优化了一些问题

src/Auth/CLoginClient.php

@@ -1,6 +1,6 @@
 <?php
 /**
- * CaiHong / rainbow aggregate OAuth client (legacy clogin parity).
+ * CaiHong aggregate OAuth client.
  *
  * @package AKSRT
  */
@@ -9,56 +9,51 @@ namespace AKSRT\Auth;
 
 defined('ABSPATH') || exit;
 
-class CLoginClient {
+final class CLoginClient {
 
 	private string $apiurl;
 	private string $appid;
 	private string $appkey;
 	private string $callback;
-	public string $state = '';
 
 	/**
 	 * @param array{apiurl:string,appid:string,appkey:string,callback?:string} $config
 	 */
 	public function __construct(array $config) {
-		$this->apiurl   = rtrim((string) ($config['apiurl'] ?? ''), '/') . '/connect.php';
-		$this->appid    = (string) ($config['appid'] ?? '');
-		$this->appkey   = (string) ($config['appkey'] ?? '');
+		$base = OAuthUrlPolicy::public_https((string) ($config['apiurl'] ?? ''));
+		$this->apiurl = $base !== '' ? rtrim($base, '/') . '/connect.php' : '';
+		$this->appid = trim((string) ($config['appid'] ?? ''));
+		$this->appkey = trim((string) ($config['appkey'] ?? ''));
 		$this->callback = (string) ($config['callback'] ?? '');
 	}
 
-	/**
-	 * @return array<string,mixed>
-	 */
-	public function login(string $type): array {
-		$this->state = md5(uniqid((string) wp_rand(), true));
-		$params = [
-			'act'          => 'login',
-			'appid'        => $this->appid,
-			'appkey'       => $this->appkey,
-			'type'         => $this->to_api_type($type),
+	public function login(string $type, string $state): array {
+		$type = sanitize_key($type);
+		if (!in_array($type, ['qq', 'weixin', 'weibo'], true) || $state === '') {
+			return ['code' => 1, 'msg' => __('聚合登录参数无效', 'aksrt')];
+		}
+		return $this->request([
+			'act' => 'login',
+			'appid' => $this->appid,
+			'appkey' => $this->appkey,
+			'type' => $this->to_api_type($type),
 			'redirect_uri' => $this->callback,
-			'state'        => $this->state,
-		];
-		return $this->request($params);
+			'state' => $state,
+		], true);
 	}
 
-	/**
-	 * @return array<string,mixed>
-	 */
 	public function callback(string $code): array {
 		return $this->request([
-			'act'    => 'callback',
-			'appid'  => $this->appid,
+			'act' => 'callback',
+			'appid' => $this->appid,
 			'appkey' => $this->appkey,
-			'code'   => $code,
+			'code' => $code,
 		]);
 	}
 
 	public function to_api_type(string $type): string {
 		switch (sanitize_key($type)) {
 			case 'weixin':
-			case 'wechat':
 				return 'wx';
 			case 'weibo':
 				return 'sina';
@@ -78,29 +73,31 @@ class CLoginClient {
 		}
 	}
 
-	/**
-	 * @param array<string,string> $params
-	 * @return array<string,mixed>
-	 */
-	private function request(array $params): array {
+	private function request(array $params, bool $expect_url = false): array {
+		if ($this->apiurl === '' || $this->appid === '' || $this->appkey === '') {
+			return ['code' => 1, 'msg' => __('聚合登录配置无效', 'aksrt')];
+		}
 		$url = $this->apiurl . '?' . http_build_query($params);
-		$response = wp_remote_get($url, [
+		$response = wp_safe_remote_get($url, [
 			'timeout' => 15,
-			'headers' => [
-				'User-Agent' => 'AKSRT-CLogin/1.0',
-			],
+			'redirects' => 1,
+			'limit_response_size' => 256 * 1024,
+			'headers' => ['User-Agent' => 'AKSRT-CLogin/2.0'],
 		]);
 		if (is_wp_error($response)) {
-			return [
-				'code' => 1,
-				'msg'  => $response->get_error_message(),
-			];
+			return ['code' => 1, 'msg' => $response->get_error_message()];
 		}
-		$body = (string) wp_remote_retrieve_body($response);
-		$data = json_decode($body, true);
-		return is_array($data) ? $data : [
-			'code' => 1,
-			'msg'  => __('聚合登录接口返回异常', 'aksrt'),
-		];
+		$status = (int) wp_remote_retrieve_response_code($response);
+		if ($status < 200 || $status >= 300) {
+			return ['code' => 1, 'msg' => __('聚合登录接口请求失败', 'aksrt')];
+		}
+		$data = json_decode((string) wp_remote_retrieve_body($response), true);
+		if (!is_array($data)) {
+			return ['code' => 1, 'msg' => __('聚合登录接口返回异常', 'aksrt')];
+		}
+		if ($expect_url && empty($data['code']) && OAuthUrlPolicy::public_https((string) ($data['url'] ?? '')) === '') {
+			return ['code' => 1, 'msg' => __('聚合登录返回地址无效', 'aksrt')];
+		}
+		return $data;
 	}
 }