WordPress 集成 GitCode OAuth 2.0 登录：从零打造第三方账号认证插件

$params = [
    'client_id'     => 'your_client_id',
    'redirect_uri'  => home_url('/wp-login.php?action=gitcode_callback'),
    'response_type' => 'code',
    'scope'         => 'all_user',
    'state'         => wp_generate_password(32, false), // 防 CSRF
];

wp_redirect('https://gitcode.com/oauth/authorize?' . http_build_query($params));
exit;

// 校验 state
$state = $_GET['state'] ?? '';
if (empty($state) || !get_transient('gcol_state_' . $state)) {
    wp_die('State 校验失败，可能是 CSRF 攻击，请重新登录。');
}
delete_transient('gcol_state_' . $state);

// 用 code 换 token
$url = 'https://gitcode.com/oauth/token?' . http_build_query([
    'grant_type' => 'authorization_code',
    'code'       => $code,
    'client_id'  => $client_id,
]);

$response = wp_remote_post($url, [
    'body'    => ['client_secret' => $client_secret],
    'timeout' => 15,
]);

$response = wp_remote_get('https://api.gitcode.com/api/v5/user', [
    'headers' => ['Authorization' => 'Bearer ' . $access_token],
    'timeout' => 15,
]);

$gitcode_user = json_decode(wp_remote_retrieve_body($response), true);

// 策略1: 按 gitcode_id meta 精确匹配（已绑定过）
$users = get_users([
    'meta_key'   => 'gcol_gitcode_id',
    'meta_value' => $gitcode_user['id'],
    'number'     => 1,
]);

// 策略2: 按邮箱匹配（GitCode 邮箱 = WP 邮箱）
if ($gitcode_user['email']) {
    $user = get_user_by('email', $gitcode_user['email']);
}

// 策略3: 自动注册新账号
$user_id = wp_insert_user([
    'user_login'   => $username,
    'user_email'   => $email,
    'display_name' => $display_name,
    'user_pass'    => wp_generate_password(24),
    'role'         => $cfg['default_role'] ?: 'subscriber',
]);

plugins/gitcode-oauth-login/
├── gitcode-oauth-login.php   # 入口：单例 + 配置集中管理
├── includes/
│   ├── class-settings.php     # 后台设置页面
│   ├── class-oauth.php        # OAuth 核心流程 + 前端注入
│   └── class-profile.php      # 用户资料页绑定展示

final class GCOL_Plugin
{
    private static $instance = null;

    public static function instance()
    {
        if (null === self::$instance) {
            self::$instance = new self();
        }
        return self::$instance;
    }

    private function __construct()
    {
        GCOL_Settings::init();
        GCOL_OAuth::init();
        GCOL_Profile::init();
    }

    public static function config($key = null)
    {
        return [
            'client_id'     => get_option('gcol_client_id', ''),
            'client_secret' => get_option('gcol_client_secret', ''),
            'auto_register' => get_option('gcol_auto_register', '1'),
            'default_role'  => get_option('gcol_default_role', 'subscriber'),
        ];
    }
}

GCOL_Plugin::instance();

public static function field_callback()
{
    $url = home_url('/wp-login.php?action=gitcode_callback');
    echo '<input type="text" readonly value="' . esc_attr($url) . '" onclick="this.select()" />';
}

add_action('login_form', [__CLASS__, 'login_button']);

public static function login_button()
{
    $url = wp_login_url() . '?action=gitcode_login';
    echo '<div class="gitcode-login-divider">—— 或 ——</div>';
    echo '<a href="' . esc_url($url) . '" class="gitcode-login-btn">GitCode 账号登录</a>';
}

add_action('wp_footer', [__CLASS__, 'inject_frontend_button']);

public static function inject_frontend_button()
{
    if (is_user_logged_in()) return;
    $login_url = esc_url(wp_login_url() . '?action=gitcode_login');
    ?>
    <script>
    (function(){
        var btn = document.createElement('a');
        btn.href = '<?php echo $login_url; ?>';
        btn.title = 'GitCode 账号登录';
        
        function tryInject() {
            var target = document.getElementById('login-trigger');
            if (!target) target = document.querySelector('.header-actions .user-avatar-placeholder');
            if (!target) target = document.querySelector('a[href*="wp-login.php"]');
            if (target && target.parentNode) {
                target.parentNode.insertBefore(btn, target.nextSibling);
            }
        }
        
        // 多重试机制，应对异步渲染
        setTimeout(tryInject, 500);
        setTimeout(tryInject, 2000);
        setTimeout(tryInject, 5000);
    })();
    </script>
    <?php
}

add_shortcode('gitcode_login', [__CLASS__, 'shortcode_button']);

public static function shortcode_button()
{
    if (is_user_logged_in()) {
        return '已登录：' . esc_html(wp_get_current_user()->display_name);
    }
    $url = wp_login_url() . '?action=gitcode_login';
    return '<a href="' . esc_url($url) . '">GitCode 账号登录</a>';
}

update_user_meta($user_id, 'gcol_access_token',  $token['access_token']);
update_user_meta($user_id, 'gcol_refresh_token', $token['refresh_token']);
update_user_meta($user_id, 'gcol_avatar_url',    $gitcode_user['avatar_url']);
update_user_meta($user_id, 'gcol_profile_url',   $gitcode_user['html_url']);

public static function refresh_token($user_id)
{
    $url = 'https://gitcode.com/oauth/token?' . http_build_query([
        'grant_type'    => 'refresh_token',
        'refresh_token' => get_user_meta($user_id, 'gcol_refresh_token', true),
    ]);
    $response = wp_remote_post($url, ['timeout' => 15]);
    // ... 更新 access_token 和 refresh_token
}