package main
import (
	"crypto/sha1"
	"encoding/hex"
	"net/http"
	"sort"
	"github.com/gin-gonic/gin"
)
type ByAlphabet []string
func (a ByAlphabet) Len() int {
	return len(a)
}
func (a ByAlphabet) Swap(i, j int) {
	a[i], a[j] = a[j], a[i]
}
func (a ByAlphabet) Less(i, j int) bool {
	return a[i] < a[j]
}
func SHA1(s string) string {
	hash := sha1.New()
	hash.Write([]byte(s))
	return hex.EncodeToString(hash.Sum(nil))
}
func main() {
	engine := gin.Default()
	engine.GET("/", func(ctx *gin.Context) {
		signature := ctx.Query("signature")
		timestamp := ctx.Query("timestamp")
		nonce := ctx.Query("nonce")
		echostr := ctx.Query("echostr")
		token := "lucas"
		tmpSlice := []string{nonce, timestamp, token}
		// 1.按字典序排序
		sort.Sort(ByAlphabet(tmpSlice))
		// 2.三個字段拼接為str
		str := tmpSlice[0] + tmpSlice[1] + tmpSlice[2]
		// 3. 計(jì)算str的sha1加密的字符串
		sha1Str := SHA1(str)
		// 4.比較sha1Str和signature，相同則返回echostr
		if sha1Str == signature {
			ctx.String(http.StatusOK, echostr)
			return
		} else {
			ctx.String(http.StatusOK, "")
			return
		}
	})
	engine.Run(":80")
}

spring:
  security:
    oauth2:
      client:
        registration:
          github:
            clientId: xxxx # 填入自己應(yīng)用的clientId
            clientSecret: xxxxx # 填入自己應(yīng)用的clientSecret
            redirectUri: http://localhost:8844/login/oauth2/code/github
          gitee:
            clientId: xxxx # 填入自己應(yīng)用的clientId
            clientSecret: xxxx # 填入自己應(yīng)用的clientSecret
            redirectUri: http://localhost:8844/login/oauth2/code/gitee
            authorizationGrantType: authorization_code
          wechat:
            clientId: xxxx # 填入自己應(yīng)用的appID
            clientSecret: xxxx # 填入自己應(yīng)用的appsecret
            redirectUri: http://347b2d93.r8.cpolar.top/login/oauth2/code/wechat
            authorizationGrantType: authorization_code
            scope:
            - snsapi_userinfo
            clientName: tencent-wechat
        provider:
          gitee:
            authorizationUri: https://gitee.com/oauth/authorize
            tokenUri: https://gitee.com/oauth/token
            userInfoUri: https://gitee.com/api/v5/user
            userNameAttribute: name
          wechat:
            authorizationUri: https://open.weixin.qq.com/connect/oauth2/authorize
            tokenUri: https://api.weixin.qq.com/sns/oauth2/access_token
            userInfoUri: https://api.weixin.qq.com/sns/userinfo
            userNameAttribute: nickname

