public class CustomAuthorizeAttribute : AuthorizeAttribute
{
    protected override void HandleUnauthorizedRequest(HttpActionContext actionContext)
    {
        actionContext.Response = actionContext.Request.CreateResponse(
            HttpStatusCode.Unauthorized,
            new
            {
                Code = "AUTH001",
                Message = "Authentication failed",
                Details = "Invalid or expired token",
                HelpLink = "https://example.com/docs/auth"
            });
    }
}

public class Startup
{
    public void Configuration(IAppBuilder app)
    {
        // 配置OAuth2
        var oauthOptions = new OAuthAuthorizationServerOptions
        {
            Provider = new CustomOAuthProvider(),
            AccessTokenExpireTimeSpan = TimeSpan.FromHours(1),
            AllowInsecureHttp = true // 仅开发环境使用
        };
        
        app.UseOAuthAuthorizationServer(oauthOptions);
        app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions
        {
            Provider = new CustomOAuthBearerProvider()
        });
    }
}

public class CustomOAuthBearerProvider : OAuthBearerAuthenticationProvider
{
    public override Task RequestToken(OAuthRequestTokenContext context)
    {
        return base.RequestToken(context);
    }

    public override Task ValidateIdentity(OAuthValidateIdentityContext context)
    {
        if (!context.IsValidated)
        {
            context.Response.Content = new StringContent(JsonConvert.SerializeObject(new
            {
                Code = "AUTH002",
                Message = "Invalid token",
                Details = "The access token is invalid or malformed"
            }));
            context.Response.StatusCode = (int)HttpStatusCode.Unauthorized;
            context.Response.Content.Headers.ContentType = new MediaTypeHeaderValue("application/json");
        }
        return Task.FromResult<object>(null);
    }
}

public class CustomUnauthorizedResult : IHttpActionResult
{
    private readonly HttpRequestMessage _request;
    private readonly string _message;

    public CustomUnauthorizedResult(HttpRequestMessage request, string message)
    {
        _request = request;
        _message = message;
    }

    public Task<HttpResponseMessage> ExecuteAsync(CancellationToken cancellationToken)
    {
        var response = new HttpResponseMessage(HttpStatusCode.Unauthorized)
        {
            RequestMessage = _request,
            Content = new StringContent(JsonConvert.SerializeObject(new
            {
                Code = "AUTH003",
                Message = _message,
                Timestamp = DateTime.UtcNow
            }))
        };
        response.Content.Headers.ContentType = new MediaTypeHeaderValue("application/json");
        return Task.FromResult(response);
    }
}

// 在控制器中使用
[Authorize]
public class ValuesController : ApiController
{
    public IHttpActionResult Get()
    {
        if (!User.Identity.IsAuthenticated)
        {
            return new CustomUnauthorizedResult(Request, "You must be authenticated to access this resource");
        }
        return Ok("Authorized content");
    }
}