import crypto from 'crypto';

function generateCodeChallenge(codeVerifier: string): string {
  return crypto
    .createHash('sha256')
    .update(codeVerifier)
    .digest('base64')
    .replace(/\+/g, '-')
    .replace(/\//g, '_')
    .replace(/=/g, '');
}

const codeVerifier = crypto.randomBytes(32).toString('hex');
const codeChallenge = generateCodeChallenge(codeVerifier);

import java.security.MessageDigest;
import java.security.SecureRandom;
import java.util.Base64;

public class PKCEUtil {
    public static String generateCodeVerifier() {
        SecureRandom sr = new SecureRandom();
        byte[] code = new byte[32];
        sr.nextBytes(code);
        return bytesToHex(code);
    }

    public static String generateCodeChallenge(String codeVerifier) throws Exception {
        MessageDigest digest = MessageDigest.getInstance("SHA-256");
        byte[] hash = digest.digest(codeVerifier.getBytes("UTF-8"));
        return Base64.getUrlEncoder().withoutPadding().encodeToString(hash);
    }

    private static String bytesToHex(byte[] bytes) {
        StringBuilder sb = new StringBuilder();
        for (byte b : bytes) sb.append(String.format("%02x", b));
        return sb.toString();
    }
}

import hashlib
import os
import base64

def generate_code_verifier() -> str:
    return os.urandom(32).hex()

def generate_code_challenge(code_verifier: str) -> str:
    digest = hashlib.sha256(code_verifier.encode()).digest()
    return base64.urlsafe_b64encode(digest).rstrip(b'=').decode()

code_verifier = generate_code_verifier()
code_challenge = generate_code_challenge(code_verifier)

using System.Security.Cryptography;
using System.Text;

public static class PKCEUtil
{
    public static string GenerateCodeVerifier()
    {
        var bytes = RandomNumberGenerator.GetBytes(32);
        return Convert.ToHexString(bytes).ToLower();
    }

    public static string GenerateCodeChallenge(string codeVerifier)
    {
        var hash = SHA256.HashData(Encoding.UTF8.GetBytes(codeVerifier));
        return Base64UrlEncode(hash);
    }

    private static string Base64UrlEncode(byte[] bytes) =>
        Convert.ToBase64String(bytes)
            .Replace('+', '-')
            .Replace('/', '_')
            .TrimEnd('=');
}

const response = await fetch('https://provider.com/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: new URLSearchParams({
    grant_type: 'authorization_code',
    code: authCode,
    client_id: YOUR_CLIENT_ID,
    client_secret: YOUR_CLIENT_SECRET,
    redirect_uri: 'https://yourapp.com/callback',
    code_verifier: codeVerifier, // Proves we own the challenge
  }),
});

const tokens = await response.json();

import org.springframework.http.*;
import org.springframework.util.LinkedMultiValueMap;
import org.springframework.util.MultiValueMap;
import org.springframework.web.client.RestTemplate;

public Map<String, Object> exchangeCodeForTokens(
        String authCode, String codeVerifier) {
    RestTemplate rest = new RestTemplate();

    HttpHeaders headers = new HttpHeaders();
    headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);

    MultiValueMap<String, String> body = new LinkedMultiValueMap<>();
    body.add("grant_type", "authorization_code");
    body.add("code", authCode);
    body.add("client_id", YOUR_CLIENT_ID);
    body.add("client_secret", YOUR_CLIENT_SECRET);
    body.add("redirect_uri", "https://yourapp.com/callback");
    body.add("code_verifier", codeVerifier);

    HttpEntity<MultiValueMap<String, String>> request = new HttpEntity<>(body, headers);
    ResponseEntity<Map> response = rest.postForEntity(
        "https://provider.com/token", request, Map.class);
    return response.getBody();
}

import httpx

async def exchange_code_for_tokens(auth_code: str, code_verifier: str) -> dict:
    async with httpx.AsyncClient() as client:
        response = await client.post(
            "https://provider.com/token",
            data={
                "grant_type": "authorization_code",
                "code": auth_code,
                "client_id": YOUR_CLIENT_ID,
                "client_secret": YOUR_CLIENT_SECRET,
                "redirect_uri": "https://yourapp.com/callback",
                "code_verifier": code_verifier,
            },
        )
        response.raise_for_status()
        return response.json()

using System.Net.Http;
using System.Collections.Generic;
using System.Text.Json;

public async Task<JsonDocument> ExchangeCodeForTokensAsync(
    string authCode, string codeVerifier)
{
    using var client = new HttpClient();
    var content = new FormUrlEncodedContent(new Dictionary<string, string>
    {
        ["grant_type"] = "authorization_code",
        ["code"] = authCode,
        ["client_id"] = YOUR_CLIENT_ID,
        ["client_secret"] = YOUR_CLIENT_SECRET,
        ["redirect_uri"] = "https://yourapp.com/callback",
        ["code_verifier"] = codeVerifier,
    });

    var response = await client.PostAsync("https://provider.com/token", content);
    response.EnsureSuccessStatusCode();
    var json = await response.Content.ReadAsStringAsync();
    return JsonDocument.Parse(json);
}

const response = await fetch('https://provider.com/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: new URLSearchParams({
    grant_type: 'client_credentials',
    client_id: YOUR_CLIENT_ID,
    client_secret: YOUR_CLIENT_SECRET,
    scope: 'api.read api.write',
  }),
});

