/**
 * 自定義用戶角色
 */
@Data
public class PhoneUserDetails implements UserDetails {

    public static final String ACCOUNT_ACTIVE_STATUS = "ACTIVE";

    public static final Integer NOT_EXPIRED = 0;

    private String userId;
    private String userName;
    private String phone;
    private String status;
    private Integer isExpired;

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        Collection<GrantedAuthority> collection = new HashSet<>();
        return collection;
    }

    @Override
    public String getPassword() {
        return null;
    }

    @Override
    public String getUsername() {
        return this.phone;
    }

    @Override
    public boolean isAccountNonExpired() {
        return NOT_EXPIRED.equals(isExpired);
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return ACCOUNT_ACTIVE_STATUS.equals(status);
    }
}

@Service
public class PhoneUserDetailsService implements UserDetailsService {

    public static final String USER_INFO_SUFFIX = "user:info:";

    @Autowired
    private PhoneUserMapper phoneUserMapper;

    @Autowired
    private RedisTemplate<String,Object> redisTemplate;

    /**
     * 查找用戶
     * @param username
     * @return
     * @throws UsernameNotFoundException
     */
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        //先查詢緩存
        String userKey = USER_INFO_SUFFIX + username;
        PhoneUserDetails cacheUserInfo = (PhoneUserDetails) redisTemplate.opsForValue().get(userKey);
        if (cacheUserInfo == null){
            //緩存不存在，從數(shù)據(jù)庫(kù)查找用戶信息
            PhoneUserDetails phoneUserDetails = phoneUserMapper.selectPhoneUserByPhone(username);
            if (phoneUserDetails == null){
                throw new UsernameNotFoundException("用戶不存在");
            }
            //加入緩存
            redisTemplate.opsForValue().set(userKey,phoneUserDetails);
            return phoneUserDetails;
        }
        return cacheUserInfo;
    }

}

@Getter
@Setter
public class PhoneAuthenticationToken  extends AbstractAuthenticationToken {

    private final Object principal;

    private Object credentials;

   /**
     * 可以自定義屬性
     */
    private String phone;

    /**
     * 創(chuàng)建一個(gè)未認(rèn)證的對(duì)象
     * @param principal
     * @param credentials
     */
    public PhoneAuthenticationToken(Object principal, Object credentials) {
        super(null);
        this.principal = principal;
        this.credentials = credentials;
        setAuthenticated(false);
    }

    public PhoneAuthenticationToken(Collection<? extends GrantedAuthority> authorities, Object principal, Object credentials) {
        super(authorities);
        this.principal = principal;
        this.credentials = credentials;
        // 必須使用super，因?yàn)槲覀円貙?xiě)
        super.setAuthenticated(true);
    }

    /**
     * 不能暴露Authenticated的設(shè)置方法，防止直接設(shè)置
     * @param isAuthenticated
     * @throws IllegalArgumentException
     */
    @Override
    public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
        Assert.isTrue(!isAuthenticated,
                "Cannot set this token to trusted - use constructor which takes a GrantedAuthority list instead");
        super.setAuthenticated(false);
    }

    /**
     * 用戶憑證，如密碼
     * @return
     */
    @Override
    public Object getCredentials() {
        return credentials;
    }

    /**
     * 被認(rèn)證主體的身份，如果是用戶名/密碼登錄，就是用戶名
     * @return
     */
    @Override
    public Object getPrincipal() {
        return principal;
    }
}

public interface AuthenticationProvider {
	
	//身份認(rèn)證
	Authentication authenticate(Authentication authentication)
			throws AuthenticationException;

	//是否支持傳入authentication類型的認(rèn)證
	boolean supports(Class<?> authentication);
}

/**
 * 手機(jī)驗(yàn)證碼認(rèn)證授權(quán)提供者
 */
@Data
public class PhoneAuthenticationProvider  implements AuthenticationProvider {

    private RedisTemplate<String,Object> redisTemplate;

    private PhoneUserDetailsService phoneUserDetailsService;

    public static final String PHONE_CODE_SUFFIX = "phone:code:";

