public class CustomAuthenticationProvider implements AuthenticationProvider {  
    private final UserDetailsService userDetailsService;    // 賬號(hào)密碼驗(yàn)證  
    private final PasswordEncoder passwordEncoder;       // 密碼加密器  
    private final PhoneNumberUserService phoneNumberUserService; // 手機(jī)號(hào)驗(yàn)證  
    public CustomAuthenticationProvider(UserDetailsService userDetailsService,  
                                        PasswordEncoder passwordEncoder,  
                                        PhoneNumberUserService phoneNumberUserService) {  
        this.userDetailsService = userDetailsService;  
        this.passwordEncoder = passwordEncoder;  
        this.phoneNumberUserService = phoneNumberUserService;  
    }  
    @Override  
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {  
        String principal = (String) authentication.getPrincipal();  // username:xxx 或 phone:xxx        
        String credentials = (String) authentication.getCredentials(); // 密碼或驗(yàn)證碼  
        UserDetails userDetails;  
        if (principal.startsWith("username:")) {         // 賬號(hào)密碼登錄  
            String username = principal.substring("username:".length());  
            userDetails = userDetailsService.loadUserByUsername(username);  
            if (!passwordEncoder.matches(credentials, userDetails.getPassword())) {  
                throw new BadCredentialsException("密碼錯(cuò)誤");  
            }  
        } else if (principal.startsWith("phone:")) {         // 手機(jī)號(hào)登錄  
            String phoneNumber = principal.substring("phone:".length());  
            userDetails = phoneNumberUserService.loadUserByPhoneNumber(phoneNumber);         // 這里驗(yàn)證碼校驗(yàn)可放在 service 內(nèi)，也可前置過(guò)濾器                      
		else{  
			throw new BadCredentialsException("登錄方式不支持");  
		}          
		// 生成已認(rèn)證令牌  
		UsernamePasswordAuthenticationToken result = new UsernamePasswordAuthenticationToken(userDetails, credentials, userDetails.getAuthorities());  
			result.setDetails(authentication.getDetails());  
		return result;  
        }  
	@Override public boolean supports (Class < ? > authentication){  
		return UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication);  
	}  
    }  
}

@Service  
@RequiredArgsConstructor  
public class UserDetailsServiceImpl implements UserDetailsService {  
    private final UserMapper userMapper;  
    private final MenuMapper menuMapper;  
    @Override  
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {  
        User user = userMapper.selectOne(new LambdaQueryWrapper<User>().eq(User::getUserName, username));  
        if (user == null) throw new UsernameNotFoundException("用戶不存在");  
        List<String> perms = menuMapper.selectPermsByUserId(user.getId());  
        perms.add(user.getRoles()); // 合并角色         
		return new LoginUser(user, perms);  
    }  
}

@Service  
@RequiredArgsConstructor  
public class PhoneNumberUserService {  
    private final UserMapper userMapper;  
    private final MenuMapper menuMapper;  
    private final RedisTemplate<String, String> redisTemplate; // 緩存驗(yàn)證碼          
    public UserDetails loadUserByPhoneNumber(String phoneNumber) {       // 1? 查庫(kù)         
User user = userMapper.selectOne(new LambdaQueryWrapper<User>().eq(User::getPhonenumber, phoneNumber));  
        if (user == null)  
            throw new RuntimeException("手機(jī)號(hào)未注冊(cè)");          // 2? 查權(quán)限         
List<String> perms = menuMapper.selectPermsByUserId(user.getId());  
        perms.add(user.getRoles());          // 3?驗(yàn)證碼校驗(yàn)示例（可前置過(guò)濾器）       
        //String codeInRedis = redisTemplate.opsForValue().get("SMS:" + phoneNumber);  
        return new LoginUser(user, perms);  
    }  
}

@Configuration  
@EnableWebSecurity  
@RequiredArgsConstructor  
public class SecurityConfig {  
    private final AuthenticationConfiguration authenticationConfiguration;  
  //密碼加密器
    @Bean  
    public PasswordEncoder passwordEncoder() {  
        return new BCryptPasswordEncoder();  
    }  
    @Bean  
    public UserDetailsService userDetailsService() {  
        return new UserDetailsServiceImpl();  
    }  
    @Bean  
    public PhoneNumberUserService phoneNumberUserService() {  
        return new PhoneNumberUserService();  
    }  
    @Bean  
    public CustomAuthenticationProvider customAuthenticationProvider() {  
        return new CustomAuthenticationProvider(userDetailsService(), passwordEncoder(), phoneNumberUserService());  
    }  
    @Bean  
    public AuthenticationManager authenticationManager() throws Exception {       
    // 替換默認(rèn) AuthenticationManager
    return new ProviderManager(customAuthenticationProvider());  
    }  
}

@RestController  
@RequestMapping("/auth")  
@RequiredArgsConstructor  
public class AuthController {  
    private final AuthenticationManager authenticationManager;  
    private final RedisTemplate<String, Object> redisTemplate;  
    @PostMapping("/login")  
    public Result login(@RequestBody LoginDTO dto) {  
        String principal = dto.getLoginType() == 1 ? "username:" + dto.getUsername() : "phone:" + dto.getPhone();  
        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(principal, dto.getCredential());  
        Authentication authenticate = authenticationManager.authenticate(token);  
        LoginUser loginUser = (LoginUser) authenticate.getPrincipal();  
        String jwt = JwtUtil.createJWT(loginUser.getUser().getId().toString());  
        redisTemplate.opsForValue().set("login:" + loginUser.getUser().getId(), loginUser);  
        return Result.OK("登錄成功", Map.of("token", jwt));  
    }  
}