncoding.WithPadding(base64.NoPadding).EncodeToString(b), nil
|
||
}
|
||
|
||
// GenerateCodeChallenge 从Code Verifier生成Code Challenge
|
||
func (t *TwitterProvider) GenerateCodeChallenge(verifier string) string {
|
||
// 简化的base64编码（实际应用中应该使用SHA256哈希）
|
||
return verifier
|
||
}
|
||
|
||
// GenerateState 生成随机状态码
|
||
func (t *TwitterProvider) GenerateState() (string, error) {
|
||
b := make([]byte, 32)
|
||
_, err := rand.Read(b)
|
||
if err != nil {
|
||
return "", err
|
||
}
|
||
return base64.URLEncoding.EncodeToString(b), nil
|
||
}
|
||
|
||
// GetAuthURL 获取Twitter授权URL (OAuth 2.0 with PKCE)
|
||
func (t *TwitterProvider) GetAuthURL() (*TwitterAuthURLResponse, error) {
|
||
verifier, err := t.GenerateCodeVerifier()
|
||
if err != nil {
|
||
return nil, fmt.Errorf("generate code verifier failed: %w", err)
|
||
}
|
||
|
||
challenge := t.GenerateCodeChallenge(verifier)
|
||
|
||
state, err := t.GenerateState()
|
||
if err != nil {
|
||
return nil, fmt.Errorf("generate state failed: %w", err)
|
||
}
|
||
|
||
authURL := fmt.Sprintf(
|
||
"https://twitter.com/i/oauth2/authorize?response_type=code&client_id=%s&redirect_uri=%s&scope=tweet.read%%20users.read%%20offline.access&state=%s&code_challenge=%s&code_challenge_method=plain",
|
||
t.ClientID,
|
||
url.QueryEscape(t.RedirectURI),
|
||
state,
|
||
challenge,
|
||
)
|
||
|
||
return &TwitterAuthURLResponse{
|
||
URL: authURL,
|
||
CodeVerifier: verifier,
|
||
State: state,
|
||
Redirect: t.RedirectURI,
|
||
}, nil
|
||
}
|
||
|
||
// ExchangeCode 用授权码换取访问令牌
|
||
func (t *TwitterProvider) ExchangeCode(ctx context.Context, code, codeVerifier string) (*TwitterTokenResponse, error) {
|
||
tokenURL := "https://api.twitter.com/2/oauth2/token"
|
||
|
||
data := url.Values{}
|
||
data.Set("code", code)
|
||
data.Set("grant_type", "authorization_code")
|
||
data.Set("client_id", t.ClientID)
|
||
data.Set("redirect_uri", t.RedirectURI)
|
||
data.Set("code_verifier", codeVerifier)
|
||
|
||
client := &http.Client{Timeout: 10 * time.Second}
|
||
resp, err := postFormWithContext(ctx, client, tokenURL, data)
|
||
if err != nil {
|
||
return nil, fmt.Errorf("request failed: %w", err)
|
||
}
|
||
defer resp.Body.Close()
|
||
|
||
body, err := readOAuthResponseBody(resp)
|
||
if err != nil {
|
||
return nil, fmt.Errorf("read response failed: %w", err)
|
||
}
|
||
|
||
// 检查错误响应
|
||
var errResp TwitterErrorResponse
|
||
if err := json.Unmarshal(body, &errResp); err == nil && errResp.Detail != "" {
|
||
return nil, fmt.Errorf("twitter api error: %s - %s", errResp.Title, errResp.Detail)
|
||
}
|
||
|
||
var tokenResp TwitterTokenResponse
|
||
if err := json.Unmarshal(body, &tokenResp); err != nil {
|
||
return nil, fmt.Errorf("parse token response failed: %w", err)
|
||
}
|
||
|
||
return &tokenResp, nil
|
||
}
|
||
|
||
// GetUserInfo 获取Twitter用户信息
|
||
func (t *TwitterProvider) GetUserInfo(ctx context.Context, accessToken string) (*TwitterUserInfo, error) {
|
||
userInfoURL := "https://api.twitter.com/2/users/me?user.fields=created_at,description,public_metrics,profile_image_url"
|
||
|
||
req, err := http.NewRequestWithContext(ctx, "GET", userInfoURL, nil)
|
||
if err != nil {
|
