OAuth2 Authentication with Google and GitHub Providers

package main

import (	"context"
	"encoding/json"
	"fmt"
	"io"
	"log"
	"net/http"
	"os"
	"sync"

	"github.com/google/uuid"
	"golang.org/x/oauth2"
	"golang.org/x/oauth2/github"
	"golang.org/x/oauth2/google")

// OAuthProvider represents an OAuth2 identity provider
type OAuthProvider struct {
	Name          string
	Config        *oauth2.Config
	ProfileURL    string
	ProfileParser func([]byte) (*UserProfile, error)
}

// UserProfile holds user information retrieved from OAuth provider
type UserProfile struct {
	ID        string `json:"id"`
	Name      string `json:"name"`
	Email     string `json:"email"`
	AvatarURL string `json:"avatar_url"`
	Provider  string `json:"provider"`
}

// OAuthService manages multiple OAuth2 providers and user sessions
type OAuthService struct {
	providers map[string]*OAuthProvider
	// In production, use a secure session store (e.g., Redis) instead of map
	sessions map[string]*UserProfile
	mu       sync.RWMutex
	cookieName string
	cookieSecret string
}

// NewOAuthService creates a new service with configured providers
func NewOAuthService(cookieSecret string) *OAuthService {
	return &OAuthService{
		providers: make(map[string]*OAuthProvider),
		sessions: make(map[string]*UserProfile),
		cookieName: "oauth_session",
		cookieSecret: cookieSecret,
	}
}

// RegisterProvider adds a new OAuth2 provider to the service
func (s *OAuthService) RegisterProvider(provider *OAuthProvider) {
	s.mu.Lock()
	defer s.mu.Unlock()
	s.providers[provider.Name] = provider
}

// getProvider retrieves a provider by name (thread-safe)
func (s *OAuthService) getProvider(name string) (*OAuthProvider, bool) {
	s.mu.RLock()
	defer s.mu.RUnlock()
	p, exists := s.providers[name]
	return p, exists
}

// loginHandler redirects user to OAuth provider's authorization URL
func (s *OAuthService) loginHandler(w http.ResponseWriter, r *http.Request) {
	providerName := r.URL.Query().Get("provider")
	if providerName == "" {
		http.Error(w, "provider query parameter required", http.StatusBadRequest)
		return
	}

	provider, exists := s.getProvider(providerName)
	if !exists {
		http.Error(w, fmt.Sprintf("provider %s not supported", providerName), http.StatusBadRequest)
		return
	}

	// Generate random state to prevent CSRF attacks
	state := uuid.NewString()
	// In production, store state in secure cookie or session
	http.SetCookie(w, &http.Cookie{
		Name:     "oauth_state",
		Value:    state,
		Path:     "/",
		MaxAge:   300, // 5 minutes
		HttpOnly: true,
		Secure:   true, // Enable in HTTPS environments
		SameSite: http.SameSiteLaxMode,
	})

	// Redirect to provider's authorization URL
	authURL := provider.Config.AuthCodeURL(state, oauth2.AccessTypeOnline)
	http.Redirect(w, r, authURL, http.StatusTemporaryRedirect)
}

// callbackHandler handles the OAuth provider's callback and retrieves user profile
func (s *OAuthService) callbackHandler(w http.ResponseWriter, r *http.Request) {
	providerName := r.URL.Query().Get("provider")
	if providerName == "" {
		http.Error(w, "provider query parameter required", http.StatusBadRequest)
		return
	}

	provider, exists := s.getProvider(providerName)
	if !exists {
		http.Error(w, fmt.Sprintf("provider %s not supported", providerName), http.StatusBadRequest)
		return
	}

	// Verify CSRF state
	stateCookie, err := r.Cookie("oauth_state")
	if err != nil || stateCookie.Value != r.URL.Query().Get("state") {
		http.Error(w, "invalid or missing CSRF state", http.StatusForbidden)
		return
	}

	// Exchange authorization code for access token
	code := r.URL.Query().Get("code")
	token, err := provider.Config.Exchange(context.Background(), code)
	if err != nil {
		http.Error(w, fmt.Sprintf("failed to exchange code: %v", err), http.StatusInternalServerError)
		return
	}

	// Retrieve user profile from provider's API
	client := provider.Config.Client(context.Background(), token)
	resp, err := client.Get(provider.ProfileURL)
	if err != nil {
		http.Error(w, fmt.Sprintf("failed to get user profile: %v", err), http.StatusInternalServerError)
		return
	}
	defer resp.Body.Close()

	// Parse profile response
	profileData, err := io.ReadAll(resp.Body)
	if err != nil {
		http.Error(w, fmt.Sprintf("failed to read profile data: %v", err), http.StatusInternalServerError)
		return
	}
	profile, err := provider.ProfileParser(profileData)
	if err != nil {
		http.Error(w, fmt.Sprintf("failed to parse profile: %v", err), http.StatusInternalServerError)
		return
	}
	profile.Provider = providerName