private final static String WECHAT_APPID = "appid";
private final static String WECHAT_SECRET = "secret";
private final static String WECHAT_FRAGMENT = "wechat_redirect";
/**
 * 1. 自定義微信獲取授權(quán)碼的uri
 * https://open.weixin.qq.com/connect/oauth2/authorize?
 * appid=wx807d86fb6b3d4fd2
 * &redirect_uri=http%3A%2F%2Fdevelopers.weixin.qq.com
 * &response_type=code
 * &scope=snsapi_userinfo
 * &state=STATE  非必須
 * #wechat_redirect
 * 微信比較特殊，比如不是clientid，而是appid，還強(qiáng)制需要一個錨點(diǎn)#wechat+redirect
 * @return
 */
public OAuth2AuthorizationRequestResolver customOAuth2AuthorizationRequestResolver(ClientRegistrationRepository clientRegistrationRepository) {
    // 定義一個默認(rèn)的oauth2請求解析器
    DefaultOAuth2AuthorizationRequestResolver oAuth2AuthorizationRequestResolver = new DefaultOAuth2AuthorizationRequestResolver(clientRegistrationRepository, OAuth2AuthorizationRequestRedirectFilter.DEFAULT_AUTHORIZATION_REQUEST_BASE_URI);
    // 進(jìn)行自定義
    Consumer<OAuth2AuthorizationRequest.Builder> authorizationRequestCustomizer = (builder) -> {
        builder.attributes(attributeConsumer -> {
            // 判斷registrationId是否為wechat
            String registrationId = (String) attributeConsumer.get(OAuth2ParameterNames.REGISTRATION_ID);
            if ("wechat".equals(registrationId)) {
                // 替換參數(shù)名稱
                builder.parameters(this::replaceWechatUriParamter);
                // 增加錨點(diǎn)，需要在uri構(gòu)建中添加
                builder.authorizationRequestUri((uriBuilder) -> {
                    uriBuilder.fragment(WECHAT_FRAGMENT);
                    return uriBuilder.build();
                });
            }
        });
    };
    // 設(shè)置authorizationRequestCustomizer
    oAuth2AuthorizationRequestResolver.setAuthorizationRequestCustomizer(authorizationRequestCustomizer);
    return oAuth2AuthorizationRequestResolver;
}
/**
 * 替換Uri參數(shù)，parameterMap是保存的請求的各個參數(shù)
 * @param parameterMap
 */
private void replaceWechatUriParamter(Map<String, Object> parameterMap) {
    Map<String, Object> linkedHashMap = new LinkedHashMap<>();
    // 遍歷所有參數(shù)，有序的,替換掉clientId為appid
    parameterMap.forEach((k, v) -> {
        if (OAuth2ParameterNames.CLIENT_ID.equals(k)) {
            linkedHashMap.put(WECHAT_APPID, v);
        } else {
            linkedHashMap.put(k, v);
        }
    });
    // 清空原始的paramterMap
    parameterMap.clear();
    // 將新的linkedHashMap存入paramterMap
    parameterMap.putAll(linkedHashMap);
}

