kate522/wordpress-theme-aksrt
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(oauth): add the seven missing providers and open the full aggregate list

Browse Source 
The theme shipped six direct providers while the reference carries fourteen,
and its aggregate-login channel offered three of sixteen platforms.

OAuthProviderClient now owns the providers the bundled SDK does not cover.
Douyin, Microsoft, Facebook, Twitter and Apple talk to their documented OAuth2
endpoints directly; Baidu and Alipay reuse yurunsoft, which already ships both
(Alipay needs its application private key, so provider_config learned an
extra_keys map to surface it). The broker dispatches through handles(), so the
existing start/callback routes stay provider-agnostic.

Three provider quirks needed handling rather than a plain copy:

Apple returns the callback as response_mode=form_post, and handle_callback
only read $_GET, so it now reads $_POST when the request is a POST — otherwise
every Apple login would fail with code_missing. Its client secret is built as
an ES256 JWT from Team ID / Key ID / .p8 rather than a static string.

Twitter requires PKCE. The verifier is derived from the state token, so it
travels with the existing transaction row and needs no extra storage.

Facebook hands back protocol-less avatar URLs, which are upgraded to https the
same way the OAuth avatar resolver does.

Settings gained matching toggles and credential groups on both sides — the PHP
schema and the Vue schema — and the aggregate platform list went from three to
sixteen, with CLoginClient's hard-coded allowlist replaced by the catalog
constant. Brand icons were extended so each new provider resolves to its
sprite; facebook and twitter moved to their colour sprites, and the
`twitter -> x` alias was dropped since it bypassed the new mapping.

The oauth-security contract previously asserted that Baidu and Alipay must not
appear on the OAuth surface. That was the old intent, so the assertion is
replaced with a positive one, keeping the separate check that the Alipay
payment gateway still exists.

Verification: a new harness stubs the HTTP layer and drives all five custom
clients — authorization URLs carry redirect/state (Twitter also a PKCE
challenge), identities normalize to the shared shape, Facebook's avatar is
upgraded to https, Apple's private-relay email survives, and an error payload
throws instead of yielding an empty identity. 871 widget/navigation tests pass
and the PSR-4 audit reports 0 errors.

Not covered: no live handshake happened — every provider needs real AppID and
secret pairs, and Apple/Douyin require developer-account review before the
full round trip can be exercised.
This commit is contained in:
kate522 committed 2026-11-04 18:00:29 +08:00
1 parent 6f29e3d865
commit 6db34646ed
11 files changed
+939 -28
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/Admin/Schema/SchemaUsers.php
+66
View File
@@ -327,6 +327,13 @@ class SchemaUsers {
['label' => 'Google', 'value' => 'google'],
['label' => '微博', 'value' => 'weibo'],
['label' => '微信', 'value' => 'weixin'],
['label' => '抖音', 'value' => 'douyin'],
['label' => '百度', 'value' => 'baidu'],
['label' => '支付宝', 'value' => 'alipay'],
['label' => 'Microsoft', 'value' => 'microsoft'],
['label' => 'Facebook', 'value' => 'facebook'],
['label' => 'Twitter', 'value' => 'twitter'],
['label' => 'Apple', 'value' => 'apple'],
], 'dependsOn' => ['key' => 'oauth_proxy_mode', 'value' => 'server']],
['key' => 'oauth_proxy_client_providers', 'label' => '客户端启用平台', 'type' => 'checkbox', 'default' => ['github', 'gitee', 'qq', 'google'], 'options' => [
