223 lines
6.9 KiB
Go
223 lines
6.9 KiB
Go
package provider
|
||
|
||
import (
|
||
"context"
|
||
"encoding/json"
|
||
"fmt"
|
||
"io"
|
||
"net/http"
|
||
"net/url"
|
||
"strings"
|
||
"time"
|
||
|
||
"apps/backend/internal/module/threads/domain"
|
||
)
|
||
|
||
// MetaProvider — Meta Threads OAuth (when AppId/Secret configured).
|
||
type MetaProvider struct {
|
||
AppID string
|
||
AppSecret string
|
||
HTTPClient *http.Client
|
||
AuthBase string // default https://threads.net
|
||
GraphBase string // default https://graph.threads.net
|
||
}
|
||
|
||
func NewMeta(appID, appSecret string) *MetaProvider {
|
||
return &MetaProvider{
|
||
AppID: appID, AppSecret: appSecret,
|
||
HTTPClient: &http.Client{Timeout: 20 * time.Second},
|
||
AuthBase: "https://threads.net",
|
||
GraphBase: "https://graph.threads.net",
|
||
}
|
||
}
|
||
|
||
func (m *MetaProvider) Name() string { return "meta" }
|
||
|
||
func (m *MetaProvider) AuthorizeURL(state, redirectURI string) string {
|
||
q := url.Values{}
|
||
q.Set("client_id", m.AppID)
|
||
q.Set("redirect_uri", redirectURI)
|
||
// basic + 發文 + 回覆/對話 + insights + 提及 + 公開人設探索（對標帳號 profile_posts）
|
||
q.Set("scope", "threads_basic,threads_content_publish,threads_manage_replies,threads_manage_insights,threads_manage_mentions,threads_profile_discovery")
|
||
q.Set("response_type", "code")
|
||
q.Set("state", state)
|
||
return strings.TrimRight(m.AuthBase, "/") + "/oauth/authorize?" + q.Encode()
|
||
}
|
||
|
||
func (m *MetaProvider) ExchangeCode(ctx context.Context, code, redirectURI string) (*domain.TokenPair, error) {
|
||
// 1) code → short-lived token
|
||
form := url.Values{}
|
||
form.Set("client_id", m.AppID)
|
||
form.Set("client_secret", m.AppSecret)
|
||
form.Set("grant_type", "authorization_code")
|
||
form.Set("redirect_uri", redirectURI)
|
||
form.Set("code", code)
|
||
endpoint := strings.TrimRight(m.GraphBase, "/") + "/oauth/access_token"
|
||
req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, strings.NewReader(form.Encode()))
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||
resp, err := m.HTTPClient.Do(req)
|
||
if err != nil {
|
||
return nil, domain.ErrOAuthExchange
|
||
}
|
||
defer resp.Body.Close()
|
||
body, _ := io.ReadAll(resp.Body)
|
||
if resp.StatusCode >= 300 {
|
||
return nil, fmt.Errorf("%w: %s", domain.ErrOAuthExchange, string(body))
|
||
}
|
||
var tok struct {
|
||
AccessToken string `json:"access_token"`
|
||
UserID int64 `json:"user_id"`
|
||
ExpiresIn int64 `json:"expires_in"`
|
||
}
|
||
if err := json.Unmarshal(body, &tok); err != nil || tok.AccessToken == "" {
|
||
return nil, domain.ErrOAuthExchange
|
||
}
|
||
// Meta short-lived 常不回 expires_in（約 1h）
|
||
expSec := tok.ExpiresIn
|
||
if expSec <= 0 {
|
||
expSec = 3600
|
||
}
|
||
pair := &domain.TokenPair{
|
||
AccessToken: tok.AccessToken,
|
||
ExpiresIn: expSec,
|
||
UserID: fmt.Sprintf("%d", tok.UserID),
|
||
}
|
||
// 2) short-lived → long-lived（之後「延長 token」才能用 th_refresh_token，無需重走授權頁）
|
||
if long, lerr := m.exchangeLongLived(ctx, pair.AccessToken); lerr == nil && long != nil {
|
||
pair.AccessToken = long.AccessToken
|
||
pair.RefreshToken = long.AccessToken // 長效 token 本身就是 refresh 把手
|
||
if long.ExpiresIn > 0 {
|
||
pair.ExpiresIn = long.ExpiresIn
|
||
} else {
|
||
pair.ExpiresIn = 60 * 24 * 3600 // ~60d
|
||
}
|
||
} else {
|
||
// 長效失敗仍回短效，延長 token 可能失敗 → 使用者需重連
|
||
pair.RefreshToken = pair.AccessToken
|
||
}
|
||
_ = m.fillProfile(ctx, pair)
|
||
return pair, nil
|
||
}
|
||
|
||
// exchangeLongLived: GET /access_token?grant_type=th_exchange_token&client_secret=…&access_token=…
|
||
func (m *MetaProvider) exchangeLongLived(ctx context.Context, shortLived string) (*domain.TokenPair, error) {
|
||
q := url.Values{}
|
||
q.Set("grant_type", "th_exchange_token")
|
||
q.Set("client_secret", m.AppSecret)
|
||
q.Set("access_token", shortLived)
|
||
u := strings.TrimRight(m.GraphBase, "/") + "/access_token?" + q.Encode()
|
||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, u, nil)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
resp, err := m.HTTPClient.Do(req)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
defer resp.Body.Close()
|
||
body, _ := io.ReadAll(resp.Body)
|
||
if resp.StatusCode >= 300 {
|
||
return nil, fmt.Errorf("long-lived exchange failed: %s", string(body))
|
||
}
|
||
var tok struct {
|
||
AccessToken string `json:"access_token"`
|
||
ExpiresIn int64 `json:"expires_in"`
|
||
TokenType string `json:"token_type"`
|
||
}
|
||
if err := json.Unmarshal(body, &tok); err != nil || tok.AccessToken == "" {
|
||
return nil, fmt.Errorf("long-lived exchange parse: %s", string(body))
|
||
}
|
||
return &domain.TokenPair{
|
||
AccessToken: tok.AccessToken,
|
||
RefreshToken: tok.AccessToken,
|
||
ExpiresIn: tok.ExpiresIn,
|
||
}, nil
|
||
}
|
||
|
||
// Refresh uses the stored long-lived token (not browser re-auth).
