OAuth2 & Đăng Nhập Mạng Xã Hội trong Spring Boot

# .env (thêm vào .gitignore!)
GOOGLE_CLIENT_ID=your-google-client-id.apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=your-google-client-secret
GITHUB_CLIENT_ID=your-github-client-id
GITHUB_CLIENT_SECRET=your-github-client-secret

<dependencies>
    <!-- Spring Boot Starter Web -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
 
    <!-- Spring Security -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
 
    <!-- OAuth2 Client - thêm hỗ trợ đăng nhập mạng xã hội -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-oauth2-client</artifactId>
    </dependency>
 
    <!-- JPA để lưu trữ người dùng -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-data-jpa</artifactId>
    </dependency>
 
    <!-- PostgreSQL -->
    <dependency>
        <groupId>org.postgresql</groupId>
        <artifactId>postgresql</artifactId>
        <scope>runtime</scope>
    </dependency>
 
    <!-- Hỗ trợ JWT (để cấp token sau đăng nhập OAuth2) -->
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-api</artifactId>
        <version>0.12.3</version>
    </dependency>
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-impl</artifactId>
        <version>0.12.3</version>
        <scope>runtime</scope>
    </dependency>
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-jackson</artifactId>
        <version>0.12.3</version>
        <scope>runtime</scope>
    </dependency>
 
    <!-- Lombok (tùy chọn) -->
    <dependency>
        <groupId>org.projectlombok</groupId>
        <artifactId>lombok</artifactId>
        <optional>true</optional>
    </dependency>
</dependencies>

spring:
  security:
    oauth2:
      client:
        registration:
          google:
            client-id: ${GOOGLE_CLIENT_ID}
            client-secret: ${GOOGLE_CLIENT_SECRET}
            scope:
              - email
              - profile
          github:
            client-id: ${GITHUB_CLIENT_ID}
            client-secret: ${GITHUB_CLIENT_SECRET}
            scope:
              - user:email
              - read:user
 
  datasource:
    url: jdbc:postgresql://localhost:5432/oauth2_demo
    username: ${DB_USERNAME:postgres}
    password: ${DB_PASSWORD:postgres}
 
  jpa:
    hibernate:
      ddl-auto: update
    show-sql: true
 
app:
  jwt:
    secret: ${JWT_SECRET:your-256-bit-secret-key-for-jwt-signing-min-32-chars}
    expiration: 86400000  # 24 giờ
  oauth2:
    authorized-redirect-uri: http://localhost:3000/oauth2/redirect

@Entity
@Table(name = "users")
@Getter
@Setter
@NoArgsConstructor
public class User {
 
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
 
    @Column(nullable = false)
    private String name;
 
    @Column(nullable = false, unique = true)
    private String email;
 
    private String imageUrl;
 
    @Column(nullable = false)
    private Boolean emailVerified = false;
 
    private String password;  // null cho người dùng OAuth2
 
    @Enumerated(EnumType.STRING)
    @Column(nullable = false)
    private AuthProvider provider;
 
    private String providerId;
 
    @Enumerated(EnumType.STRING)
    @Column(nullable = false)
    private Role role = Role.USER;
}

public enum AuthProvider {
    LOCAL,
    GOOGLE,
    GITHUB
}

public enum Role {
    USER,
    ADMIN
}

@Repository
public interface UserRepository extends JpaRepository<User, Long> {
 
    Optional<User> findByEmail(String email);
 
    Boolean existsByEmail(String email);
}

public abstract class OAuth2UserInfo {
 
    protected Map<String, Object> attributes;
 
    public OAuth2UserInfo(Map<String, Object> attributes) {
        this.attributes = attributes;
    }
 
    public abstract String getId();
    public abstract String getName();
    public abstract String getEmail();
    public abstract String getImageUrl();
}

public class GoogleOAuth2UserInfo extends OAuth2UserInfo {
 
    public GoogleOAuth2UserInfo(Map<String, Object> attributes) {
        super(attributes);
    }
 
    @Override
    public String getId() {
        return (String) attributes.get("sub");
    }
 
    @Override
    public String getName() {
        return (String) attributes.get("name");
    }
 
    @Override
    public String getEmail() {
        return (String) attributes.get("email");
    }
 
    @Override
    public String getImageUrl() {
        return (String) attributes.get("picture");
    }
}

public class GitHubOAuth2UserInfo extends OAuth2UserInfo {
 
    public GitHubOAuth2UserInfo(Map<String, Object> attributes) {
        super(attributes);
    }
 