['label' => 'GitHub', 'value' => 'github'],
@@ -335,6 +342,13 @@ class SchemaUsers {
['label' => 'Google', 'value' => 'google'],
['label' => '微博', 'value' => 'weibo'],
['label' => '微信', 'value' => 'weixin'],
['label' => '抖音', 'value' => 'douyin'],
['label' => '百度', 'value' => 'baidu'],
['label' => '支付宝', 'value' => 'alipay'],
['label' => 'Microsoft', 'value' => 'microsoft'],
['label' => 'Facebook', 'value' => 'facebook'],
['label' => 'Twitter', 'value' => 'twitter'],
['label' => 'Apple', 'value' => 'apple'],
], 'dependsOn' => ['key' => 'oauth_proxy_mode', 'value' => 'client']],
['key' => 'oauth_bind_type', 'label' => '绑定方式', 'type' => 'radio', 'default' => 'auto', 'options' => [
['label' => '自动绑定', 'value' => 'auto'],
@@ -351,6 +365,13 @@ class SchemaUsers {
['key' => 'oauth_weibo_s', 'label' => '微博登录', 'type' => 'switch', 'default' => false],
['key' => 'oauth_weixin_s', 'label' => '微信开放平台登录', 'type' => 'switch', 'default' => false],
['key' => 'oauth_weixingzh_s', 'label' => '微信公众号登录', 'type' => 'switch', 'default' => false],
['key' => 'oauth_douyin_s', 'label' => '抖音登录', 'type' => 'switch', 'default' => false],
['key' => 'oauth_baidu_s', 'label' => '百度登录', 'type' => 'switch', 'default' => false],
['key' => 'oauth_alipay_s', 'label' => '支付宝登录', 'type' => 'switch', 'default' => false],
['key' => 'oauth_microsoft_s', 'label' => 'Microsoft 登录', 'type' => 'switch', 'default' => false],
['key' => 'oauth_facebook_s', 'label' => 'Facebook 登录', 'type' => 'switch', 'default' => false],
['key' => 'oauth_twitter_s', 'label' => 'Twitter 登录', 'type' => 'switch', 'default' => false],
['key' => 'oauth_apple_s', 'label' => 'Apple 登录', 'type' => 'switch', 'default' => false],
['key' => 'clogin_s', 'label' => '彩虹聚合登录', 'type' => 'switch', 'default' => false, 'help' => '通过第三方聚合登录平台统一接入 QQ、微信和微博'],
]],
['key' => 'github', 'title' => 'GitHub配置', 'collapsible' => true, 'defaultCollapsed' => true, 'fields' => [
@@ -377,6 +398,38 @@ class SchemaUsers {
['key' => 'weixin_appid', 'label' => 'AppID', 'type' => 'input', 'default' => ''],
['key' => 'weixin_appsecret', 'label' => 'AppSecret', 'type' => 'input', 'inputType' => 'password', 'secret' => true, 'default' => ''],
]],
['key' => 'douyin', 'title' => '抖音配置', 'collapsible' => true, 'defaultCollapsed' => true, 'fields' => [
['key' => 'douyin_appid', 'label' => 'Client Key', 'type' => 'input', 'default' => ''],
['key' => 'douyin_appkey', 'label' => 'Client Secret', 'type' => 'input', 'inputType' => 'password', 'secret' => true, 'default' => ''],
]],
['key' => 'baidu', 'title' => '百度配置', 'collapsible' => true, 'defaultCollapsed' => true, 'fields' => [
['key' => 'baidu_appid', 'label' => 'API Key', 'type' => 'input', 'default' => ''],
['key' => 'baidu_appkey', 'label' => 'Secret Key', 'type' => 'input', 'inputType' => 'password', 'secret' => true, 'default' => ''],
]],
['key' => 'alipay', 'title' => '支付宝配置', 'collapsible' => true, 'defaultCollapsed' => true, 'fields' => [
['key' => 'alipay_appid', 'label' => 'App ID', 'type' => 'input', 'default' => ''],
['key' => 'alipay_appkey', 'label' => '支付宝公钥', 'type' => 'textarea', 'default' => ''],
['key' => 'alipay_private_key', 'label' => '应用私钥', 'type' => 'textarea', 'secret' => true, 'default' => '', 'help' => 'RSA2 签名使用的应用私钥（PKCS8 格式）'],
]],
['key' => 'microsoft', 'title' => 'Microsoft 配置', 'collapsible' => true, 'defaultCollapsed' => true, 'fields' => [
['key' => 'microsoft_appid', 'label' => 'Application (client) ID', 'type' => 'input', 'default' => ''],
