<!-- 编程指南登录按钮 -->
<button onclick="loginWithCodeGuide()">使用编程指南登录</button>

<script>
function loginWithCodeGuide() {
  const clientId = 'YOUR_CLIENT_ID';
  const redirectUri = encodeURIComponent('https://yoursite.com/callback');
  const state = Math.random().toString(36).substring(2);

  // 保存 state 到 sessionStorage，回调时验证
  sessionStorage.setItem('oauth_state', state);

  window.location.href =
    'https://code-guide.vip/oauth/consent' +
    '?client_id=' + clientId +
    '&redirect_uri=' + redirectUri +
    '&response_type=code' +
    '&scope=user_info' +
    '&state=' + state;
}
</script>

// callback 页面
const params = new URLSearchParams(window.location.search);
const code = params.get('code');
const state = params.get('state');
const error = params.get('error');

// 验证 state 防止 CSRF
const savedState = sessionStorage.getItem('oauth_state');
if (state !== savedState) {
  alert('安全验证失败');
  return;
}

if (error) {
  // 用户拒绝授权
  console.log('授权被拒绝:', error);
  return;
}

if (code) {
  // 将 code 发送到你的后端换取 token
  fetch('/api/auth/code-guide/callback', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ code, state })
  })
  .then(res => res.json())
  .then(data => {
    // 登录成功，保存用户信息
    console.log('登录成功:', data);
  });
}

const express = require('express');
const axios = require('axios');
const app = express();

const CLIENT_ID = 'your_client_id';
const CLIENT_SECRET = 'your_client_secret';
const REDIRECT_URI = 'https://yoursite.com/callback';
const API_BASE = 'https://api.code-guide.autogptai.club';

app.use(express.json());

// 处理回调
app.post('/api/auth/code-guide/callback', async (req, res) => {
  const { code } = req.body;

  try {
    // 第一步：用 code 换取 access_token
    const tokenRes = await axios.post(
      API_BASE + '/oauth/token',
      new URLSearchParams({
        grant_type: 'authorization_code',
        code,
        client_id: CLIENT_ID,
        client_secret: CLIENT_SECRET,
        redirect_uri: REDIRECT_URI
      }).toString(),
      { headers: { 'Content-Type': 'application/x-www-form-urlencoded' } }
    );

    const { access_token, refresh_token } = tokenRes.data.data;

    // 第二步：用 access_token 获取用户信息
    const userRes = await axios.get(API_BASE + '/oauth/userinfo', {
      headers: { Authorization: 'Bearer ' + access_token }
    });

    const userInfo = userRes.data.data;

    // 第三步：在你的系统中查找或创建用户，生成登录态
    // ...

    res.json({
      success: true,
      user: userInfo,
      access_token,
      refresh_token
    });
  } catch (error) {
    console.error('OAuth 回调处理失败:', error);
    res.status(500).json({ success: false, message: '登录失败' });
  }
});

app.listen(3000);