    @Override
    public String getId() {
        return String.valueOf(attributes.get("id"));
    }
 
    @Override
    public String getName() {
        return (String) attributes.get("name");
    }
 
    @Override
    public String getEmail() {
        return (String) attributes.get("email");
    }
 
    @Override
    public String getImageUrl() {
        return (String) attributes.get("avatar_url");
    }
}

public class OAuth2UserInfoFactory {
 
    public static OAuth2UserInfo getOAuth2UserInfo(
            String registrationId, Map<String, Object> attributes) {
 
        if (registrationId.equalsIgnoreCase(AuthProvider.GOOGLE.name())) {
            return new GoogleOAuth2UserInfo(attributes);
        } else if (registrationId.equalsIgnoreCase(AuthProvider.GITHUB.name())) {
            return new GitHubOAuth2UserInfo(attributes);
        } else {
            throw new OAuth2AuthenticationProcessingException(
                "Đăng nhập bằng " + registrationId + " không được hỗ trợ");
        }
    }
}

@Service
@RequiredArgsConstructor
public class CustomOAuth2UserService extends DefaultOAuth2UserService {
 
    private final UserRepository userRepository;
 
    @Override
    public OAuth2User loadUser(OAuth2UserRequest userRequest)
            throws OAuth2AuthenticationException {
 
        OAuth2User oAuth2User = super.loadUser(userRequest);
 
        try {
            return processOAuth2User(userRequest, oAuth2User);
        } catch (Exception ex) {
            throw new OAuth2AuthenticationProcessingException(
                ex.getMessage(), ex);
        }
    }
 
    private OAuth2User processOAuth2User(
            OAuth2UserRequest userRequest, OAuth2User oAuth2User) {
 
        String registrationId = userRequest.getClientRegistration()
            .getRegistrationId();
 
        OAuth2UserInfo oAuth2UserInfo = OAuth2UserInfoFactory
            .getOAuth2UserInfo(registrationId, oAuth2User.getAttributes());
 
        if (oAuth2UserInfo.getEmail() == null
                || oAuth2UserInfo.getEmail().isEmpty()) {
            throw new OAuth2AuthenticationProcessingException(
                "Không tìm thấy email từ nhà cung cấp OAuth2");
        }
 
        Optional<User> userOptional = userRepository
            .findByEmail(oAuth2UserInfo.getEmail());
 
        User user;
        if (userOptional.isPresent()) {
            user = userOptional.get();
 
            if (!user.getProvider().name()
                    .equalsIgnoreCase(registrationId)) {
                throw new OAuth2AuthenticationProcessingException(
                    "Bạn đã đăng ký bằng " + user.getProvider()
                    + ". Vui lòng sử dụng tài khoản " + user.getProvider()
                    + " để đăng nhập.");
            }
 
            user = updateExistingUser(user, oAuth2UserInfo);
        } else {
            user = registerNewUser(registrationId, oAuth2UserInfo);
        }
 
        return new CustomUserPrincipal(user, oAuth2User.getAttributes());
    }
 
    private User registerNewUser(
            String registrationId, OAuth2UserInfo oAuth2UserInfo) {
 
        User user = new User();
        user.setProvider(AuthProvider.valueOf(registrationId.toUpperCase()));
        user.setProviderId(oAuth2UserInfo.getId());
        user.setName(oAuth2UserInfo.getName());
        user.setEmail(oAuth2UserInfo.getEmail());
        user.setImageUrl(oAuth2UserInfo.getImageUrl());
        user.setEmailVerified(true);
 
        return userRepository.save(user);
    }
 
    private User updateExistingUser(
            User existingUser, OAuth2UserInfo oAuth2UserInfo) {
 
        existingUser.setName(oAuth2UserInfo.getName());
        existingUser.setImageUrl(oAuth2UserInfo.getImageUrl());
 
        return userRepository.save(existingUser);
    }
}

public class CustomUserPrincipal implements OAuth2User, UserDetails {
 
    private Long id;
    private String email;
    private String password;
    private Collection<? extends GrantedAuthority> authorities;
    private Map<String, Object> attributes;
 
    public CustomUserPrincipal(
            Long id, String email, String password,
            Collection<? extends GrantedAuthority> authorities) {
        this.id = id;
        this.email = email;
        this.password = password;
        this.authorities = authorities;
    }
 