['key' => 'microsoft_appkey', 'label' => 'Client Secret', 'type' => 'input', 'inputType' => 'password', 'secret' => true, 'default' => ''],
]],
['key' => 'facebook', 'title' => 'Facebook 配置', 'collapsible' => true, 'defaultCollapsed' => true, 'fields' => [
['key' => 'facebook_appid', 'label' => 'App ID', 'type' => 'input', 'default' => ''],
['key' => 'facebook_appkey', 'label' => 'App Secret', 'type' => 'input', 'inputType' => 'password', 'secret' => true, 'default' => ''],
]],
['key' => 'twitter', 'title' => 'Twitter 配置', 'collapsible' => true, 'defaultCollapsed' => true, 'fields' => [
['key' => 'twitter_appid', 'label' => 'Client ID', 'type' => 'input', 'default' => ''],
['key' => 'twitter_appkey', 'label' => 'Client Secret', 'type' => 'input', 'inputType' => 'password', 'secret' => true, 'default' => ''],
]],
['key' => 'apple', 'title' => 'Apple 配置', 'collapsible' => true, 'defaultCollapsed' => true, 'fields' => [
['key' => 'apple_appid', 'label' => 'Service ID', 'type' => 'input', 'default' => ''],
['key' => 'apple_appkey', 'label' => '备用 Secret', 'type' => 'input', 'inputType' => 'password', 'secret' => true, 'default' => ''],
['key' => 'apple_team_id', 'label' => 'Team ID', 'type' => 'input', 'default' => ''],
['key' => 'apple_key_id', 'label' => 'Key ID', 'type' => 'input', 'default' => ''],
['key' => 'apple_private_key', 'label' => '私钥（.p8）', 'type' => 'textarea', 'secret' => true, 'default' => '', 'help' => '用于生成 client_secret 的 ES256 私钥'],
]],
['key' => 'weixingzh', 'title' => '微信公众号配置', 'collapsible' => true, 'defaultCollapsed' => true, 'fields' => [
['key' => 'weixingzh_gzh_type', 'label' => '公众号类型', 'type' => 'radio', 'default' => 'service', 'options' => [
['label' => '服务号', 'value' => 'service'],
@@ -398,7 +451,20 @@ class SchemaUsers {
['key' => 'clogin_oauth_s', 'label' => '启用平台', 'type' => 'checkbox', 'default' => ['qq', 'weixin', 'weibo'], 'options' => [
['label' => 'QQ', 'value' => 'qq'],
['label' => '微信', 'value' => 'weixin'],
['label' => '支付宝', 'value' => 'alipay'],
['label' => '微博', 'value' => 'weibo'],
['label' => '抖音', 'value' => 'douyin'],
['label' => '百度', 'value' => 'baidu'],
['label' => 'GitHub', 'value' => 'github'],
['label' => 'Gitee', 'value' => 'gitee'],
['label' => '钉钉', 'value' => 'dingtalk'],
['label' => '华为', 'value' => 'huawei'],
['label' => '小米', 'value' => 'xiaomi'],
['label' => 'Google', 'value' => 'google'],
['label' => 'Microsoft', 'value' => 'microsoft'],
['label' => 'Facebook', 'value' => 'facebook'],
['label' => 'Twitter', 'value' => 'twitter'],
['label' => 'Apple', 'value' => 'apple'],
]],
]],
],
src/Auth/CLoginClient.php
+1 -1
View File
@@ -29,7 +29,7 @@ final class CLoginClient {
public function login(string $type, string $state): array {
$type = sanitize_key($type);
if (!in_array($type, ['qq', 'weixin', 'weibo'], true) || $state === '') {
if (!in_array($type, OAuthProviderCatalog::CLOGIN_TYPES, true) || $state === '') {
return ['code' => 1, 'msg' => __('聚合登录参数无效', 'jio')];
}
return $this->request([
src/Auth/OAuth.php
+5 -3
View File
@@ -352,7 +352,9 @@ final class OAuth {
}
private function handle_callback(): void {
$state = sanitize_text_field((string) ($_GET['state'] ?? ''));
// Apple 使用 response_mode=form_post，state/code 走 POST 而不是 query。
$input = $_SERVER['REQUEST_METHOD'] === 'POST' ? $_POST : $_GET;
$state = sanitize_text_field((string) ($input['state'] ?? ''));
$row = $state !== '' ? OAuthTransactionStore::claim($state, 'direct') : null;
$payload = is_array($row['payload'] ?? null) ? $row['payload'] : [];
$provider = sanitize_key((string) ($payload['provider'] ?? ''));
@@ -363,10 +365,10 @@ final class OAuth {