|
||
// GET /refresh_access_token?grant_type=th_refresh_token&access_token={long-lived}
|
||
func (m *MetaProvider) Refresh(ctx context.Context, longLivedToken string) (*domain.TokenPair, error) {
|
||
if strings.TrimSpace(longLivedToken) == "" {
|
||
return nil, domain.ErrRefreshFailed
|
||
}
|
||
q := url.Values{}
|
||
q.Set("grant_type", "th_refresh_token")
|
||
q.Set("access_token", longLivedToken)
|
||
u := strings.TrimRight(m.GraphBase, "/") + "/refresh_access_token?" + q.Encode()
|
||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, u, nil)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
resp, err := m.HTTPClient.Do(req)
|
||
if err != nil {
|
||
return nil, fmt.Errorf("%w: network", domain.ErrRefreshFailed)
|
||
}
|
||
defer resp.Body.Close()
|
||
body, _ := io.ReadAll(resp.Body)
|
||
if resp.StatusCode >= 300 {
|
||
return nil, fmt.Errorf("%w: %s", domain.ErrRefreshFailed, truncateBody(string(body), 240))
|
||
}
|
||
var tok struct {
|
||
AccessToken string `json:"access_token"`
|
||
ExpiresIn int64 `json:"expires_in"`
|
||
}
|
||
if err := json.Unmarshal(body, &tok); err != nil || tok.AccessToken == "" {
|
||
return nil, fmt.Errorf("%w: empty token", domain.ErrRefreshFailed)
|
||
}
|
||
// 新長效 token 同時當 access 與下次 refresh 把手
|
||
exp := tok.ExpiresIn
|
||
if exp <= 0 {
|
||
exp = 60 * 24 * 3600
|
||
}
|
||
return &domain.TokenPair{
|
||
AccessToken: tok.AccessToken,
|
||
RefreshToken: tok.AccessToken,
|
||
ExpiresIn: exp,
|
||
}, nil
|
||
}
|
||
|
||
func truncateBody(s string, n int) string {
|
||
if len(s) <= n {
|
||
return s
|
||
}
|
||
return s[:n] + "…"
|
||
}
|
||
|
||
func (m *MetaProvider) fillProfile(ctx context.Context, pair *domain.TokenPair) error {
|
||
u := strings.TrimRight(m.GraphBase, "/") + "/me?fields=id,username,name,threads_profile_picture_url&access_token=" + url.QueryEscape(pair.AccessToken)
|
||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, u, nil)
|
||
if err != nil {
|
||
return err
|
||
}
|
||
resp, err := m.HTTPClient.Do(req)
|
||
if err != nil {
|
||
return err
|
||
}
|
||
defer resp.Body.Close()
|
||
body, _ := io.ReadAll(resp.Body)
|
||
var p struct {
|
||
ID string `json:"id"`
|
||
Username string `json:"username"`
|
||
Name string `json:"name"`
|
||
Pic string `json:"threads_profile_picture_url"`
|
||
}
|
||
if err := json.Unmarshal(body, &p); err != nil {
|
||
return err
|
||
}
|
||
if p.ID != "" {
|
||
pair.UserID = p.ID
|
||
}
|
||
pair.Username = p.Username
|
||
pair.DisplayName = p.Name
|
||
if pair.DisplayName == "" {
|
||
pair.DisplayName = p.Username
|
||
}
|
||
pair.AvatarURL = p.Pic
|
||
return nil
|
||
}
|
||
|
||
var _ domain.Provider = (*MetaProvider)(nil)
|