    // Constructor cho người dùng OAuth2
    public CustomUserPrincipal(User user, Map<String, Object> attributes) {
        this.id = user.getId();
        this.email = user.getEmail();
        this.password = user.getPassword();
        this.authorities = Collections.singletonList(
            new SimpleGrantedAuthority("ROLE_" + user.getRole().name()));
        this.attributes = attributes;
    }
 
    // Factory method cho người dùng local
    public static CustomUserPrincipal create(User user) {
        List<GrantedAuthority> authorities = Collections.singletonList(
            new SimpleGrantedAuthority("ROLE_" + user.getRole().name()));
 
        return new CustomUserPrincipal(
            user.getId(), user.getEmail(),
            user.getPassword(), authorities);
    }
 
    // Các phương thức UserDetails
    @Override
    public String getUsername() { return email; }
 
    @Override
    public String getPassword() { return password; }
 
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return authorities;
    }
 
    @Override
    public boolean isAccountNonExpired() { return true; }
 
    @Override
    public boolean isAccountNonLocked() { return true; }
 
    @Override
    public boolean isCredentialsNonExpired() { return true; }
 
    @Override
    public boolean isEnabled() { return true; }
 
    // Các phương thức OAuth2User
    @Override
    public Map<String, Object> getAttributes() { return attributes; }
 
    @Override
    public String getName() { return String.valueOf(id); }
 
    public Long getId() { return id; }
}

@Entity
@Table(name = "user_social_connections")
@Getter
@Setter
@NoArgsConstructor
public class SocialConnection {
 
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
 
    @ManyToOne(fetch = FetchType.LAZY)
    @JoinColumn(name = "user_id", nullable = false)
    private User user;
 
    @Enumerated(EnumType.STRING)
    @Column(nullable = false)
    private AuthProvider provider;
 
    @Column(nullable = false)
    private String providerId;
 
    private String providerEmail;
 
    @Column(nullable = false)
    private LocalDateTime connectedAt = LocalDateTime.now();
}

@Repository
public interface SocialConnectionRepository
        extends JpaRepository<SocialConnection, Long> {
 
    Optional<SocialConnection> findByProviderAndProviderId(
        AuthProvider provider, String providerId);
 
    List<SocialConnection> findByUser(User user);
 
    boolean existsByUserAndProvider(User user, AuthProvider provider);
}

private OAuth2User processOAuth2User(
        OAuth2UserRequest userRequest, OAuth2User oAuth2User) {
 
    String registrationId = userRequest.getClientRegistration()
        .getRegistrationId();
    AuthProvider provider = AuthProvider.valueOf(
        registrationId.toUpperCase());
 
    OAuth2UserInfo userInfo = OAuth2UserInfoFactory
        .getOAuth2UserInfo(registrationId, oAuth2User.getAttributes());
 
    if (userInfo.getEmail() == null || userInfo.getEmail().isEmpty()) {
        throw new OAuth2AuthenticationProcessingException(
            "Không tìm thấy email từ nhà cung cấp OAuth2");
    }
 
    // Kiểm tra xem kết nối mạng xã hội đã tồn tại chưa
    Optional<SocialConnection> connectionOpt = socialConnectionRepository
        .findByProviderAndProviderId(provider, userInfo.getId());
 
    User user;
    if (connectionOpt.isPresent()) {
        // Người dùng quay lại — cập nhật thông tin
        user = connectionOpt.get().getUser();
        user.setName(userInfo.getName());
        user.setImageUrl(userInfo.getImageUrl());
        userRepository.save(user);
    } else {
        // Kiểm tra người dùng theo email
        Optional<User> userOpt = userRepository
            .findByEmail(userInfo.getEmail());
 
        if (userOpt.isPresent()) {
            // Liên kết nhà cung cấp mới vào tài khoản hiện có
            user = userOpt.get();
            createSocialConnection(user, provider, userInfo);
        } else {
            // Người dùng hoàn toàn mới
            user = registerNewUser(provider, userInfo);
            createSocialConnection(user, provider, userInfo);
        }
    }
 
    return new CustomUserPrincipal(user, oAuth2User.getAttributes());
}
 
private void createSocialConnection(
        User user, AuthProvider provider, OAuth2UserInfo userInfo) {
 
    SocialConnection connection = new SocialConnection();
    connection.setUser(user);
    connection.setProvider(provider);
    connection.setProviderId(userInfo.getId());
    connection.setProviderEmail(userInfo.getEmail());
 
    socialConnectionRepository.save(connection);
}

@Service
public class CustomOAuth2UserService extends DefaultOAuth2UserService {
 
    // ... các trường khác
 
    @Override
    public OAuth2User loadUser(OAuth2UserRequest userRequest)
            throws OAuth2AuthenticationException {
 
