Azure AD 访问令牌刷新机制详解

final TokenCredential tokenCredential = request -> {
    // account.getTokenExpiry() 和 account.getAccessToken() 应该动态更新
    final OffsetDateTime offset = OffsetDateTime.ofInstant(account.getTokenExpiry().toInstant(), ZoneId.systemDefault());
    final AccessToken token = new AccessToken(account.getAccessToken(), offset);
    return Mono.create(sink -> sink.success(token));
};

final TokenCredentialAuthProvider tokenCredentialAuthProvider = 
  new TokenCredentialAuthProvider(tokenCredential);

this.graphServiceClient =
    GraphServiceClient
        .builder()
        .authenticationProvider(tokenCredentialAuthProvider)
        .buildClient();

import org.springframework.http.HttpEntity;
import org.springframework.http.HttpHeaders;
import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;
import org.springframework.util.LinkedMultiValueMap;
import org.springframework.util.MultiValueMap;
import org.springframework.web.client.RestTemplate;

import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;

import java.io.IOException;
import java.time.OffsetDateTime;
import java.time.ZoneId;

public class AzureAdTokenRefresher {

    private final RestTemplate restTemplate;
    private final ObjectMapper objectMapper;

    public AzureAdTokenRefresher() {
        this.restTemplate = new RestTemplate();
        this.objectMapper = new ObjectMapper();
    }

    /**
     * 使用刷新令牌获取新的访问令牌。
     * @param refreshToken 用户的刷新令牌
     * @return 包含新访问令牌、刷新令牌（如果返回）和过期时间等信息的JSON字符串
     * @throws IOException 如果JSON解析失败
     */
    public TokenResponse refreshAccessToken(String refreshToken) throws IOException {
        String url = "https://login.microsoftonline.com/common/oauth2/v2.0/token";

        HttpHeaders headers = new HttpHeaders();
        headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);

        // TODO: 这些值应从配置文件或环境变量中安全读取
        MultiValueMap<String, String> map= new LinkedMultiValueMap<>();
        map.add("client_id", "your_client_id"); // 替换为您的应用客户端ID
        map.add("grant_type", "refresh_token");
        map.add("redirect_uri", "http://localhost:5000/login/oauth2/code/microsoft"); // 替换为您的重定向URI
        map.add("scope", "openid profile offline_access User.Read Mail.Read"); // 替换为您的权限范围
        map.add("refresh_token", refreshToken);
        map.add("client_secret", "your_client_secret"); // 替换为您的应用客户端密钥

        HttpEntity<MultiValueMap<String, String>> request = new HttpEntity<>(map, headers);

        ResponseEntity<String> response = restTemplate.postForEntity(url, request, String.class);

        if (response.getStatusCode().is2xxSuccessful()) {
            String responseBody = response.getBody();
            JsonNode rootNode = objectMapper.readTree(responseBody);

            String newAccessToken = rootNode.get("access_token").asText();
            String newRefreshToken = rootNode.has("refresh_token") ? rootNode.get("refresh_token").asText() : refreshToken;
            long expiresInSeconds = rootNode.get("expires_in").asLong();

            // 计算新的过期时间
            OffsetDateTime expiryTime = OffsetDateTime.now(ZoneId.systemDefault()).plusSeconds(expiresInSeconds);

            return new TokenResponse(newAccessToken, newRefreshToken, expiryTime);
        } else {
            // 处理错误响应
            throw new RuntimeException("Failed to refresh token: " + response.getStatusCode() + " - " + response.getBody());
        }
    }

    // 辅助类用于封装令牌响应
    public static class TokenResponse {
        private final String accessToken;
        private final String refreshToken;
        private final OffsetDateTime expiryTime;

        public TokenResponse(String accessToken, String refreshToken, OffsetDateTime expiryTime) {
            this.accessToken = accessToken;
            this.refreshToken = refreshToken;
            this.expiryTime = expiryTime;
        }

        public String getAccessToken() { return accessToken; }
        public String getRefreshToken() { return refreshToken; }
        public OffsetDateTime getExpiryTime() { return expiryTime; }
    }
}

// 假设您的 Account 类有以下方法
public class UserAccount {
    private String accessToken;
    private String refreshToken;
    private OffsetDateTime tokenExpiry;

    // ... 构造函数，getter和setter ...

    public void updateTokens(String newAccessToken, String newRefreshToken, OffsetDateTime newExpiry) {
        this.accessToken = newAccessToken;
        this.refreshToken = newRefreshToken;
        this.tokenExpiry = newExpiry;
    }
}

// 假设 currentAccount 是当前用户的 UserAccount 实例
UserAccount currentAccount = // ... 从存储中加载 ...

// 检查令牌是否即将过期或已过期
if (currentAccount.getTokenExpiry().isBefore(OffsetDateTime.now(ZoneId.systemDefault()).plusMinutes(5))) { // 提前5分钟刷新
    try {
        AzureAdTokenRefresher refresher = new AzureAdTokenRefresher();
        AzureAdTokenRefresher.TokenResponse tokenResponse = refresher.refreshAccessToken(currentAccount.getRefreshToken());

        // 更新 account 对象中的令牌信息
        currentAccount.updateTokens(
            tokenResponse.getAccessToken(),
            tokenResponse.getRefreshToken(), // 使用新的刷新令牌，如果返回了的话
            tokenResponse.getExpiryTime()
        );
        // ... 将更新后的 currentAccount 保存回存储 ...

        // GraphServiceClient 的 TokenCredential 会在下次请求时自动获取更新后的令牌
        // 因为它的实现是每次请求时从 account 对象中获取最新令牌。
        // 如果 GraphServiceClient 需要重新构建，则在此处重新构建。
        // 对于上述 lambda 表达式实现的 TokenCredential，通常不需要重新构建 GraphServiceClient。

    } catch (IOException | RuntimeException e) {
        // 处理令牌刷新失败的情况，可能需要用户重新登录
        System.err.println("Failed to refresh access token: " + e.getMessage());
        // 标记用户需要重新认证
    }
}