@RestController
@RequestMapping("/user")
public class UserController {
    @Autowired
    private UserService userService;
    @PostMapping("/login")
    public R login(@RequestBody User user) {
        String jwt = userService.login(user);
        if (StringUtils.hasLength(jwt)) {
            return R.ok().message("登陸成功").data("token", jwt);
        }
        return R.error().message("登陸失敗");
    }
}

@Service
public class UserDetailsServiceImpl implements UserDetailsService {
     @Autowired
     private UserMapper userMapper;
     @Override
     public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
         //查詢用戶信息
         QueryWrapper<User> queryWrapper=new QueryWrapper<>();
         queryWrapper.eq("user_name",username);
         User user = userMapper.selectOne(queryWrapper);
         //如果沒有查詢到用戶，就拋出異常
         if(Objects.isNull(user)){
             throw  new RuntimeException("用戶名或密碼錯(cuò)誤");
         }
         //TODO 查詢用戶對(duì)應(yīng)的權(quán)限信息
         細(xì)節(jié)見SpringSecurity（二）——授權(quán)實(shí)現(xiàn)
         //如果有，把數(shù)據(jù)封裝成UserDetails對(duì)象返回
         return new LoginUser(user);
    }
}

@EnableWebSecurity
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig{
    /**
     * 登錄時(shí)需要調(diào)用AuthenticationManager.authenticate執(zhí)行一次校驗(yàn)
     */
    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
        return config.getAuthenticationManager();
    }
}

@Service
public class UserServiceImpl extends ServiceImpl<UserMapper, User> implements UserService {
    @Autowired
    private AuthenticationManager authenticationManager;
    @Autowired
    private StringRedisTemplate stringRedisTemplate;
    @Override
    public String login(User user) {
        //1.封裝Authentication對(duì)象 ,密碼校驗(yàn)，自動(dòng)完成
        UsernamePasswordAuthenticationToken authentication =
                new UsernamePasswordAuthenticationToken(user.getUserName(), user.getPassword());
        //2.進(jìn)行校驗(yàn)
        Authentication authenticate = authenticationManager.authenticate(authentication);
        //3.如果authenticate為空
        if (Objects.isNull(authenticate)) {
            throw new RuntimeException("登錄失敗"); //TODO 登錄失敗
        }
        //4.得到用戶信息
        LoginUser loginUser = (LoginUser) authenticate.getPrincipal();
        //生成jwt，使用fastjson的方法，把對(duì)象轉(zhuǎn)成字符串
        String loginUserString = JSON.toJSONString(loginUser);
        //調(diào)用JWT工具類，生成jwt令牌
        String jwt = JwtUtils.createJWT(loginUserString, null);
        //5.把生成的jwt存到redis
        String tokenKey = "token_" + jwt;
        stringRedisTemplate.opsForValue().set(tokenKey, jwt, JwtUtils.JWT_TTL / 1000);
        Map<String, Object> map = new HashMap<>();
        map.put("token", jwt);
        map.put("username", loginUser.getUsername());
        return jwt;
    }
}

/**
 * token驗(yàn)證過(guò)濾器   //每一個(gè)servlet請(qǐng)求，只會(huì)執(zhí)行一次
 */
@Component
public class JwtAuthenticationTokenFilter extends OncePerRequestFilter {
    @Autowired
    private LoginFailureHandler loginFailureHandler;
    @Autowired
    private StringRedisTemplate stringRedisTemplate;
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
                                    FilterChain filterChain)
            throws ServletException, IOException {
        try {
            //1.獲取當(dāng)前請(qǐng)求的url地址
            String url = request.getRequestURI();
            //如果當(dāng)前請(qǐng)求不是登錄請(qǐng)求，則需要進(jìn)行token驗(yàn)證
            if (!url.equals("/user/login")) {
                //2.驗(yàn)證token
                this.validateToken(request);
            }
        } catch (AuthenticationException e) {
            System.out.println(e);
            loginFailureHandler.onAuthenticationFailure(request, response, e);
        }
        //3.登錄請(qǐng)求不需要驗(yàn)證token
        doFilter(request, response, filterChain);
    }
    /**
     * 驗(yàn)證token
     */
    private void validateToken(HttpServletRequest request) throws AuthenticationException {
        //1.獲取token
        String token = request.getHeader("Authorization");
        //如果請(qǐng)求頭部沒有獲取到token，則從請(qǐng)求的參數(shù)中進(jìn)行獲取
        if (ObjectUtils.isEmpty(token)) {
            token = request.getParameter("Authorization");
        }
        if (ObjectUtils.isEmpty(token)) {
            throw new CustomerAuthenticationException("token不存在");
        }
        //2.redis進(jìn)行校驗(yàn)
        String redisStr = stringRedisTemplate.opsForValue().get("token_" + token);
        if(ObjectUtils.isEmpty(redisStr)) {
            throw new CustomerAuthenticationException("token已過(guò)期");
        }
        //3.解析token
        Claims claims = null;
        try {
            claims = JwtUtils.parseJWT(token);
        } catch (Exception e) {
            throw new CustomerAuthenticationException("token解析失敗");
        }
        //4.獲取到用戶信息
        String loginUserString = claims.getSubject();
        //把字符串轉(zhuǎn)成loginUser對(duì)象
        LoginUser loginUser = JSON.parseObject(loginUserString, LoginUser.class);
        //創(chuàng)建身份驗(yàn)證對(duì)象
        UsernamePasswordAuthenticationToken authenticationToken =
                new UsernamePasswordAuthenticationToken(loginUser, null, loginUser.getAuthorities());
        //5.設(shè)置到Spring Security上下文
        SecurityContextHolder.getContext().setAuthentication(authenticationToken);
    }
}

@EnableWebSecurity
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig{
    //自定義jwt校驗(yàn)過(guò)濾器
    @Autowired
    private JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter;
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        //配置關(guān)閉csrf機(jī)制
        http.csrf(csrf -> csrf.disable());
        //登陸失敗處理器
        http.formLogin(configurer -> {
            configurer.failureHandler(loginFailureHandler);
        });
        http.sessionManagement(configurer ->
                // STATELESS（無(wú)狀態(tài)）： 表示應(yīng)用程序是無(wú)狀態(tài)的，不會(huì)創(chuàng)建會(huì)話。
                configurer.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
        );
        //請(qǐng)求攔截方式
        http.authorizeHttpRequests(auth -> auth
                .requestMatchers("/user/login").permitAll()
                .anyRequest().authenticated()
        );
        //?。。。?！注冊(cè)jwt過(guò)濾器?。。。。。?！
        http.addFilterBefore(jwtAuthenticationTokenFilter,      
                             UsernamePasswordAuthenticationFilter.class);
        //異常處理器
        http.exceptionHandling(configurer -> {
            configurer.accessDeniedHandler(customerAccessDeniedHandler);
            configurer.authenticationEntryPoint(anonymousAuthenticationHandler);
        });
        return http.build();   //允許跨域
    }
    /**
     * 登錄時(shí)需要調(diào)用AuthenticationManager.authenticate執(zhí)行一次校驗(yàn)
     */
    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
        return config.getAuthenticationManager();
    }
}