        OAuth2User oAuth2User = super.loadUser(userRequest);
 
        // Workaround cho email GitHub
        String registrationId = userRequest.getClientRegistration()
            .getRegistrationId();
 
        Map<String, Object> attributes =
            new HashMap<>(oAuth2User.getAttributes());
 
        if ("github".equals(registrationId)
                && attributes.get("email") == null) {
            String email = fetchGitHubEmail(userRequest);
            attributes.put("email", email);
        }
 
        try {
            return processOAuth2User(userRequest,
                new DefaultOAuth2User(
                    oAuth2User.getAuthorities(),
                    attributes,
                    "id"));
        } catch (Exception ex) {
            throw new OAuth2AuthenticationProcessingException(
                ex.getMessage(), ex);
        }
    }
 
    private String fetchGitHubEmail(OAuth2UserRequest userRequest) {
        RestTemplate restTemplate = new RestTemplate();
 
        HttpHeaders headers = new HttpHeaders();
        headers.setBearerAuth(
            userRequest.getAccessToken().getTokenValue());
 
        HttpEntity<String> entity = new HttpEntity<>(headers);
 
        ResponseEntity<List<Map<String, Object>>> response =
            restTemplate.exchange(
                "https://api.github.com/user/emails",
                HttpMethod.GET,
                entity,
                new ParameterizedTypeReference<>() {});
 
        return response.getBody().stream()
            .filter(email -> Boolean.TRUE.equals(email.get("primary")))
            .map(email -> (String) email.get("email"))
            .findFirst()
            .orElseThrow(() ->
                new OAuth2AuthenticationProcessingException(
                    "Không tìm thấy email chính từ GitHub"));
    }
}

@Component
public class JwtTokenProvider {
 
    @Value("${app.jwt.secret}")
    private String jwtSecret;
 
    @Value("${app.jwt.expiration}")
    private long jwtExpirationMs;
 
    public String generateToken(CustomUserPrincipal userPrincipal) {
        return Jwts.builder()
            .subject(String.valueOf(userPrincipal.getId()))
            .issuedAt(new Date())
            .expiration(new Date(
                System.currentTimeMillis() + jwtExpirationMs))
            .signWith(getSigningKey())
            .compact();
    }
 
    public Long getUserIdFromToken(String token) {
        Claims claims = Jwts.parser()
            .verifyWith(getSigningKey())
            .build()
            .parseSignedClaims(token)
            .getPayload();
 
        return Long.parseLong(claims.getSubject());
    }
 
    public boolean validateToken(String token) {
        try {
            Jwts.parser()
                .verifyWith(getSigningKey())
                .build()
                .parseSignedClaims(token);
            return true;
        } catch (JwtException | IllegalArgumentException ex) {
            return false;
        }
    }
 
    private SecretKey getSigningKey() {
        byte[] keyBytes = Decoders.BASE64.decode(jwtSecret);
        return Keys.hmacShaKeyFor(keyBytes);
    }
}

@Component
@RequiredArgsConstructor
public class OAuth2AuthenticationSuccessHandler
        extends SimpleUrlAuthenticationSuccessHandler {
 
    private final JwtTokenProvider tokenProvider;
 
    @Value("${app.oauth2.authorized-redirect-uri}")
    private String authorizedRedirectUri;
 
    @Override
    public void onAuthenticationSuccess(
            HttpServletRequest request,
            HttpServletResponse response,
            Authentication authentication) throws IOException {
 
        CustomUserPrincipal userPrincipal =
            (CustomUserPrincipal) authentication.getPrincipal();
 
        String token = tokenProvider.generateToken(userPrincipal);
 
        // Chuyển hướng về frontend với JWT token
        String targetUrl = UriComponentsBuilder
            .fromUriString(authorizedRedirectUri)
            .queryParam("token", token)
            .build()
            .toUriString();
 
        getRedirectStrategy().sendRedirect(request, response, targetUrl);
    }
}

@Component
public class OAuth2AuthenticationFailureHandler
        extends SimpleUrlAuthenticationFailureHandler {
 
    @Value("${app.oauth2.authorized-redirect-uri}")
    private String authorizedRedirectUri;
 
    @Override
    public void onAuthenticationFailure(
            HttpServletRequest request,
            HttpServletResponse response,
            AuthenticationException exception) throws IOException {
 