	// Create session (in production, use Redis or database)
	sessionID := uuid.NewString()
	s.mu.Lock()
	s.sessions[sessionID] = profile
	s.mu.Unlock()

	// Set session cookie
	http.SetCookie(w, &http.Cookie{
		Name:     s.cookieName,
		Value:    sessionID,
		Path:     "/",
		MaxAge:   86400, // 24 hours
		HttpOnly: true,
		Secure:   true,
		SameSite: http.SameSiteLaxMode,
	})

	// Redirect to user profile page
	http.Redirect(w, r, "/profile", http.StatusTemporaryRedirect)
}

// profileHandler displays the authenticated user's profile
func (s *OAuthService) profileHandler(w http.ResponseWriter, r *http.Request) {
	// Get session cookie
	cookie, err := r.Cookie(s.cookieName)
	if err != nil {
		http.Redirect(w, r, "/login?provider=google", http.StatusTemporaryRedirect)
		return
	}

	// Retrieve user profile from session store
	s.mu.RLock()
	profile, exists := s.sessions[cookie.Value]
	s.mu.RUnlock()
	if !exists {
		http.Redirect(w, r, "/login?provider=google", http.StatusTemporaryRedirect)
		return
	}

	// Display profile as HTML
	w.Header().Set("Content-Type", "text/html")
	fmt.Fprintf(w, `<html>
	<head><title>User Profile</title></head>
	<body>
		<h1>Welcome, %s!</h1>
		<p>ID: %s</p>
		<p>Email: %s</p>
		<p>Provider: %s</p>
		<img src="%s" alt="Avatar" width="100">
	</body>
</html>`,
		profile.Name, profile.ID, profile.Email, profile.Provider, profile.AvatarURL)
}

// Example profile parsers
func googleProfileParser(data []byte) (*UserProfile, error) {
	var resp struct {
		ID        string `json:"id"`
		Name      string `json:"name"`
		Email     string `json:"email"`
		Picture   string `json:"picture"`
	}
	if err := json.Unmarshal(data, &resp); err != nil {
		return nil, err
	}
	return &UserProfile{
		ID:        resp.ID,
		Name:      resp.Name,
		Email:     resp.Email,
		AvatarURL: resp.Picture,
	}, nil
}

func githubProfileParser(data []byte) (*UserProfile, error) {
	var resp struct {
		ID        int    `json:"id"`
		Login     string `json:"login"`
		Name      string `json:"name"`
		Email     string `json:"email"`
		AvatarURL string `json:"avatar_url"`
	}
	if err := json.Unmarshal(data, &resp); err != nil {
		return nil, err
	}
	return &UserProfile{
		ID:        fmt.Sprintf("%d", resp.ID),
		Name:      resp.Name,
		Email:     resp.Email,
		AvatarURL: resp.AvatarURL,
	}, nil
}

// Example Usage
func main() {
	// Load OAuth credentials from environment variables (never hardcode!)
	googleClientID := os.Getenv("GOOGLE_CLIENT_ID")
	googleClientSecret := os.Getenv("GOOGLE_CLIENT_SECRET")
	githubClientID := os.Getenv("GITHUB_CLIENT_ID")
	githubClientSecret := os.Getenv("GITHUB_CLIENT_SECRET")
	cookieSecret := os.Getenv("COOKIE_SECRET")
	if cookieSecret == "" {
		cookieSecret = uuid.NewString() // For demo only; use a fixed secret in production
	}

	// Create OAuth service
	service := NewOAuthService(cookieSecret)

	// Register Google provider
	service.RegisterProvider(&OAuthProvider{
		Name: "google",
		Config: &oauth2.Config{
			ClientID:     googleClientID,
			ClientSecret: googleClientSecret,
			RedirectURL:  "http://localhost:8080/auth/callback?provider=google",
			Scopes:       []string{"openid", "email", "profile"},
			Endpoint:     google.Endpoint,
		},
		ProfileURL:    "https://www.googleapis.com/oauth2/v3/userinfo",
		ProfileParser: googleProfileParser,
	})

	// Register GitHub provider
	service.RegisterProvider(&OAuthProvider{
		Name: "github",
		Config: &oauth2.Config{
			ClientID:     githubClientID,
			ClientSecret: githubClientSecret,
			RedirectURL:  "http://localhost:8080/auth/callback?provider=github",
			Scopes:       []string{"user:email"},
			Endpoint:     github.Endpoint,
		},
		ProfileURL:    "https://api.github.com/user",
		ProfileParser: githubProfileParser,
	})

	// Register HTTP handlers
	http.HandleFunc("/auth/login", service.loginHandler)
	http.HandleFunc("/auth/callback", service.callbackHandler)
	http.HandleFunc("/profile", service.profileHandler)

	// Start HTTP server
	log.Println("OAuth2 authentication service starting on :8080")
	log.Fatal(http.ListenAndServe(":8080", nil))
}