第3章：OAuth 2.0与OpenID Connect

// OAuth 2.0授权服务器
type OAuthServer struct {
	clients map[string]*Client
	codes   map[string]*AuthorizationCode
	tokens  map[string]*AccessToken
}

// Client 客户端
type Client struct {
	ID           string
	Secret       string
	RedirectURIs []string
}

// AuthorizationCode 授权码
type AuthorizationCode struct {
	Code        string
	ClientID    string
	UserID      int
	RedirectURI string
	ExpiresAt   time.Time
	Used        bool
}

// AccessToken 访问令牌
type AccessToken struct {
	Token     string
	ClientID  string
	UserID    int
	ExpiresAt time.Time
}

// 授权端点
func (s *OAuthServer) Authorize(w http.ResponseWriter, r *http.Request) {
	clientID := r.URL.Query().Get("client_id")
	redirectURI := r.URL.Query().Get("redirect_uri")
	responseType := r.URL.Query().Get("response_type")
	state := r.URL.Query().Get("state")

	// 验证client
	client, exists := s.clients[clientID]
	if !exists {
		http.Error(w, "Invalid client", 400)
		return
	}

	// 验证redirect_uri
	if !contains(client.RedirectURIs, redirectURI) {
		http.Error(w, "Invalid redirect URI", 400)
		return
	}

	// 用户登录并同意授权（简化）
	userID := 123

	// 生成授权码
	code := generateCode()
	s.codes[code] = &AuthorizationCode{
		Code:        code,
		ClientID:    clientID,
		UserID:      userID,
		RedirectURI: redirectURI,
		ExpiresAt:   time.Now().Add(10 * time.Minute),
		Used:        false,
	}

	// 重定向回客户端
	redirectURL := fmt.Sprintf("%s?code=%s&state=%s", redirectURI, code, state)
	http.Redirect(w, r, redirectURL, 302)
}

// Token端点
func (s *OAuthServer) Token(w http.ResponseWriter, r *http.Request) {
	grantType := r.FormValue("grant_type")
	code := r.FormValue("code")
	clientID := r.FormValue("client_id")
	clientSecret := r.FormValue("client_secret")
	redirectURI := r.FormValue("redirect_uri")

	// 验证client
	client, exists := s.clients[clientID]
	if !exists || client.Secret != clientSecret {
		http.Error(w, "Invalid client credentials", 401)
		return
	}

	// 验证授权码
	authCode, exists := s.codes[code]
	if !exists || authCode.Used || time.Now().After(authCode.ExpiresAt) {
		http.Error(w, "Invalid or expired code", 400)
		return
	}

	// 验证redirect_uri
	if authCode.RedirectURI != redirectURI {
		http.Error(w, "Redirect URI mismatch", 400)
		return
	}

	// 标记授权码为已使用
	authCode.Used = true

	// 生成access_token
	token := generateToken()
	s.tokens[token] = &AccessToken{
		Token:     token,
		ClientID:  clientID,
		UserID:    authCode.UserID,
		ExpiresAt: time.Now().Add(1 * time.Hour),
	}

	// 返回token
	json.NewEncoder(w).Encode(map[string]interface{}{
		"access_token": token,
		"token_type":   "Bearer",
		"expires_in":   3600,
	})
}

// 密码模式：直接用用户名密码换取token
func (s *OAuthServer) TokenPassword(w http.ResponseWriter, r *http.Request) {
	username := r.FormValue("username")
	password := r.FormValue("password")
	clientID := r.FormValue("client_id")

	// 验证用户名密码
	userID, ok := s.authenticateUser(username, password)
	if !ok {
		http.Error(w, "Invalid credentials", 401)
		return
	}

	// 生成token
	token := generateToken()
	s.tokens[token] = &AccessToken{
		Token:     token,
		ClientID:  clientID,
		UserID:    userID,
		ExpiresAt: time.Now().Add(1 * time.Hour),
	}

	json.NewEncoder(w).Encode(map[string]interface{}{
		"access_token": token,
		"token_type":   "Bearer",
		"expires_in":   3600,
	})
}

// 客户端模式：服务间调用
func (s *OAuthServer) TokenClientCredentials(w http.ResponseWriter, r *http.Request) {
	clientID := r.FormValue("client_id")
	clientSecret := r.FormValue("client_secret")

	// 验证客户端
	client, exists := s.clients[clientID]
	if !exists || client.Secret != clientSecret {
		http.Error(w, "Invalid client", 401)
		return
	}

