export async function actSignInWithOAuth({ provider }: { provider: Provider }) {
  const supabase = createClient();

  // 根据provider生成supabase/auth 地址以及参数。携带redirectTo（完成授权后的业务地址callback）
  const { data, error } = await supabase.auth.signInWithOAuth({
    provider,
    options: {
      redirectTo: absoluteUrl("auth/callback"),
    },
  });
  if (error) {
    redirect("/auth/error");
  }

  // revalidate the path to ensure that the user is logged in?
  revalidatePath("/", "layout");

  // 302跳转supabase的auth 地址
  if (data.url) {
    redirect(data.url); // use the redirect API for your server framework
  }
}

{
  "provider": "github",
  "url": "https://xxxxxx.supabase.co/auth/v1/authorize?provider=github&redirect_to=http%3A%2F%2F127.0.0.1%3A3000%2Fauth%2Fcallback&code_challenge=qnxFcWdM82JiOMPibcPa9_jiP4b1n6FVHx82QYLs_Ag&code_challenge_method=s256"
}

// Provider returns a Provider interface for the given name.
func (a *API) Provider(ctx context.Context, name string, scopes string) (provider.Provider, error) {
	config := a.config
	name = strings.ToLower(name)

	switch name {
	case "apple":
		return provider.NewAppleProvider(ctx, config.External.Apple)
	case "azure":
		return provider.NewAzureProvider(config.External.Azure, scopes)
	case "bitbucket":
		return provider.NewBitbucketProvider(config.External.Bitbucket)
	case "github":
		return provider.NewGithubProvider(config.External.Github, scopes)
	// ... Ignore other provider here
	default:
		return nil, fmt.Errorf("Provider %s could not be found", name)
	}
}
// Construct provider object option
func NewGithubProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error) {
	if err := ext.ValidateOAuth(); err != nil {
		return nil, err
	}

	authHost := chooseHost(ext.URL, defaultGitHubAuthBase)
	apiHost := chooseHost(ext.URL, defaultGitHubAPIBase)
	if !strings.HasSuffix(apiHost, defaultGitHubAPIBase) {
		apiHost += "/api/v3"
	}

	oauthScopes := []string{
		"user:email",
	}

	if scopes != "" {
		oauthScopes = append(oauthScopes, strings.Split(scopes, ",")...)
	}

	return &githubProvider{
		Config: &oauth2.Config{
			ClientID:     ext.ClientID[0],
			ClientSecret: ext.Secret,
			Endpoint: oauth2.Endpoint{
				AuthURL:  authHost + "/login/oauth/authorize",
				TokenURL: authHost + "/login/oauth/access_token",
			},
			RedirectURL: ext.RedirectURI,
			Scopes:      oauthScopes,
		},
		APIHost: apiHost,
	}, nil
}

// generate authorize URL for porvider
// from golang.org/x/oauth2
func (c *Config) AuthCodeURL(state string, opts ...AuthCodeOption) string {
	var buf bytes.Buffer
	buf.WriteString(c.Endpoint.AuthURL)
	v := url.Values{
		"response_type": {"code"},
		"client_id":     {c.ClientID},
	}
	if c.RedirectURL != "" {
		v.Set("redirect_uri", c.RedirectURL)
	}
	if len(c.Scopes) > 0 {
		v.Set("scope", strings.Join(c.Scopes, " "))
	}
	if state != "" {
		v.Set("state", state)
	}
	for _, opt := range opts {
		opt.setValue(v)
	}
	if strings.Contains(c.Endpoint.AuthURL, "?") {
		buf.WriteByte('&')
	} else {
		buf.WriteByte('?')
	}
	buf.WriteString(v.Encode())
	return buf.String()
}

claims := ExternalProviderClaims{
		AuthMicroserviceClaims: AuthMicroserviceClaims{
			RegisteredClaims: jwt.RegisteredClaims{
				ExpiresAt: jwt.NewNumericDate(time.Now().Add(5 * time.Minute)),
			},
			SiteURL:    config.SiteURL,
			InstanceID: uuid.Nil.String(),
		},
		Provider:    providerType,
		InviteToken: inviteToken,
		Referrer:    redirectURL,  // 业务指定的 redirect_to 参数，存储在 referrer 字段中
		FlowStateID: flowStateID,
	}

  // 生成stat参数
	tokenString, err := signJwt(&config.JWT, claims)
	if err != nil {
		return "", apierrors.NewInternalServerError("Error creating state").WithInternalError(err)
	}
	
	// ...
	authURL := p.AuthCodeURL(tokenString, authUrlParams...)

// 解析 redirec_to 参数，并校验合法性。非法时返回 site_url 代替。
func GetReferrer(r *http.Request, config *conf.GlobalConfiguration) string {
	// try get redirect url from query or post data first
	reqref := getRedirectTo(r)
	if IsRedirectURLValid(config, reqref) {
		return reqref
	}

	// instead try referrer header value
	reqref = r.Referer()
	if IsRedirectURLValid(config, reqref) {
		return reqref
	}

	return config.SiteURL
}

{
  "access_token": "xxx.xxxx.xxx",
  "token_type": "bearer",
  "expires_in": 3600,
  "expires_at": 1719229897,
  "refresh_token": "z41prc_xxxxxxxxxx",
  "user": {
    "id": "d87bb2ff-8ac4",
    "aud": "authenticated",
    "role": "authenticated",
    "email": "xxx@gmail.com",
    "email_confirmed_at": "",
    "phone": "",
    "confirmation_sent_at": "",
    "confirmed_at": "",
    "last_sign_in_at": "",
    "app_metadata": {
      "provider": "email",
      "providers": []
    },
    "user_metadata": {
      "avatar_url": "",
      "email": "xxx@gmail.com",
      "email_verified": true,
      "full_name": "",
      "iss": "https://api.github.com",
      "name": "",
      "phone_verified": false,
      "preferred_username": "alex-guoba",
      "provider_id": "",
      "sub": "",
      "user_name": "alex-guoba"
    },
    "created_at": "",
    "updated_at": "",
    "is_anonymous": false
  },
  "provider_token": "yyyyyy"
}