refactor: flatten src/AKSRT → src (drop theme-identifier dir)

Move all domain folders from src/AKSRT/{Domain} to src/{Domain}; remap Composer PSR-4 "AKSRT\\": "src/"; update audit script + README + ADR paths; remove dead tools/build-psr4-map.php (scanned deleted inc/classes).
2026-08-02 22:06:06 +08:00
parent 56f1a8175f
commit 8c5b1555c9
285 changed files with 26 additions and 3600 deletions
@@ -0,0 +1,424 @@
+<?php
+/**
+ * @package AKSRT
+ */
+
+namespace AKSRT\Auth;
+
+defined('ABSPATH') || exit;
+
+class OAuth {
+    use OAuthPart1;
+    use OAuthPart2;
+
+
+    private static $instance = null;
+
+    private function __construct() {}
+
+    public static function get_instance(): self {
+        if (null === self::$instance) self::$instance = new self();
+        return self::$instance;
+    }
+
+    public function init(): void {
+        add_action('init', [$this, 'add_rewrite_rules']);
+        add_action('template_redirect', [$this, 'handle_callback']);
+        add_action('template_redirect', [$this, 'handle_clogin_routes'], 9);
+        add_action('show_user_profile', [$this, 'profile_bindings'], 10, 1);
+        add_action('wp_ajax_aksrt_oauth_unbind', [$this, 'ajax_unbind']);
+    }
+
+    public function add_rewrite_rules(): void {
+        add_rewrite_rule('^oauth/callback/?$', 'index.php?aksrt_oauth=callback', 'top');
+        add_rewrite_rule('^oauth/clogin/?$', 'index.php?aksrt_oauth=clogin', 'top');
+        add_rewrite_rule('^oauth/clogin/callback/?$', 'index.php?aksrt_oauth=clogin_callback', 'top');
+        add_filter('query_vars', function($vars) {
+            $vars[] = 'aksrt_oauth';
+            return $vars;
+        });
+    }
+
+    /**
+     * 生成OAuth授权URL
+     */
+    public function get_auth_url(string $provider, string $action = 'login'): string {
+        $provider = sanitize_key($provider);
+        if (str_starts_with($provider, 'clogin_') || str_starts_with($provider, 'clogin-')) {
+            $type = str_replace(['clogin_', 'clogin-'], '', $provider);
+            return $this->get_clogin_login_url($type, $action);
+        }
+        if ($provider === 'clogin') {
+            return $this->get_clogin_login_url('qq', $action);
+        }
+
+        if (class_exists('\AKSRT\Settings\Settings') && \AKSRT\Settings\Settings::oauth_proxy_mode() === 'client') {
+            if (class_exists('AKSRT\\Auth\\OAuthProxyClient')) {
+                return OAuthProxyClient::get_instance()->get_proxy_auth_url($provider, $action);
+            }
+            return '';
+        }
+
+        $config = $this->get_provider_config($provider);
+        if (!$config) return '';
+
+        $uid = get_current_user_id();
+        $nonce = wp_create_nonce('aksrt_oauth_' . $provider . '_' . $uid);
+        $state = ($action === 'bind' && $uid)
+            ? 'bind_' . $provider . '_' . $nonce
+            : $provider . '_' . $nonce;
+
+        $redirect_uri = !empty($config['redirect_uri']) ? $config['redirect_uri'] : home_url('/oauth/callback/');
+
+        try {
+            switch ($provider) {
+                case 'github':
+                    $oauth = new \Yurun\OAuthLogin\Github\OAuth2(
+                        $config['client_id'],
+                        $config['client_secret'],
+                        $redirect_uri
+                    );
+                    return $oauth->getAuthUrl($redirect_uri, $state);
+
+                case 'gitee':
+                    $oauth = new \Yurun\OAuthLogin\Gitee\OAuth2(
+                        $config['client_id'],
+                        $config['client_secret'],
+                        $redirect_uri
+                    );
+                    return $oauth->getAuthUrl($redirect_uri, $state);
+
+                case 'qq':
+                    $oauth = new \Yurun\OAuthLogin\QQ\OAuth2(
+                        $config['client_id'],
+                        $config['client_secret'],
+                        $redirect_uri
+                    );
+                    return $oauth->getAuthUrl($redirect_uri, $state);
+
+                case 'weibo':
+                    $oauth = new \Yurun\OAuthLogin\Weibo\OAuth2(
+                        $config['client_id'],
+                        $config['client_secret'],
+                        $redirect_uri