MultiValueMap<String, String> body = new LinkedMultiValueMap<>();
body.add("grant_type", "client_credentials");
body.add("client_id", YOUR_CLIENT_ID);
body.add("client_secret", YOUR_CLIENT_SECRET);
body.add("scope", "api.read api.write");

HttpEntity<MultiValueMap<String, String>> request =
    new HttpEntity<>(body, headers);
ResponseEntity<Map> response = rest.postForEntity(
    "https://provider.com/token", request, Map.class);

async with httpx.AsyncClient() as client:
    response = await client.post(
        "https://provider.com/token",
        data={
            "grant_type": "client_credentials",
            "client_id": YOUR_CLIENT_ID,
            "client_secret": YOUR_CLIENT_SECRET,
            "scope": "api.read api.write",
        },
    )
    response.raise_for_status()
    tokens = response.json()

var content = new FormUrlEncodedContent(new Dictionary<string, string>
{
    ["grant_type"] = "client_credentials",
    ["client_id"] = YOUR_CLIENT_ID,
    ["client_secret"] = YOUR_CLIENT_SECRET,
    ["scope"] = "api.read api.write",
});
var response = await client.PostAsync("https://provider.com/token", content);
response.EnsureSuccessStatusCode();

// src/config/passport.ts
import passport from 'passport';
import { Strategy as GoogleStrategy } from 'passport-google-oauth20';
import { User } from '@/models/user';
import { findOrCreateUser } from '@/services/auth';

passport.use(
  new GoogleStrategy(
    {
      clientID: process.env.GOOGLE_CLIENT_ID!,
      clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
      callbackURL: process.env.GOOGLE_CALLBACK_URL || 'http://localhost:3000/auth/google/callback',
      scope: ['profile', 'email'],
    },
    async (accessToken, refreshToken, profile, done) => {
      try {
        // Find or create user
        const user = await findOrCreateUser({
          provider: 'google',
          providerId: profile.id,
          email: profile.emails?.[0]?.value,
          name: profile.displayName,
          picture: profile.photos?.[0]?.value,
          accessToken,
          refreshToken,
        });

        done(null, user);
      } catch (error) {
        done(error);
      }
    }
  )
);

// Serialize user for session
passport.serializeUser((user: any, done) => {
  done(null, user.id);
});

passport.deserializeUser(async (id: string, done) => {
  try {
    const user = await User.findById(id);
    done(null, user);
  } catch (error) {
    done(error);
  }
});

export default passport;

// Spring Boot — application.properties + OAuth2 auto-configuration
// application.properties:
// spring.security.oauth2.client.registration.google.client-id=${GOOGLE_CLIENT_ID}
// spring.security.oauth2.client.registration.google.client-secret=${GOOGLE_CLIENT_SECRET}
// spring.security.oauth2.client.registration.google.scope=profile,email

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Autowired
    private CustomOAuth2UserService oAuth2UserService;

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .oauth2Login(oauth2 -> oauth2
                .userInfoEndpoint(info -> info
                    .userService(oAuth2UserService))
                .successHandler(this::onAuthSuccess)
                .failureUrl("/login?error=true"))
            .logout(logout -> logout
                .logoutUrl("/auth/logout")
                .deleteCookies("JSESSIONID"));
        return http.build();
    }

    private void onAuthSuccess(HttpServletRequest req,
            HttpServletResponse res, Authentication auth) throws IOException {
        // Issue session token, redirect to dashboard
        res.sendRedirect("/dashboard");
    }
}

@Service
public class CustomOAuth2UserService extends DefaultOAuth2UserService {
    @Autowired private UserRepository userRepo;

    @Override
    public OAuth2User loadUser(OAuth2UserRequest req) {
        OAuth2User oauthUser = super.loadUser(req);
        String provider = req.getClientRegistration().getRegistrationId();
        String providerId = oauthUser.getName();
        String email = oauthUser.getAttribute("email");
        String name = oauthUser.getAttribute("name");
        String picture = oauthUser.getAttribute("picture");

        userRepo.findByProviderAndProviderId(provider, providerId)
            .orElseGet(() -> userRepo.save(User.builder()
                .provider(provider).providerId(providerId)
                .email(email).name(name).picture(picture)
                .emailVerified(true).build()));
        return oauthUser;
    }
}

# FastAPI + Authlib
from authlib.integrations.starlette_client import OAuth
from starlette.config import Config

config = Config(".env")
oauth = OAuth(config)

oauth.register(
    name="google",
    client_id=config("GOOGLE_CLIENT_ID"),
    client_secret=config("GOOGLE_CLIENT_SECRET"),
    server_metadata_url="https://accounts.google.com/.well-known/openid-configuration",
    client_kwargs={"scope": "openid profile email"},
)

@router.get("/auth/google")
async def google_login(request: Request):
    redirect_uri = request.url_for("google_callback")
    return await oauth.google.authorize_redirect(request, redirect_uri)

@router.get("/auth/google/callback")
async def google_callback(request: Request, db: Session = Depends(get_db)):
    token = await oauth.google.authorize_access_token(request)
    profile = token.get("userinfo")

    user = find_or_create_user(db, provider="google",
        provider_id=profile["sub"], email=profile["email"],
        name=profile.get("name"), picture=profile.get("picture"),
        access_token=token["access_token"])
    
    session_token = create_session(db, user.id)
    response = RedirectResponse("/dashboard")
    response.set_cookie("sessionToken", session_token,
        httponly=True, secure=True, samesite="lax",
        max_age=7 * 24 * 60 * 60)
    return response

