Fix Alipay code exchange (#566)

* #565   Change client_id to app_id

* Update src/AspNet.Security.OAuth.Alipay/AlipayAuthenticationHandler.cs

Co-authored-by: Martin Costello <[email protected]>

Co-authored-by: hzexe <[email protected]>
Co-authored-by: Martin Costello <[email protected]>

Author: 3 people

src/AspNet.Security.OAuth.Alipay/AlipayAuthenticationHandler.cs

@@ -213,5 +213,40 @@ private string GetRSA2Signature([NotNull] SortedDictionary<string, string> sorte
 
             return Convert.ToBase64String(encryptedBytes);
         }
+
+         /// <inheritdoc />
+        protected override string BuildChallengeUrl(AuthenticationProperties properties, string redirectUri)
+        {
+            var scopeParameter = properties.GetParameter<ICollection<string>>(OAuthChallengeProperties.ScopeKey);
+            var scope = scopeParameter != null ? FormatScope(scopeParameter) : FormatScope();
+
+            var parameters = new Dictionary<string, string>
+            {
+                ["app_id"] = Options.ClientId, // Used instead of "client_id"
+                ["scope"] = scope,
+                ["response_type"] = "code",
+                ["redirect_uri"] = redirectUri,
+            };
+
+            if (Options.UsePkce)
+            {
+                var bytes = new byte[32];
+                RandomNumberGenerator.Fill(bytes);
+                var codeVerifier = Microsoft.AspNetCore.Authentication.Base64UrlTextEncoder.Encode(bytes);
+
+                // Store this for use during the code redemption.
+                properties.Items.Add(OAuthConstants.CodeVerifierKey, codeVerifier);
+
+                var challengeBytes = SHA256.HashData(Encoding.UTF8.GetBytes(codeVerifier));
+                var codeChallenge = WebEncoders.Base64UrlEncode(challengeBytes);
+
+                parameters[OAuthConstants.CodeChallengeKey] = codeChallenge;
+                parameters[OAuthConstants.CodeChallengeMethodKey] = OAuthConstants.CodeChallengeMethodS256;
+            }
+
+            parameters["state"] = Options.StateDataFormat.Protect(properties);
+
+            return QueryHelpers.AddQueryString(Options.AuthorizationEndpoint, parameters!);
+        }
     }
 }