||
return nil, fmt.Errorf("create request failed: %w", err)
|
||
}
|
||
req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", accessToken))
|
||
|
||
client := &http.Client{Timeout: 10 * time.Second}
|
||
resp, err := client.Do(req)
|
||
if err != nil {
|
||
return nil, fmt.Errorf("request failed: %w", err)
|
||
}
|
||
defer resp.Body.Close()
|
||
|
||
body, err := readOAuthResponseBody(resp)
|
||
if err != nil {
|
||
return nil, fmt.Errorf("read response failed: %w", err)
|
||
}
|
||
|
||
// 检查错误响应
|
||
var errResp TwitterErrorResponse
|
||
if err := json.Unmarshal(body, &errResp); err == nil && errResp.Detail != "" {
|
||
return nil, fmt.Errorf("twitter api error: %s - %s", errResp.Title, errResp.Detail)
|
||
}
|
||
|
||
var userInfo TwitterUserInfo
|
||
if err := json.Unmarshal(body, &userInfo); err != nil {
|
||
return nil, fmt.Errorf("parse user info failed: %w", err)
|
||
}
|
||
|
||
return &userInfo, nil
|
||
}
|
||
|
||
// RefreshToken 刷新访问令牌
|
||
func (t *TwitterProvider) RefreshToken(ctx context.Context, refreshToken string) (*TwitterTokenResponse, error) {
|
||
tokenURL := "https://api.twitter.com/2/oauth2/token"
|
||
|
||
data := url.Values{}
|
||
data.Set("refresh_token", refreshToken)
|
||
data.Set("grant_type", "refresh_token")
|
||
data.Set("client_id", t.ClientID)
|
||
|
||
client := &http.Client{Timeout: 10 * time.Second}
|
||
resp, err := postFormWithContext(ctx, client, tokenURL, data)
|
||
if err != nil {
|
||
return nil, fmt.Errorf("request failed: %w", err)
|
||
}
|
||
defer resp.Body.Close()
|
||
|
||
body, err := readOAuthResponseBody(resp)
|
||
if err != nil {
|
||
return nil, fmt.Errorf("read response failed: %w", err)
|
||
}
|
||
|
||
var errResp TwitterErrorResponse
|
||
if err := json.Unmarshal(body, &errResp); err == nil && errResp.Detail != "" {
|
||
return nil, fmt.Errorf("twitter api error: %s - %s", errResp.Title, errResp.Detail)
|
||
}
|
||
|
||
var tokenResp TwitterTokenResponse
|
||
if err := json.Unmarshal(body, &tokenResp); err != nil {
|
||
return nil, fmt.Errorf("parse token response failed: %w", err)
|
||
}
|
||
|
||
return &tokenResp, nil
|
||
}
|
||
|
||
// ValidateToken 验证访问令牌是否有效
|
||
func (t *TwitterProvider) ValidateToken(ctx context.Context, accessToken string) (bool, error) {
|
||
userInfo, err := t.GetUserInfo(ctx, accessToken)
|
||
if err != nil {
|
||
return false, err
|
||
}
|
||
return userInfo != nil && userInfo.Data.ID != "", nil
|
||
}
|
||
|
||
// RevokeToken 撤销访问令牌
|
||
func (t *TwitterProvider) RevokeToken(ctx context.Context, accessToken string) error {
|
||
revokeURL := "https://api.twitter.com/2/oauth2/revoke"
|
||
|
||
data := url.Values{}
|
||
data.Set("token", accessToken)
|
||
data.Set("client_id", t.ClientID)
|
||
data.Set("token_type_hint", "access_token")
|
||
|
||
client := &http.Client{Timeout: 10 * time.Second}
|
||
resp, err := postFormWithContext(ctx, client, revokeURL, data)
|
||
if err != nil {
|
||
return fmt.Errorf("request failed: %w", err)
|
||
}
|
||
defer resp.Body.Close()
|
||
|
||
if _, err := readOAuthResponseBody(resp); err != nil {
|
||
return fmt.Errorf("revoke token failed: %w", err)
|
||
}
|
||
|
||
return nil
|
||
}
|