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        //先將authentication轉(zhuǎn)為我們自定義的Authentication對(duì)象
        PhoneAuthenticationToken authenticationToken = (PhoneAuthenticationToken) authentication;
        //校驗(yàn)參數(shù)
        Object principal = authentication.getPrincipal();
        Object credentials = authentication.getCredentials();
        if (principal == null || "".equals(principal.toString()) || credentials == null || "".equals(credentials.toString())){
            throw new InternalAuthenticationServiceException("手機(jī)/手機(jī)驗(yàn)證碼為空！");
        }
        //獲取手機(jī)號(hào)和驗(yàn)證碼
        String phone = (String) authenticationToken.getPrincipal();
        String code = (String) authenticationToken.getCredentials();
        //查找手機(jī)用戶信息，驗(yàn)證用戶是否存在
        UserDetails userDetails = phoneUserDetailsService.loadUserByUsername(phone);
        if (userDetails == null){
            throw new InternalAuthenticationServiceException("用戶手機(jī)不存在！");
        }
        String codeKey =  PHONE_CODE_SUFFIX+phone;
        //手機(jī)用戶存在，驗(yàn)證手機(jī)驗(yàn)證碼是否正確
        if (!redisTemplate.hasKey(codeKey)){
            throw new InternalAuthenticationServiceException("驗(yàn)證碼不存在或已失效！");
        }
        String realCode = (String) redisTemplate.opsForValue().get(codeKey);
        if (StringUtils.isBlank(realCode) || !realCode.equals(code)){
            throw new InternalAuthenticationServiceException("驗(yàn)證碼錯(cuò)誤！");
        }
        //返回認(rèn)證成功的對(duì)象
        PhoneAuthenticationToken phoneAuthenticationToken = new PhoneAuthenticationToken(userDetails.getAuthorities(),phone,code);
        phoneAuthenticationToken.setPhone(phone);
        //details是一個(gè)泛型屬性，用于存儲(chǔ)關(guān)于認(rèn)證令牌的額外信息。其類型是 Object，所以你可以存儲(chǔ)任何類型的數(shù)據(jù)。這個(gè)屬性通常用于存儲(chǔ)與認(rèn)證相關(guān)的詳細(xì)信息，比如用戶的角色、IP地址、時(shí)間戳等。
        phoneAuthenticationToken.setDetails(userDetails);
        return phoneAuthenticationToken;
    }


    /**
     * ProviderManager 選擇具體Provider時(shí)根據(jù)此方法判斷
     * 判斷 authentication 是不是 SmsCodeAuthenticationToken 的子類或子接口
     */
    @Override
    public boolean supports(Class<?> authentication) {
        //isAssignableFrom方法如果比較類和被比較類類型相同，或者是其子類、實(shí)現(xiàn)類，返回true
        return PhoneAuthenticationToken.class.isAssignableFrom(authentication);
    }

}

public class PhoneVerificationCodeAuthenticationFilter extends AbstractAuthenticationProcessingFilter {

    /**
     * 參數(shù)名稱
     */
    public static final String USER_PHONE = "phone";
    public static final String PHONE_CODE = "phoneCode";

    private String userPhoneParameter = USER_PHONE;
    private String phoneCodeParameter = PHONE_CODE;

    /**
     * 是否只支持post請(qǐng)求
     */
    private boolean postOnly = true;

    /**
     * 通過(guò)構(gòu)造函數(shù)，設(shè)置對(duì)哪些請(qǐng)求進(jìn)行過(guò)濾，如下設(shè)置，則只有接口為 /phone_login，請(qǐng)求方式為 POST的請(qǐng)求才會(huì)進(jìn)入邏輯
     */
    public PhoneVerificationCodeAuthenticationFilter(){
        super(new RegexRequestMatcher("/phone_login","POST"));
    }


    /**
     * 認(rèn)證方法
     * @param request
     * @param response
     * @return
     * @throws AuthenticationException
     * @throws IOException
     * @throws ServletException
     */
    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException, IOException, ServletException {
        PhoneAuthenticationToken phoneAuthenticationToken;
        //請(qǐng)求方法類型校驗(yàn)
        if (this.postOnly && !request.getMethod().equals("POST")) {
            throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
        }
        //如果不是json參數(shù)，從request獲取參數(shù)
        if (!request.getContentType().equals(MediaType.APPLICATION_JSON_UTF8_VALUE) && !request.getContentType().equals(MediaType.APPLICATION_JSON_VALUE)) {
            String userPhone = request.getParameter(userPhoneParameter);
            String phoneCode = request.getParameter(phoneCodeParameter);
            phoneAuthenticationToken = new PhoneAuthenticationToken(userPhone,phoneCode);
        }else {
            //如果是json請(qǐng)求使用取參數(shù)邏輯,直接用map接收，也可以創(chuàng)建一個(gè)實(shí)體類接收
            Map<String, String> loginData = new HashMap<>(2);
            try {
                loginData = JSONObject.parseObject(request.getInputStream(), Map.class);
            } catch (IOException e) {
                throw new InternalAuthenticationServiceException("請(qǐng)求參數(shù)異常");
            }
            // 獲得請(qǐng)求參數(shù)
            String userPhone = loginData.get(userPhoneParameter);
            String phoneCode = loginData.get(phoneCodeParameter);
            phoneAuthenticationToken = new PhoneAuthenticationToken(userPhone,phoneCode);
        }
        phoneAuthenticationToken.setDetails(authenticationDetailsSource.buildDetails(request));
        return this.getAuthenticationManager().authenticate(phoneAuthenticationToken);
    }


