Golang App Engine中OAuth认证与授权的实现指南

package myapp

import (
    "fmt"
    "net/http"

    "google.golang.org/appengine"
    "google.golang.org/appengine/user"
)

func init() {
    http.HandleFunc("/", handler)
}

func handler(w http.ResponseWriter, r *http.Request) {
    c := appengine.NewContext(r)
    u := user.Current(c) // 获取当前登录的用户

    if u == nil {
        // 用户未登录，生成登录URL并重定向
        loginURL, err := user.LoginURL(c, r.URL.String())
        if err != nil {
            http.Error(w, err.Error(), http.StatusInternalServerError)
            return
        }
        w.Header().Set("Location", loginURL)
        w.WriteHeader(http.StatusFound)
        return
    }

    // 用户已登录
    fmt.Fprintf(w, "Hello, %v! Welcome to your App Engine app.", u.Email)

    // 提供登出URL
    logoutURL, err := user.LogoutURL(c, "/")
    if err != nil {
        http.Error(w, err.Error(), http.StatusInternalServerError)
        return
    }
    fmt.Fprintf(w, "<br><a href=\"%s\">Logout</a>", logoutURL)
}

env_variables:
  GOOGLE_CLIENT_ID: "YOUR_CLIENT_ID.apps.googleusercontent.com"
  GOOGLE_CLIENT_SECRET: "YOUR_CLIENT_SECRET"

package myapp

import (
    "context"
    "encoding/json"
    "fmt"
    "io/ioutil"
    "net/http"
    "os"

    "golang.org/x/oauth2"
    "golang.org/x/oauth2/google"
    "google.golang.org/appengine"
    "google.golang.org/appengine/datastore"
    "google.golang.org/appengine/urlfetch"
    "google.golang.org/appengine/user"
)

// 定义一个结构体来存储用户的OAuth令牌
type OAuthToken struct {
    ID     string `datastore:"-"` // 用户ID作为Datastore Key的名称
    Token  *oauth2.Token
}

// 初始化OAuth配置
var (
    oauthConf *oauth2.Config
    // 请求访问Google UserInfo API的范围
    oauthScopes = []string{"https://www.googleapis.com/auth/userinfo.email"}
)

func init() {
    clientID := os.Getenv("GOOGLE_CLIENT_ID")
    clientSecret := os.Getenv("GOOGLE_CLIENT_SECRET")

    if clientID == "" || clientSecret == "" {
        panic("GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET must be set as environment variables.")
    }

    oauthConf = &oauth2.Config{
        ClientID:     clientID,
        ClientSecret: clientSecret,
        RedirectURL:  "/oauth2callback", // 必须与Google Cloud Console中配置的重定向URI一致
        Scopes:       oauthScopes,
        Endpoint:     google.Endpoint,
    }

    http.HandleFunc("/", handleMain)
    http.HandleFunc("/login", handleLogin)
    http.HandleFunc("/oauth2callback", handleOAuth2Callback)
    http.HandleFunc("/profile", handleProfile)
}

func handleMain(w http.ResponseWriter, r *http.Request) {
    c := appengine.NewContext(r)
    u := user.Current(c)

    if u == nil {
        fmt.Fprintf(w, `<h1>Welcome!</h1><p><a href="/login">Login with Google</a></p>`)
        return
    }

    fmt.Fprintf(w, `<h1>Hello, %s!</h1><p><a href="/profile">View My Profile (via Google API)</a></p>`, u.Email)
    logoutURL, _ := user.LogoutURL(c, "/")
    fmt.Fprintf(w, `<p><a href="%s">Logout</a></p>`, logoutURL)
}

// 处理登录请求，重定向到Google授权页面
func handleLogin(w http.ResponseWriter, r *http.Request) {
    // state参数用于防止CSRF攻击，这里简单生成，生产环境应更复杂
    state := "random-string-for-csrf-protection"
    url := oauthConf.AuthCodeURL(state, oauth2.AccessTypeOffline, oauth2.ApprovalForce)
    http.Redirect(w, r, url, http.StatusTemporaryRedirect)
}

// 处理OAuth回调
func handleOAuth2Callback(w http.ResponseWriter, r *http.Request) {
    c := appengine.NewContext(r)
    u := user.Current(c) // 确保用户已通过appengine/user登录

    if u == nil {
        http.Error(w, "User not authenticated with App Engine.", http.StatusUnauthorized)
        return
    }

    // 检查state参数以防止CSRF
    if r.FormValue("state") != "random-string-for-csrf-protection" {
        http.Error(w, "Invalid state parameter", http.StatusBadRequest)
        return
    }

    code := r.FormValue("code")
    if code == "" {
        http.Error(w, "Authorization code not found", http.StatusBadRequest)
        return
    }

    // 使用授权码交换令牌
    tok, err := oauthConf.Exchange(c, code) // Pass appengine.Context
    if err != nil {
        http.Error(w, fmt.Sprintf("Failed to exchange token: %v", err), http.StatusInternalServerError)
        return
    }

    // 存储令牌
    tokenEntity := OAuthToken{
        ID:    u.ID, // 使用App Engine用户ID作为Datastore Key
        Token: tok,
    }
    key := datastore.NewKey(c, "OAuthToken", tokenEntity.ID, 0, nil)
    _, err = datastore.Put(c, key, &tokenEntity)
    if err != nil {
        http.Error(w, fmt.Sprintf("Failed to store token: %v", err), http.StatusInternalServerError)
        return
    }

    http.Redirect(w, r, "/profile", http.StatusFound)
}

// 使用访问令牌调用Google API
func handleProfile(w http.ResponseWriter, r *http.Request) {
    c := appengine.NewContext(r)
    u := user.Current(c)

    if u == nil {
        http.Error(w, "User not authenticated with App Engine.", http.StatusUnauthorized)
        return
    }

    // 从Datastore加载令牌
    var tokenEntity OAuthToken
    key := datastore.NewKey(c, "OAuthToken", u.ID, 0, nil)
    err := datastore.Get(c, key, &tokenEntity)
    if err == datastore.ErrNoSuchEntity {
        fmt.Fprintf(w, `<h1>Authorization Required</h1><p>Your app needs authorization to access your profile.</p><p><a href="/login">Authorize Now</a></p>`)
        return
    }
    if err != nil {
        http.Error(w, fmt.Sprintf("Failed to retrieve token: %v", err), http.StatusInternalServerError)
        return
    }

    // 创建一个使用App Engine URL Fetch服务的HTTP客户端
    // App Engine要求使用其内置的urlfetch服务进行外部HTTP请求
    httpClient := &http.Client{
        Transport: &oauth2.Transport{
            Source: oauth2.ReuseTokenSource(tokenEntity.Token, &appengine.Transport{Context: c}),
            Base:   &urlfetch.Transport{Context: c},
        },
    }

    // 使用令牌客户端调用Google UserInfo API
    resp, err := httpClient.Get("https://www.googleapis.com/oauth2/v2/userinfo")
    if err != nil {
        http.Error(w, fmt.Sprintf("Failed to get user info: %v", err), http.StatusInternalServerError)
        return
    }
    defer resp.Body.Close()

    body, err := ioutil.ReadAll(resp.Body)
    if err != nil {
        http.Error(w, fmt.Sprintf("Failed to read response body: %v", err), http.StatusInternalServerError)
        return
    }

    var userInfo map[string]interface{}
    json.Unmarshal(body, &userInfo)

    fmt.Fprintf(w, "<h1>Your Google Profile Info:</h1><pre>%s</pre>", string(body))
    fmt.Fprintf(w, `<p><a href="/">Back to Home</a></p>`)
}