        String targetUrl = UriComponentsBuilder
            .fromUriString(authorizedRedirectUri)
            .queryParam("error", exception.getLocalizedMessage())
            .build()
            .toUriString();
 
        getRedirectStrategy().sendRedirect(request, response, targetUrl);
    }
}

@Component
@RequiredArgsConstructor
public class JwtAuthenticationFilter extends OncePerRequestFilter {
 
    private final JwtTokenProvider tokenProvider;
    private final CustomUserDetailsService userDetailsService;
 
    @Override
    protected void doFilterInternal(
            HttpServletRequest request,
            HttpServletResponse response,
            FilterChain filterChain)
            throws ServletException, IOException {
 
        String jwt = getJwtFromRequest(request);
 
        if (jwt != null && tokenProvider.validateToken(jwt)) {
            Long userId = tokenProvider.getUserIdFromToken(jwt);
            UserDetails userDetails =
                userDetailsService.loadUserById(userId);
 
            UsernamePasswordAuthenticationToken authentication =
                new UsernamePasswordAuthenticationToken(
                    userDetails, null,
                    userDetails.getAuthorities());
 
            authentication.setDetails(
                new WebAuthenticationDetailsSource()
                    .buildDetails(request));
 
            SecurityContextHolder.getContext()
                .setAuthentication(authentication);
        }
 
        filterChain.doFilter(request, response);
    }
 
    private String getJwtFromRequest(HttpServletRequest request) {
        String bearerToken = request.getHeader("Authorization");
        if (bearerToken != null && bearerToken.startsWith("Bearer ")) {
            return bearerToken.substring(7);
        }
        return null;
    }
}

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
@RequiredArgsConstructor
public class SecurityConfig {
 
    private final CustomOAuth2UserService customOAuth2UserService;
    private final OAuth2AuthenticationSuccessHandler oAuth2SuccessHandler;
    private final OAuth2AuthenticationFailureHandler oAuth2FailureHandler;
    private final JwtAuthenticationFilter jwtAuthenticationFilter;
 
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http)
            throws Exception {
 
        http
            // Tắt CSRF cho API JWT stateless
            .csrf(csrf -> csrf.disable())
 
            // Quản lý session — stateless cho JWT
            .sessionManagement(session -> session
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS))
 
            // Quy tắc authorization
            .authorizeHttpRequests(auth -> auth
                .requestMatchers(
                    "/api/auth/**",
                    "/oauth2/**",
                    "/login/oauth2/**"
                ).permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
 
            // Cấu hình đăng nhập OAuth2
            .oauth2Login(oauth2 -> oauth2
                .userInfoEndpoint(userInfo -> userInfo
                    .userService(customOAuth2UserService))
                .successHandler(oAuth2SuccessHandler)
                .failureHandler(oAuth2FailureHandler)
            )
 
            // Xử lý exception
            .exceptionHandling(ex -> ex
                .authenticationEntryPoint(
                    (request, response, authException) -> {
                        response.setStatus(
                            HttpServletResponse.SC_UNAUTHORIZED);
                        response.setContentType("application/json");
                        response.getWriter().write(
                            "{\"error\": \"Unauthorized\"}");
                    })
            )
 
            // JWT filter trước filter của Spring Security
            .addFilterBefore(jwtAuthenticationFilter,
                UsernamePasswordAuthenticationFilter.class);
 
        return http.build();
    }
 
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
 
    @Bean
    public AuthenticationManager authenticationManager(
            AuthenticationConfiguration authConfig) throws Exception {
        return authConfig.getAuthenticationManager();
    }
}

@RestController
@RequestMapping("/api/auth")
@RequiredArgsConstructor
public class AuthController {
 
    private final AuthenticationManager authenticationManager;
    private final UserRepository userRepository;
    private final PasswordEncoder passwordEncoder;
    private final JwtTokenProvider tokenProvider;
 
    @PostMapping("/signup")
    public ResponseEntity<?> registerUser(
            @Valid @RequestBody SignUpRequest signUpRequest) {
 
        if (userRepository.existsByEmail(signUpRequest.getEmail())) {
            return ResponseEntity.badRequest()
                .body(Map.of("error",
                    "Địa chỉ email đã được sử dụng"));
        }
 
        User user = new User();
        user.setName(signUpRequest.getName());
        user.setEmail(signUpRequest.getEmail());
        user.setPassword(passwordEncoder.encode(
            signUpRequest.getPassword()));
        user.setProvider(AuthProvider.LOCAL);
 
        userRepository.save(user);
 
        return ResponseEntity.status(HttpStatus.CREATED)
            .body(Map.of("message",
                "Đăng ký người dùng thành công"));
    }
 