if ($action === 'bind' && (int) ($payload['user_id'] ?? 0) !== get_current_user_id()) {
$this->redirect_error('state_user_mismatch', $provider, $action);
}
if (!empty($_GET['error'])) {
if (!empty($input['error'])) {
$this->redirect_error('provider_cancelled', $provider, $action);
}
$code = sanitize_text_field((string) ($_GET['code'] ?? ''));
$code = sanitize_text_field((string) ($input['code'] ?? ''));
if ($code === '') {
$this->redirect_error('code_missing', $provider, $action);
}
src/Auth/OAuthProviderBroker.php
+6
View File
@@ -23,6 +23,9 @@ final class OAuthProviderBroker {
'state' => $state,
]);
}
if (OAuthProviderClient::handles($provider)) {
return OAuthProviderClient::auth_url($provider, $config, $redirect_uri, $state);
}
$oauth = $this->client($provider, $config, $redirect_uri);
$scope = $provider === 'github' ? 'read:user user:email' : null;
return (string) $oauth->getAuthUrl($redirect_uri, $state, $scope);
@@ -36,6 +39,9 @@ final class OAuthProviderBroker {
if ($provider === 'google') {
return $this->google_identity($config, $code, $redirect_uri);
}
if (OAuthProviderClient::handles($provider)) {
return OAuthProviderClient::identity($provider, $config, $code, $redirect_uri, $state);
}
$oauth = $this->client($provider, $config, $redirect_uri);
$oauth->getAccessToken($state, $code, $state);
if ($provider === 'qq') {
src/Auth/OAuthProviderCatalog.php
+51 -2
View File
@@ -42,9 +42,54 @@ final class OAuthProviderCatalog {
'id_key' => 'weixin_appid',
'secret_key' => 'weixin_appsecret',
],
'douyin' => [
'label' => '抖音',
'id_key' => 'douyin_appid',
'secret_key' => 'douyin_appkey',
],
'baidu' => [
'label' => '百度',
'id_key' => 'baidu_appid',
'secret_key' => 'baidu_appkey',
],
'alipay' => [
'label' => '支付宝',
'id_key' => 'alipay_appid',
'secret_key' => 'alipay_appkey',
'extra_keys' => ['private_key' => 'alipay_private_key'],
],
'microsoft' => [
'label' => 'Microsoft',
'id_key' => 'microsoft_appid',
'secret_key' => 'microsoft_appkey',
],
'facebook' => [
'label' => 'Facebook',
'id_key' => 'facebook_appid',
'secret_key' => 'facebook_appkey',
],
'twitter' => [
'label' => 'Twitter',
'id_key' => 'twitter_appid',
'secret_key' => 'twitter_appkey',
],
'apple' => [
'label' => 'Apple',
'id_key' => 'apple_appid',
'secret_key' => 'apple_appkey',
'extra_keys' => [
'team_id' => 'apple_team_id',
'key_id' => 'apple_key_id',
'private_key' => 'apple_private_key',
],
],
];
private const CLOGIN_TYPES = ['qq', 'weixin', 'weibo'];
/** 彩虹聚合登录支持的平台，与参考主题一致。 */
public const CLOGIN_TYPES = [
'qq', 'weixin', 'alipay', 'weibo', 'douyin', 'baidu', 'github', 'gitee',
'dingtalk', 'huawei', 'xiaomi', 'google', 'microsoft', 'facebook', 'twitter', 'apple',
];
public static function direct_keys(): array {
return array_keys(self::DIRECT);
@@ -101,13 +146,17 @@ final class OAuthProviderCatalog {
$definition = self::DIRECT[$provider];
$client_id = trim((string) ($settings[$definition['id_key']] ?? ''));
$client_secret = trim((string) ($settings[$definition['secret_key']] ?? ''));
$extra = [];
foreach ((array) ($definition['extra_keys'] ?? []) as $field => $setting_key) {
$extra[$field] = trim((string) ($settings[$setting_key] ?? ''));
}
return [
'provider' => $provider,
'enabled' => self::master_enabled() && !empty($settings['oauth_' . $provider . '_s']),
'client_id' => $client_id,
'client_secret' => $client_secret,
'configured' => $client_id !== '' && $client_secret !== '',
];
] + $extra;
}
public static function enabled_direct_keys(): array {
src/Auth/OAuthProviderClient.php
+436
View File
@@ -0,0 +1,436 @@
<?php
/**
* Third-party login providers that the bundled SDK does not cover.