+                    );
+                    return $oauth->getAuthUrl($redirect_uri, $state);
+
+                case 'weixin':
+                    $oauth = new \Yurun\OAuthLogin\Weixin\OAuth2(
+                        $config['client_id'],
+                        $config['client_secret'],
+                        $redirect_uri
+                    );
+                    return $oauth->getAuthUrl($redirect_uri, $state);
+
+                case 'baidu':
+                    $oauth = new \Yurun\OAuthLogin\Baidu\OAuth2(
+                        $config['client_id'],
+                        $config['client_secret'],
+                        $redirect_uri
+                    );
+                    return $oauth->getAuthUrl($redirect_uri, $state);
+
+                case 'alipay':
+                    $oauth = new \Yurun\OAuthLogin\Alipay\OAuth2(
+                        $config['client_id'],
+                        $config['client_secret'],
+                        $redirect_uri
+                    );
+                    return $oauth->getAuthUrl($redirect_uri, $state);
+
+                case 'google':
+                    return $this->get_google_auth_url($config, $redirect_uri, $state);
+
+                case 'weixingzh':
+                    return $this->get_weixingzh_auth_url($config, $redirect_uri, $state);
+
+                default:
+                    return '';
+            }
+        } catch (\Exception $e) {
+            return '';
+        }
+    }
+
+    /**
+     * 处理OAuth回调 — 路由分发
+     */
+    public function handle_callback(): void {
+        $provider = $this->resolve_callback_provider();
+        if ($provider === '' || !in_array($provider, $this->get_enabled_providers())) return;
+
+        $error = $_GET['error'] ?? '';
+        if ($error) {
+            wp_die(__('登录失败：', 'aksrt') . esc_html($error));
+        }
+
+        $code  = $_GET['code'] ?? '';
+        $state = $_GET['state'] ?? '';
+        if (empty($code)) {
+            wp_die(__('OAuth回调缺少授权码', 'aksrt'));
+        }
+
+        $is_bind = strpos($state, 'bind_') === 0;
+        $rest    = $is_bind ? substr($state, 5) : $state;
+        $sep     = strpos($rest, '_');
+
+        if ($sep === false || $sep >= strlen($rest) - 1) {
+            wp_die(__('无效的OAuth状态参数', 'aksrt'));
+        }
+
+        $parsed_provider = sanitize_key(substr($rest, 0, $sep));
+        if (!in_array($parsed_provider, $this->get_enabled_providers())) {
+            wp_die(__('未知的OAuth提供商', 'aksrt'));
+        }
+
+        $nonce_state = substr($rest, $sep + 1);
+
+        if ($is_bind) {
+            $this->handle_bind_callback($parsed_provider, $code, $nonce_state);
+        } else {
+            $this->handle_login_callback($parsed_provider, $code, $nonce_state);
+        }
+    }
+
+    private function handle_login_callback(string $provider, string $code, string $nonce): void {
+        try {
+            if (!wp_verify_nonce($nonce, "aksrt_oauth_{$provider}_0")) {
+                throw new \Exception(__('安全验证失败，请重试', 'aksrt'));
+            }
+
+            $user_data = $this->get_user_data($provider, $code);
+
+            if (!$user_data || empty($user_data['provider_id'])) {
+                throw new \Exception(__('无法获取用户信息', 'aksrt'));
+            }
+
+            $user = $this->find_or_create_user($provider, $user_data);
+
+            if (is_wp_error($user) && $user->get_error_code() === 'oauth_no_match') {
+                $error_data = $user->get_error_data();
+                $obk = 'aksrt_ob_' . wp_generate_password(24, false);
+                set_transient($obk, [
+                    'provider'    => $error_data['provider'],
+                    'provider_id' => $error_data['user_data']['provider_id'] ?? '',
+                    'user_data'   => $error_data['user_data'],
+                ], 15 * MINUTE_IN_SECONDS);
+
+                $bind_url = aksrt_get_bind_url();
+                wp_safe_redirect(add_query_arg('obk', $obk, $bind_url));
+                exit;
+            }
+
+            if (is_wp_error($user)) {
+                throw new \Exception($user->get_error_message());
+            }
+
+            wp_set_auth_cookie($user->ID, true);
+            $redirect_url = home_url('/');