}

@Component
public class CustomAuthenticationSuccessHandler implements AuthenticationSuccessHandler {

    /**
     * 登錄成功處理
     * @param httpServletRequest
     * @param httpServletResponse
     * @param authentication
     * @throws IOException
     * @throws ServletException
     */
    @Override
    public void onAuthenticationSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException {
        httpServletResponse.setContentType("application/json;charset=utf-8");
        Map<String, Object> resp = new HashMap<>();
        resp.put("status", 200);
        resp.put("msg", "登錄成功!");
        resp.put("token", new UUIDGenerator().next());
        String s = JSONObject.toJSONString(resp);
        httpServletResponse.getWriter().write(s);
    }

}

@Slf4j
@Component
public class CustomAuthenticationFailureHandler implements AuthenticationFailureHandler {

    /**
     * 登錄失敗處理
     * @param httpServletRequest
     * @param httpServletResponse
     * @param exception
     * @throws IOException
     * @throws ServletException
     */
    @Override
    public void onAuthenticationFailure(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException exception) throws IOException, ServletException {
        httpServletResponse.setContentType("application/json;charset=utf-8");
        Map<String, Object> resp = new HashMap<>();
        resp.put("status", 500);
        resp.put("msg", "登錄失敗!" );
        String s  = JSONObject.toJSONString(resp);
        log.error("登錄異常：",exception);
        httpServletResponse.getWriter().write(s);
    }


}

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private RedisTemplate<String, Object> redisTemplate;

    @Autowired
    private PhoneUserDetailsService phoneUserDetailsService;


    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().anyRequest().authenticated()
                .and()
                .formLogin().successHandler(new CustomAuthenticationSuccessHandler()).permitAll()
                .and()
                .csrf().disable();

        //添加自定義過(guò)濾器
        PhoneVerificationCodeAuthenticationFilter phoneVerificationCodeAuthenticationFilter = new PhoneVerificationCodeAuthenticationFilter();
        //設(shè)置過(guò)濾器認(rèn)證成功和失敗的處理類
        phoneVerificationCodeAuthenticationFilter.setAuthenticationSuccessHandler(new CustomAuthenticationSuccessHandler());
        phoneVerificationCodeAuthenticationFilter.setAuthenticationFailureHandler(new CustomAuthenticationFailureHandler());
        //設(shè)置認(rèn)證管理器
        phoneVerificationCodeAuthenticationFilter.setAuthenticationManager(authenticationManager());
        //addFilterBefore方法用于將自定義的過(guò)濾器添加到過(guò)濾器鏈中，并指定該過(guò)濾器在哪個(gè)已存在的過(guò)濾器之前執(zhí)行
        http.addFilterBefore(phoneVerificationCodeAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        // 采用密碼授權(quán)模式需要顯式配置AuthenticationManager
        return super.authenticationManagerBean();
    }

    /**
     *
     * @param auth 認(rèn)證管理器
     * @throws Exception
     */
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        //添加自定義認(rèn)證提供者
        auth.authenticationProvider(phoneAuthenticationProvider());
    }

    /**
     * 手機(jī)驗(yàn)證碼登錄的認(rèn)證提供者
     * @return
     */
    @Bean
    public PhoneAuthenticationProvider phoneAuthenticationProvider(){
        PhoneAuthenticationProvider phoneAuthenticationProvider = new PhoneAuthenticationProvider();
        phoneAuthenticationProvider.setRedisTemplate(redisTemplate);
        phoneAuthenticationProvider.setPhoneUserDetailsService(phoneUserDetailsService);
        return phoneAuthenticationProvider;
    }

}