*
* Douyin, Microsoft, Facebook, Twitter and Apple are implemented here directly
* against their documented OAuth2 endpoints; Baidu and Alipay come from the
* bundled yurunsoft SDK, which already ships working clients for both.
*
* @package Jio
*/
namespace Jio\Auth;
defined('ABSPATH') || exit;
final class OAuthProviderClient {
/** Providers served by this class rather than the bundled SDK. */
public const CUSTOM = ['douyin', 'microsoft', 'facebook', 'twitter', 'apple'];
/** Providers served by yurunsoft/yurun-oauth-login. */
public const SDK = ['baidu', 'alipay'];
/** Whether this class owns the provider (direct endpoints or SDK bridge). */
public static function handles(string $provider): bool {
return in_array($provider, self::CUSTOM, true) || in_array($provider, self::SDK, true);
}
/**
* Build the authorization URL.
*
* @param array<string,string> $config provider_config() output plus extra secrets.
* @param string $redirect_uri Callback URL registered with the provider.
* @param string $state Opaque CSRF token.
*/
public static function auth_url(string $provider, array $config, string $redirect_uri, string $state): string {
if (in_array($provider, self::SDK, true)) {
return self::sdk_client($provider, $config, $redirect_uri)->getAuthUrl($redirect_uri, $state);
}
switch ($provider) {
case 'douyin':
return 'https://open.douyin.com/platform/oauth/connect?' . http_build_query([
'client_key' => $config['client_id'],
'redirect_uri' => $redirect_uri,
'response_type' => 'code',
'scope' => 'user_info',
'state' => $state,
]);
case 'microsoft':
return 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize?' . http_build_query([
'client_id' => $config['client_id'],
'redirect_uri' => $redirect_uri,
'response_type' => 'code',
'response_mode' => 'query',
'scope' => 'openid profile email User.Read',
'state' => $state,
]);
case 'facebook':
return 'https://www.facebook.com/v21.0/dialog/oauth?' . http_build_query([
'client_id' => $config['client_id'],
'redirect_uri' => $redirect_uri,
'response_type' => 'code',
'scope' => 'public_profile,email',
'state' => $state,
]);
case 'twitter':
// Twitter 的 PKCE code_challenge 需要随 state 一起保存，回调时再校验。
$verifier = self::twitter_verifier($state);
$challenge = rtrim(strtr(base64_encode(hash('sha256', $verifier, true)), '+/', '-_'), '=');
return 'https://twitter.com/i/oauth2/authorize?' . http_build_query([
'client_id' => $config['client_id'],
'redirect_uri' => $redirect_uri,
'response_type' => 'code',
'scope' => 'users.read tweet.read offline.access',
'state' => $state,
'code_challenge' => $challenge,
'code_challenge_method' => 'S256',
]);
case 'apple':
return 'https://appleid.apple.com/auth/authorize?' . http_build_query([
'client_id' => $config['client_id'],
'redirect_uri' => $redirect_uri,
'response_type' => 'code',
// Apple 只支持 form_post 回调，服务端需要读 $_POST。
'response_mode' => 'form_post',
'scope' => 'name email',
'state' => $state,
]);
}
throw new \RuntimeException(__('不支持的第三方登录平台', 'jio'));
}
/**
* Exchange the callback code for a normalized identity.
*
* @param array<string,string> $config provider_config() output plus extra secrets.
