// 登录：生成JWT，返回给客户端
public String login(String username, String password) {
    User user = userService.verify(username, password);
    return Jwts.builder()
        .setSubject(user.getId().toString())
        .setExpiration(new Date(System.currentTimeMillis() + 30 * 60 * 1000))
        .signWith(SECRET_KEY)
        .compact();
}

// 拦截器：验证JWT签名和过期时间
public boolean preHandle(HttpServletRequest request, ...) {
    String token = request.getHeader("Authorization");
    Claims claims = Jwts.parserBuilder()
        .setSigningKey(SECRET_KEY).build()
        .parseClaimsJws(token).getBody();
    // Token签名正确且未过期 → 放行
    return true;
}

{
  "alg": "HS256",
  "typ": "JWT"
}

{
  "sub": "1001",
  "username": "zhangsan",
  "role": "ROLE_ADMIN",
  "jti": "a1b2c3d4-e5f6-4a1b-82c3-d8e9f0aab3cc",
  "iat": 1660123400,
  "exp": 1660125200,
  "type": "access"
}

# 登录时写入
SET auth:token:a1b2c3d4-e5f6-4a1b-82c3-d8e9f0aab3cc \
  '{"userId":1001,"username":"zhangsan","role":"ROLE_ADMIN"}' EX 1800

# 每次请求时检查
GET auth:token:a1b2c3d4-e5f6-4a1b-82c3-d8e9f0aab3cc
# 返回: {"userId":1001,...}  → Token 有效，放行
# 返回: (nil)                 → Token 已失效（登出 / 自然过期）

# 登出时删除
DEL auth:token:a1b2c3d4-e5f6-4a1b-82c3-d8e9f0aab3cc

# 登录时写入
HSET auth:token:a1b2c3d4-e5f6-4a1b-82c3-d8e9f0aab3cc \
  userId 1001 username zhangsan role ROLE_ADMIN
EXPIRE auth:token:a1b2c3d4-e5f6-4a1b-82c3-d8e9f0aab3cc 1800

# 每次请求时检查（读全部字段）
HGETALL auth:token:a1b2c3d4-e5f6-4a1b-82c3-d8e9f0aab3cc
# 返回所有 field-value → Token 有效
# 返回 (empty)           → Token 已失效

# 只读某一个字段（如只需要 role 做权限判断）
HGET auth:token:a1b2c3d4-e5f6-4a1b-82c3-d8e9f0aab3cc role
# 返回: "ROLE_ADMIN"

# 更新单个字段（如检测到 IP 变化时更新）
HSET auth:token:a1b2c3d4-e5f6-4a1b-82c3-d8e9f0aab3cc loginIp "10.0.0.1"

# 登录时写入
SET auth:token:a1b2c3d4-e5f6-4a1b-82c3-d8e9f0aab3cc "1" EX 1800

# 每次请求时检查
EXISTS auth:token:a1b2c3d4-e5f6-4a1b-82c3-d8e9f0aab3cc
# 返回: 1 → Token 有效
# 返回: 0 → Token 已失效

# 登出时删除
DEL auth:token:a1b2c3d4-e5f6-4a1b-82c3-d8e9f0aab3cc

# 1. 查看用户 1001 当前在几台设备上登录
SCARD auth:user:1001
# 返回: 3

# 2. 列出用户 1001 的所有活跃Token的jti
SMEMBERS auth:user:1001
# 返回: a1b2c3d4-..., b2c3d4e5-..., c3d4e5f6-...

# 3. 【踢出所有设备】改密码时触发
#    先拿到所有jti → 逐个删除Token → 删除Set
SMEMBERS auth:user:1001 | xargs -I {} redis-cli DEL auth:token:{}
DEL auth:user:1001

# 4. 限制最多 3 台设备同时登录
#    业务代码中：SCARD > 3 时，SPOP出一个最旧的jti并删除对应Token

<dependencies>
    <!-- Spring Boot Web -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>

    <!-- Spring Security -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>

    <!-- Spring Data Redis (默认使用Lettuce) -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-data-redis</artifactId>
    </dependency>

    <!-- JJWT (Java JWT库) -->
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-api</artifactId>
        <version>0.11.5</version>
    </dependency>
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-impl</artifactId>
        <version>0.11.5</version>
        <scope>runtime</scope>
    </dependency>
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-jackson</artifactId>
        <version>0.11.5</version>
        <scope>runtime</scope>
    </dependency>

    <!-- 连接池（Jedis与Lettuce的通用池） -->
    <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-pool2</artifactId>
    </dependency>

    <!-- Lombok -->
    <dependency>
        <groupId>org.projectlombok</groupId>
        <artifactId>lombok</artifactId>
        <optional>true</optional>
    </dependency>

    <!-- MyBatis-Plus -->
    <dependency>
        <groupId>com.baomidou</groupId>
        <artifactId>mybatis-plus-boot-starter</artifactId>
        <version>3.5.5</version>
    </dependency>