// Program.cs — ASP.NET Core
builder.Services.AddAuthentication(options => {
    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = GoogleDefaults.AuthenticationScheme;
})
.AddCookie()
.AddGoogle(options => {
    options.ClientId = builder.Configuration["Google:ClientId"]!;
    options.ClientSecret = builder.Configuration["Google:ClientSecret"]!;
    options.Scope.Add("profile");
    options.Scope.Add("email");
    options.SaveTokens = true;
    options.Events.OnCreatingTicket = async ctx => {
        var userService = ctx.HttpContext.RequestServices
            .GetRequiredService<IUserService>();
        await userService.FindOrCreateAsync(new OAuthProfile {
            Provider = "google",
            ProviderId = ctx.Principal!.FindFirstValue(ClaimTypes.NameIdentifier)!,
            Email = ctx.Principal.FindFirstValue(ClaimTypes.Email)!,
            Name = ctx.Principal.FindFirstValue(ClaimTypes.Name),
            Picture = ctx.Principal.FindFirstValue("picture"),
            AccessToken = ctx.AccessToken,
            RefreshToken = ctx.RefreshToken,
        });
    };
});

// src/routes/auth.ts
import express from 'express';
import passport from 'passport';
import { generateSessionToken } from '@/utils/jwt';

const router = express.Router();

// Initiate Google login
router.get(
  '/google',
  passport.authenticate('google', {
    scope: ['profile', 'email'],
    accessType: 'offline', // Request refresh token
  })
);

// Google callback
router.get(
  '/google/callback',
  passport.authenticate('google', { failureRedirect: '/login?error=true' }),
  (req, res) => {
    // User is authenticated
    const sessionToken = generateSessionToken(req.user);
    
    // Set secure, httpOnly cookie
    res.cookie('sessionToken', sessionToken, {
      httpOnly: true,
      secure: process.env.NODE_ENV === 'production',
      sameSite: 'lax',
      maxAge: 7 * 24 * 60 * 60 * 1000, // 7 days
    });

    res.redirect('/dashboard');
  }
);

// Logout
router.post('/logout', (req, res) => {
  req.logout((err) => {
    if (err) return res.status(500).json({ error: 'Logout failed' });
    res.clearCookie('sessionToken');
    res.json({ success: true });
  });
});

export default router;

@RestController
@RequestMapping("/auth")
public class AuthController {

    @GetMapping("/google")
    public void googleLogin(HttpServletResponse response) throws IOException {
        // Spring Security handles redirect automatically via OAuth2LoginConfigurer
        response.sendRedirect("/oauth2/authorization/google");
    }

    // Spring Security handles /login/oauth2/code/google callback automatically.
    // Customize via successHandler in SecurityConfig.

    @PostMapping("/logout")
    public ResponseEntity<Map<String, Object>> logout(
            HttpServletRequest req, HttpServletResponse res,
            Authentication auth) throws Exception {
        new SecurityContextLogoutHandler().logout(req, res, auth);
        // Clear session cookie
        ResponseCookie cookie = ResponseCookie.from("sessionToken", "")
            .httpOnly(true).secure(true).maxAge(0).path("/").build();
        res.addHeader(HttpHeaders.SET_COOKIE, cookie.toString());
        return ResponseEntity.ok(Map.of("success", true));
    }
}

from fastapi import APIRouter, Request, Response
from starlette.responses import RedirectResponse, JSONResponse

router = APIRouter()

@router.get("/auth/google")
async def google_login(request: Request):
    redirect_uri = request.url_for("google_callback")
    return await oauth.google.authorize_redirect(request, redirect_uri,
        access_type="offline")

@router.get("/auth/google/callback", name="google_callback")
async def google_callback(request: Request, db: Session = Depends(get_db)):
    token = await oauth.google.authorize_access_token(request)
    profile = token.get("userinfo")
    user = find_or_create_user(db, provider="google",
        provider_id=profile["sub"], email=profile["email"],
        name=profile.get("name"), access_token=token["access_token"])
    session_token = create_session(db, user.id)
    resp = RedirectResponse("/dashboard")
    resp.set_cookie("sessionToken", session_token,
        httponly=True, secure=True, samesite="lax",
        max_age=7 * 24 * 60 * 60)
    return resp

@router.post("/auth/logout")
async def logout(response: Response):
    response.delete_cookie("sessionToken")
    return {"success": True}

[ApiController]
[Route("auth")]
public class AuthController : ControllerBase
{
    [HttpGet("google")]
    public IActionResult GoogleLogin() =>
        Challenge(new AuthenticationProperties { RedirectUri = "/dashboard" },
            GoogleDefaults.AuthenticationScheme);

    [HttpGet("google/callback")]
    public async Task<IActionResult> GoogleCallback()
    {
        var result = await HttpContext.AuthenticateAsync(
            CookieAuthenticationDefaults.AuthenticationScheme);
        if (!result.Succeeded)
            return Redirect("/login?error=true");
        return Redirect("/dashboard");
    }

    [HttpPost("logout")]
    public async Task<IActionResult> Logout()
    {
        await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
        Response.Cookies.Delete("sessionToken");
        return Ok(new { success = true });
    }
}