*/
public static function identity(string $provider, array $config, string $code, string $redirect_uri, string $state): array {
if (in_array($provider, self::SDK, true)) {
return self::sdk_identity($provider, $config, $code, $redirect_uri, $state);
}
switch ($provider) {
case 'douyin':
return self::douyin_identity($config, $code);
case 'microsoft':
return self::microsoft_identity($config, $code, $redirect_uri);
case 'facebook':
return self::facebook_identity($config, $code, $redirect_uri);
case 'twitter':
return self::twitter_identity($config, $code, $redirect_uri, $state);
case 'apple':
return self::apple_identity($config, $code, $redirect_uri);
}
throw new \RuntimeException(__('不支持的第三方登录平台', 'jio'));
}
// ---------------------------------------------------------------- SDK bridge
/** @param array<string,string> $config */
private static function sdk_client(string $provider, array $config, string $redirect_uri) {
switch ($provider) {
case 'baidu':
$client = new \Yurun\OAuthLogin\Baidu\OAuth2($config['client_id'], $config['client_secret'], $redirect_uri);
break;
case 'alipay':
$client = new \Yurun\OAuthLogin\Alipay\OAuth2($config['client_id'], $config['client_secret'], $redirect_uri);
// 支付宝要求应用私钥；client_secret 位存的是支付宝公钥。
if (!empty($config['private_key'])) {
$client->appPrivateKey = (string) $config['private_key'];
}
break;
default:
throw new \RuntimeException(__('不支持的第三方登录平台', 'jio'));
}
return $client;
}
/** @param array<string,string> $config */
private static function sdk_identity(string $provider, array $config, string $code, string $redirect_uri, string $state): array {
$client = self::sdk_client($provider, $config, $redirect_uri);
$client->getAccessToken($state, $code, $state);
$info = (array) $client->getUserInfo();
if ($provider === 'baidu') {
return [
'provider' => 'baidu',
'provider_id' => (string) ($info['userid'] ?? $info['uid'] ?? ''),
'username' => (string) ($info['uname'] ?? ''),
'name' => (string) ($info['uname'] ?? ''),
'email' => sanitize_email((string) ($info['email'] ?? '')),
'email_verified' => false,
'avatar_url' => str_replace('tb.himg.baidu.com', 'himg.bdimg.com', (string) ($info['portrait'] ?? '')),
];
}
// 支付宝：user_id 为唯一标识，昵称在 user_info.nick_name。
$user_info = (array) ($info['user_info'] ?? $info);
return [
'provider' => 'alipay',
'provider_id' => (string) ($info['user_id'] ?? $user_info['user_id'] ?? ''),
'username' => (string) ($user_info['nick_name'] ?? ''),
'name' => (string) ($user_info['nick_name'] ?? ''),
'email' => '',
'email_verified' => false,
'avatar_url' => (string) ($user_info['avatar'] ?? ''),
];
}
// ------------------------------------------------------------------- Douyin
/** @param array<string,string> $config */
private static function douyin_identity(array $config, string $code): array {
$token = wp_remote_post('https://open.douyin.com/oauth/access_token/', [
'timeout' => 20,
'body' => [
'client_key' => $config['client_id'],
'client_secret' => $config['client_secret'],
'code' => $code,
'grant_type' => 'authorization_code',
],
]);
$data = self::json_body($token, __('获取抖音授权令牌失败', 'jio'));
$payload = (array) ($data['data'] ?? []);
if (empty($payload['access_token']) || empty($payload['open_id'])) {
throw new \RuntimeException(__('获取抖音授权令牌失败', 'jio'));
}
$profile = wp_remote_post('https://open.douyin.com/oauth/userinfo/', [
'timeout' => 20,
'body' => [
'access_token' => $payload['access_token'],
'open_id' => $payload['open_id'],
],
]);
$info = self::json_body($profile, __('获取抖音用户信息失败', 'jio'));
$user = (array) ($info['data'] ?? []);
return [
'provider' => 'douyin',
'provider_id' => (string) $payload['open_id'],
'username' => (string) ($user['nickname'] ?? ''),
'name' => (string) ($user['nickname'] ?? ''),
'email' => '',
'email_verified' => false,
'avatar_url' => (string) ($user['avatar_larger'] ?? $user['avatar_300x300'] ?? $user['avatar_168x168'] ?? ''),
];
}
// ---------------------------------------------------------------- Microsoft
