OneAuth/internal/api/oauth/oauth.go

package oauth

import (
	"crypto/rand"
	"crypto/sha256"
	"encoding/base64"
	"encoding/hex"
	"net/http"
	"net/url"
	"strings"
	"time"

	"github.com/veypi/vbase/internal/model"
	"github.com/veypi/vigo"
)

// AuthorizeRequest 授权请求
type AuthorizeRequest struct {
	ResponseType         string `json:"response_type" src:"query" desc:"响应类型: code/token"`
	ClientID             string `json:"client_id" src:"query" desc:"客户端ID"`
	RedirectURI          string `json:"redirect_uri" src:"query" desc:"回调地址"`
	Scope                string `json:"scope" src:"query" desc:"请求的权限范围"`
	State                string `json:"state" src:"query" desc:"状态值(防CSRF)"`
	CodeChallenge        string `json:"code_challenge" src:"query" desc:"PKCE挑战码"`
	CodeChallengeMethod  string `json:"code_challenge_method" src:"query" desc:"PKCE方法: S256/plain"`
}

// AuthorizeResponse 授权响应 (用于重定向)
type AuthorizeResponse struct {
	Code  string `json:"code"`
	State string `json:"state"`
}

// Authorize 授权端点 - 处理授权码请求
// GET /oauth/authorize
func Authorize(x *vigo.X, req *AuthorizeRequest) error {
	// 验证必填参数
	if req.ResponseType == "" {
		return oauthError(x, req.RedirectURI, "invalid_request", "response_type is required", req.State)
	}
	if req.ClientID == "" {
		return oauthError(x, req.RedirectURI, "invalid_request", "client_id is required", req.State)
	}

	// 查找客户端
	var client model.OAuthClient
	if err := model.DB.Where("client_id = ? AND status = ?", req.ClientID, 1).First(&client).Error; err != nil {
		return oauthError(x, req.RedirectURI, "invalid_client", "client not found", req.State)
	}

	// 验证response_type
	if !strings.Contains(client.ResponseTypes, req.ResponseType) {
		return oauthError(x, req.RedirectURI, "unsupported_response_type", "", req.State)
	}

	// 验证redirect_uri
	if req.RedirectURI != "" {
		allowedURIs := strings.Split(client.RedirectURIs, ",")
		found := false
		for _, uri := range allowedURIs {
			if strings.TrimSpace(uri) == req.RedirectURI {
				found = true
				break
			}
		}
		if !found {
			return oauthError(x, "", "invalid_request", "redirect_uri mismatch", "")
		}
	} else if client.RedirectURIs != "" {
		// 使用第一个注册的回调地址
		req.RedirectURI = strings.Split(client.RedirectURIs, ",")[0]
	} else {
		return oauthError(x, "", "invalid_request", "redirect_uri required", "")
	}

	// 验证scope
	requestedScopes := parseScopes(req.Scope)
	allowedScopes := parseScopes(client.AllowedScopes)
	for _, scope := range requestedScopes {
		if !contains(allowedScopes, scope) {
			return oauthError(x, req.RedirectURI, "invalid_scope", "scope not allowed: "+scope, req.State)
		}
	}

	// 获取当前用户
	var userID string
	if uid, ok := x.Get("current_user").(string); ok {
		userID = uid
	}
	if userID == "" {
		// 未登录，需要重定向到登录页面
		loginURL := "/login?redirect=" + url.QueryEscape(x.Request.URL.String())
		x.ResponseWriter().Header().Set("Location", loginURL)
		x.ResponseWriter().WriteHeader(http.StatusFound)
		return nil
	}

	// 获取组织ID (从请求头或用户选择)
	orgID := x.Request.Header.Get("X-Org-ID")
	if orgID == "" && client.OrgID != "" {
		orgID = client.OrgID
	}

	switch req.ResponseType {
	case model.ResponseTypeCode:
		// 生成授权码
		code, err := generateAuthorizationCode(&client, userID, orgID, req)
		if err != nil {
			return oauthError(x, req.RedirectURI, "server_error", "", req.State)
		}