// src/services/auth.ts
import { User } from '@/models/user';
import bcrypt from 'bcrypt';

export async function findOrCreateUser(profile: {
  provider: string;
  providerId: string;
  email: string;
  name: string;
  picture?: string;
  accessToken: string;
  refreshToken?: string;
}) {
  // Look for existing user with this OAuth provider
  let user = await User.findOne({
    'oauth.provider': profile.provider,
    'oauth.providerId': profile.providerId,
  });

  if (user) {
    // Update tokens if user exists
    user.oauth.accessToken = profile.accessToken;
    if (profile.refreshToken) {
      user.oauth.refreshToken = profile.refreshToken;
    }
    await user.save();
    return user;
  }

  // Check if user exists by email
  user = await User.findOne({ email: profile.email });

  if (user) {
    // Link OAuth to existing user
    user.oauth = {
      provider: profile.provider,
      providerId: profile.providerId,
      accessToken: profile.accessToken,
      refreshToken: profile.refreshToken,
    };
    await user.save();
    return user;
  }

  // Create new user
  user = new User({
    email: profile.email,
    name: profile.name,
    picture: profile.picture,
    emailVerified: true, // OAuth providers verify email
    oauth: {
      provider: profile.provider,
      providerId: profile.providerId,
      accessToken: profile.accessToken,
      refreshToken: profile.refreshToken,
    },
  });

  await user.save();
  return user;
}

@Service
@Transactional
public class AuthService {

    @Autowired private UserRepository userRepo;

    public User findOrCreateUser(OAuthProfile profile) {
        // Look for existing user with this OAuth provider
        return userRepo.findByProviderAndProviderId(
                profile.provider(), profile.providerId())
            .map(user -> {
                user.setAccessToken(profile.accessToken());
                if (profile.refreshToken() != null)
                    user.setRefreshToken(profile.refreshToken());
                return userRepo.save(user);
            })
            .orElseGet(() -> userRepo.findByEmail(profile.email())
                .map(user -> {
                    // Link OAuth to existing user
                    user.setProvider(profile.provider());
                    user.setProviderId(profile.providerId());
                    user.setAccessToken(profile.accessToken());
                    user.setRefreshToken(profile.refreshToken());
                    return userRepo.save(user);
                })
                .orElseGet(() -> userRepo.save(User.builder()
                    .email(profile.email())
                    .name(profile.name())
                    .picture(profile.picture())
                    .emailVerified(true)
                    .provider(profile.provider())
                    .providerId(profile.providerId())
                    .accessToken(profile.accessToken())
                    .refreshToken(profile.refreshToken())
                    .build())));
    }
}

from sqlalchemy.orm import Session
from models import User

def find_or_create_user(
    db: Session,
    provider: str,
    provider_id: str,
    email: str,
    name: str,
    picture: str | None = None,
    access_token: str = "",
    refresh_token: str | None = None,
) -> User:
    # Look for existing user with this OAuth provider
    user = db.query(User).filter_by(
        provider=provider, provider_id=provider_id).first()

    if user:
        user.access_token = access_token
        if refresh_token:
            user.refresh_token = refresh_token
        db.commit()
        return user

    # Check if user exists by email
    user = db.query(User).filter_by(email=email).first()
    if user:
        user.provider = provider
        user.provider_id = provider_id
        user.access_token = access_token
        user.refresh_token = refresh_token
        db.commit()
        return user

    # Create new user
    user = User(
        email=email, name=name, picture=picture,
        email_verified=True, provider=provider,
        provider_id=provider_id, access_token=access_token,
        refresh_token=refresh_token,
    )
    db.add(user)
    db.commit()
    return user

public class AuthService : IAuthService
{
    private readonly AppDbContext _db;

    public AuthService(AppDbContext db) => _db = db;

    public async Task<User> FindOrCreateUserAsync(OAuthProfile profile)
    {
        // Look for existing user with this OAuth provider
        var user = await _db.Users.FirstOrDefaultAsync(u =>
            u.Provider == profile.Provider &&
            u.ProviderId == profile.ProviderId);

        if (user != null)
        {
            user.AccessToken = profile.AccessToken;
            if (profile.RefreshToken != null)
                user.RefreshToken = profile.RefreshToken;
            await _db.SaveChangesAsync();
            return user;
        }

        // Check if user exists by email
        user = await _db.Users.FirstOrDefaultAsync(u => u.Email == profile.Email);
        if (user != null)
        {
            user.Provider = profile.Provider;
            user.ProviderId = profile.ProviderId;
            user.AccessToken = profile.AccessToken;
            user.RefreshToken = profile.RefreshToken;
            await _db.SaveChangesAsync();
            return user;
        }

        // Create new user
        user = new User {
            Email = profile.Email, Name = profile.Name,
            Picture = profile.Picture, EmailVerified = true,
            Provider = profile.Provider, ProviderId = profile.ProviderId,
            AccessToken = profile.AccessToken, RefreshToken = profile.RefreshToken,
        };
        _db.Users.Add(user);
        await _db.SaveChangesAsync();
        return user;
    }
}

