@Data
@Entity
public class Role {
    @Id
    @GeneratedValue
    private Integer id;
    private Long userId;
    private String role;
}

@Data
@Entity
public class User {
    @Id
    @GeneratedValue
    private Long id;
    private String username;
    private String password;
}

public class Realm extends AuthorizingRealm {
    @Autowired
    private UserService userService;
    //授權(quán)
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        //從憑證中獲得用戶名
        String username = (String) SecurityUtils.getSubject().getPrincipal();
        //根據(jù)用戶名查詢用戶對象
        User user = userService.getUserByUserName(username);
        //查詢用戶擁有的角色
        List<Role> list = roleService.findByUserId(user.getId());
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        for (Role role : list) {
            //賦予用戶角色
            info.addStringPermission(role.getRole());
        }
        return info;
    }
    //認(rèn)證
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        //獲得當(dāng)前用戶的用戶名
        String username = (String) authenticationToken.getPrincipal();
        //從數(shù)據(jù)庫中根據(jù)用戶名查找用戶
        User user = userService.getUserByUserName(username);
        if (userService.getUserByUserName(username) == null) {
            throw new UnknownAccountException(
                    "沒有在本系統(tǒng)中找到對應(yīng)的用戶信息。");
        }
        SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(user.getUsername(), user.getPassword(),getName());
        return info;
    }
}

@Configuration
public class ShiroConfig {
    @Bean
    public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager) {
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(securityManager);
        Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>();
        //以下是過濾鏈，按順序過濾，所以/**需要放最后
        //開放的靜態(tài)資源
        filterChainDefinitionMap.put("/favicon.ico", "anon");//網(wǎng)站圖標(biāo)
        filterChainDefinitionMap.put("/**", "authc");
        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
        return shiroFilterFactoryBean;
    }
    @Bean
    public DefaultWebSecurityManager securityManager() {
        DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager(myRealm());
        return defaultWebSecurityManager;
    }
    @Bean
    public MyRealm myRealm() {
        MyRealm myRealm = new MyRealm();
        return myRealm;
    }
}

@Controller
public class UserController {
    @Autowired
    private UserService userService;
    @GetMapping("/")
    public String index() {
        return "index";
    }
    @GetMapping("/login")
    public String toLogin() {
        return "login";
    }
    @GetMapping("/admin")
    public String admin() {
        return "admin";
    }
    @PostMapping("/login")
    public String doLogin(String username, String password) {
        UsernamePasswordToken token = new UsernamePasswordToken(username, password);
        Subject subject = SecurityUtils.getSubject();
        try {
            subject.login(token);
        } catch (Exception e) {
            e.printStackTrace();
        }
        return "redirect:admin";
    }
    @GetMapping("/home")
    public String home() {
        Subject subject = SecurityUtils.getSubject();
        try {
            subject.checkPermission("admin");
        } catch (UnauthorizedException exception) {
            System.out.println("沒有足夠的權(quán)限");
        }
        return "home";
    }
    @GetMapping("/logout")
    public String logout() {
        return "index";
    }
}

@Service
public class UserService {
    @Autowired
    private UserDao userDao;
    public User getUserByUserName(String username) {
        return userDao.findByUsername(username);
    }
    @RequiresRoles("admin")
    public void send() {
        System.out.println("我現(xiàn)在擁有角色admin，可以執(zhí)行本條語句");
    }
}

//當(dāng)這個(gè)方法返回true時(shí)說明有此權(quán)限
//這個(gè)p是代表當(dāng)前循環(huán)匹配到的權(quán)限標(biāo)簽
public boolean implies(Permission p) {
// By default only supports comparisons with other WildcardPermissions
if (!(p instanceof WildcardPermission)) {
return false;
}
    WildcardPermission wp = (WildcardPermission) p;
 //把當(dāng)前標(biāo)簽轉(zhuǎn)分割成一個(gè)set集合（如one:page1:view:add 會(huì)分割成[[one], [page1], [view], [add]]）
    List<Set<String>> otherParts = wp.getParts();
    int i = 0;
 //循環(huán)匹配權(quán)限標(biāo)簽
    for (Set<String> otherPart : otherParts) {
        // If this permission has less parts than the other permission, everything after the number of parts contained
        // in this permission is automatically implied, so return true
  //當(dāng)全部循環(huán)匹配完沒有返回false,則返回true,這個(gè)getparts()方法是獲取當(dāng)前角色當(dāng)前循環(huán)的權(quán)限標(biāo)簽（[[one], [page1], [view]]）
        if (getParts().size() - 1 < i) {
            return true;
        } else {
            Set<String> part = getParts().get(i);
   /*如果包含有‘*'而且不包含當(dāng)前分割后的標(biāo)簽則返回false,
    *當(dāng)用戶可以查看頁面，也就是說當(dāng)前角色擁有one:page1:view標(biāo)簽
    *這里【!part.contains(WILDCARD_TOKEN)】返回true,第二個(gè)【part.containsAll(otherPart)】one會(huì)跟當(dāng)前標(biāo)簽匹**配one,
    *也就是說這里全部循環(huán)完返回的都是false,所以最后都沒true,于是在上面返回了一個(gè)true。
            if (!part.contains(WILDCARD_TOKEN) && !part.containsAll(otherPart)) {
                return false;
            }
            i++;
        }
    }