// 授权服务器核心验证逻辑示例
public class AuthorizationCodeValidator {
    private final CryptoService cryptoService;
    private final TokenStore tokenStore;

    public AuthorizationCode validateCode(String code, String clientId, 
                                         String redirectUri) {
        // 1. 验证授权码存在性
        AuthorizationCode authCode = tokenStore.getAuthorizationCode(code);
        if (authCode == null) {
            throw new InvalidGrantException("Invalid authorization code");
        }

        // 2. 验证客户端匹配
        if (!authCode.getClientId().equals(clientId)) {
            throw new InvalidClientException("Client mismatch");
        }

        // 3. 验证重定向URI一致性
        if (!authCode.getRedirectUri().equals(redirectUri)) {
            throw new InvalidRequestException("Redirect URI mismatch");
        }

        // 4. 验证授权码有效期
        if (authCode.getExpirationTime().isBefore(Instant.now())) {
            throw new InvalidGrantException("Authorization code expired");
        }

        // 5. 单次使用验证
        tokenStore.removeAuthorizationCode(code);

        return authCode;
    }
}

class TokenSecurityHandler:
    def __init__(self):
        self.jwt_signer = JWTSigner()
        self.token_binding = TokenBindingService()

    def generate_secure_access_token(self, claims: dict) -> str:
        """生成安全访问令牌"""
        # 添加时间戳防止重放攻击
        claims['iat'] = int(time.time())
        claims['exp'] = int(time.time()) + 3600  # 1小时有效期

        # 使用HMAC-SHA256签名
        token = self.jwt_signer.sign(claims, algorithm='HS256')

        # 绑定令牌到TLS会话
        bound_token = self.token_binding.bind_to_tls(token)

        return bound_token

    def validate_token_integrity(self, token: str, client_cert: str) -> bool:
        """验证令牌完整性和绑定关系"""
        try:
            # 验证TLS绑定
            if not self.token_binding.verify_binding(token, client_cert):
                return False

            # 验证JWT签名和有效期
            claims = self.jwt_signer.verify(token)
            if claims['exp'] < time.time():
                return False

            return True
        except Exception:
            return False

// 微服务间令牌传播安全实现
@Component
public class ServiceToServiceSecurity {

    @Autowired
    private TokenExchanger tokenExchanger;

    public ServiceResponse callSecureService(String targetService, 
                                           String action, Object payload) {
        // 1. 获取当前服务身份令牌
        String serviceToken = obtainServiceIdentityToken();

        // 2. 交换为目标服务可识别的令牌
        String targetToken = tokenExchanger.exchangeToken(
            serviceToken, 
            targetService, 
            Arrays.asList("service.read", "service.write")
        );

        // 3. 使用mTLS建立安全连接
        SSLContext sslContext = createMutualTLSContext();

        // 4. 发送带令牌的请求
        return httpClient.withSSL(sslContext)
                        .withHeader("Authorization", "Bearer " + targetToken)
                        .post(targetService, action, payload);
    }
}

// 令牌缓存优化实现
@Configuration
@EnableCaching
public class TokenCacheConfig {

    @Bean
    public CacheManager tokenCacheManager() {
        CaffeineCacheManager cacheManager = new CaffeineCacheManager();
        cacheManager.setCaffeine(Caffeine.newBuilder()
            .maximumSize(10_000)  // 最大缓存条目
            .expireAfterWrite(5, TimeUnit.MINUTES)  // 写入后5分钟过期
            .recordStats()  // 记录统计信息
        );
        return cacheManager;
    }

    @Service
    public class OptimizedTokenValidator {

        @Cacheable(value = "tokenCache", key = "#token")
        public OAuth2Authentication validateToken(String token) {
            // 昂贵的令牌验证逻辑
            return remoteTokenServices.loadAuthentication(token);
        }

        // 监控缓存命中率
        @Scheduled(fixedRate = 60000)
        public void monitorCachePerformance() {
            Cache cache = cacheManager.getCache("tokenCache");
            com.github.benmanes.caffeine.cache.stats stats = 
                ((CaffeineCache) cache).getNativeCache().stats();

            double hitRate = stats.hitRate();
            log.info("Token cache hit rate: {}", hitRate);

            if (hitRate < 0.8) {
                // 调整缓存策略
                adjustCacheConfiguration();
            }
        }
    }
}

// 响应式令牌验证实现
@RestController
public class ReactiveTokenEndpoint {

    @Autowired
    private ReactiveTokenService tokenService;

    @PostMapping("/token")
    public Mono<ResponseEntity<OAuth2AccessToken>> getToken(
            @Valid @RequestBody TokenRequest request) {

        return tokenService.issueToken(request)
            .timeout(Duration.ofSeconds(30))
            .onErrorResume(TimeoutException.class, 
                e -> Mono.error(new ServerTimeoutException("Token service timeout")))
            .map(token -> ResponseEntity.ok().body(token))
            .doOnSuccess(response -> 
                metrics.incrementCounter("token.issued.success"))
            .doOnError(error -> 
                metrics.incrementCounter("token.issued.failure"));
    }
}

@Service
public class ReactiveTokenService {

    public Mono<OAuth2AccessToken> issueToken(TokenRequest request) {
        return Mono.fromCallable(() -> validateRequest(request))
            .subscribeOn(Schedulers.boundedElastic())
            .flatMap(validRequest -> 
                generateAccessToken(validRequest)
                    .doOnNext(token -> 
                        auditLog.logTokenIssuance(request, token)));
    }
}