private final static String WECHAT_APPID = "appid";
private final static String WECHAT_SECRET = "secret";
private final static String WECHAT_FRAGMENT = "wechat_redirect";
/**
    * 2. 自定義請求access_token時的請求體轉(zhuǎn)換器
    * 獲取access_token
    * https://api.weixin.qq.com/sns/oauth2/access_token?
    * appid=APPID
    * &secret=SECRET
    * &code=CODE 從上一個請求響應(yīng)中獲取
    * &grant_type=authorization_code  框架幫忙填寫了
    */
public OAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> customOAuth2AccessTokenResponseClient() {
    // 定義默認(rèn)的Token響應(yīng)客戶端
    DefaultAuthorizationCodeTokenResponseClient oAuth2AccessTokenResponseClient = new DefaultAuthorizationCodeTokenResponseClient();
    // 定義默認(rèn)的轉(zhuǎn)換器
    OAuth2AuthorizationCodeGrantRequestEntityConverter oAuth2AuthorizationCodeGrantRequestEntityConverter = new OAuth2AuthorizationCodeGrantRequestEntityConverter();
    // 自定義參數(shù)轉(zhuǎn)換器
    Converter<OAuth2AuthorizationCodeGrantRequest, MultiValueMap<String, String>> customParameterConverter = (authorizationCodeGrantRequest) -> {
        ClientRegistration clientRegistration = authorizationCodeGrantRequest.getClientRegistration();
        OAuth2AuthorizationExchange authorizationExchange = authorizationCodeGrantRequest.getAuthorizationExchange();
        MultiValueMap<String, String> parameters = new LinkedMultiValueMap();
        parameters.add("grant_type", authorizationCodeGrantRequest.getGrantType().getValue());
        parameters.add("code", authorizationExchange.getAuthorizationResponse().getCode());
        String redirectUri = authorizationExchange.getAuthorizationRequest().getRedirectUri();
        String codeVerifier = (String)authorizationExchange.getAuthorizationRequest().getAttribute("code_verifier");
        if (redirectUri != null) {
            parameters.add("redirect_uri", redirectUri);
        }
        parameters.add(WECHAT_APPID, clientRegistration.getClientId());
        parameters.add(WECHAT_SECRET, clientRegistration.getClientSecret());
        if (codeVerifier != null) {
            parameters.add("code_verifier", codeVerifier);
        }
        return parameters;
    };
    // 設(shè)置自定義參數(shù)轉(zhuǎn)換器
    oAuth2AuthorizationCodeGrantRequestEntityConverter.setParametersConverter(customParameterConverter);
    // 自定義RestTemplate處理響應(yīng)content-type為“text/plain”
    OAuth2AccessTokenResponseHttpMessageConverter oAuth2AccessTokenResponseHttpMessageConverter = new OAuth2AccessTokenResponseHttpMessageConverter();
    oAuth2AccessTokenResponseHttpMessageConverter.setSupportedMediaTypes(Arrays.asList(MediaType.TEXT_PLAIN, MediaType.APPLICATION_JSON));
    // 處理TOKEN_TYPE為null的問題，自定義accessTokenResponseParametersConverter，給TOKEN_TYPE賦值
    // 因?yàn)橐呀?jīng)有默認(rèn)的處理了，只是需要給token_type賦值
    Converter<Map<String, Object>, OAuth2AccessTokenResponse> setAccessTokenResponseConverter = (paramMap) -> {
        DefaultMapOAuth2AccessTokenResponseConverter defaultMapOAuth2AccessTokenResponseConverter = new DefaultMapOAuth2AccessTokenResponseConverter();
        paramMap.put(OAuth2ParameterNames.TOKEN_TYPE, OAuth2AccessToken.TokenType.BEARER.getValue());
        return defaultMapOAuth2AccessTokenResponseConverter.convert(paramMap);
    };
    // 設(shè)置這個轉(zhuǎn)換器
    oAuth2AccessTokenResponseHttpMessageConverter.setAccessTokenResponseConverter(setAccessTokenResponseConverter);
    RestTemplate restTemplate = new RestTemplate(Arrays.asList(new FormHttpMessageConverter(), oAuth2AccessTokenResponseHttpMessageConverter));
    restTemplate.setErrorHandler(new OAuth2ErrorResponseErrorHandler());
    // 設(shè)置自定義轉(zhuǎn)換器
    oAuth2AccessTokenResponseClient.setRequestEntityConverter(oAuth2AuthorizationCodeGrantRequestEntityConverter);
    // 設(shè)置自定義RestTemplate
    oAuth2AccessTokenResponseClient.setRestOperations(restTemplate);
    return oAuth2AccessTokenResponseClient;
}

OAuth2AccessTokenResponseHttpMessageConverter oAuth2AccessTokenResponseHttpMessageConverter = new OAuth2AccessTokenResponseHttpMessageConverter();
oAuth2AccessTokenResponseHttpMessageConverter.setSupportedMediaTypes(Arrays.asList(MediaType.TEXT_PLAIN, MediaType.APPLICATION_JSON));

// 處理TOKEN_TYPE為null的問題，自定義accessTokenResponseParametersConverter，給TOKEN_TYPE賦值
// 因?yàn)橐呀?jīng)有默認(rèn)的處理了，只是需要給token_type賦值
Converter<Map<String, Object>, OAuth2AccessTokenResponse> setAccessTokenResponseConverter = (paramMap) -> {
    DefaultMapOAuth2AccessTokenResponseConverter defaultMapOAuth2AccessTokenResponseConverter = new DefaultMapOAuth2AccessTokenResponseConverter();
    paramMap.put(OAuth2ParameterNames.TOKEN_TYPE, OAuth2AccessToken.TokenType.BEARER.getValue());
    return defaultMapOAuth2AccessTokenResponseConverter.convert(paramMap);
};

