# 數(shù)據(jù)庫驅(qū)動：
spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
# 數(shù)據(jù)庫連接地址
spring.datasource.url=jdbc:mysql:///rog?useUnicode=true&characterEncoding=UTF-8&serverTimezone=Asia/Shanghai
# 數(shù)據(jù)庫用戶名&密碼：
spring.datasource.username=root
spring.datasource.password=root
#日志輸出,使用默認(rèn)的控制臺輸出
mybatis-plus.configuration.log-impl=org.apache.ibatis.logging.stdout.StdOutImpl
 
#mybatis plus 設(shè)置
mybatis-plus.mapper-locations=classpath*:com/xxx/mapper/xml/*Mapper.xml
 
#配置別名掃描
mybatis-plus.type-aliases-package=com.xxx.entity

@Service()
public class UsersServiceImpl extends ServiceImpl<UsersMapper, Users> implements IUsersService, UserDetailsService {
    @Autowired
    private UsersMapper usersMapper;
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        QueryWrapper<Users> wrapper = new QueryWrapper<>();
        wrapper.eq("user_name",username);
        //根據(jù)頁面?zhèn)鞯挠脩裘檎覕?shù)據(jù)庫判斷是否存在該用戶
        Users users = usersMapper.selectOne(wrapper);
        if (users==null){
            throw new UsernameNotFoundException("用戶不存在");
        }
        List<Role> roles = usersMapper.findRoles(users.getId());
        List<SimpleGrantedAuthority> authorities = new ArrayList<>();
        //遍歷當(dāng)前用戶的角色集合組裝權(quán)限
        for (Role role : roles) {
            authorities.add(new SimpleGrantedAuthority(role.getName()));
        }
        return new User(username,users.getPassword(),authorities);//如果用戶沒有角色會NullPointerException
    }
}

@Configuration
@MapperScan("com.xxx.mapper")
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private UserDetailsService userDetailsService;
 @Bean
    PasswordEncoder passwordEncoder() {
        //使用明文密碼：為了簡單方便測試
        return NoOpPasswordEncoder.getInstance();
        //暗文密碼：會用salt加密
        // return new BCryptPasswordEncoder();
    }
 @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        //設(shè)置注入的自定義認(rèn)證實現(xiàn)類userService，必須實現(xiàn)了UserDetailsService接口
        auth.userDetailsService(userDetailsService);
    }
@Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                //.antMatchers需要寫在 .anyRequest()之前
               /* anyRequest 已經(jīng)包含了其他請求了，在它之后如果還配置其他請求也沒有任何意義。
                anyRequest 應(yīng)該放在最后，表示除了前面攔截規(guī)則之外，剩下的請求要如何處理。具體可以稍微查看一下源碼,
                在攔截規(guī)則的配置類 AbstractRequestMatcherRegistry 中*/
                .antMatchers("/admin/**").hasRole("admin")//以/admin作為前綴的請求必須具有admin權(quán)限才能訪問（當(dāng)前也必須認(rèn)證通過）
                .antMatchers("/user/**").hasRole("user")//以/user作為前綴的請求必須具有user權(quán)限才能訪問（當(dāng)前也必須認(rèn)證通過）
                .anyRequest().authenticated()//任何請求都認(rèn)證過放行
                .and()//方法表示結(jié)束當(dāng)前標(biāo)簽，上下文回到HttpSecurity，開啟新一輪的配置。
                .formLogin()//使用表單認(rèn)證
                .loginProcessingUrl("/doLogin")//指定登錄頁面提交數(shù)據(jù)的接口
                .successHandler((req, resp, authentication) -> {
                    Object principal = authentication.getPrincipal();//獲取認(rèn)證成功的用戶對象
                    resp.setContentType("application/json;charset=utf-8");
                    PrintWriter out = resp.getWriter();
                    //使用Jackson將對象轉(zhuǎn)換為JSON字符串
                    out.write(new ObjectMapper().writeValueAsString(principal));//將登錄成功的對象基于JSON響應(yīng)
                    out.flush();
                    out.close();
                })
                .failureHandler((req, resp, e) -> {//根據(jù)異常信息判斷哪一操作出現(xiàn)錯誤
                    resp.setContentType("application/json;charset=utf-8");
                    PrintWriter out = resp.getWriter();
                    Map<String, Object> map = new HashMap<String, Object>();
                    map.put("status", 400);
                    if (e instanceof LockedException) {
                        map.put("msg", "賬戶被鎖定，請聯(lián)系管理員!");
                    } else if (e instanceof CredentialsExpiredException) {
                        map.put("msg", "密碼過期，請聯(lián)系管理員!");
                    } else if (e instanceof AccountExpiredException) {
                        map.put("msg", "賬戶過期，請聯(lián)系管理員!");
                    } else if (e instanceof DisabledException) {
                        map.put("msg", "賬戶被禁用，請聯(lián)系管理員!");
                    } else if (e instanceof BadCredentialsException) {
                        map.put("msg", "用戶名或者密碼輸入錯誤，請重新輸入!");
                    }
                    out.write(new ObjectMapper().writeValueAsString(map));
                    out.flush();
                    out.close();
                })
                .permitAll()//放行自定義登錄頁面請求
                .and()
                .logout()//默認(rèn)注銷接口/logout
                .logoutUrl("/logout")//默認(rèn)注銷的URL
                //基于前后端分離開發(fā)，前端發(fā)起/logout請求，后端自定義注銷成功處理邏輯：返回json提示成功
                .logoutSuccessHandler((req, resp, authentication) -> {
                    resp.setContentType("application/json;charset=utf-8");
                    PrintWriter out = resp.getWriter();
                    out.write("注銷成功");
                    out.flush();
                    out.close();
                })
                .permitAll()
                .and()
                .csrf().disable()//關(guān)閉csrf攻擊攔截
                //配置未認(rèn)證提示，給未認(rèn)證（登錄成功）訪問其他請求時，給前端響應(yīng)json提示
                .exceptionHandling()
                .authenticationEntryPoint((req, resp, authException) -> {
                            resp.setContentType("application/json;charset=utf-8");
                            PrintWriter out = resp.getWriter();
                            out.write("尚未登錄，請先登錄");
                            out.flush();
                            out.close();
                        }
                );
    }
}