// src/config/passport-github.ts
import passport from 'passport';
import { Strategy as GitHubStrategy } from 'passport-github2';
import { findOrCreateUser } from '@/services/auth';

passport.use(
  'github',
  new GitHubStrategy(
    {
      clientID: process.env.GITHUB_CLIENT_ID!,
      clientSecret: process.env.GITHUB_CLIENT_SECRET!,
      callbackURL: process.env.GITHUB_CALLBACK_URL || 'http://localhost:3000/auth/github/callback',
      scope: ['user:email', 'repo'], // Request specific scopes
    },
    async (accessToken, refreshToken, profile, done) => {
      try {
        const primaryEmail = profile.emails?.find(e => e.primary)?.value || 
                           profile.emails?.[0]?.value;

        const user = await findOrCreateUser({
          provider: 'github',
          providerId: String(profile.id),
          email: primaryEmail!,
          name: profile.displayName || profile.username || '',
          picture: profile.photos?.[0]?.value,
          accessToken,
        });

        done(null, user);
      } catch (error) {
        done(error);
      }
    }
  )
);

// Spring Boot — application.properties
// spring.security.oauth2.client.registration.github.client-id=${GITHUB_CLIENT_ID}
// spring.security.oauth2.client.registration.github.client-secret=${GITHUB_CLIENT_SECRET}
// spring.security.oauth2.client.registration.github.scope=user:email,repo

@Service
public class GitHubOAuth2UserService extends DefaultOAuth2UserService {
    @Autowired private UserRepository userRepo;

    @Override
    public OAuth2User loadUser(OAuth2UserRequest req) {
        OAuth2User oauthUser = super.loadUser(req);
        String providerId = String.valueOf(oauthUser.getAttribute("id"));
        String name = oauthUser.getAttribute("name");
        if (name == null) name = oauthUser.getAttribute("login");
        String picture = oauthUser.getAttribute("avatar_url");
        String email = oauthUser.getAttribute("email");
        String accessToken = req.getAccessToken().getTokenValue();

        userRepo.findByProviderAndProviderId("github", providerId)
            .orElseGet(() -> userRepo.save(User.builder()
                .provider("github").providerId(providerId)
                .email(email).name(name).picture(picture)
                .accessToken(accessToken)
                .emailVerified(true).build()));
        return oauthUser;
    }
}

oauth.register(
    name="github",
    client_id=config("GITHUB_CLIENT_ID"),
    client_secret=config("GITHUB_CLIENT_SECRET"),
    access_token_url="https://github.com/login/oauth/access_token",
    authorize_url="https://github.com/login/oauth/authorize",
    api_base_url="https://api.github.com/",
    client_kwargs={"scope": "user:email repo"},
)

@router.get("/auth/github/callback")
async def github_callback(request: Request, db: Session = Depends(get_db)):
    token = await oauth.github.authorize_access_token(request)
    profile_resp = await oauth.github.get("user", token=token)
    profile = profile_resp.json()

    emails_resp = await oauth.github.get("user/emails", token=token)
    emails = emails_resp.json()
    primary_email = next(
        (e["email"] for e in emails if e.get("primary")),
        profile.get("email"))

    user = find_or_create_user(db, provider="github",
        provider_id=str(profile["id"]),
        email=primary_email,
        name=profile.get("name") or profile.get("login", ""),
        picture=profile.get("avatar_url"),
        access_token=token["access_token"])
    
    session_token = create_session(db, user.id)
    resp = RedirectResponse("/dashboard")
    resp.set_cookie("sessionToken", session_token,
        httponly=True, secure=True, samesite="lax",
        max_age=7 * 24 * 60 * 60)
    return resp

// Program.cs
builder.Services.AddAuthentication()
    .AddGitHub(options => {
        options.ClientId = builder.Configuration["GitHub:ClientId"]!;
        options.ClientSecret = builder.Configuration["GitHub:ClientSecret"]!;
        options.Scope.Add("user:email");
        options.Scope.Add("repo");
        options.SaveTokens = true;
        options.Events.OnCreatingTicket = async ctx => {
            var userService = ctx.HttpContext.RequestServices
                .GetRequiredService<IUserService>();
            var primaryEmail = ctx.Principal!
                .FindFirstValue(ClaimTypes.Email) ?? "";
            await userService.FindOrCreateAsync(new OAuthProfile {
                Provider = "github",
                ProviderId = ctx.Principal.FindFirstValue(ClaimTypes.NameIdentifier)!,
                Email = primaryEmail,
                Name = ctx.Principal.FindFirstValue(ClaimTypes.Name),
                Picture = ctx.Principal.FindFirstValue("urn:github:avatar"),
                AccessToken = ctx.AccessToken,
            });
        };
    });

// GitHub routes
router.get('/github', passport.authenticate('github', { scope: ['user:email'] }));

router.get(
  '/github/callback',
  passport.authenticate('github', { failureRedirect: '/login' }),
  (req, res) => {
    const sessionToken = generateSessionToken(req.user);
    res.cookie('sessionToken', sessionToken, { /* ... */ });
    res.redirect('/dashboard');
  }
);

@GetMapping("/github")
public void githubLogin(HttpServletResponse response) throws IOException {
    response.sendRedirect("/oauth2/authorization/github");
}

// Spring Security handles /login/oauth2/code/github automatically.
// Success redirects to /dashboard via successHandler in SecurityConfig.