+            if (function_exists('aksrt_get_user_center_url')) {
+                $redirect_url = aksrt_get_user_center_url();
+            }
+            wp_safe_redirect(add_query_arg(['oauth_action' => 'login', 'oauth_bound' => $provider], $redirect_url));
+            exit;
+
+        } catch (\Exception $e) {
+            wp_die(__('登录失败：', 'aksrt') . '<br>' . esc_html($e->getMessage()));
+        }
+    }
+
+    private function handle_bind_callback(string $provider, string $code, string $nonce): void {
+        $current_uid = get_current_user_id();
+        if (!$current_uid) {
+            wp_safe_redirect(aksrt_get_login_url());
+            exit;
+        }
+
+        try {
+            $expected = wp_create_nonce("aksrt_oauth_{$provider}_{$current_uid}");
+            if (!hash_equals($expected, $nonce)) {
+                throw new \Exception(__('安全验证失败，请重试', 'aksrt'));
+            }
+
+            $existing_binding = get_user_meta($current_uid, "aksrt_{$provider}_id", true);
+            if (!empty($existing_binding)) {
+                wp_safe_redirect(add_query_arg(['tab' => 'settings', 'oauth_action' => 'bind', 'oauth_bound' => $provider], $this->get_profile_url()));
+                exit;
+            }
+
+            $user_data = $this->get_user_data($provider, $code);
+
+            if (!$user_data || empty($user_data['provider_id'])) {
+                throw new \Exception(__('无法获取用户信息', 'aksrt'));
+            }
+
+            $existing = $this->find_user_by_provider($provider, $user_data['provider_id'] ?? '');
+            if ($existing && $existing->ID !== $current_uid) {
+                throw new \Exception(__('该第三方账号已被其他用户绑定', 'aksrt'));
+            }
+
+            $this->bind_provider_to_user($current_uid, $provider, $user_data);
+
+            wp_safe_redirect(add_query_arg(['tab' => 'settings', 'oauth_action' => 'bind', 'oauth_bound' => $provider], $this->get_profile_url()));
+            exit;
+
+        } catch (\Exception $e) {
+            wp_die(__('绑定失败：', 'aksrt') . '<br>' . esc_html($e->getMessage()));
+        }
+    }
+
+    /**
+     * 通过授权码获取用户数据（统一输出格式）
+     */
+    private function get_user_data(string $provider, string $code): array {
+        $config = $this->get_provider_config($provider);
+        $redirect_uri = !empty($config['redirect_uri']) ? $config['redirect_uri'] : home_url('/oauth/callback/');
+
+        switch ($provider) {
+            case 'github':
+                return $this->get_github_user_data($config, $code, $redirect_uri);
+            case 'gitee':
+                return $this->get_gitee_user_data($config, $code, $redirect_uri);
+            case 'qq':
+                return $this->get_qq_user_data($config, $code, $redirect_uri);
+            case 'weibo':
+                return $this->get_weibo_user_data($config, $code, $redirect_uri);
+            case 'weixin':
+                return $this->get_weixin_user_data($config, $code, $redirect_uri);
+            case 'baidu':
+                return $this->get_baidu_user_data($config, $code, $redirect_uri);
+            case 'alipay':
+                return $this->get_alipay_user_data($config, $code, $redirect_uri);
+            case 'google':
+                return $this->get_google_user_data($config, $code, $redirect_uri);
+            case 'weixingzh':
+                return $this->get_weixingzh_user_data($config, $code, $redirect_uri);
+            default:
+                throw new \Exception(__('不支持的OAuth平台：', 'aksrt') . $provider);
+        }
+    }
+
+    private function get_github_user_data(array $config, string $code, string $redirect_uri): array {
+        $oauth = new \Yurun\OAuthLogin\Github\OAuth2(
+            $config['client_id'],
+            $config['client_secret'],
+            $redirect_uri
+        );
+
+        $oauth->getAccessToken($_GET['state'] ?? '', $code, $_GET['state'] ?? null);
+        $userInfo = $oauth->getUserInfo();
+
+        // 获取邮箱
+        $email = $userInfo['email'] ?? '';
+        if (empty($email)) {
+            $emails_json = $oauth->http->header('Authorization', ' token ' . $oauth->accessToken)
+                ->get('https://api.github.com/user/emails')
+                ->body();
+            $emails = json_decode($emails_json, true) ?: [];