    @PostMapping("/login")
    public ResponseEntity<?> authenticateUser(
            @Valid @RequestBody LoginRequest loginRequest) {
 
        Authentication authentication =
            authenticationManager.authenticate(
                new UsernamePasswordAuthenticationToken(
                    loginRequest.getEmail(),
                    loginRequest.getPassword()));
 
        SecurityContextHolder.getContext()
            .setAuthentication(authentication);
 
        CustomUserPrincipal userPrincipal =
            (CustomUserPrincipal) authentication.getPrincipal();
 
        String token = tokenProvider.generateToken(userPrincipal);
 
        return ResponseEntity.ok(Map.of(
            "token", token,
            "tokenType", "Bearer"
        ));
    }
}

@Getter
@Setter
public class SignUpRequest {
 
    @NotBlank
    private String name;
 
    @NotBlank
    @Email
    private String email;
 
    @NotBlank
    @Size(min = 8, max = 40)
    private String password;
}
 
@Getter
@Setter
public class LoginRequest {
 
    @NotBlank
    @Email
    private String email;
 
    @NotBlank
    private String password;
}

@Service
@RequiredArgsConstructor
public class CustomUserDetailsService implements UserDetailsService {
 
    private final UserRepository userRepository;
 
    @Override
    public UserDetails loadUserByUsername(String email)
            throws UsernameNotFoundException {
 
        User user = userRepository.findByEmail(email)
            .orElseThrow(() -> new UsernameNotFoundException(
                "Không tìm thấy người dùng với email: " + email));
 
        return CustomUserPrincipal.create(user);
    }
 
    public UserDetails loadUserById(Long id) {
        User user = userRepository.findById(id)
            .orElseThrow(() -> new UsernameNotFoundException(
                "Không tìm thấy người dùng với id: " + id));
 
        return CustomUserPrincipal.create(user);
    }
}

// Ví dụ React / Next.js
const API_BASE_URL = 'http://localhost:8080';
 
function LoginPage() {
 
  const handleGoogleLogin = () => {
    window.location.href =
      `${API_BASE_URL}/oauth2/authorization/google`;
  };
 
  const handleGitHubLogin = () => {
    window.location.href =
      `${API_BASE_URL}/oauth2/authorization/github`;
  };
 
  return (
    <div>
      <h1>Đăng Nhập</h1>
 
      <button onClick={handleGoogleLogin}>
        Đăng nhập bằng Google
      </button>
 
      <button onClick={handleGitHubLogin}>
        Đăng nhập bằng GitHub
      </button>
 
      {/* Form đăng nhập local */}
      <form onSubmit={handleLocalLogin}>
        <input type="email" placeholder="Email" />
        <input type="password" placeholder="Mật khẩu" />
        <button type="submit">Đăng nhập</button>
      </form>
    </div>
  );
}

// pages/oauth2/redirect.tsx (hoặc tương đương)
import { useEffect } from 'react';
import { useRouter, useSearchParams } from 'next/navigation';
 
function OAuth2RedirectPage() {
  const router = useRouter();
  const searchParams = useSearchParams();
 
  useEffect(() => {
    const token = searchParams.get('token');
    const error = searchParams.get('error');
 
    if (token) {
      // Lưu JWT token
      localStorage.setItem('accessToken', token);
      router.push('/dashboard');
    } else if (error) {
      console.error('Lỗi OAuth2:', error);
      router.push('/login?error=' + encodeURIComponent(error));
    }
  }, [searchParams, router]);
 
  return <div>Đang xử lý đăng nhập...</div>;
}
 
export default OAuth2RedirectPage;

// lib/api.ts
const api = {
  async fetch(url: string, options: RequestInit = {}) {
    const token = localStorage.getItem('accessToken');
 
    const response = await fetch(`${API_BASE_URL}${url}`, {
      ...options,
      headers: {
        'Content-Type': 'application/json',
        ...(token && { Authorization: `Bearer ${token}` }),
        ...options.headers,
      },
    });
 
    if (response.status === 401) {
      localStorage.removeItem('accessToken');
      window.location.href = '/login';
    }
 
    return response;
  },
 
  get(url: string) {
    return this.fetch(url);
  },
 
  post(url: string, data: unknown) {
    return this.fetch(url, {
      method: 'POST',
      body: JSON.stringify(data),
    });
  },
};
 
export default api;

