#刷新 token 使用源码解析

// 覆盖原生实现，支持 query params 获取
public class PigxOAuth2RefreshTokenAuthenticationConverter implements AuthenticationConverter {

    public Authentication convert(HttpServletRequest request) {
        // 1. 从 query + body 中统一获取参数
        MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getParameters(request);

        // 2. 校验 grant_type 是否为 refresh_token
        String grantType = parameters.getFirst("grant_type");
        if (!"refresh_token".equals(grantType)) return null;

        // 3. 校验 refresh_token 参数（必填）
        String refreshToken = parameters.getFirst("refresh_token");
        ...

        // 4. 解析 scope（可选，可重新指定权限范围）
        Set<String> requestedScopes = parseScopes(parameters);

        // 5. 组装认证对象
        return new OAuth2RefreshTokenAuthenticationToken(
            refreshToken, clientPrincipal, requestedScopes, additionalParameters);
    }
}

public AuthenticationConverter accessTokenRequestConverter() {
    return new DelegatingAuthenticationConverter(Arrays.asList(
        new OAuth2ResourceOwnerPasswordAuthenticationConverter(),  // 密码模式
        new OAuth2ResourceOwnerSmsAuthenticationConverter(),       // 短信模式
        new PigxOAuth2RefreshTokenAuthenticationConverter(),       // 刷新 Token
        new OAuth2ClientCredentialsAuthenticationConverter(),      // 客户端模式
        new OAuth2AuthorizationCodeAuthenticationConverter(),      // 授权码模式
        ...
    ));
}

// Spring Authorization Server 内置实现
public class OAuth2RefreshTokenAuthenticationProvider implements AuthenticationProvider {

    public Authentication authenticate(Authentication authentication) {
        OAuth2RefreshTokenAuthenticationToken refreshTokenAuth = (OAuth2RefreshTokenAuthenticationToken) authentication;

        // 1. 根据 refresh_token 值查找授权信息
        OAuth2Authorization authorization = authorizationService.findByToken(
            refreshTokenAuth.getRefreshToken(), OAuth2TokenType.REFRESH_TOKEN);
        ...

        // 2. 验证客户端是否支持 refresh_token 授权模式
        RegisteredClient registeredClient = ...;
        if (!registeredClient.getAuthorizationGrantTypes()
                .contains(AuthorizationGrantType.REFRESH_TOKEN)) {
            throw new OAuth2AuthenticationException(...);
        }

        // 3. 生成新的 access_token
        OAuth2AccessToken accessToken = tokenGenerator.generate(tokenContext);

        // 4. 生成新的 refresh_token（如果启用了轮转）
        OAuth2RefreshToken refreshToken = tokenGenerator.generate(refreshTokenContext);

        // 5. 返回认证结果
        return new OAuth2AccessTokenAuthenticationToken(
            registeredClient, clientPrincipal, accessToken, refreshToken, additionalParameters);
    }
}

@Bean
public OAuth2TokenGenerator oAuth2TokenGenerator() {
    CustomeOAuth2AccessTokenGenerator accessTokenGenerator = new CustomeOAuth2AccessTokenGenerator();
    // 注入 Token 增加关联用户信息
    accessTokenGenerator.setAccessTokenCustomizer(new CustomeOAuth2TokenCustomizer());
    return new DelegatingOAuth2TokenGenerator(accessTokenGenerator, new OAuth2RefreshTokenGenerator());
}

// 客户端 Token 配置
TokenSettings.builder()
    .accessTokenFormat(OAuth2TokenFormat.REFERENCE)
    .accessTokenTimeToLive(Duration.ofSeconds(accessTokenValidity))   // 默认 12 小时
    .refreshTokenTimeToLive(Duration.ofSeconds(refreshTokenValidity)) // 默认 30 天
    .build()

// Redis Token 存储
public class PigxRedisOAuth2AuthorizationService implements OAuth2AuthorizationService {

    public void save(OAuth2Authorization authorization) {
        // 1. 存储 refresh_token
        if (isRefreshToken(authorization)) {
            OAuth2RefreshToken refreshToken = authorization.getRefreshToken().getToken();
            long ttl = ChronoUnit.SECONDS.between(refreshToken.getIssuedAt(), refreshToken.getExpiresAt());
            redisTemplate.opsForValue().set(
                "token::refresh_token::" + refreshToken.getTokenValue(),
                authorization, ttl, TimeUnit.SECONDS);
        }

        // 2. 存储 access_token
        if (isAccessToken(authorization)) {
            OAuth2AccessToken accessToken = authorization.getAccessToken().getToken();
            long ttl = ChronoUnit.SECONDS.between(accessToken.getIssuedAt(), accessToken.getExpiresAt());
            redisTemplate.opsForValue().set(
                "token::access_token::" + accessToken.getTokenValue(),
                authorization, ttl, TimeUnit.SECONDS);

            // 3. 维护 username 与 access_token 的关系索引
            String tokenUsername = "token::username::" + username + "::" + clientId
                + "::" + tenantId + "::" + accessToken.getTokenValue();
            redisTemplate.opsForValue().set(tokenUsername, accessToken.getTokenValue(), ttl, TimeUnit.SECONDS);
        }
    }
}

// 认证成功处理器
public class PigxAuthenticationSuccessEventHandler implements AuthenticationSuccessHandler {

    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
                                        Authentication authentication) {
        OAuth2AccessTokenAuthenticationToken tokenAuth = (OAuth2AccessTokenAuthenticationToken) authentication;
        OAuth2AccessToken accessToken = tokenAuth.getAccessToken();
        OAuth2RefreshToken refreshToken = tokenAuth.getRefreshToken();

        // 组装响应
        OAuth2AccessTokenResponse.Builder builder = OAuth2AccessTokenResponse
            .withToken(accessToken.getTokenValue())
            .tokenType(accessToken.getTokenType())
            .scopes(accessToken.getScopes())
            .expiresIn(ChronoUnit.SECONDS.between(accessToken.getIssuedAt(), accessToken.getExpiresAt()));

        if (refreshToken != null) {
            builder.refreshToken(refreshToken.getTokenValue());  // 返回新的 refresh_token
        }

        // 无状态，清除 SecurityContext
        SecurityContextHolder.clearContext();
        accessTokenHttpResponseConverter.write(builder.build(), null, httpResponse);
    }
}