深入理解 OAuth 2.0：从原理到实践

async function handleClientCredentialsGrant(request: NextRequest) {
  const token = getTokenFromRequest(request.headers);
  const user = await validateToken(token);
  
  // 返回 OAuth 2.0 标准响应
  return {
    access_token: token,
    token_type: 'Bearer',
    expires_in: expiresIn,
    scope: 'read write'
  };
}

// 1. 客户端生成 code_verifier 和 code_challenge
const codeVerifier = generateRandomString();
const codeChallenge = base64url(sha256(codeVerifier));

// 2. 发起授权请求
GET /authorize?
  response_type=code&
  client_id=xxx&
  redirect_uri=xxx&
  code_challenge={codeChallenge}&
  code_challenge_method=S256

// 3. 服务端验证
async function handleAuthorizationCodeGrant(code, client_id, code_verifier) {
  const authCodeData = await redis.get(`oauth:auth_code:${code}`);
  
  if (authCodeData.code_challenge) {
    // 计算 code_challenge 并验证
    const computedChallenge = createHash('sha256')
      .update(code_verifier)
      .digest('base64url');
    
    if (computedChallenge !== authCodeData.code_challenge) {
      throw new Error('Invalid code verifier');
    }
  }
  // ... 继续生成 token
}

export async function authenticateMcpRequestEnhanced(headers: Headers) {
  const token = getTokenFromRequest(headers);

  // 1. OAuth 2.0 Bearer Token（标准）
  const user = await validateToken(token);
  if (user) return user;

  // 2. 长期 Token（LTK_ 前缀）
  if (token.startsWith('LTK_')) {
    const userId = await validateLongTermToken(token);
    if (userId) {
      return await getUserById(userId);
    }
  }

  // 3. 向后兼容：自定义 Headers（带警告）
  const account = headers.get('x-mcp-account');
  const password = headers.get('x-mcp-password');
  if (account && password) {
    console.warn('[MCP] ⚠️ 使用已弃用的自定义头部认证');
    const result = await login(account, password);
    if (result) return result.userInfo;
  }

  throw new Error("Invalid token");
}

model LongTermToken {
  id          String    @id @default(uuid())
  token       String    @unique  // LTK_ 开头
  userId      Int
  expiresAt   DateTime? // null = 永久
  description String
  createdAt   DateTime  @default(now())
  lastUsed    DateTime?
  
  user TbUser @relation(fields: [userId], references: [id])
  
  @@index([token])
}

GET /.well-known/oauth-protected-resource

Response:
{
  "issuer": "http://localhost:3000",
  "authorization_endpoint": "http://localhost:3000/authorize",
  "token_endpoint": "http://localhost:3000/token",
  "revocation_endpoint": "http://localhost:3000/revoke",
  "introspection_endpoint": "http://localhost:3000/introspect",
  "scopes_supported": ["read", "write", "admin"],
  "grant_types_supported": ["client_credentials", "authorization_code"],
  "code_challenge_methods_supported": ["plain", "S256"]
}

# 客户端凭证模式
POST /token
Content-Type: application/json
Authorization: Bearer LTK_xxx

{
  "grant_type": "client_credentials"
}

# 响应
{
  "access_token": "LTK_xxx",
  "token_type": "Bearer",
  "expires_in": 604800,
  "scope": "read write"
}

POST /introspect
Content-Type: application/json

{
  "token": "LTK_xxx"
}

# 响应
{
  "active": true,
  "username": "admin",
  "scope": "read write",
  "client_id": "mcp-client-1",
  "token_type": "Bearer",
  "exp": 1737936000
}

POST /revoke
Content-Type: application/json

{
  "token": "LTK_xxx"
}

# 响应
{ "success": true }

// 生成 state
const state = generateRandomString();
sessionStorage.setItem('oauth_state', state);

// 授权请求
const authUrl = `/authorize?state=${state}&...`;

// 回调验证
if (request.state !== sessionStorage.getItem('oauth_state')) {
  throw new Error('Invalid state');
}

// 只请求读权限
GET /authorize?scope=read

// 而不是
GET /authorize?scope=read,write,admin  // ❌ 过度授权

// ❌ 不好
return { error: 'Invalid password for user@example.com' };

// ✅ 好
return { error: 'invalid_grant', error_description: 'Invalid credentials' };

# 1. 生成长期 Token
# 访问 http://localhost:3000/c/user/info

# 2. 配置 Claude Code CLI
claude mcp add MyBlog http://localhost:3000/api/mcp \
  --header "Authorization: Bearer LTK_xxx"

# 3. 验证连接
claude mcp list