Spring Security基本使用¶

@Component
public class JwtUtil {
    // 服务器签名
    private static final String SERVER_SIGNATURE = "kIEy29oOe+xk6V9umA3ddq96mPjg6hV31fG/3It3TNQ=";
    // 过期时间
    private static final long EXPIRATION = 24 * 60 * 60 * 1000; // 一天
    // 生成安全密钥，String->Byte数组：解码
    private static final SecretKey KEY = Keys.hmacShaKeyFor(Decoders.BASE64.decode(SERVER_SIGNATURE));

    // 生成token
    public static String generate(Map<String, Object> claim) {
        return Jwts.builder()
                .setClaims(claim) // 添加自定义信息
                .setIssuedAt(new Date()) // 设置签名时间
                .setExpiration(new Date(System.currentTimeMillis() + EXPIRATION)) // 设置token过期时间
                .signWith(KEY) // 签名
                .compact();
    }

    // 解析token
    public static Claims parse(String token) {
        JwtParserBuilder jwtParserBuilder = Jwts.parser().setSigningKey(KEY);
        return jwtParserBuilder.build().parseClaimsJws(token).getBody();
    }
}

public interface UserDetailsService {
    UserDetails loadUserByUsername(String username) throws UsernameNotFoundException;
}

public interface UserDetails extends Serializable {
    Collection<? extends GrantedAuthority> getAuthorities(); // 权限集合

    String getPassword(); // 密码

    String getUsername(); // 用户名

    // 账户是否未过期（false则无法登录）
    default boolean isAccountNonExpired() { 
        return true;
    }

    // 账户是否未锁定（false则无法登录）
    default boolean isAccountNonLocked() {
        return true;
    }

    // 凭证（密码）是否未过期（false则无法登录）
    default boolean isCredentialsNonExpired() { 
        return true;
    }

    // 账户是否启用（false则无法登录）
    default boolean isEnabled() {
        return true;
    }
}

public UsernamePasswordAuthenticationToken(
    Object principal, Object credentials, Collection<? extends GrantedAuthority> authorities) {
    super(authorities);
    this.principal = principal;
    this.credentials = credentials;
    super.setAuthenticated(true);
}

// 将认证信息设置到Security上下文中
SecurityContextHolder.getContext().setAuthentication(authToken);

// 从数据库查询用户信息
User user = userMapper.findByUsername(username);
if (user == null) {
    throw new UsernameNotFoundException("用户不存在: " + username);
}
@Mapper
public interface UserMapper extends BaseMapper<User> {

    /**
     * 根据用户名查询用户信息
     * @param username 用户名
     * @return 用户信息
     */
    @Select("SELECT * FROM user WHERE username = #{username}")
    User findByUsername(String username);
}

// 查询用户角色信息
Role role = roleMapper.selectById(user.getRoleId());
if (role == null) {
    throw new UsernameNotFoundException("用户角色不存在");
}
// 构建用户权限列表
Collection<GrantedAuthority> authorities = new ArrayList<>();
authorities.add(new SimpleGrantedAuthority("ROLE_" + role.getRole()));

// 返回Spring Security的User对象
return new org.springframework.security.core.userdetails.User(
        user.getUsername(),
        user.getPassword(),
        true, // enabled属性
        true, // accountNonExpired属性
        true, // credentialsNonExpired属性
        true, // accountNonLocked属性
        authorities // 权限集合
);

@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {

    @Autowired
    private JwtUtil jwtUtil;

    @Autowired
    private CustomUserDetailsService userDetailsService;

    @Override
    protected void doFilterInternal(HttpServletRequest request, 
                                  HttpServletResponse response, 
                                  FilterChain filterChain) throws ServletException, IOException {

        // 从请求头中获取Authorization字段
        final String authorizationHeader = request.getHeader("Authorization");

        String username = null;
        String jwt = null;

        // 检查Authorization头是否存在且以"Bearer "开头
        if (authorizationHeader != null && authorizationHeader.startsWith("Bearer ")) {
            // 提取JWT Token（去掉"Bearer "前缀）
            jwt = authorizationHeader.substring(7);
            try {
                // 从Token中提取用户名
                username = jwtUtil.extractUsername(jwt);
            } catch (Exception e) {
                logger.error("无法从JWT Token中提取用户名", e);
            }
        }

        // 如果提取到用户名且当前没有认证信息
        if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {

            // 加载用户详情
            UserDetails userDetails = userDetailsService.loadUserByUsername(username);

            // 验证Token是否有效
            if (jwtUtil.validateToken(jwt, userDetails.getUsername())) {

                // 创建认证Token
                UsernamePasswordAuthenticationToken authToken = 
                    new UsernamePasswordAuthenticationToken(
                        userDetails, 
                        null, 
                        userDetails.getAuthorities()
                    );

                // 设置认证详情
                authToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));

                // 将认证信息设置到Security上下文中
                SecurityContextHolder.getContext().setAuthentication(authToken);
            }
        }

        // 继续执行过滤器链
        filterChain.doFilter(request, response);
    }
}
@Service
public class CustomUserDetailsService implements UserDetailsService {

    @Autowired
    private UserMapper userMapper;

    @Autowired
    private RoleMapper roleMapper;

