config/          → 安全配置、JWT 過濾器
controller/      → 接收請(qǐng)求的入口
service/         → 業(yè)務(wù)邏輯、用戶詳情加載
repository/      → 數(shù)據(jù)庫(kù)訪問
model/           → 用戶實(shí)體、角色定義
utils/           → 密碼加密、JWT 工具

@Data
@Entity
@Table(name = "wzxg_users", uniqueConstraints = @UniqueConstraint(columnNames = "username"))
public class WzxgUser {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(nullable = false)
    private String username;

    @Column(nullable = false)
    private String password;

    @Enumerated(EnumType.STRING)
    @Column(nullable = false)
    private WzxgRole role;

    @CreationTimestamp
    private LocalDateTime createdTime;

    @UpdateTimestamp
    private LocalDateTime updatedTime;

    public enum WzxgRole {
        USER, ADMIN
    }
}

public interface WzxgUserRepository extends JpaRepository<WzxgUser, Long> {
    Optional<WzxgUser> findByUsername(String username);
}

public class WzxgPasswordUtil {
    private static final BCryptPasswordEncoder wzxgEncoder = new BCryptPasswordEncoder();

    public static String encode(String rawPassword) {
        return wzxgEncoder.encode(rawPassword);
    }

    public static boolean matches(String rawPassword, String encodedPassword) {
        return wzxgEncoder.matches(rawPassword, encodedPassword);
    }
}

@Component
public class WzxgJwtUtils {
    private static final String WZXG_SECRET_KEY = "wzxg_jwt_secret_key_2024";
    private static final long WZXG_EXPIRATION = 86400000; // 24小時(shí)

    public String generateToken(String username) {
        return Jwts.builder()
                .setSubject(username)
                .setExpiration(new Date(System.currentTimeMillis() + WZXG_EXPIRATION))
                .signWith(SignatureAlgorithm.HS256, WZXG_SECRET_KEY)
                .compact();
    }

    public boolean validateToken(String token) {
        try {
            Jwts.parser().setSigningKey(WZXG_SECRET_KEY).parseClaimsJws(token);
            return true;
        } catch (Exception e) {
            return false;
        }
    }

    public String extractUsername(String token) {
        Claims wzxgClaims = Jwts.parser()
                .setSigningKey(WZXG_SECRET_KEY)
                .parseClaimsJws(token)
                .getBody();
        return wzxgClaims.getSubject();
    }
}

@Service
public class WzxgUserDetailsService implements UserDetailsService {

    @Autowired
    private WzxgUserRepository wzxgUserRepository;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        WzxgUser wzxgUser = wzxgUserRepository.findByUsername(username)
                .orElseThrow(() -> new UsernameNotFoundException("用戶不存在"));

        return new org.springframework.security.core.userdetails.User(
                wzxgUser.getUsername(),
                wzxgUser.getPassword(),
                buildAuthorities(wzxgUser.getRole())
        );
    }

    private Collection<? extends GrantedAuthority> buildAuthorities(WzxgUser.WzxgRole role) {
        return Collections.singletonList(new SimpleGrantedAuthority("ROLE_" + role.name()));
    }
}

@Component
public class WzxgJwtAuthFilter extends OncePerRequestFilter {

    @Autowired
    private UserDetailsService wzxgUserDetailsService;

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain filterChain)
            throws ServletException, IOException {
        try {
            String wzxgToken = getToken(request);//從請(qǐng)求頭獲取jwt token
            if (wzxgToken != null) {
                String username = getUsername(wzxgToken);
                UserDetails wzxgUserDetails = wzxgUserDetailsService.loadUserByUsername(username);//根據(jù)用戶名加載用戶詳細(xì)信息
                UsernamePasswordAuthenticationToken wzxgAuth =
                        new UsernamePasswordAuthenticationToken(
                                wzxgUserDetails, null, wzxgUserDetails.getAuthorities());
                wzxgAuth.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                SecurityContextHolder.getContext().setAuthentication(wzxgAuth);
            }
        } catch (Exception e) {
        }
        filterChain.doFilter(request, response);
    }

    private String getToken(HttpServletRequest request) {
        String wzxgBearer = request.getHeader("Authorization");
        if (wzxgBearer != null && wzxgBearer.startsWith("Bearer ")) {
            return wzxgBearer.substring(7);
        }
        return null;
    }

    private String getUsername(String token) {
        try {
            Claims claims = extractClaimsIgnoreExpiration(token);
            return claims != null ? claims.getSubject() : null;
        } catch (Exception e) {
            return null;
        }
    }
}

@Configuration
@EnableWebSecurity
public class WzxgSecurityConfig {

    @Autowired
    private WzxgJwtAuthFilter wzxgJwtAuthFilter;

    @Bean
    public SecurityFilterChain wzxgFilterChain(HttpSecurity http) throws Exception {
        http.csrf(csrf -> csrf.disable())
            .authorizeHttpRequests(auth -> auth
                // 登錄注冊(cè)不需要認(rèn)證
                .requestMatchers("/api/v1/auth/register", "/api/v1/auth/login").permitAll()
                // 管理接口只有 ADMIN 能訪問
                .requestMatchers("/api/v1/manage/**").hasRole("ADMIN")
                // 普通業(yè)務(wù)接口，USER 和 ADMIN 都能訪問
                .requestMatchers("/api/v1/workspace/**").hasAnyRole("USER", "ADMIN")
                // 其余接口都需要認(rèn)證
                .anyRequest().authenticated()
            )
            .sessionManagement(session ->
                session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            )
            // 把 JWT 過濾器插到 UsernamePasswordAuthenticationFilter 前面
            .addFilterBefore(wzxgJwtAuthFilter, UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }
}

1. 用戶注冊(cè) → 密碼用 BCrypt 加密 → 分配默認(rèn)角色 USER → 存入數(shù)據(jù)庫(kù)

2. 用戶登錄 → 驗(yàn)證用戶名密碼 → 生成 JWT Token → 返回給客戶端

3. 客戶端請(qǐng)求業(yè)務(wù)接口 → 請(qǐng)求頭帶上 Authorization: Bearer <token>

4. WzxgJwtAuthFilter 攔截請(qǐng)求 → 提取 token → 驗(yàn)證簽名和有效期
   → 解析出用戶名 → 加載用戶信息和角色 → 寫入 SecurityContext

5. Spring Security 根據(jù) WzxgSecurityConfig 中的規(guī)則
   → 檢查當(dāng)前用戶的角色是否匹配目標(biāo)接口的權(quán)限要求
   → 通過則放行，否則返回 403