	// 生成token（无用户）
	token := generateToken()
	s.tokens[token] = &AccessToken{
		Token:     token,
		ClientID:  clientID,
		ExpiresAt: time.Now().Add(1 * time.Hour),
	}

	json.NewEncoder(w).Encode(map[string]interface{}{
		"access_token": token,
		"token_type":   "Bearer",
		"expires_in":   3600,
	})
}

package main

import (
	"crypto/rand"
	"crypto/sha256"
	"encoding/base64"
	"encoding/json"
	"fmt"
	"net/http"
	"strings"
)

// PKCE授权码
type PKCEAuthorizationCode struct {
	Code          string
	ClientID      string
	UserID        int
	RedirectURI   string
	CodeChallenge string
	ChallengeMethod string
	Used          bool
}

// PKCE服务器
type PKCEServer struct {
	codes  map[string]*PKCEAuthorizationCode
	tokens map[string]*AccessToken
}

// 1. 授权端点（接收code_challenge）
func (s *PKCEServer) Authorize(w http.ResponseWriter, r *http.Request) {
	clientID := r.URL.Query().Get("client_id")
	redirectURI := r.URL.Query().Get("redirect_uri")
	codeChallenge := r.URL.Query().Get("code_challenge")
	codeChallengeMethod := r.URL.Query().Get("code_challenge_method")
	state := r.URL.Query().Get("state")

	// 验证code_challenge
	if codeChallenge == "" {
		http.Error(w, "code_challenge required", 400)
		return
	}

	// 支持S256（推荐）或plain
	if codeChallengeMethod != "S256" && codeChallengeMethod != "plain" {
		http.Error(w, "Invalid code_challenge_method", 400)
		return
	}

	// 用户登录并授权（简化）
	userID := 123

	// 生成授权码
	code := generateRandomString(32)
	s.codes[code] = &PKCEAuthorizationCode{
		Code:            code,
		ClientID:        clientID,
		UserID:          userID,
		RedirectURI:     redirectURI,
		CodeChallenge:   codeChallenge,
		ChallengeMethod: codeChallengeMethod,
		Used:            false,
	}

	// 重定向回客户端
	redirectURL := fmt.Sprintf("%s?code=%s&state=%s", redirectURI, code, state)
	http.Redirect(w, r, redirectURL, 302)
}

// 2. Token端点（验证code_verifier）
func (s *PKCEServer) Token(w http.ResponseWriter, r *http.Request) {
	code := r.FormValue("code")
	codeVerifier := r.FormValue("code_verifier")
	clientID := r.FormValue("client_id")

	// 验证授权码
	authCode, exists := s.codes[code]
	if !exists || authCode.Used {
		http.Error(w, "Invalid or expired code", 400)
		return
	}

	// PKCE验证：验证code_verifier
	if !s.verifyCodeVerifier(codeVerifier, authCode.CodeChallenge, authCode.ChallengeMethod) {
		http.Error(w, "Invalid code_verifier", 400)
		return
	}

	// 标记已使用
	authCode.Used = true

	// 生成access_token
	token := generateRandomString(32)
	s.tokens[token] = &AccessToken{
		Token:     token,
		ClientID:  clientID,
		UserID:    authCode.UserID,
	}

	// 返回token
	json.NewEncoder(w).Encode(map[string]interface{}{
		"access_token": token,
		"token_type":   "Bearer",
		"expires_in":   3600,
	})
}

// 验证code_verifier
func (s *PKCEServer) verifyCodeVerifier(verifier, challenge, method string) bool {
	if method == "plain" {
		// plain模式：直接比较
		return verifier == challenge
	}

	// S256模式：SHA256哈希比较
	hash := sha256.Sum256([]byte(verifier))
	computed := base64.RawURLEncoding.EncodeToString(hash[:])
	return computed == challenge
}

// 生成随机字符串
func generateRandomString(length int) string {
	b := make([]byte, length)
	rand.Read(b)
	return base64.RawURLEncoding.EncodeToString(b)[:length]
}

package main

import (
	"crypto/rand"
	"crypto/sha256"
	"encoding/base64"
	"fmt"
	"net/http"
	"net/url"
)

// PKCE客户端
type PKCEClient struct {
	clientID     string
	redirectURI  string
	authURL      string
	tokenURL     string
	codeVerifier string
}

// 1. 生成code_verifier和code_challenge
func (c *PKCEClient) generatePKCE() (verifier, challenge string) {
	// 生成code_verifier（43-128个字符）
	b := make([]byte, 32)
	rand.Read(b)
	verifier = base64.RawURLEncoding.EncodeToString(b)

