1
// Cloudflare Worker：CoTalk OAuth 安全代理
2
export default {
3
    async fetch(request, env) {
4
        const url = new URL(request.url);
5
        const blogOrigin = 'yourblogdomain'; // 你的博客域名
6

7
        // 封装 CORS 头部设置，避免遗漏
8
        const corsHeaders = {
9
            'Access-Control-Allow-Origin': blogOrigin,
10
            'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
11
            'Access-Control-Allow-Headers': 'Content-Type',
12
        };
13

14
        // CORS 预检
15
        if (request.method === 'OPTIONS') {
16
            return new Response(null, { headers: corsHeaders });
17
        }
18

19
        // ---------- 1. 授权请求：GET /authorize ----------
20
        if (request.method === 'GET' && url.pathname === '/authorize') {
21
            const clientId = url.searchParams.get('client_id');
22
            const redirectUri = url.searchParams.get('redirect_uri') || blogOrigin;
23
            const state = url.searchParams.get('state') || '';
24

25
            // 将前端回调地址和状态编码进 state
26
            const codebergState = JSON.stringify({
27
                redirect_uri: redirectUri,
28
                frontend_state: state,
29
            });
30

31
            const codebergAuthUrl = new URL('https://codeberg.org/login/oauth/authorize');
32
            codebergAuthUrl.searchParams.set('client_id', env.CLIENT_ID);
33
            codebergAuthUrl.searchParams.set('redirect_uri', `${url.origin}/callback`);
34
            codebergAuthUrl.searchParams.set('response_type', 'code');
35
            codebergAuthUrl.searchParams.set('state', codebergState);
36

37
            // ✅ 302 重定向务必带上 CORS 头
38
            return new Response(null, {
39
                status: 302,
40
                headers: {
41
                    ...corsHeaders,               // CORS 头
42
                    'Location': codebergAuthUrl.toString(),
43
                },
44
            });
45
        }
46

47
        // ---------- 2. 回调处理：GET /callback ----------
48
        if (request.method === 'GET' && url.pathname === '/callback') {
49
            const code = url.searchParams.get('code');
50
            const stateParam = url.searchParams.get('state');
51

52
            if (!code || !stateParam) {
53
                return new Response('Missing code or state', { status: 400, headers: corsHeaders });
54
            }
55

56
            let parsedState;
57
            try {
58
                parsedState = JSON.parse(stateParam);
59
            } catch {
60
                return new Response('Invalid state parameter', { status: 400, headers: corsHeaders });
61
            }
62

63
            const redirectUri = parsedState.redirect_uri || blogOrigin;
64
            const frontendState = parsedState.frontend_state || '';
65

66
            try {
67
                const tokenResponse = await fetch('https://codeberg.org/login/oauth/access_token', {
68
                    method: 'POST',
69
                    headers: { 'Content-Type': 'application/json', 'Accept': 'application/json' },
70
                    body: JSON.stringify({
71
                        client_id: env.CLIENT_ID,
72
                        client_secret: env.CLIENT_SECRET,
73
                        code,
74
                        grant_type: 'authorization_code',
75
                        redirect_uri: `${url.origin}/callback`,
76
                    }),
77
                });
78

79
                const tokenData = await tokenResponse.json().catch(() => null);
80

81
                if (!tokenData || tokenData.error) {
82
                    const errorRedirect = new URL(redirectUri);
83
                    errorRedirect.hash = `error=${tokenData?.error || 'unknown'}&error_description=${encodeURIComponent(tokenData?.error_description || 'Token exchange failed')}`;
84
                    return new Response(null, {
85
                        status: 302,
86
                        headers: { ...corsHeaders, 'Location': errorRedirect.toString() },
87
                    });
88
                }
89

90
                if (!tokenData.access_token) {
91
                    throw new Error('No access_token in response');
92
                }
93

94
                const frontendRedirect = new URL(redirectUri);
95
                const hashParams = new URLSearchParams();
96
                hashParams.set('access_token', tokenData.access_token);
97
                hashParams.set('token_type', tokenData.token_type || 'bearer');
98
                if (frontendState) hashParams.set('state', frontendState);
99
                frontendRedirect.hash = hashParams.toString();
100

101
                return new Response(null, {
102
                    status: 302,
103
                    headers: { ...corsHeaders, 'Location': frontendRedirect.toString() },
104
                });
105
            } catch (err) {
106
                const errorRedirect = new URL(redirectUri);
107
                errorRedirect.hash = `error=server_error&error_description=${encodeURIComponent(err.message)}`;
108
                return new Response(null, {
109
                    status: 302,
110
                    headers: { ...corsHeaders, 'Location': errorRedirect.toString() },
111
                });
112
            }
113
        }
114

115
        // ---------- 3. Token 交换：POST /access_token ----------
116
        if (request.method === 'POST' && url.pathname === '/access_token') {
117
            try {
118
                const { code } = await request.json();
119
                if (!code) {
120
                    return new Response(JSON.stringify({ error: 'Code missing' }), {
121
                        status: 400,
122
                        headers: { ...corsHeaders, 'Content-Type': 'application/json' },
123
                    });
124
                }
125

126
                const tokenResponse = await fetch('https://codeberg.org/login/oauth/access_token', {
127
                    method: 'POST',
128
                    headers: { 'Content-Type': 'application/json', 'Accept': 'application/json' },
129
                    body: JSON.stringify({
130
                        client_id: env.CLIENT_ID,
131
                        client_secret: env.CLIENT_SECRET,
132
                        code,
133
                        grant_type: 'authorization_code',
134
                        redirect_uri: `${url.origin}/callback`,
135
                    }),
136
                });
137

138
                const data = await tokenResponse.json().catch(() => ({ error: 'Invalid JSON' }));
139
                return new Response(JSON.stringify(data), {
140
                    status: data.error ? 400 : 200,
141
                    headers: { ...corsHeaders, 'Content-Type': 'application/json' },
142
                });
143
            } catch (err) {
144
                return new Response(JSON.stringify({ error: 'server_error' }), {
145
                    status: 500,
146
                    headers: { ...corsHeaders, 'Content-Type': 'application/json' },
147
                });
148
            }
149
        }
150

151
        return new Response('Not Found', { status: 404, headers: corsHeaders });
152
    },
153
};