@router.get("/auth/github")
async def github_login(request: Request):
    redirect_uri = request.url_for("github_callback")
    return await oauth.github.authorize_redirect(request, redirect_uri)

[HttpGet("github")]
public IActionResult GitHubLogin() =>
    Challenge(new AuthenticationProperties { RedirectUri = "/dashboard" },
        "GitHub");

// src/services/github.ts
export async function getUserRepositories(accessToken: string) {
  const response = await fetch('https://api.github.com/user/repos', {
    headers: {
      Authorization: `token ${accessToken}`,
      Accept: 'application/vnd.github.v3+json',
    },
  });

  if (!response.ok) {
    throw new Error(`GitHub API error: ${response.statusText}`);
  }

  return response.json();
}

@Service
public class GitHubService {
    private final RestTemplate restTemplate = new RestTemplate();

    public List<Map<String, Object>> getUserRepositories(String accessToken) {
        HttpHeaders headers = new HttpHeaders();
        headers.set("Authorization", "token " + accessToken);
        headers.set("Accept", "application/vnd.github.v3+json");

        ResponseEntity<List> response = restTemplate.exchange(
            "https://api.github.com/user/repos",
            HttpMethod.GET,
            new HttpEntity<>(headers),
            List.class);

        if (!response.getStatusCode().is2xxSuccessful()) {
            throw new RuntimeException("GitHub API error: " + response.getStatusCode());
        }
        return response.getBody();
    }
}

import httpx
from typing import Any

async def get_user_repositories(access_token: str) -> list[dict[str, Any]]:
    async with httpx.AsyncClient() as client:
        response = await client.get(
            "https://api.github.com/user/repos",
            headers={
                "Authorization": f"token {access_token}",
                "Accept": "application/vnd.github.v3+json",
            },
        )
        if not response.is_success:
            raise RuntimeError(f"GitHub API error: {response.status_code}")
        return response.json()

public class GitHubService
{
    private readonly HttpClient _http;

    public GitHubService(HttpClient http) => _http = http;

    public async Task<List<JsonElement>> GetUserRepositoriesAsync(string accessToken)
    {
        using var request = new HttpRequestMessage(
            HttpMethod.Get, "https://api.github.com/user/repos");
        request.Headers.Add("Authorization", $"token {accessToken}");
        request.Headers.Add("Accept", "application/vnd.github.v3+json");
        request.Headers.Add("User-Agent", "MyApp/1.0");

        var response = await _http.SendAsync(request);
        response.EnsureSuccessStatusCode();
        var json = await response.Content.ReadAsStringAsync();
        return JsonSerializer.Deserialize<List<JsonElement>>(json)!;
    }
}

// Use access token for API requests
const headers = {
  Authorization: `Bearer ${accessToken}`,
};

// Use access token for API requests
HttpHeaders headers = new HttpHeaders();
headers.setBearerAuth(accessToken);

# Use access token for API requests
headers = {"Authorization": f"Bearer {access_token}"}

// Use access token for API requests
httpClient.DefaultRequestHeaders.Authorization =
    new AuthenticationHeaderValue("Bearer", accessToken);

// src/services/token.ts
export async function refreshAccessToken(refreshToken: string) {
  const response = await fetch('https://provider.com/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      grant_type: 'refresh_token',
      refresh_token: refreshToken,
      client_id: process.env.OAUTH_CLIENT_ID!,
      client_secret: process.env.OAUTH_CLIENT_SECRET!,
    }),
  });

  if (!response.ok) {
    throw new Error('Token refresh failed');
  }

  const data = await response.json();
  return {
    accessToken: data.access_token,
    refreshToken: data.refresh_token || refreshToken,
    expiresIn: data.expires_in,
  };
}

// Middleware to refresh token if needed
export async function ensureValidToken(user: any) {
  if (!user.oauth?.accessToken) {
    throw new Error('No access token');
  }

  // Check if token expires in less than 5 minutes
  const expiresAt = user.oauth.accessTokenExpiresAt;
  if (expiresAt && new Date() > new Date(expiresAt.getTime() - 5 * 60 * 1000)) {
    const refreshed = await refreshAccessToken(user.oauth.refreshToken);
    user.oauth.accessToken = refreshed.accessToken;
    user.oauth.accessTokenExpiresAt = new Date(Date.now() + refreshed.expiresIn * 1000);
    await user.save();
  }

  return user.oauth.accessToken;
}

@Service
public class TokenService {
    @Autowired private UserRepository userRepo;
    private final RestTemplate restTemplate = new RestTemplate();

    @Value("${oauth.client-id}") private String clientId;
    @Value("${oauth.client-secret}") private String clientSecret;

    public TokenResponse refreshAccessToken(String refreshToken) {
        MultiValueMap<String, String> body = new LinkedMultiValueMap<>();
        body.add("grant_type", "refresh_token");
        body.add("refresh_token", refreshToken);
        body.add("client_id", clientId);
        body.add("client_secret", clientSecret);

        HttpHeaders headers = new HttpHeaders();
        headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);
        ResponseEntity<Map> resp = restTemplate.postForEntity(
            "https://provider.com/token",
            new HttpEntity<>(body, headers), Map.class);

        if (!resp.getStatusCode().is2xxSuccessful())
            throw new RuntimeException("Token refresh failed");

        Map<?, ?> data = resp.getBody();
        String newRefresh = data.containsKey("refresh_token")
            ? (String) data.get("refresh_token") : refreshToken;
        return new TokenResponse(
            (String) data.get("access_token"),
            newRefresh,
            (Integer) data.get("expires_in"));
    }

    public String ensureValidToken(User user) {
        if (user.getAccessToken() == null)
            throw new IllegalStateException("No access token");