		// 构建重定向URL
		redirectURL, _ := url.Parse(req.RedirectURI)
		q := redirectURL.Query()
		q.Set("code", code)
		if req.State != "" {
			q.Set("state", req.State)
		}
		redirectURL.RawQuery = q.Encode()

		x.ResponseWriter().Header().Set("Location", redirectURL.String())
		x.ResponseWriter().WriteHeader(http.StatusFound)
		return nil

	case model.ResponseTypeToken:
		// Implicit flow (简化模式) - 直接返回token
		// 注意: 简化模式安全性较低，建议仅在必要时使用
		return handleImplicitGrant(x, &client, userID, orgID, req)

	default:
		return oauthError(x, req.RedirectURI, "unsupported_response_type", "", req.State)
	}
}

// TokenRequest 令牌请求
type TokenRequest struct {
	GrantType    string `json:"grant_type" src:"form" desc:"授权类型"`
	Code         string `json:"code" src:"form" desc:"授权码"`
	RedirectURI  string `json:"redirect_uri" src:"form" desc:"回调地址"`
	ClientID     string `json:"client_id" src:"form" desc:"客户端ID"`
	ClientSecret string `json:"client_secret" src:"form" desc:"客户端密钥"`
	RefreshToken string `json:"refresh_token" src:"form" desc:"刷新令牌"`
	Scope        string `json:"scope" src:"form" desc:"权限范围"`
	CodeVerifier string `json:"code_verifier" src:"form" desc:"PKCE验证器"`
	Username     string `json:"username" src:"form" desc:"用户名(密码模式)"`
	Password     string `json:"password" src:"form" desc:"密码(密码模式)"`
}

// TokenResponse 令牌响应
type TokenResponse struct {
	AccessToken  string `json:"access_token"`
	TokenType    string `json:"token_type"`
	ExpiresIn    int    `json:"expires_in"`
	RefreshToken string `json:"refresh_token,omitempty"`
	Scope        string `json:"scope,omitempty"`
	IDToken      string `json:"id_token,omitempty"` // OIDC
}

// Token 令牌端点 - 交换授权码获取访问令牌
// POST /oauth/token
func Token(x *vigo.X, req *TokenRequest) (*TokenResponse, error) {
	// 验证客户端身份
	client, err := authenticateClient(x, req)
	if err != nil {
		return nil, vigo.ErrNotAuthorized.WithString("invalid_client")
	}

	// 验证grant_type
	if !strings.Contains(client.GrantTypes, req.GrantType) {
		return nil, vigo.ErrArgInvalid.WithString("unsupported_grant_type")
	}

	switch req.GrantType {
	case model.GrantTypeAuthorizationCode:
		return handleAuthorizationCodeGrant(x, client, req)
	case model.GrantTypeRefreshToken:
		return handleRefreshTokenGrant(x, client, req)
	case model.GrantTypeClientCredentials:
		return handleClientCredentialsGrant(x, client, req)
	case model.GrantTypePassword:
		return handlePasswordGrant(x, client, req)
	default:
		return nil, vigo.ErrArgInvalid.WithString("unsupported_grant_type")
	}
}

// handleAuthorizationCodeGrant 处理授权码模式
func handleAuthorizationCodeGrant(x *vigo.X, client *model.OAuthClient, req *TokenRequest) (*TokenResponse, error) {
	if req.Code == "" {
		return nil, vigo.ErrArgInvalid.WithString("code is required")
	}

	// 查找授权码
	var auth model.OAuthAuthorization
	if err := model.DB.Where("code = ? AND client_id = ? AND used = ?", req.Code, client.ClientID, false).First(&auth).Error; err != nil {
		return nil, vigo.ErrArgInvalid.WithString("invalid_grant")
	}

	// 检查是否过期
	if time.Now().After(auth.ExpiresAt) {
		return nil, vigo.ErrArgInvalid.WithString("invalid_grant: code expired")
	}

	// 验证redirect_uri
	if req.RedirectURI != "" && req.RedirectURI != auth.RedirectURI {
		return nil, vigo.ErrArgInvalid.WithString("invalid_grant: redirect_uri mismatch")
	}