+            foreach ($emails as $em) {
+                if (!empty($em['primary']) && !empty($em['email'])) {
+                    $email = $em['email'];
+                    break;
+                }
+            }
+        }
+
+        return [
+            'provider'    => 'github',
+            'provider_id' => (string) ($userInfo['id'] ?? ''),
+            'username'    => $userInfo['login'] ?? '',
+            'name'        => $userInfo['name'] ?? '',
+            'email'       => $email,
+            'avatar_url'  => $userInfo['avatar_url'] ?? '',
+            'url'         => $userInfo['html_url'] ?? '',
+            'bio'         => $userInfo['bio'] ?? '',
+        ];
+    }
+
+    private function get_gitee_user_data(array $config, string $code, string $redirect_uri): array {
+        $oauth = new \Yurun\OAuthLogin\Gitee\OAuth2(
+            $config['client_id'],
+            $config['client_secret'],
+            $redirect_uri
+        );
+
+        $oauth->getAccessToken($_GET['state'] ?? '', $code, $_GET['state'] ?? null);
+        $userInfo = $oauth->getUserInfo();
+
+        return [
+            'provider'    => 'gitee',
+            'provider_id' => (string) ($userInfo['id'] ?? ''),
+            'username'    => $userInfo['login'] ?? '',
+            'name'        => $userInfo['name'] ?? '',
+            'email'       => $userInfo['email'] ?? '',
+            'avatar_url'  => $userInfo['avatar_url'] ?? '',
+            'url'         => $userInfo['html_url'] ?? '',
+            'bio'         => $userInfo['bio'] ?? '',
+        ];
+    }
+
+    private function get_qq_user_data(array $config, string $code, string $redirect_uri): array {
+        $oauth = new \Yurun\OAuthLogin\QQ\OAuth2(
+            $config['client_id'],
+            $config['client_secret'],
+            $redirect_uri
+        );
+
+        $oauth->getAccessToken($_GET['state'] ?? '', $code, $_GET['state'] ?? null);
+        $openid = $oauth->getOpenID();
+        $userInfo = $oauth->getUserInfo();
+
+        return [
+            'provider'    => 'qq',
+            'provider_id' => $openid,
+            'username'    => $userInfo['nickname'] ?? '',
+            'name'        => $userInfo['nickname'] ?? '',
+            'email'       => '',
+            'avatar_url'  => $userInfo['figureurl_qq_2'] ?? $userInfo['figureurl_2'] ?? $userInfo['figureurl'] ?? '',
+            'gender'      => $userInfo['gender'] ?? '',
+        ];
+    }
+
+    private function get_weibo_user_data(array $config, string $code, string $redirect_uri): array {
+        $oauth = new \Yurun\OAuthLogin\Weibo\OAuth2(
+            $config['client_id'],
+            $config['client_secret'],
+            $redirect_uri
+        );
+
+        $oauth->getAccessToken($_GET['state'] ?? '', $code, $_GET['state'] ?? null);
+        $userInfo = $oauth->getUserInfo();
+
+        return [
+            'provider'    => 'weibo',
+            'provider_id' => (string) ($userInfo['id'] ?? ''),
+            'username'    => $userInfo['screen_name'] ?? '',
+            'name'        => $userInfo['name'] ?? '',
+            'email'       => '',
+            'avatar_url'  => $userInfo['avatar_large'] ?? $userInfo['profile_image_url'] ?? '',
+            'gender'      => ($userInfo['gender'] ?? '') === 'm' ? 'male' : (($userInfo['gender'] ?? '') === 'f' ? 'female' : ''),
+        ];
+    }
+
+    private function get_weixin_user_data(array $config, string $code, string $redirect_uri): array {
+        $oauth = new \Yurun\OAuthLogin\Weixin\OAuth2(
+            $config['client_id'],
+            $config['client_secret'],
+            $redirect_uri
+        );
+
+        $oauth->getAccessToken($_GET['state'] ?? '', $code, $_GET['state'] ?? null);
+        $userInfo = $oauth->getUserInfo();
+
+        return [
+            'provider'    => 'weixin',
+            'provider_id' => (string) ($userInfo['openid'] ?? ''),
+            'username'    => $userInfo['nickname'] ?? '',
+            'name'        => $userInfo['nickname'] ?? '',
+            'email'       => '',
+            'avatar_url'  => $userInfo['headimgurl'] ?? '',
+            'gender'      => ($userInfo['sex'] ?? 0) == 1 ? 'male' : (($userInfo['sex'] ?? 0) == 2 ? 'female' : ''),
+        ];
+    }
+
+}