        Instant expiresAt = user.getAccessTokenExpiresAt();
        if (expiresAt != null &&
                Instant.now().isAfter(expiresAt.minusSeconds(300))) {
            TokenResponse refreshed = refreshAccessToken(user.getRefreshToken());
            user.setAccessToken(refreshed.accessToken());
            user.setAccessTokenExpiresAt(
                Instant.now().plusSeconds(refreshed.expiresIn()));
            userRepo.save(user);
        }
        return user.getAccessToken();
    }
}

import httpx
from datetime import datetime, timedelta, timezone

async def refresh_access_token(refresh_token: str) -> dict:
    async with httpx.AsyncClient() as client:
        response = await client.post(
            "https://provider.com/token",
            data={
                "grant_type": "refresh_token",
                "refresh_token": refresh_token,
                "client_id": settings.OAUTH_CLIENT_ID,
                "client_secret": settings.OAUTH_CLIENT_SECRET,
            },
        )
        if not response.is_success:
            raise RuntimeError("Token refresh failed")
        data = response.json()
        return {
            "access_token": data["access_token"],
            "refresh_token": data.get("refresh_token", refresh_token),
            "expires_in": data["expires_in"],
        }

async def ensure_valid_token(user: User, db: Session) -> str:
    if not user.access_token:
        raise ValueError("No access token")

    expires_at = user.access_token_expires_at
    if expires_at and datetime.now(timezone.utc) > expires_at - timedelta(minutes=5):
        refreshed = await refresh_access_token(user.refresh_token)
        user.access_token = refreshed["access_token"]
        user.access_token_expires_at = (
            datetime.now(timezone.utc) + timedelta(seconds=refreshed["expires_in"]))
        db.commit()

    return user.access_token

public class TokenService
{
    private readonly HttpClient _http;
    private readonly AppDbContext _db;
    private readonly IConfiguration _config;

    public TokenService(HttpClient http, AppDbContext db, IConfiguration config)
    { _http = http; _db = db; _config = config; }

    public async Task<TokenResponse> RefreshAccessTokenAsync(string refreshToken)
    {
        var content = new FormUrlEncodedContent(new Dictionary<string, string>
        {
            ["grant_type"] = "refresh_token",
            ["refresh_token"] = refreshToken,
            ["client_id"] = _config["OAuth:ClientId"]!,
            ["client_secret"] = _config["OAuth:ClientSecret"]!,
        });

        var response = await _http.PostAsync("https://provider.com/token", content);
        response.EnsureSuccessStatusCode();
        var data = await response.Content.ReadFromJsonAsync<JsonDocument>();
        var root = data!.RootElement;

        return new TokenResponse(
            AccessToken: root.GetProperty("access_token").GetString()!,
            RefreshToken: root.TryGetProperty("refresh_token", out var rt)
                ? rt.GetString()! : refreshToken,
            ExpiresIn: root.GetProperty("expires_in").GetInt32());
    }

    public async Task<string> EnsureValidTokenAsync(User user)
    {
        if (user.AccessToken == null)
            throw new InvalidOperationException("No access token");

        if (user.AccessTokenExpiresAt.HasValue &&
            DateTimeOffset.UtcNow > user.AccessTokenExpiresAt.Value.AddMinutes(-5))
        {
            var refreshed = await RefreshAccessTokenAsync(user.RefreshToken!);
            user.AccessToken = refreshed.AccessToken;
            user.AccessTokenExpiresAt = DateTimeOffset.UtcNow
                .AddSeconds(refreshed.ExpiresIn);
            await _db.SaveChangesAsync();
        }
        return user.AccessToken;
    }
}

export async function findOrCreateUser(profile: OAuthProfile) {
  // Strategy: Link by OAuth provider first, then by email
  
  let user = await User.findOne({
    $or: [
      { 'oauth.provider': profile.provider, 'oauth.providerId': profile.providerId },
      { email: profile.email }, // Link by email if not yet linked
    ],
  });

  if (!user) {
    // Create new user
    user = new User({
      email: profile.email,
      name: profile.name,
      emailVerified: true, // Assume OAuth provider verified email
    });
  } else if (!user.oauth) {
    // User exists by email, link the OAuth account
    user.oauth = {
      provider: profile.provider,
      providerId: profile.providerId,
    };
  }

  // Always update tokens
  user.oauth.accessToken = profile.accessToken;
  user.oauth.refreshToken = profile.refreshToken;
  await user.save();

  return user;
}

@Transactional
public User findOrCreateUser(OAuthProfile profile) {
    // Link by OAuth provider first, then by email
    User user = userRepo
        .findByProviderAndProviderId(profile.provider(), profile.providerId())
        .or(() -> userRepo.findByEmail(profile.email()))
        .orElse(null);

    if (user == null) {
        user = User.builder()
            .email(profile.email())
            .name(profile.name())
            .emailVerified(true)
            .build();
    } else if (user.getProvider() == null) {
        // User exists by email, link the OAuth account
        user.setProvider(profile.provider());
        user.setProviderId(profile.providerId());
    }