	// 计算code_challenge = BASE64URL(SHA256(code_verifier))
	hash := sha256.Sum256([]byte(verifier))
	challenge = base64.RawURLEncoding.EncodeToString(hash[:])

	return verifier, challenge
}

// 2. 生成授权URL
func (c *PKCEClient) GetAuthorizationURL() string {
	// 生成并保存code_verifier
	verifier, challenge := c.generatePKCE()
	c.codeVerifier = verifier

	// 构造授权URL
	params := url.Values{
		"client_id":             {c.clientID},
		"redirect_uri":          {c.redirectURI},
		"response_type":         {"code"},
		"code_challenge":        {challenge},
		"code_challenge_method": {"S256"},
		"state":                 {generateRandomString(16)},
	}

	return c.authURL + "?" + params.Encode()
}

// 3. 用授权码换取token
func (c *PKCEClient) ExchangeToken(code string) (string, error) {
	// 发送token请求（携带code_verifier）
	resp, err := http.PostForm(c.tokenURL, url.Values{
		"grant_type":    {"authorization_code"},
		"code":          {code},
		"redirect_uri":  {c.redirectURI},
		"client_id":     {c.clientID},
		"code_verifier": {c.codeVerifier}, // PKCE关键
	})

	if err != nil {
		return "", err
	}
	defer resp.Body.Close()

	var result struct {
		AccessToken string `json:"access_token"`
		TokenType   string `json:"token_type"`
		ExpiresIn   int    `json:"expires_in"`
	}
	// 解析响应...

	return result.AccessToken, nil
}

// 使用示例
func main() {
	client := &PKCEClient{
		clientID:    "my-spa-app",
		redirectURI: "http://localhost:3000/callback",
		authURL:     "https://auth.example.com/authorize",
		tokenURL:    "https://auth.example.com/token",
	}

	// 跳转到授权页面
	authURL := client.GetAuthorizationURL()
	fmt.Println("访问:", authURL)

	// 授权后回调，获取code
	// code := "..."

	// 用code换取token
	// token, _ := client.ExchangeToken(code)
}

// 1. code_verifier必须随机且足够长
func GenerateSecureCodeVerifier() string {
	// 推荐43-128个字符
	b := make([]byte, 32) // 生成32字节，编码后约43字符
	rand.Read(b)
	return base64.RawURLEncoding.EncodeToString(b)
}

// 2. 必须使用S256，不要使用plain
// plain模式不安全，仅用于调试
const codeChallengeMethod = "S256"

// 3. code_verifier只能使用一次
type AuthCode struct {
	Code         string
	CodeVerifier string
	Used         bool    // 标记已使用
	ExpiresAt    time.Time
}

// 4. 授权码必须短期有效
const codeExpiration = 10 * time.Minute

// 5. 服务端必须验证redirect_uri
func validateRedirectURI(provided, registered string) bool {
	return provided == registered
}

// OIDC Token端点（返回ID Token + Access Token）
func (s *OIDCServer) Token(w http.ResponseWriter, r *http.Request) {
	// ... OAuth 2.0流程 ...

	// 生成ID Token
	idToken, _ := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
		"iss":   "https://example.com",
		"sub":   "user123",
		"aud":   clientID,
		"exp":   time.Now().Add(1 * time.Hour).Unix(),
		"iat":   time.Now().Unix(),
		"email": "user@example.com",
		"name":  "John Doe",
	}).SignedString([]byte("secret"))

	json.NewEncoder(w).Encode(map[string]interface{}{
		"access_token": accessToken,
		"token_type":   "Bearer",
		"expires_in":   3600,
		"id_token":     idToken,
	})
}

// UserInfo端点
func (s *OIDCServer) UserInfo(w http.ResponseWriter, r *http.Request) {
	// 从Authorization Header获取access_token
	token := extractToken(r)

	// 验证token
	accessToken, exists := s.tokens[token]
	if !exists {
		http.Error(w, "Invalid token", 401)
		return
	}

	// 返回用户信息
	json.NewEncoder(w).Encode(map[string]interface{}{
		"sub":   accessToken.UserID,
		"email": "user@example.com",
		"name":  "John Doe",
	})
}

const (
	GitHubClientID     = "your_client_id"
	GitHubClientSecret = "your_client_secret"
	GitHubRedirectURI  = "http://localhost:8080/callback"
)