@Data
public class WeChatEntity implements OAuth2User {
    // 用戶的唯一標(biāo)識
    private String openid;
    // 用戶昵稱
    private String nickname;
    // 用戶的性別，值為1表示男，值為2表示女，值為0表示未知
    private Integer sex;
    // 用戶個人資料填寫的省份
    private String province;
    // 普通用戶個人資料填寫的城市
    private String city;
    // 國家，如中國為CN
    private String country;
    // 用戶頭像,最后一個數(shù)值代表正方形頭像大小（有0、46、64、96、132數(shù)值可選，0代表640*640正方形頭像），
    // 用戶沒有頭像時該項(xiàng)為空。若用戶更換頭像，原有頭像URL將失效。
    private String headimgurl;
    // 用戶特權(quán)信息
    private List<String> privilege;
    // 只有在用戶將公眾號綁定到微信開放平臺帳號后，才會出現(xiàn)該字段。
    private String unionid;
    @Override
    public Map<String, Object> getAttributes() {
        return null;
    }
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return null;
    }
    /**
        不可以返回null，在構(gòu)建實(shí)體時會有斷言
    **/
    @Override
    public String getName() {
        return nickname;
    }
}

private ResponseEntity<WeChatEntity> getResponse(OAuth2UserRequest userRequest) {
    OAuth2Error oauth2Error;
    try {
        // 發(fā)起Get請求，請求參數(shù)是query參數(shù)，需要自己拼接
        MultiValueMap<String, String> queryParams = new LinkedMultiValueMap<>();
        queryParams.add("access_token", userRequest.getAccessToken().getTokenValue());
        // 獲取access token時，其他參數(shù)被存儲在了userRequest中，從里面把openid拿出來
        queryParams.add("openid", (String) userRequest.getAdditionalParameters().get("openid"));
        queryParams.add("lang", "zh_CN");
        URI uri = UriComponentsBuilder.fromUriString(userRequest.getClientRegistration().getProviderDetails().getUserInfoEndpoint().getUri()).queryParams(queryParams).build().toUri();
        ResponseEntity<WeChatEntity> retData = this.restOperations.exchange(uri, HttpMethod.GET, null, PARAMETERIZED_RESPONSE_TYPE);
        return retData;
    } catch (OAuth2AuthorizationException var6) {
        oauth2Error = var6.getError();
        StringBuilder errorDetails = new StringBuilder();
        errorDetails.append("Error details: [");
        errorDetails.append("UserInfo Uri: ").append(userRequest.getClientRegistration().getProviderDetails().getUserInfoEndpoint().getUri());
        errorDetails.append(", Error Code: ").append(oauth2Error.getErrorCode());
        if (oauth2Error.getDescription() != null) {
            errorDetails.append(", Error Description: ").append(oauth2Error.getDescription());
        }
        errorDetails.append("]");
        oauth2Error = new OAuth2Error("invalid_user_info_response", "An error occurred while attempting to retrieve the UserInfo Resource: " + errorDetails.toString(), (String)null);
        throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString(), var6);
    } catch (UnknownContentTypeException var7) {
        String errorMessage = "An error occurred while attempting to retrieve the UserInfo Resource from '" + userRequest.getClientRegistration().getProviderDetails().getUserInfoEndpoint().getUri() + "': response contains invalid content type '" + var7.getContentType().toString() + "'. The UserInfo Response should return a JSON object (content type 'application/json') that contains a collection of name and value pairs of the claims about the authenticated End-User. Please ensure the UserInfo Uri in UserInfoEndpoint for Client Registration '" + userRequest.getClientRegistration().getRegistrationId() + "' conforms to the UserInfo Endpoint, as defined in OpenID Connect 1.0: 'https://openid.net/specs/openid-connect-core-1_0.html#UserInfo'";
        oauth2Error = new OAuth2Error("invalid_user_info_response", errorMessage, (String)null);
        throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString(), var7);
    } catch (RestClientException var8) {
        oauth2Error = new OAuth2Error("invalid_user_info_response", "An error occurred while attempting to retrieve the UserInfo Resource: " + var8.getMessage(), (String)null);
        throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString(), var8);
    }
}