	// PKCE验证
	if auth.CodeChallenge != "" {
		if req.CodeVerifier == "" {
			return nil, vigo.ErrArgInvalid.WithString("invalid_grant: code_verifier required")
		}
		if !verifyPKCE(req.CodeVerifier, auth.CodeChallenge, auth.CodeChallengeMethod) {
			return nil, vigo.ErrArgInvalid.WithString("invalid_grant: code_verifier mismatch")
		}
	}

	// 标记授权码为已使用
	now := time.Now()
	model.DB.Model(&auth).Updates(map[string]interface{}{
		"used":    true,
		"used_at": now,
	})

	// 生成访问令牌
	tokenResp, err := generateTokenPair(client, auth.UserID, auth.OrgID, auth.Scope, client.TokenExpiry, client.RefreshExpiry)
	if err != nil {
		return nil, vigo.ErrInternalServer.WithError(err)
	}

	return tokenResp, nil
}

// handleRefreshTokenGrant 处理刷新令牌模式
func handleRefreshTokenGrant(x *vigo.X, client *model.OAuthClient, req *TokenRequest) (*TokenResponse, error) {
	if req.RefreshToken == "" {
		return nil, vigo.ErrArgInvalid.WithString("refresh_token is required")
	}

	// 查找刷新令牌
	var token model.OAuthToken
	if err := model.DB.Where("refresh_token = ? AND client_id = ? AND revoked = ?", req.RefreshToken, client.ClientID, false).First(&token).Error; err != nil {
		return nil, vigo.ErrArgInvalid.WithString("invalid_grant")
	}

	// 检查是否过期
	if time.Now().After(token.ExpiresAt) {
		return nil, vigo.ErrArgInvalid.WithString("invalid_grant: token expired")
	}

	// 撤销旧的刷新令牌
	now := time.Now()
	model.DB.Model(&token).Updates(map[string]interface{}{
		"revoked":     true,
		"revoked_at":  now,
	})

	// 生成新的访问令牌
	tokenResp, err := generateTokenPair(client, token.UserID, token.OrgID, token.Scope, client.TokenExpiry, client.RefreshExpiry)
	if err != nil {
		return nil, vigo.ErrInternalServer.WithError(err)
	}

	return tokenResp, nil
}

// handleClientCredentialsGrant 处理客户端凭证模式
func handleClientCredentialsGrant(x *vigo.X, client *model.OAuthClient, req *TokenRequest) (*TokenResponse, error) {
	// 客户端凭证模式没有用户上下文，通常用于服务间调用
	// 限制scope，只允许非用户相关的权限

	requestedScopes := parseScopes(req.Scope)
	allowedScopes := []string{}
	for _, scope := range requestedScopes {
		if scope == "service" || strings.HasPrefix(scope, "service:") {
			allowedScopes = append(allowedScopes, scope)
		}
	}

	if len(allowedScopes) == 0 {
		allowedScopes = []string{"service"}
	}

	scopeStr := strings.Join(allowedScopes, " ")

	// 生成访问令牌
	accessToken := generateRandomToken(32)
	expiresAt := time.Now().Add(time.Duration(client.TokenExpiry) * time.Second)

	token := &model.OAuthToken{
		UserID:      "", // 客户端凭证模式没有用户
		ClientID:    client.ClientID,
		OrgID:       client.OrgID,
		AccessToken: accessToken,
		TokenType:   "Bearer",
		Scope:       scopeStr,
		ExpiresAt:   expiresAt,
	}

	if err := model.DB.Create(token).Error; err != nil {
		return nil, vigo.ErrInternalServer.WithError(err)
	}

	return &TokenResponse{
		AccessToken: accessToken,
		TokenType:   "Bearer",
		ExpiresIn:   client.TokenExpiry,
		Scope:       scopeStr,
	}, nil
}

// handlePasswordGrant 处理密码模式 (不推荐，但为兼容性保留)
func handlePasswordGrant(x *vigo.X, client *model.OAuthClient, req *TokenRequest) (*TokenResponse, error) {
	// 密码模式需要验证用户凭据
	// 这里简化处理，实际应该调用用户认证逻辑
	return nil, vigo.ErrArgInvalid.WithString("unsupported_grant_type: password grant is disabled")
}

