const clientId = '你的应用程序ID';
const redirectUri = encodeURIComponent('你的重定向URI');
const scopes = encodeURIComponent('openid profile email User.Read');
const authUrl = `https://login.microsoftonline.com/common/oauth2/v2.0/authorize?
    client_id=${clientId}
    &response_type=code
    &redirect_uri=${redirectUri}
    &response_mode=query
    &scope=${scopes}
    &state=12345`;

// 假设重定向URI是 https://your-app.com/auth/callback?code=xxxx&state=12345
const urlParams = new URLSearchParams(window.location.search);
const authorizationCode = urlParams.get('code');
const state = urlParams.get('state');

// 验证state参数是否匹配你最初设置的值
if (state !== '12345') {
    console.error('State mismatch, possible CSRF attack');
    return;
}

if (authorizationCode) {
    console.log('获取到的授权码:', authorizationCode);
    // 现在可以使用这个授权码获取访问令牌
}

async function getAccessToken(authorizationCode) {
    const tokenUrl = 'https://login.microsoftonline.com/common/oauth2/v2.0/token';
    const params = new URLSearchParams();
    params.append('client_id', '你的应用程序ID');
    params.append('scope', 'User.Read');
    params.append('code', authorizationCode);
    params.append('redirect_uri', '你的重定向URI');
    params.append('grant_type', 'authorization_code');
    params.append('client_secret', '你的客户端密钥'); // 仅适用于Web应用程序
    
    try {
        const response = await fetch(tokenUrl, {
            method: 'POST',
            headers: {
                'Content-Type': 'application/x-www-form-urlencoded'
            },
            body: params
        });
        
        if (!response.ok) {
            throw new Error(`HTTP error! status: ${response.status}`);
        }
        
        const tokenData = await response.json();
        console.log('访问令牌:', tokenData.access_token);
        return tokenData;
    } catch (error) {
        console.error('获取访问令牌失败:', error);
    }
}