在Google App Engine Go应用中实现OAuth2用户认证

package main

import (
    "context"
    "fmt"
    "net/http"
    "os" // 用于获取环境变量
    "time"

    "golang.org/x/oauth2"
    "golang.org/x/oauth2/google" // 导入Google特定的端点
    "google.golang.org/appengine"
    "google.golang.org/appengine/log"
    "google.golang.org/appengine/urlfetch" // App Engine HTTP客户端
)

// 定义OAuth2配置，通常在应用启动时初始化
var googleOauthConfig *oauth2.Config

func init() {
    // 确保在部署时设置这些环境变量
    clientID := os.Getenv("GOOGLE_CLIENT_ID")
    clientSecret := os.Getenv("GOOGLE_CLIENT_SECRET")
    redirectURL := os.Getenv("GOOGLE_REDIRECT_URL") // 例如: https://your-app-id.appspot.com/oauth2callback

    if clientID == "" || clientSecret == "" || redirectURL == "" {
        // 在开发环境中可以提供默认值，但在生产环境应严格检查
        // log.Fatal("Missing GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, or GOOGLE_REDIRECT_URL environment variables")
        fmt.Println("WARNING: Missing GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, or GOOGLE_REDIRECT_URL. Using placeholders.")
        clientID = "YOUR_CLIENT_ID"
        clientSecret = "YOUR_CLIENT_SECRET"
        redirectURL = "http://localhost:8080/oauth2callback" // 开发环境示例
    }

    googleOauthConfig = &oauth2.Config{
        RedirectURL:  redirectURL,
        ClientID:     clientID,
        ClientSecret: clientSecret,
        Scopes:       []string{"https://www.googleapis.com/auth/userinfo.profile", "https://www.googleapis.com/auth/userinfo.email"}, // 请求用户基本资料和邮箱
        Endpoint:     google.Endpoint, // 使用Google的OAuth2端点
    }

    http.HandleFunc("/", handleHome)
    http.HandleFunc("/login", handleGoogleLogin)
    http.HandleFunc("/oauth2callback", handleGoogleCallback)
    http.HandleFunc("/userinfo", handleUserInfo) // 用于展示获取到的用户信息
}

// GAE环境下的HTTP客户端
func newAppEngineClient(ctx context.Context) *http.Client {
    return &http.Client{
        Transport: &urlfetch.Transport{Context: ctx},
        Timeout:   30 * time.Second, // 设置超时
    }
}

// handleGoogleLogin 重定向用户到Google进行认证
func handleGoogleLogin(w http.ResponseWriter, r *http.Request) {
    ctx := appengine.NewContext(r)
    // 生成一个随机的state字符串，用于防止CSRF攻击
    // 实际应用中，state应该存储在用户的session中，并在回调时进行验证
    state := generateStateOauthCookie(w) // 示例函数，实际应更健壮

    url := googleOauthConfig.AuthCodeURL(state)
    http.Redirect(w, r, url, http.StatusTemporaryRedirect)
    log.Infof(ctx, "Redirecting to Google for OAuth2: %s", url)
}

// generateStateOauthCookie 示例：生成并设置state cookie
func generateStateOauthCookie(w http.ResponseWriter) string {
    expiration := time.Now().Add(1 * time.Hour)
    b := make([]byte, 16)
    // 使用 crypto/rand 生成更安全的随机数
    _, err := fmt.Sscanf(fmt.Sprintf("%x", time.Now().UnixNano()), "%s", &b) // 简化示例，实际应使用 crypto/rand
    if err != nil {
        // 错误处理
    }
    state := fmt.Sprintf("%x", b)
    cookie := http.Cookie{Name: "oauthstate", Value: state, Expires: expiration, HttpOnly: true, Secure: true}
    http.SetCookie(w, &cookie)
    return state
}

// handleGoogleCallback 处理Google OAuth2回调
func handleGoogleCallback(w http.ResponseWriter, r *http.Request) {
    ctx := appengine.NewContext(r)

    // 1. 验证state参数
    state, err := r.Cookie("oauthstate")
    if err != nil || state.Value != r.FormValue("state") {
        log.Errorf(ctx, "Invalid state parameter: %v", err)
        http.Redirect(w, r, "/", http.StatusTemporaryRedirect)
        return
    }
    // 成功验证后，可以清除state cookie
    http.SetCookie(w, &http.Cookie{Name: "oauthstate", Value: "", Expires: time.Now().Add(-time.Hour)})

    // 2. 交换授权码获取Access Token
    // 使用App Engine的HTTP客户端
    oauth2Ctx := context.WithValue(ctx, oauth2.HTTPClient, newAppEngineClient(ctx))
    token, err := googleOauthConfig.Exchange(oauth2Ctx, r.FormValue("code"))
    if err != nil {
        log.Errorf(ctx, "Code exchange failed: %v", err)
        http.Redirect(w, r, "/", http.StatusTemporaryRedirect)
        return
    }

    // 3. 使用Access Token获取用户信息
    // 可以直接调用Google UserInfo API
    resp, err := newAppEngineClient(ctx).Get("https://www.googleapis.com/oauth2/v2/userinfo?access_token=" + token.AccessToken)
    if err != nil {
        log.Errorf(ctx, "Failed to get user info: %v", err)
        http.Redirect(w, r, "/", http.StatusTemporaryRedirect)
        return
    }
    defer resp.Body.Close()

    // 解析用户信息
    var userInfo map[string]interface{}
    if err := json.NewDecoder(resp.Body).Decode(&userInfo); err != nil {
        log.Errorf(ctx, "Failed to decode user info: %v", err)
        http.Redirect(w, r, "/", http.StatusTemporaryRedirect)
        return
    }

    // 示例：将用户信息存储到会话或数据库
    // 在生产环境中，您需要将此用户信息与您的应用用户关联
    // 例如，将用户的Google ID存储到Datastore，并创建应用内部的会话
    log.Infof(ctx, "User logged in: %v", userInfo)

    // 示例：将用户ID存储到cookie中，作为登录状态
    http.SetCookie(w, &http.Cookie{
        Name:    "user_id",
        Value:   userInfo["id"].(string),
        Expires: time.Now().Add(24 * time.Hour),
        HttpOnly: true,
        Secure:  true, // 生产环境应设置为true
    })

    http.Redirect(w, r, "/userinfo", http.StatusTemporaryRedirect)
}

import "encoding/json" // 需要导入json包

// handleUserInfo 示例：展示用户登录后的信息
func handleUserInfo(w http.ResponseWriter, r *http.Request) {
    ctx := appengine.NewContext(r)
    userIDCookie, err := r.Cookie("user_id")
    if err != nil {
        log.Infof(ctx, "User not logged in, redirecting to home: %v", err)
        http.Redirect(w, r, "/", http.StatusTemporaryRedirect)
        return
    }

    fmt.Fprintf(w, "<h1>Welcome, User ID: %s!</h1>", userIDCookie.Value)
    fmt.Fprintf(w, "<p>This is a protected page. You are logged in via Google OAuth2.</p>")
    fmt.Fprintf(w, "<p><a href=\"/\">Go Home</a></p>")
    // 实际应用中，您会从数据库加载更多用户资料
}

func handleHome(w http.ResponseWriter, r *http.Request) {
    fmt.Fprintf(w, `
        <h1>Google App Engine Go OAuth2 Demo</h1>
        <p><a href="/login">Login with Google</a></p>
    `)
}