// handleImplicitGrant 处理简化模式
func handleImplicitGrant(x *vigo.X, client *model.OAuthClient, userID, orgID string, req *AuthorizeRequest) error {
	// 生成访问令牌
	accessToken := generateRandomToken(32)
	expiresAt := time.Now().Add(time.Duration(client.TokenExpiry) * time.Second)

	token := &model.OAuthToken{
		UserID:      userID,
		ClientID:    client.ClientID,
		OrgID:       orgID,
		AccessToken: accessToken,
		TokenType:   "Bearer",
		Scope:       req.Scope,
		ExpiresAt:   expiresAt,
	}

	if err := model.DB.Create(token).Error; err != nil {
		return oauthError(x, req.RedirectURI, "server_error", "", req.State)
	}

	// 构建fragment URL
	fragment := url.Values{}
	fragment.Set("access_token", accessToken)
	fragment.Set("token_type", "Bearer")
	fragment.Set("expires_in", string(rune(client.TokenExpiry)))
	if req.Scope != "" {
		fragment.Set("scope", req.Scope)
	}
	if req.State != "" {
		fragment.Set("state", req.State)
	}

	redirectURL, _ := url.Parse(req.RedirectURI)
	redirectURL.Fragment = fragment.Encode()

	x.ResponseWriter().Header().Set("Location", redirectURL.String())
	x.ResponseWriter().WriteHeader(http.StatusFound)
	return nil
}

// RevokeRequest 撤销请求
type RevokeRequest struct {
	Token         string `json:"token" src:"form" desc:"要撤销的令牌"`
	TokenTypeHint string `json:"token_type_hint" src:"form" desc:"令牌类型提示: access_token/refresh_token"`
}

// Revoke 撤销令牌端点
// POST /oauth/revoke
func Revoke(x *vigo.X, req *RevokeRequest) error {
	if req.Token == "" {
		return nil // 根据RFC 7009，无效的令牌也应返回200
	}

	// 尝试查找access_token
	var token model.OAuthToken
	if err := model.DB.Where("access_token = ?", req.Token).First(&token).Error; err == nil {
		now := time.Now()
		model.DB.Model(&token).Updates(map[string]interface{}{
			"revoked":    true,
			"revoked_at": now,
		})
		return nil
	}

	// 尝试查找refresh_token
	if err := model.DB.Where("refresh_token = ?", req.Token).First(&token).Error; err == nil {
		now := time.Now()
		model.DB.Model(&token).Updates(map[string]interface{}{
			"revoked":    true,
			"revoked_at": now,
		})
	}

	return nil
}

// IntrospectRequest 令牌内省请求
type IntrospectRequest struct {
	Token         string `json:"token" src:"form" desc:"要内省的令牌"`
	TokenTypeHint string `json:"token_type_hint" src:"form" desc:"令牌类型提示"`
}

// IntrospectResponse 令牌内省响应
type IntrospectResponse struct {
	Active    bool   `json:"active"`
	Scope     string `json:"scope,omitempty"`
	ClientID  string `json:"client_id,omitempty"`
	Username  string `json:"username,omitempty"`
	TokenType string `json:"token_type,omitempty"`
	Exp       int64  `json:"exp,omitempty"`
	Iat       int64  `json:"iat,omitempty"`
	Sub       string `json:"sub,omitempty"`
	Aud       string `json:"aud,omitempty"`
	Iss       string `json:"iss,omitempty"`
	Jti       string `json:"jti,omitempty"`
}

// Introspect 令牌内省端点 (RFC 7662)
// POST /oauth/introspect
func Introspect(x *vigo.X, req *IntrospectRequest) (*IntrospectResponse, error) {
	if req.Token == "" {
		return &IntrospectResponse{Active: false}, nil
	}

	var token model.OAuthToken
	if err := model.DB.Where("access_token = ? AND revoked = ?", req.Token, false).First(&token).Error; err != nil {
		return &IntrospectResponse{Active: false}, nil
	}

	// 检查是否过期
	if time.Now().After(token.ExpiresAt) {
		return &IntrospectResponse{Active: false}, nil
	}