// 令牌绑定实现
@Component
public class TokenBindingService {

    private final SecureRandom random = new SecureRandom();

    public String generateTokenBindingKey() {
        byte[] keyMaterial = new byte[32];
        random.nextBytes(keyMaterial);
        return Base64.getUrlEncoder().encodeToString(keyMaterial);
    }

    public boolean verifyTokenBinding(String token, 
                                     HttpServletRequest request) {
        // 提取令牌中的绑定ID
        String tokenBindingId = extractBindingIdFromToken(token);

        // 从TLS会话中获取绑定ID
        String tlsBindingId = extractTlsBindingId(request);

        // 验证绑定匹配
        return tokenBindingId != null && 
               tlsBindingId != null && 
               tokenBindingId.equals(tlsBindingId);
    }

    private String extractTlsBindingId(HttpServletRequest request) {
        // 从TLS会话哈希生成绑定ID
        String tlsSessionId = request.getHeader("X-TLS-Session-ID");
        if (tlsSessionId != null) {
            return DigestUtils.sha256Hex(tlsSessionId);
        }
        return null;
    }
}

class ThreatDetectionEngine:
    def __init__(self):
        self.behavior_baseline = BehaviorBaseline()
        self.anomaly_detector = AnomalyDetector()

    def analyze_token_request(self, request_data: dict) -> ThreatLevel:
        """分析令牌请求的威胁等级"""

        # 1. 频率分析
        request_frequency = self.calculate_request_frequency(
            request_data['client_id'], 
            request_data['ip_address']
        )

        # 2. 地理位置分析
        geo_anomaly = self.detect_geographic_anomaly(
            request_data['ip_address'], 
            request_data['user_agent']
        )

        # 3. 设备指纹分析
        device_risk = self.assess_device_risk(request_data['user_agent'])

        # 4. 行为模式分析
        behavior_score = self.analyze_behavior_pattern(request_data)

        # 综合威胁评分
        threat_score = (request_frequency * 0.3 + 
                       geo_anomaly * 0.25 + 
                       device_risk * 0.2 + 
                       behavior_score * 0.25)

        return self.classify_threat_level(threat_score)

# 简化安全配置
oauth2:
  client:
    registration:
      github:
        client-id: ${GITHUB_CLIENT_ID}
        client-secret: ${GITHUB_CLIENT_SECRET}
        scope: read:user
      google:
        client-id: ${GOOGLE_CLIENT_ID}
        client-secret: ${GOOGLE_CLIENT_SECRET}
        scope: profile,email

  security:
    basic:
      enable: false
    token:
      validate: true
      store: jwt
      jwt:
        key: ${JWT_SIGNING_KEY}

// 分布式令牌缓存架构
@Configuration
public class DistributedTokenConfig {

    @Bean
    public RedisConnectionFactory redisConnectionFactory() {
        RedisClusterConfiguration config = new RedisClusterConfiguration();
        config.clusterNode("redis-node1", 6379);
        config.clusterNode("redis-node2", 6379);
        config.clusterNode("redis-node3", 6379);

        return new JedisConnectionFactory(config);
    }

    @Bean
    public RedisTemplate<String, OAuth2AccessToken> tokenRedisTemplate() {
        RedisTemplate<String, OAuth2AccessToken> template = new RedisTemplate<>();
        template.setConnectionFactory(redisConnectionFactory());
        template.setKeySerializer(new StringRedisSerializer());
        template.setValueSerializer(new Jackson2JsonRedisSerializer<>(OAuth2AccessToken.class));
        return template;
    }
}

// 轻量级OAuth2客户端实现（C语言）
typedef struct {
    char client_id[64];
    char client_secret[128];
    char access_token[256];
    uint32_t token_expiry;
} oauth2_client_t;

int oauth2_device_authenticate(oauth2_client_t *client, 
                              const char *auth_server) {
    // 设备证书双向认证
    if (!tls_mutual_auth(auth_server)) {
        return -1;
    }

    // 使用设备指纹作为客户端断言
    char device_fingerprint[64];
    generate_device_fingerprint(device_fingerprint);

    // JWT客户端断言
    char client_assertion[512];
    build_jwt_assertion(client, device_fingerprint, client_assertion);

    // 令牌请求
    return request_device_token(client, auth_server, client_assertion);
}

server:
  ssl:
    enabled: true
    key-store: classpath:keystore.p12
    key-store-password: ${KEYSTORE_PASSWORD}
    key-store-type: PKCS12
    protocol: TLSv1.3
    ciphers: TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256

security:
  require-ssl: true
  hsts: 
    include-subdomains: true
    preload: true
    max-age: 31536000

# Prometheus监控配置
metrics:
  oauth2:
    enabled: true
    endpoints:

      - /oauth2/authorize
      - /oauth2/token
      - /oauth2/introspect

alerting:
  rules:

    - alert: HighTokenErrorRate
      expr: rate(oauth2_token_errors_total[5m]) > 0.05
      for: 2m
      labels:
        severity: critical
      annotations:
        summary: "高令牌错误率"
        description: "令牌端点错误率超过5%，可能需要检查客户端配置"

    - alert: TokenServiceLatencyHigh
      expr: histogram_quantile(0.95, rate(oauth2_token_duration_seconds_bucket[5m])) > 1
      for: 5m
      labels:
        severity: warning
      annotations:
        summary: "令牌服务延迟过高"