// 跳转到GitHub授权页面
func HandleGitHubLogin(w http.ResponseWriter, r *http.Request) {
	url := fmt.Sprintf(
		"https://github.com/login/oauth/authorize?client_id=%s&redirect_uri=%s&scope=user:email",
		GitHubClientID,
		url.QueryEscape(GitHubRedirectURI),
	)
	http.Redirect(w, r, url, 302)
}

// GitHub回调
func HandleGitHubCallback(w http.ResponseWriter, r *http.Request) {
	code := r.URL.Query().Get("code")

	// 用code换取access_token
	tokenResp, _ := http.PostForm("https://github.com/login/oauth/access_token", url.Values{
		"client_id":     {GitHubClientID},
		"client_secret": {GitHubClientSecret},
		"code":          {code},
	})

	// 解析access_token
	body, _ := io.ReadAll(tokenResp.Body)
	values, _ := url.ParseQuery(string(body))
	accessToken := values.Get("access_token")

	// 获取用户信息
	req, _ := http.NewRequest("GET", "https://api.github.com/user", nil)
	req.Header.Set("Authorization", "Bearer "+accessToken)
	userResp, _ := http.DefaultClient.Do(req)

	var user struct {
		ID    int    `json:"id"`
		Login string `json:"login"`
		Email string `json:"email"`
	}
	json.NewDecoder(userResp.Body).Decode(&user)

	// 创建本地用户或登录
	fmt.Fprintf(w, "Welcome, %s!", user.Login)
}

package main

import (
	"encoding/json"
	"fmt"
	"net/http"
	"net/url"
	"time"
)

const (
	WeChatAppID     = "your_appid"
	WeChatAppSecret = "your_appsecret"
	WeChatRedirect  = "http://yourdomain.com/wechat/callback"
)

// 微信登录管理器
type WeChatLoginManager struct {
	qrCodes map[string]*QRCodeSession
}

type QRCodeSession struct {
	State     string
	CreatedAt time.Time
	Scanned   bool
	Code      string
}

// 1. 生成微信登录二维码
func (m *WeChatLoginManager) HandleWeChatLogin(w http.ResponseWriter, r *http.Request) {
	// 生成state（防CSRF）
	state := generateRandomString(32)

	// 保存session
	m.qrCodes[state] = &QRCodeSession{
		State:     state,
		CreatedAt: time.Now(),
		Scanned:   false,
	}

	// 构造微信授权URL
	authURL := fmt.Sprintf(
		"https://open.weixin.qq.com/connect/qrconnect?appid=%s&redirect_uri=%s&response_type=code&scope=snsapi_login&state=%s#wechat_redirect",
		WeChatAppID,
		url.QueryEscape(WeChatRedirect),
		state,
	)

	// 返回HTML页面（展示二维码）
	html := fmt.Sprintf(`
<!DOCTYPE html>
<html>
<head>
    <title>微信登录</title>
    <script src="https://res.wx.qq.com/connect/zh_CN/htmledition/js/wxLogin.js"></script>
</head>
<body>
    <h2>使用微信扫码登录</h2>
    <div id="wechat-qrcode"></div>

    <script>
        new WxLogin({
            self_redirect: false,
            id: "wechat-qrcode",
            appid: "%s",
            scope: "snsapi_login",
            redirect_uri: "%s",
            state: "%s",
            style: "black",
            href: ""
        });

        // 轮询检查扫码状态
        const checkInterval = setInterval(() => {
            fetch('/wechat/check?state=%s')
                .then(res => res.json())
                .then(data => {
                    if (data.scanned) {
                        clearInterval(checkInterval);
                        window.location.href = "/dashboard";
                    }
                });
        }, 2000);
    </script>
</body>
</html>
	`, WeChatAppID, url.QueryEscape(WeChatRedirect), state, state)

	w.Header().Set("Content-Type", "text/html")
	w.Write([]byte(html))
}

// 2. 检查扫码状态（轮询）
func (m *WeChatLoginManager) HandleCheckStatus(w http.ResponseWriter, r *http.Request) {
	state := r.URL.Query().Get("state")

	session, exists := m.qrCodes[state]
	if !exists {
		json.NewEncoder(w).Encode(map[string]bool{"scanned": false})
		return
	}

	json.NewEncoder(w).Encode(map[string]bool{"scanned": session.Scanned})
}

// 3. 微信回调处理
func (m *WeChatLoginManager) HandleWeChatCallback(w http.ResponseWriter, r *http.Request) {
	code := r.URL.Query().Get("code")
	state := r.URL.Query().Get("state")