	// 获取用户信息
	var user model.User
	username := ""
	if err := model.DB.First(&user, "id = ?", token.UserID).Error; err == nil {
		username = user.Username
	}

	return &IntrospectResponse{
		Active:    true,
		Scope:     token.Scope,
		ClientID:  token.ClientID,
		Username:  username,
		TokenType: token.TokenType,
		Exp:       token.ExpiresAt.Unix(),
		Sub:       token.UserID,
	}, nil
}

// helper functions

func generateAuthorizationCode(client *model.OAuthClient, userID, orgID string, req *AuthorizeRequest) (string, error) {
	code := generateRandomToken(32)
	expiresAt := time.Now().Add(10 * time.Minute) // 授权码10分钟有效

	auth := &model.OAuthAuthorization{
		UserID:              userID,
		ClientID:            client.ClientID,
		OrgID:               orgID,
		Code:                code,
		Scope:               req.Scope,
		State:               req.State,
		CodeChallenge:       req.CodeChallenge,
		CodeChallengeMethod: req.CodeChallengeMethod,
		RedirectURI:         req.RedirectURI,
		ExpiresAt:           expiresAt,
	}

	if err := model.DB.Create(auth).Error; err != nil {
		return "", err
	}

	return code, nil
}

func generateTokenPair(client *model.OAuthClient, userID, orgID, scope string, accessExpiry, refreshExpiry int) (*TokenResponse, error) {
	accessToken := generateRandomToken(32)
	refreshToken := generateRandomToken(32)
	expiresAt := time.Now().Add(time.Duration(accessExpiry) * time.Second)

	token := &model.OAuthToken{
		UserID:       userID,
		ClientID:     client.ClientID,
		OrgID:        orgID,
		AccessToken:  accessToken,
		RefreshToken: refreshToken,
		TokenType:    "Bearer",
		Scope:        scope,
		ExpiresAt:    expiresAt,
	}

	if err := model.DB.Create(token).Error; err != nil {
		return nil, err
	}

	return &TokenResponse{
		AccessToken:  accessToken,
		TokenType:    "Bearer",
		ExpiresIn:    accessExpiry,
		RefreshToken: refreshToken,
		Scope:        scope,
	}, nil
}

func generateRandomToken(length int) string {
	b := make([]byte, length)
	rand.Read(b)
	return hex.EncodeToString(b)
}

func authenticateClient(x *vigo.X, req *TokenRequest) (*model.OAuthClient, error) {
	// 优先从Basic Auth获取
	clientID, clientSecret, ok := x.Request.BasicAuth()
	if ok {
		req.ClientID = clientID
		req.ClientSecret = clientSecret
	}

	if req.ClientID == "" || req.ClientSecret == "" {
		return nil, vigo.ErrNotAuthorized
	}

	var client model.OAuthClient
	if err := model.DB.Where("client_id = ? AND client_secret = ? AND status = ?", req.ClientID, req.ClientSecret, 1).First(&client).Error; err != nil {
		return nil, err
	}

	return &client, nil
}

func verifyPKCE(verifier, challenge, method string) bool {
	switch method {
	case "S256":
		hash := sha256.Sum256([]byte(verifier))
		encoded := base64.RawURLEncoding.EncodeToString(hash[:])
		return encoded == challenge
	case "plain":
		return verifier == challenge
	default:
		return false
	}
}

func parseScopes(scope string) []string {
	if scope == "" {
		return []string{}
	}
	return strings.Split(scope, " ")
}

func contains(arr []string, item string) bool {
	for _, a := range arr {
		if a == item {
			return true
		}
	}
	return false
}

func oauthError(x *vigo.X, redirectURI, errorCode, errorDescription, state string) error {
	if redirectURI == "" {
		return vigo.ErrArgInvalid.WithString(errorCode + ": " + errorDescription)
	}

	u, err := url.Parse(redirectURI)
	if err != nil {
		return vigo.ErrArgInvalid.WithString(errorCode + ": " + errorDescription)
	}

	q := u.Query()
	q.Set("error", errorCode)
	if errorDescription != "" {
		q.Set("error_description", errorDescription)
	}
	if state != "" {
		q.Set("state", state)
	}
	u.RawQuery = q.Encode()

	x.ResponseWriter().Header().Set("Location", u.String())
	x.ResponseWriter().WriteHeader(http.StatusFound)
	return nil
}