@Target({ElementType.PARAMETER, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
@AuthenticationPrincipal
public @interface CurrentUser {
}

@RestController
@RequestMapping("/api/users")
@RequiredArgsConstructor
public class UserController {
 
    private final UserRepository userRepository;
 
    @GetMapping("/me")
    public ResponseEntity<?> getCurrentUser(
            @CurrentUser CustomUserPrincipal currentUser) {
 
        User user = userRepository.findById(currentUser.getId())
            .orElseThrow(() -> new ResourceNotFoundException(
                "User", "id", currentUser.getId()));
 
        return ResponseEntity.ok(Map.of(
            "id", user.getId(),
            "name", user.getName(),
            "email", user.getEmail(),
            "imageUrl", user.getImageUrl(),
            "provider", user.getProvider()
        ));
    }
 
    @GetMapping("/me/connections")
    public ResponseEntity<?> getSocialConnections(
            @CurrentUser CustomUserPrincipal currentUser) {
 
        User user = userRepository.findById(currentUser.getId())
            .orElseThrow(() -> new ResourceNotFoundException(
                "User", "id", currentUser.getId()));
 
        List<SocialConnection> connections =
            socialConnectionRepository.findByUser(user);
 
        return ResponseEntity.ok(connections.stream()
            .map(conn -> Map.of(
                "provider", conn.getProvider(),
                "email", conn.getProviderEmail(),
                "connectedAt", conn.getConnectedAt()
            ))
            .toList());
    }
}

@RestController
@RequestMapping("/api/admin")
public class AdminController {
 
    @PreAuthorize("hasRole('ADMIN')")
    @GetMapping("/users")
    public ResponseEntity<List<User>> getAllUsers() {
        return ResponseEntity.ok(userRepository.findAll());
    }
 
    @PreAuthorize("hasRole('ADMIN')")
    @DeleteMapping("/users/{id}")
    public ResponseEntity<?> deleteUser(@PathVariable Long id) {
        userRepository.deleteById(id);
        return ResponseEntity.noContent().build();
    }
}

@WebMvcTest(UserController.class)
class UserControllerTest {
 
    @Autowired
    private MockMvc mockMvc;
 
    @MockBean
    private UserRepository userRepository;
 
    @Test
    @WithMockUser(username = "1", roles = "USER")
    void testGetCurrentUser() throws Exception {
        User user = new User();
        user.setId(1L);
        user.setName("John Doe");
        user.setEmail("[email protected]");
        user.setProvider(AuthProvider.GOOGLE);
 
        when(userRepository.findById(1L))
            .thenReturn(Optional.of(user));
 
        mockMvc.perform(get("/api/users/me"))
            .andExpect(status().isOk())
            .andExpect(jsonPath("$.name").value("John Doe"))
            .andExpect(jsonPath("$.provider").value("GOOGLE"));
    }
 
    @Test
    void testUnauthenticatedAccess() throws Exception {
        mockMvc.perform(get("/api/users/me"))
            .andExpect(status().isUnauthorized());
    }
}

@SpringBootTest
@AutoConfigureMockMvc
class OAuth2LoginTest {
 
    @Autowired
    private MockMvc mockMvc;
 
    @Test
    void testOAuth2LoginCreatesUser() throws Exception {
        mockMvc.perform(get("/api/users/me")
                .with(oauth2Login()
                    .oauth2User(new DefaultOAuth2User(
                        List.of(
                            new SimpleGrantedAuthority("ROLE_USER")),
                        Map.of(
                            "sub", "123456",
                            "name", "Test User",
                            "email", "[email protected]",
                            "picture", "https://example.com/photo.jpg"
                        ),
                        "sub"
                    ))))
            .andExpect(status().isOk());
    }
}

@SpringBootTest
@AutoConfigureMockMvc
class AuthIntegrationTest {
 
    @Autowired
    private MockMvc mockMvc;
 
    @Autowired
    private UserRepository userRepository;
 
    @Autowired
    private JwtTokenProvider tokenProvider;
 
    @Test
    void testLocalSignupAndLogin() throws Exception {
        // 1. Đăng ký
        mockMvc.perform(post("/api/auth/signup")
                .contentType(MediaType.APPLICATION_JSON)
                .content("""
                    {
                        "name": "Jane Doe",
                        "email": "[email protected]",
                        "password": "password123"
                    }
                    """))
            .andExpect(status().isCreated());
 