	// 验证state
	session, exists := m.qrCodes[state]
	if !exists {
		http.Error(w, "Invalid state", 400)
		return
	}

	// 用code换取access_token
	tokenURL := fmt.Sprintf(
		"https://api.weixin.qq.com/sns/oauth2/access_token?appid=%s&secret=%s&code=%s&grant_type=authorization_code",
		WeChatAppID,
		WeChatAppSecret,
		code,
	)

	resp, err := http.Get(tokenURL)
	if err != nil {
		http.Error(w, "Failed to get token", 500)
		return
	}
	defer resp.Body.Close()

	var tokenResp struct {
		AccessToken  string `json:"access_token"`
		ExpiresIn    int    `json:"expires_in"`
		RefreshToken string `json:"refresh_token"`
		OpenID       string `json:"openid"`
		Scope        string `json:"scope"`
		UnionID      string `json:"unionid"`
		ErrCode      int    `json:"errcode"`
		ErrMsg       string `json:"errmsg"`
	}
	json.NewDecoder(resp.Body).Decode(&tokenResp)

	if tokenResp.ErrCode != 0 {
		http.Error(w, tokenResp.ErrMsg, 400)
		return
	}

	// 获取用户信息
	userInfoURL := fmt.Sprintf(
		"https://api.weixin.qq.com/sns/userinfo?access_token=%s&openid=%s",
		tokenResp.AccessToken,
		tokenResp.OpenID,
	)

	userResp, _ := http.Get(userInfoURL)
	defer userResp.Body.Close()

	var wechatUser struct {
		OpenID     string   `json:"openid"`
		Nickname   string   `json:"nickname"`
		Sex        int      `json:"sex"`
		Province   string   `json:"province"`
		City       string   `json:"city"`
		Country    string   `json:"country"`
		HeadImgURL string   `json:"headimgurl"`
		Privilege  []string `json:"privilege"`
		UnionID    string   `json:"unionid"`
	}
	json.NewDecoder(userResp.Body).Decode(&wechatUser)

	// 标记为已扫码
	session.Scanned = true
	session.Code = code

	// 创建本地用户或登录
	// TODO: 保存用户信息到数据库
	// TODO: 创建本地session

	fmt.Fprintf(w, "登录成功！欢迎 %s", wechatUser.Nickname)
}

// 辅助函数
func generateRandomString(length int) string {
	const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
	b := make([]byte, length)
	for i := range b {
		b[i] = charset[time.Now().UnixNano()%int64(len(charset))]
	}
	return string(b)
}

package main

import (
	"context"
	"encoding/json"
	"fmt"
	"net/http"

	"golang.org/x/oauth2"
	"golang.org/x/oauth2/google"
)

const (
	GoogleClientID     = "your_client_id.apps.googleusercontent.com"
	GoogleClientSecret = "your_client_secret"
	GoogleRedirectURL  = "http://localhost:8080/google/callback"
)

var googleOauthConfig = &oauth2.Config{
	ClientID:     GoogleClientID,
	ClientSecret: GoogleClientSecret,
	RedirectURL:  GoogleRedirectURL,
	Scopes: []string{
		"https://www.googleapis.com/auth/userinfo.email",
		"https://www.googleapis.com/auth/userinfo.profile",
	},
	Endpoint: google.Endpoint,
}

// 1. 跳转到Google授权页面
func HandleGoogleLogin(w http.ResponseWriter, r *http.Request) {
	// 生成state（防CSRF）
	state := generateRandomString(32)

	// 保存state到session（简化版）
	http.SetCookie(w, &http.Cookie{
		Name:     "oauth_state",
		Value:    state,
		MaxAge:   300,
		HttpOnly: true,
		Secure:   true,
	})

	// 生成授权URL
	url := googleOauthConfig.AuthCodeURL(state, oauth2.AccessTypeOffline)

	// 重定向到Google
	http.Redirect(w, r, url, http.StatusTemporaryRedirect)
}

// 2. Google回调处理
func HandleGoogleCallback(w http.ResponseWriter, r *http.Request) {
	// 验证state
	state := r.URL.Query().Get("state")
	cookie, err := r.Cookie("oauth_state")
	if err != nil || cookie.Value != state {
		http.Error(w, "Invalid state", http.StatusBadRequest)
		return
	}

	// 获取code
	code := r.URL.Query().Get("code")

