// 假設(shè)UserService是一個服務(wù)類，用于處理用戶登錄邏輯
public class UserService {

    public User login(HttpServletRequest request, String username, String password) {
        // 真實環(huán)境中，這里應(yīng)該是從數(shù)據(jù)庫驗證用戶名和密碼
        User user = findUserByUsernameAndPassword(username, password);

        if (user != null) {
            // 檢查用戶是否已經(jīng)登錄
            HttpSession session = request.getSession(false);
            if (session != null) {
                // 如果session不為空，說明用戶已登錄，可以根據(jù)業(yè)務(wù)需求處理，這里簡單示例為踢出前一個登錄
                session.invalidate(); // 使之前的session失效
            }
            
            // 創(chuàng)建新的session，并保存用戶信息
            HttpSession newUserSession = request.getSession(true);
            newUserSession.setAttribute("currentUser", user);
            return user;
        } else {
            return null; // 登錄失敗
        }
    }
}

@Service
public class UserService {

    @Autowired
    private UserRepository userRepository;

    public User login(HttpServletRequest request, String username, String password) {
        User user = userRepository.findByUsername(username);
        
        if (user != null && user.getPassword().equals(password)) {
            // 檢查用戶是否已登錄
            if (user.getLoginStatus()) {
                // 根據(jù)業(yè)務(wù)需求處理重復(fù)登錄，這里假設(shè)直接覆蓋之前的登錄
                logout(request, user);
            }
            
            // 更新數(shù)據(jù)庫中的登錄狀態(tài)和Session ID
            String sessionId = request.getSession().getId();
            user.setSessionId(sessionId);
            user.setLoginStatus(true);
            userRepository.save(user);
            return user;
        }
        return null;
    }

    public void logout(HttpServletRequest request, User user) {
        // 更新數(shù)據(jù)庫中的登錄狀態(tài)
        user.setLoginStatus(false);
        user.setSessionId(null);
        userRepository.save(user);
        
        // 清除Session
        request.getSession().invalidate();
    }
}

<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-api</artifactId>
    <version>0.11.2</version>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-impl</artifactId>
    <version>0.11.2</version>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-jackson</artifactId> <!-- 或jjwt-gson如果你使用Gson -->
    <version>0.11.2</version>
</dependency>

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;

public class JwtUtils {
    private static final String SECRET_KEY = "SecretKey"; // 應(yīng)替換密鑰
    private static final long EXPIRATION_TIME = 86400000; // 1天有效期

    // 生成Token
    public static String generateToken(String username) {
        Date now = new Date();
        Date expiration = new Date(now.getTime() + EXPIRATION_TIME);

        Map<String, Object> claims = new HashMap<>();
        claims.put("username", username);

        return Jwts.builder()
                .setClaims(claims)
                .setIssuedAt(now)
                .setExpiration(expiration)
                .signWith(SignatureAlgorithm.HS256, SECRET_KEY)
                .compact();
    }

    // 驗證Token
    public static boolean validateToken(String token) {
        try {
            Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token);
            return true;
        } catch (Exception e) {
            return false;
        }
    }

    // 從Token中獲取用戶名
    public static String getUsernameFromToken(String token) {
        Claims claims = Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token).getBody();
        return claims.get("username", String.class);
    }
}

@RestController
@RequestMapping("/api/auth")
public class AuthController {

    @PostMapping("/login")
    public ResponseEntity<Map<String, String>> login(@RequestBody LoginRequest loginRequest) {
        // 假設(shè)UserService能根據(jù)用戶名和密碼驗證用戶
        if (userService.authenticate(loginRequest.getUsername(), loginRequest.getPassword())) {
            // 生成Token
            String token = JwtUtils.generateToken(loginRequest.getUsername());

            // 假設(shè)TokenService用于存儲和管理Token
            tokenService.saveToken(token);

            Map<String, String> response = new HashMap<>();
            response.put("token", token);
            return ResponseEntity.ok(response);
        } else {
            throw new ResponseStatusException(HttpStatus.UNAUTHORIZED, "Invalid username or password");
        }
    }
}

// 示例攔截器或過濾器邏輯
public class JwtAuthenticationFilter extends OncePerRequestFilter {

    @Autowired
    private TokenService tokenService;

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {
        String token = getTokenFromRequest(request);
        if (JwtUtils.validateToken(token)) {
            String username = JwtUtils.getUsernameFromToken(token);
            if (tokenService.isTokenActive(username, token)) {
                // Token有效且未被其他會話使用，繼續(xù)請求鏈
                filterChain.doFilter(request, response);
            } else {
                // 重復(fù)登錄，可以在這里處理邏輯，如返回錯誤信息
                response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "重復(fù)登錄");
            }
        } else {
            // Token無效，可以在這里處理邏輯
            response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "無效的Token");
        }
    }

    // 從請求中提取Token的邏輯
    private String getTokenFromRequest(HttpServletRequest request) {
        String bearerToken = request.getHeader("Authorization");
        if (StringUtils.hasText(bearerToken) && bearerToken.startsWith("Bearer ")) {
            return bearerToken.substring(7);
        }
        return null;
    }
}