/** @param array<string,string> $config */
private static function microsoft_identity(array $config, string $code, string $redirect_uri): array {
$token = wp_remote_post('https://login.microsoftonline.com/common/oauth2/v2.0/token', [
'timeout' => 20,
'body' => [
'client_id' => $config['client_id'],
'client_secret' => $config['client_secret'],
'code' => $code,
'grant_type' => 'authorization_code',
'redirect_uri' => $redirect_uri,
'scope' => 'openid profile email User.Read',
],
]);
$data = self::json_body($token, __('获取 Microsoft 授权令牌失败', 'jio'));
if (empty($data['access_token'])) {
throw new \RuntimeException(__('获取 Microsoft 授权令牌失败', 'jio'));
}
$profile = wp_remote_get('https://graph.microsoft.com/oidc/userinfo', [
'timeout' => 20,
'headers' => ['Authorization' => 'Bearer ' . $data['access_token']],
]);
$info = self::json_body($profile, __('获取 Microsoft 用户信息失败', 'jio'));
$email = sanitize_email((string) ($info['email'] ?? $info['preferred_username'] ?? ''));
return [
'provider' => 'microsoft',
'provider_id' => (string) ($info['sub'] ?? ''),
'username' => (string) ($info['email'] ?? $info['preferred_username'] ?? ''),
'name' => (string) ($info['name'] ?? ''),
'email' => $email,
'email_verified' => $email !== '' && !empty($info['email']),
'avatar_url' => '',
];
}
// ----------------------------------------------------------------- Facebook
/** @param array<string,string> $config */
private static function facebook_identity(array $config, string $code, string $redirect_uri): array {
$token = wp_remote_get('https://graph.facebook.com/v21.0/oauth/access_token?' . http_build_query([
'client_id' => $config['client_id'],
'client_secret' => $config['client_secret'],
'redirect_uri' => $redirect_uri,
'code' => $code,
]), ['timeout' => 20]);
$data = self::json_body($token, __('获取 Facebook 授权令牌失败', 'jio'));
if (empty($data['access_token'])) {
throw new \RuntimeException(__('获取 Facebook 授权令牌失败', 'jio'));
}
$profile = wp_remote_get('https://graph.facebook.com/v21.0/me?' . http_build_query([
'fields' => 'id,name,email,picture.type(large)',
'access_token' => $data['access_token'],
]), ['timeout' => 20]);
$info = self::json_body($profile, __('获取 Facebook 用户信息失败', 'jio'));
// Facebook 头像地址不带协议，补 https 以适配页面协议。
$avatar = (string) ($info['picture']['data']['url'] ?? '');
$email = sanitize_email((string) ($info['email'] ?? ''));
return [
'provider' => 'facebook',
'provider_id' => (string) ($info['id'] ?? ''),
'username' => $email !== '' ? $email : (string) ($info['name'] ?? ''),
'name' => (string) ($info['name'] ?? ''),
'email' => $email,
'email_verified' => $email !== '',
'avatar_url' => $avatar !== '' ? self::https_url($avatar) : '',
];
}
// ------------------------------------------------------------------ Twitter
/** @param array<string,string> $config */
private static function twitter_identity(array $config, string $code, string $redirect_uri, string $state): array {
$verifier = self::twitter_verifier($state);
$token = wp_remote_post('https://api.twitter.com/2/oauth2/token', [
'timeout' => 20,
'headers' => ['Authorization' => 'Basic ' . base64_encode($config['client_id'] . ':' . $config['client_secret'])],
'body' => [
'code' => $code,
'grant_type' => 'authorization_code',
'redirect_uri' => $redirect_uri,
'code_verifier' => $verifier,
],
]);
$data = self::json_body($token, __('获取 Twitter 授权令牌失败', 'jio'));
if (empty($data['access_token'])) {
throw new \RuntimeException(__('获取 Twitter 授权令牌失败', 'jio'));
}
$profile = wp_remote_get('https://api.twitter.com/2/users/me?' . http_build_query([
'user.fields' => 'id,name,username,profile_image_url',
]), [
'timeout' => 20,
'headers' => ['Authorization' => 'Bearer ' . $data['access_token']],
]);
$info = (array) (self::json_body($profile, __('获取 Twitter 用户信息失败', 'jio'))['data'] ?? []);
return [
'provider' => 'twitter',
'provider_id' => (string) ($info['id'] ?? ''),
'username' => (string) ($info['username'] ?? ''),
'name' => (string) ($info['name'] ?? ''),
'email' => '',
'email_verified' => false,