	// 用code换取token
	token, err := googleOauthConfig.Exchange(context.Background(), code)
	if err != nil {
		http.Error(w, "Failed to exchange token", http.StatusInternalServerError)
		return
	}

	// 获取用户信息
	client := googleOauthConfig.Client(context.Background(), token)
	resp, err := client.Get("https://www.googleapis.com/oauth2/v2/userinfo")
	if err != nil {
		http.Error(w, "Failed to get user info", http.StatusInternalServerError)
		return
	}
	defer resp.Body.Close()

	var googleUser struct {
		ID            string `json:"id"`
		Email         string `json:"email"`
		VerifiedEmail bool   `json:"verified_email"`
		Name          string `json:"name"`
		GivenName     string `json:"given_name"`
		FamilyName    string `json:"family_name"`
		Picture       string `json:"picture"`
		Locale        string `json:"locale"`
	}
	json.NewDecoder(resp.Body).Decode(&googleUser)

	// 创建本地用户或登录
	// TODO: 保存用户信息到数据库
	// TODO: 创建本地session

	fmt.Fprintf(w, "登录成功！\n")
	fmt.Fprintf(w, "姓名: %s\n", googleUser.Name)
	fmt.Fprintf(w, "邮箱: %s\n", googleUser.Email)
	fmt.Fprintf(w, "头像: %s\n", googleUser.Picture)
}

func main() {
	http.HandleFunc("/google/login", HandleGoogleLogin)
	http.HandleFunc("/google/callback", HandleGoogleCallback)

	fmt.Println("服务器启动: http://localhost:8080")
	http.ListenAndServe(":8080", nil)
}

import (
	"context"
	"github.com/coreos/go-oidc/v3/oidc"
	"golang.org/x/oauth2"
	"golang.org/x/oauth2/google"
)

func HandleGoogleCallbackWithOIDC(w http.ResponseWriter, r *http.Request) {
	ctx := context.Background()

	// 配置OIDC Provider
	provider, err := oidc.NewProvider(ctx, "https://accounts.google.com")
	if err != nil {
		http.Error(w, "Failed to get provider", 500)
		return
	}

	// 配置OAuth2
	oauth2Config := oauth2.Config{
		ClientID:     GoogleClientID,
		ClientSecret: GoogleClientSecret,
		RedirectURL:  GoogleRedirectURL,
		Endpoint:     google.Endpoint,
		Scopes:       []string{oidc.ScopeOpenID, "profile", "email"},
	}

	// 交换code
	code := r.URL.Query().Get("code")
	oauth2Token, err := oauth2Config.Exchange(ctx, code)
	if err != nil {
		http.Error(w, "Failed to exchange token", 500)
		return
	}

	// 验证ID Token
	rawIDToken, ok := oauth2Token.Extra("id_token").(string)
	if !ok {
		http.Error(w, "No id_token", 500)
		return
	}

	verifier := provider.Verifier(&oidc.Config{ClientID: GoogleClientID})
	idToken, err := verifier.Verify(ctx, rawIDToken)
	if err != nil {
		http.Error(w, "Failed to verify ID Token", 500)
		return
	}

	// 解析Claims
	var claims struct {
		Email         string `json:"email"`
		EmailVerified bool   `json:"email_verified"`
		Name          string `json:"name"`
		Picture       string `json:"picture"`
	}
	idToken.Claims(&claims)

	fmt.Fprintf(w, "登录成功！\n")
	fmt.Fprintf(w, "姓名: %s\n", claims.Name)
	fmt.Fprintf(w, "邮箱: %s (%v)\n", claims.Email, claims.EmailVerified)
}

// 1. 验证ID Token（Google）
func VerifyGoogleIDToken(idToken string) (*GoogleUser, error) {
	ctx := context.Background()
	provider, _ := oidc.NewProvider(ctx, "https://accounts.google.com")
	verifier := provider.Verifier(&oidc.Config{
		ClientID: GoogleClientID,
	})

	token, err := verifier.Verify(ctx, idToken)
	if err != nil {
		return nil, err
	}

	var user GoogleUser
	token.Claims(&user)
	return &user, nil
}

// 2. 防止CSRF攻击
func generateState() string {
	b := make([]byte, 32)
	rand.Read(b)
	return base64.URLEncoding.EncodeToString(b)
}

// 3. 使用HTTPS
// 生产环境必须使用HTTPS，否则OAuth不安全

// 4. 安全存储token
// 不要在localStorage存储access_token
// 使用HttpOnly Cookie存储session