        // 2. Đăng nhập và lấy token
        MvcResult result = mockMvc.perform(post("/api/auth/login")
                .contentType(MediaType.APPLICATION_JSON)
                .content("""
                    {
                        "email": "[email protected]",
                        "password": "password123"
                    }
                    """))
            .andExpect(status().isOk())
            .andExpect(jsonPath("$.token").exists())
            .andReturn();
 
        String token = JsonPath.read(
            result.getResponse().getContentAsString(), "$.token");
 
        // 3. Truy cập endpoint được bảo vệ với JWT
        mockMvc.perform(get("/api/users/me")
                .header("Authorization", "Bearer " + token))
            .andExpect(status().isOk())
            .andExpect(jsonPath("$.email").value("[email protected]"))
            .andExpect(jsonPath("$.provider").value("LOCAL"));
    }
 
    @AfterEach
    void cleanup() {
        userRepository.deleteAll();
    }
}

@Component
public class OAuth2AuthenticationSuccessHandler
        extends SimpleUrlAuthenticationSuccessHandler {
 
    @Value("${app.oauth2.authorized-redirect-uri}")
    private String authorizedRedirectUri;
 
    @Override
    public void onAuthenticationSuccess(
            HttpServletRequest request,
            HttpServletResponse response,
            Authentication authentication) throws IOException {
 
        String targetUrl = determineTargetUrl(request, authentication);
 
        if (response.isCommitted()) {
            logger.debug("Response đã được commit.");
            return;
        }
 
        getRedirectStrategy().sendRedirect(
            request, response, targetUrl);
    }
 
    private String determineTargetUrl(
            HttpServletRequest request,
            Authentication authentication) {
 
        CustomUserPrincipal userPrincipal =
            (CustomUserPrincipal) authentication.getPrincipal();
 
        String token = tokenProvider.generateToken(userPrincipal);
 
        return UriComponentsBuilder
            .fromUriString(authorizedRedirectUri)
            .queryParam("token", token)
            .build()
            .toUriString();
    }
}

spring:
  security:
    oauth2:
      client:
        registration:
          google:
            client-id: ${GOOGLE_CLIENT_ID}
            client-secret: ${GOOGLE_CLIENT_SECRET}
            scope: email, profile
            redirect-uri: "https://yourdomain.com/login/oauth2/code/google"
          github:
            client-id: ${GITHUB_CLIENT_ID}
            client-secret: ${GITHUB_CLIENT_SECRET}
            scope: user:email, read:user
            redirect-uri: "https://yourdomain.com/login/oauth2/code/github"
 
app:
  jwt:
    secret: ${JWT_SECRET}
    expiration: 3600000  # 1 giờ trong production
  oauth2:
    authorized-redirect-uri: https://yourdomain.com/oauth2/redirect

spring:
  security:
    oauth2:
      client:
        registration:
          facebook:
            client-id: ${FACEBOOK_CLIENT_ID}
            client-secret: ${FACEBOOK_CLIENT_SECRET}
            scope: email, public_profile

public class FacebookOAuth2UserInfo extends OAuth2UserInfo {
 
    public FacebookOAuth2UserInfo(Map<String, Object> attributes) {
        super(attributes);
    }
 
    @Override
    public String getId() {
        return (String) attributes.get("id");
    }
 
    @Override
    public String getName() {
        return (String) attributes.get("name");
    }
 
    @Override
    public String getEmail() {
        return (String) attributes.get("email");
    }
 
    @Override
    public String getImageUrl() {
        Map<String, Object> pictureObj =
            (Map<String, Object>) attributes.get("picture");
        if (pictureObj != null) {
            Map<String, Object> data =
                (Map<String, Object>) pictureObj.get("data");
            if (data != null) {
                return (String) data.get("url");
            }
        }
        return null;
    }
}

http://localhost:8080/login/oauth2/code/google   (development)
https://yourdomain.com/login/oauth2/code/google  (production)

// ĐÚNG — chuyển hướng toàn trang
window.location.href = '/oauth2/authorization/google';
 
// SAI — sẽ gây lỗi CORS
fetch('/oauth2/authorization/google');

@Bean
public SecurityFilterChain filterChain(HttpSecurity http)
        throws Exception {
 
    http
        .sessionManagement(session -> session
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS))
        .oauth2Login(oauth2 -> oauth2
            .authorizationEndpoint(auth -> auth
                .authorizationRequestRepository(
                    new HttpSessionOAuth2AuthorizationRequestRepository()))
            // ...
        );
 
    return http.build();
}