    /**
     * 根据用户名加载用户信息
     * @param username 用户名
     * @return UserDetails对象
     * @throws UsernameNotFoundException 用户不存在异常
     */
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        // 从数据库查询用户信息
        User user = userMapper.findByUsername(username);
        if (user == null) {
            throw new UsernameNotFoundException("用户不存在: " + username);
        }

        // 查询用户角色信息
        Role role = roleMapper.selectById(user.getRoleId());
        if (role == null) {
            throw new UsernameNotFoundException("用户角色不存在");
        }

        // 构建用户权限列表
        Collection<GrantedAuthority> authorities = new ArrayList<>();
        authorities.add(new SimpleGrantedAuthority("ROLE_" + role.getRole()));

        // 返回Spring Security的User对象
        return new org.springframework.security.core.userdetails.User(
                user.getUsername(),
                user.getPassword(),
                true, // enabled
                true, // accountNonExpired
                true, // credentialsNonExpired
                true, // accountNonLocked
                authorities
        );
    }
}

@Configuration
@EnableWebSecurity // 启用Spring Security
public class SecurityConfig {

    @Autowired
    private JwtAuthenticationFilter jwtAuthenticationFilter;

    /**
     * 配置密码编码器
     * 使用明文密码（仅用于学习，生产环境不推荐）
     */
    @Bean
    public PasswordEncoder passwordEncoder() {
        return NoOpPasswordEncoder.getInstance();
    }

    /**
     * 配置认证管理器
     */
    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
        return config.getAuthenticationManager();
    }

    /**
     * 配置安全过滤器链
     */
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            // 禁用CSRF保护（因为使用JWT）
            .csrf(csrf -> csrf.disable())

            // 配置请求授权
            .authorizeHttpRequests(authz -> authz
                // 允许登录接口无需认证
                .requestMatchers("/auth/login", "/auth/test").permitAll()
                // 管理员接口需要管理员权限
                .requestMatchers("/admin/**").hasRole("管理员")
                // 用户接口需要普通用户或管理员权限
                .requestMatchers("/user/**").hasAnyRole("普通用户", "管理员")
                // 其他所有请求都需要认证
                .anyRequest().authenticated()
            )

            // 配置会话管理为无状态（使用JWT）
            .sessionManagement(session -> session
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            )

            // 添加JWT认证过滤器
            .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }
}

@RestController
@RequestMapping("/auth")
@CrossOrigin(origins = "*") // 允许跨域请求
public class AuthController {

    @Autowired
    private AuthService authService;

    @PostMapping("/login")
    public ResponseEntity<LoginResponse> login(@RequestBody LoginRequest loginRequest) {
        LoginResponse response = authService.login(loginRequest);
        return ResponseEntity.ok(response);
    }


    @GetMapping("/test")
    public ResponseEntity<String> test() {
        return ResponseEntity.ok("认证服务正常运行！");
    }
}

public LoginResponse login(LoginRequest loginRequest) {
    try {
        // 使用Spring Security进行认证
        Authentication authentication = authenticationManager.authenticate(
            new UsernamePasswordAuthenticationToken(
                loginRequest.getUsername(), 
                loginRequest.getPassword()
            )
        );

        // 认证成功，获取用户信息
        User user = userMapper.findByUsername(loginRequest.getUsername());
        Role role = roleMapper.selectById(user.getRoleId());

        // 生成JWT Token
        String token = jwtUtil.generateToken(user.getUsername(), role.getRole());

        return new LoginResponse(token, user.getUsername(), role.getRole(), "登录成功");

    } catch (AuthenticationException e) {
        throw new RuntimeException("用户名或密码错误");
    }
}

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class SecurityConfig {
    // ...
}

@RestController
@RequestMapping("/method")
public class MethodController {

    // 管理员和用户都能访问
    @RequestMapping("/all")
    @PreAuthorize("hasRole('管理员') or hasRole('普通用户')")
    public String all() {
        return "管理员和用户都能访问";
    }

    // 只有普通用户可以访问
    @RequestMapping("/onlyUser")
    @PreAuthorize("hasRole('普通用户')")
    public String onlyUser() {
        return "用户都能访问";
    }

    // 只有普通管理员可以访问
    @RequestMapping("/onlyAdmin")
    @PreAuthorize("hasRole('管理员')")
    public String onlyAdmin() {
        return "管理员能访问";
    }
}

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class SecurityConfig {

    @Autowired
    private JwtAuthenticationFilter jwtAuthenticationFilter;

    // 配置密码器，目前使用明文校验
    @Bean
    public PasswordEncoder passwordEncoder() {
        return NoOpPasswordEncoder.getInstance();
    }

    // 配置安全管理器
    @Bean
    @SneakyThrows
    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) {
        return configuration.getAuthenticationManager();
    }

    // 自定义安全过滤器链
    @Bean
    @SneakyThrows
    public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) {

        httpSecurity.csrf(csrf -> csrf.disable())
                .authorizeHttpRequests(request ->
                        request.requestMatchers("auth/**", "ai/chat").permitAll()
                                .anyRequest().authenticated())
                .sessionManagement(session ->
                        session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);

        return httpSecurity.build();
    }

}