'avatar_url' => (string) ($info['profile_image_url'] ?? ''),
];
}
/** Derive the PKCE verifier from the state so it never needs extra storage. */
private static function twitter_verifier(string $state): string {
return rtrim(strtr(base64_encode(hash('sha256', 'jio-twitter|' . $state, true)), '+/', '-_'), '=');
}
// -------------------------------------------------------------------- Apple
/** @param array<string,string> $config */
private static function apple_identity(array $config, string $code, string $redirect_uri): array {
$secret = self::apple_client_secret($config);
$token = wp_remote_post('https://appleid.apple.com/auth/token', [
'timeout' => 20,
'body' => [
'client_id' => $config['client_id'],
'client_secret' => $secret,
'code' => $code,
'grant_type' => 'authorization_code',
'redirect_uri' => $redirect_uri,
],
]);
$data = self::json_body($token, __('获取 Apple 授权令牌失败', 'jio'));
if (empty($data['id_token'])) {
throw new \RuntimeException(__('获取 Apple 授权令牌失败', 'jio'));
}
$claims = self::jwt_claims((string) $data['id_token']);
if (!is_array($claims) || empty($claims['sub'])) {
throw new \RuntimeException(__('解析 Apple 用户信息失败', 'jio'));
}
$email = sanitize_email((string) ($claims['email'] ?? ''));
return [
'provider' => 'apple',
'provider_id' => (string) $claims['sub'],
'username' => $email !== '' ? $email : (string) $claims['sub'],
'name' => '',
'email' => $email,
'email_verified' => !empty($claims['email_verified']) || !empty($claims['is_private_email']) === false && $email !== '',
'avatar_url' => '',
];
}
/**
* Build the ES256 client secret Apple requires (a short-lived JWT).
*
* @param array<string,string> $config
*/
private static function apple_client_secret(array $config): string {
$team = (string) ($config['team_id'] ?? '');
$key = (string) ($config['key_id'] ?? '');
$pem = (string) ($config['private_key'] ?? '');
if ($pem === '') {
// 未配置密钥时退化为普通 client_secret，仍然遵循同一签名流程。
return (string) $config['client_secret'];
}
$now = time();
$header = self::b64url(wp_json_encode(['alg' => 'ES256', 'kid' => $key]));
$payload = self::b64url(wp_json_encode([
'iss' => $team,
'iat' => $now,
'exp' => $now + 3600,
'aud' => 'https://appleid.apple.com',
'sub' => (string) $config['client_id'],
]));
$signing = $header . '.' . $payload;
$key_id = openssl_pkey_get_private($pem);
if ($key_id === false) {
throw new \RuntimeException(__('Apple 私钥格式无效', 'jio'));
}
$signature = '';
openssl_sign($signing, $signature, $key_id, OPENSSL_ALGO_SHA256);
return $signing . '.' . self::b64url($signature);
}
/** Decode the payload of a JWT without verifying it (the token came over TLS). */
private static function jwt_claims(string $token): ?array {
$parts = explode('.', $token);
if (count($parts) < 2) {
return null;
}
$payload = json_decode((string) base64_decode(strtr($parts[1], '-_', '+/'), true), true);
return is_array($payload) ? $payload : null;
}
private static function b64url(string $value): string {
return rtrim(strtr(base64_encode($value), '+/', '-_'), '=');
}
// ------------------------------------------------------------------ helpers
/**
* Decode a JSON response, raising a translated message on transport errors.
*
* @param array|\WP_Error $response
* @return array<string,mixed>
*/
private static function json_body($response, string $message): array {
if (is_wp_error($response)) {
throw new \RuntimeException($response->get_error_message());
}
if ((int) wp_remote_retrieve_response_code($response) !== 200) {
throw new \RuntimeException($message);
}
$data = json_decode((string) wp_remote_retrieve_body($response), true);
if (!is_array($data)) {
throw new \RuntimeException($message);
}
if (!empty($data['error'])) {
$detail = $data['error_description'] ?? $data['error']['message'] ?? $data['error'];
throw new \RuntimeException(is_string($detail) ? $detail : $message);
}
return $data;
}
private static function https_url(string $url): string {
return (string) preg_replace('#^http://#i', 'https://', $url);
}
}