    // Always update tokens
    user.setAccessToken(profile.accessToken());
    user.setRefreshToken(profile.refreshToken());
    return userRepo.save(user);
}

def find_or_create_user(db: Session, profile: OAuthProfile) -> User:
    # Link by OAuth provider first, then by email
    user = (db.query(User)
        .filter_by(provider=profile.provider, provider_id=profile.provider_id)
        .first()
        or db.query(User).filter_by(email=profile.email).first())

    if user is None:
        user = User(
            email=profile.email,
            name=profile.name,
            email_verified=True,
        )
        db.add(user)
    elif user.provider is None:
        user.provider = profile.provider
        user.provider_id = profile.provider_id

    user.access_token = profile.access_token
    user.refresh_token = profile.refresh_token
    db.commit()
    return user

public async Task<User> FindOrCreateUserAsync(OAuthProfile profile)
{
    var user = await _db.Users.FirstOrDefaultAsync(u =>
        (u.Provider == profile.Provider && u.ProviderId == profile.ProviderId)
        || u.Email == profile.Email);

    if (user == null)
    {
        user = new User {
            Email = profile.Email,
            Name = profile.Name,
            EmailVerified = true,
        };
        _db.Users.Add(user);
    }
    else if (user.Provider == null)
    {
        user.Provider = profile.Provider;
        user.ProviderId = profile.ProviderId;
    }

    user.AccessToken = profile.AccessToken;
    user.RefreshToken = profile.RefreshToken;
    await _db.SaveChangesAsync();
    return user;
}

// Route: Display linking page
router.get('/auth/google/callback', (req, res) => {
  const profile = req.user; // From Passport verify callback
  
  // Check if user exists
  const existingUser = await User.findOne({ email: profile.email });
  
  if (existingUser && !existingUser.oauth) {
    // Show linking page
    const token = generateLinkingToken(profile);
    return res.redirect(`/auth/link?token=${token}`);
  }
  
  // Otherwise, normal flow
});

// Linking endpoint
router.post('/auth/link', authenticateUser, async (req, res) => {
  const linkingToken = req.body.token;
  const profile = decodeLinkingToken(linkingToken);
  
  req.user.oauth = {
    provider: profile.provider,
    providerId: profile.providerId,
    accessToken: profile.accessToken,
  };
  
  await req.user.save();
  res.json({ success: true });
});

@GetMapping("/auth/google/callback")
public RedirectView googleCallback(Authentication auth,
        HttpServletRequest req) {
    OAuth2AuthenticationToken token = (OAuth2AuthenticationToken) auth;
    String email = token.getPrincipal().getAttribute("email");

    Optional<User> existingUser = userRepo.findByEmail(email);
    if (existingUser.isPresent() && existingUser.get().getProvider() == null) {
        String linkingToken = generateLinkingToken(token.getPrincipal());
        return new RedirectView("/auth/link?token=" + linkingToken);
    }
    return new RedirectView("/dashboard");
}

@PostMapping("/auth/link")
@PreAuthorize("isAuthenticated()")
public ResponseEntity<Map<String, Object>> linkAccount(
        @RequestBody LinkRequest body,
        @AuthenticationPrincipal UserDetails currentUser) {
    OAuthProfile profile = decodeLinkingToken(body.token());
    User user = userRepo.findByEmail(currentUser.getUsername()).orElseThrow();
    user.setProvider(profile.provider());
    user.setProviderId(profile.providerId());
    user.setAccessToken(profile.accessToken());
    userRepo.save(user);
    return ResponseEntity.ok(Map.of("success", true));
}

@router.get("/auth/google/callback")
async def google_callback(request: Request, db: Session = Depends(get_db)):
    token = await oauth.google.authorize_access_token(request)
    profile = token.get("userinfo")

    existing_user = db.query(User).filter_by(email=profile["email"]).first()
    if existing_user and existing_user.provider is None:
        linking_token = generate_linking_token(profile)
        return RedirectResponse(f"/auth/link?token={linking_token}")

    # Normal flow
    user = find_or_create_user(db, provider="google", ...)
    return create_session_response(user)

@router.post("/auth/link")
async def link_account(
    body: LinkRequest,
    current_user: User = Depends(get_current_user),
    db: Session = Depends(get_db),
):
    profile = decode_linking_token(body.token)
    current_user.provider = profile["provider"]
    current_user.provider_id = profile["provider_id"]
    current_user.access_token = profile["access_token"]
    db.commit()
    return {"success": True}

[HttpGet("google/callback")]
public async Task<IActionResult> GoogleCallback()
{
    var result = await HttpContext.AuthenticateAsync(
        CookieAuthenticationDefaults.AuthenticationScheme);
    var email = result.Principal?.FindFirstValue(ClaimTypes.Email);

    var existingUser = await _db.Users.FirstOrDefaultAsync(u => u.Email == email);
    if (existingUser != null && existingUser.Provider == null)
    {
        var linkingToken = GenerateLinkingToken(result.Principal!);
        return Redirect($"/auth/link?token={linkingToken}");
    }
    return Redirect("/dashboard");
}

[HttpPost("link")]
[Authorize]
public async Task<IActionResult> LinkAccount([FromBody] LinkRequest body)
{
    var profile = DecodeLinkingToken(body.Token);
    var user = await _db.Users.FirstAsync(u =>
        u.Email == User.FindFirstValue(ClaimTypes.Email));
    user.Provider = profile.Provider;
    user.ProviderId = profile.ProviderId;
    user.AccessToken = profile.AccessToken;
    await _db.SaveChangesAsync();
    return Ok(new { success = true });
}