@Override
public OAuth2User loadUser(OAuth2UserRequest userRequest) throws OAuth2AuthenticationException {
    Assert.notNull(userRequest, "userRequest cannot be null");
    if (!StringUtils.hasText(userRequest.getClientRegistration().getProviderDetails().getUserInfoEndpoint().getUri())) {
        OAuth2Error oauth2Error = new OAuth2Error("missing_user_info_uri", "Missing required UserInfo Uri in UserInfoEndpoint for Client Registration: " + userRequest.getClientRegistration().getRegistrationId(), (String)null);
        throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
    } else {
        String userNameAttributeName = userRequest.getClientRegistration().getProviderDetails().getUserInfoEndpoint().getUserNameAttributeName();
        if (!StringUtils.hasText(userNameAttributeName)) {
            OAuth2Error oauth2Error = new OAuth2Error("missing_user_name_attribute", "Missing required \"user name\" attribute name in UserInfoEndpoint for Client Registration: " + userRequest.getClientRegistration().getRegistrationId(), (String)null);
            throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
        } else {
            ResponseEntity<WeChatEntity> response = this.getResponse(userRequest);
            // 直接返回最終的實(shí)體
            WeChatEntity userAttributes = (WeChatEntity)response.getBody();
            return userAttributes;
        }
    }
}

public class WeChatUserHttpMessageConverter extends AbstractHttpMessageConverter<WeChatEntity> {
    private static final ParameterizedTypeReference<WeChatEntity> STRING_OBJECT_MAP;
    private static final Charset DEFAULT_CHARSET;
    private GenericHttpMessageConverter<Object> jsonMessageConverter = HttpMessageConverters.getJsonMessageConverter();
    static {
        DEFAULT_CHARSET = StandardCharsets.UTF_8;
        STRING_OBJECT_MAP = new ParameterizedTypeReference<WeChatEntity>() {
        };
    }
    public WeChatUserHttpMessageConverter() {
        super(DEFAULT_CHARSET, MediaType.TEXT_PLAIN, MediaType.APPLICATION_JSON, new MediaType("application", "*+json"));
    }
    @Override
    protected boolean supports(Class<?> clazz) {
        return  WeChatEntity.class.isAssignableFrom(clazz);
    }
    @Override
    protected WeChatEntity readInternal(Class<? extends WeChatEntity> clazz, HttpInputMessage inputMessage) throws IOException, HttpMessageNotReadableException {
        try {
            WeChatEntity weChatEntity = (WeChatEntity)this.jsonMessageConverter.read(STRING_OBJECT_MAP.getType(), (Class)null, inputMessage);
            return weChatEntity;
        } catch (Exception var5) {
            throw new HttpMessageNotReadableException("An error occurred reading the OAuth 2.0 Access Token Response: " + var5.getMessage(), var5, inputMessage);
        }
    }
    @Override
    protected void writeInternal(WeChatEntity weChatEntity, HttpOutputMessage outputMessage) throws IOException, HttpMessageNotWritableException {
    }
}

@Bean
public SecurityFilterChain filterChain(HttpSecurity http,  ClientRegistrationRepository clientRegistrationRepository) throws Exception {
    http
            .authorizeHttpRequests()
            .anyRequest()
            .authenticated().and()
            .oauth2Login(oauth2LoginCustomizer -> {
                // 授權(quán)端點(diǎn)配置
                oauth2LoginCustomizer.authorizationEndpoint().authorizationRequestResolver(customOAuth2AuthorizationRequestResolver(clientRegistrationRepository));
                // 獲取token端點(diǎn)配置
                oauth2LoginCustomizer.tokenEndpoint().accessTokenResponseClient(customOAuth2AccessTokenResponseClient());
                // 獲取用戶信息端點(diǎn)配置
                oauth2LoginCustomizer.userInfoEndpoint().userService(new WeChatUserService());
            });
    return http.build();
}