    <dependency>
        <groupId>com.mysql</groupId>
        <artifactId>mysql-connector-j</artifactId>
        <scope>runtime</scope>
    </dependency>
</dependencies>

server:
  port: 8080

spring:
  datasource:
    url: jdbc:mysql://localhost:3306/mall?useUnicode=true&characterEncoding=utf-8&serverTimezone=Asia/Shanghai
    username: root
    password: 123456
    driver-class-name: com.mysql.cj.jdbc.Driver

  redis:
    host: localhost
    port: 6379
    password:            # 生产环境务必设置密码
    database: 0
    lettuce:
      pool:
        max-active: 16
        max-idle: 8
        min-idle: 4
    timeout: 3000ms

# JWT 配置
jwt:
  secret: a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2  # 生产环境至少256位
  access-token-expire: 30    # Access Token 过期时间（分钟）
  refresh-token-expire: 10080  # Refresh Token 过期时间（分钟，7天）

# Token 存储配置
auth:
  redis:
    key-prefix: "auth:token:"      # Access Token Redis Key 前缀
    user-tokens-prefix: "auth:user:" # 用户所有Token集合 Key前缀

package com.mallshop.mallsecurity.util;

import io.jsonwebtoken.*;
import io.jsonwebtoken.security.Keys;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;

import javax.crypto.SecretKey;
import java.nio.charset.StandardCharsets;
import java.util.Date;
import java.util.UUID;

@Component
public class JwtUtil {

    private final SecretKey secretKey;
    private final long accessTokenExpireMs;
    private final long refreshTokenExpireMs;

    public JwtUtil(
            @Value("${jwt.secret}") String secret,
            @Value("${jwt.access-token-expire}") long accessTokenExpireMinutes,
            @Value("${jwt.refresh-token-expire}") long refreshTokenExpireMinutes) {
        // JJWT要求密钥至少256位（32字节）
        this.secretKey = Keys.hmacShaKeyFor(secret.getBytes(StandardCharsets.UTF_8));
        this.accessTokenExpireMs = accessTokenExpireMinutes * 60 * 1000;
        this.refreshTokenExpireMs = refreshTokenExpireMinutes * 60 * 1000;
    }

    /**
     * 生成 Access Token（含 jti）
     */
    public String createAccessToken(Long userId, String username, String role) {
        Date now = new Date();
        Date expiration = new Date(now.getTime() + accessTokenExpireMs);

        return Jwts.builder()
                .setId(UUID.randomUUID().toString())          // jti：Token唯一标识
                .setSubject(userId.toString())                // sub：用户ID
                .claim("username", username)                  // 自定义：用户名
                .claim("role", role)                          // 自定义：角色
                .claim("type", "access")                      // 自定义：Token类型
                .setIssuedAt(now)                             // iat：签发时间
                .setExpiration(expiration)                    // exp：过期时间
                .signWith(secretKey)                          // 签名
                .compact();
    }

    /**
     * 生成 Refresh Token
     */
    public String createRefreshToken(Long userId) {
        Date now = new Date();
        Date expiration = new Date(now.getTime() + refreshTokenExpireMs);

        return Jwts.builder()
                .setId(UUID.randomUUID().toString())
                .setSubject(userId.toString())
                .claim("type", "refresh")
                .setIssuedAt(now)
                .setExpiration(expiration)
                .signWith(secretKey)
                .compact();
    }

    /**
     * 解析JWT（不验证是否在Redis中存在）
     */
    public Claims parseToken(String token) {
        return Jwts.parserBuilder()
                .setSigningKey(secretKey)
                .build()
                .parseClaimsJws(token)
                .getBody();
    }

    /**
     * 获取Token的剩余有效时间（毫秒）
     */
    public long getRemainingTimeMillis(Claims claims) {
        return claims.getExpiration().getTime() - System.currentTimeMillis();
    }

    /**
     * 从Claims中提取常用字段
     */
    public String getJti(Claims claims) {
        return claims.getId();
    }

    public Long getUserId(Claims claims) {
        return Long.valueOf(claims.getSubject());
    }

    public String getUsername(Claims claims) {
        return claims.get("username", String.class);
    }

    public String getRole(Claims claims) {
        return claims.get("role", String.class);
    }

    public boolean isAccessToken(Claims claims) {
        return "access".equals(claims.get("type", String.class));
    }
}

package com.mallshop.mallsecurity.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.data.redis.connection.RedisConnectionFactory;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.data.redis.serializer.GenericJackson2JsonRedisSerializer;
import org.springframework.data.redis.serializer.StringRedisSerializer;

@Configuration
public class RedisConfig {

    @Bean
    public RedisTemplate<String, Object> redisTemplate(
            RedisConnectionFactory connectionFactory) {

        RedisTemplate<String, Object> template = new RedisTemplate<>();
        template.setConnectionFactory(connectionFactory);

        // Key 用 String 序列化（可读性好）
        template.setKeySerializer(new StringRedisSerializer());
        template.setHashKeySerializer(new StringRedisSerializer());

        // Value 用 JSON 序列化（存入Java对象时自动转JSON）
        template.setValueSerializer(new GenericJackson2JsonRedisSerializer());
        template.setHashValueSerializer(new GenericJackson2JsonRedisSerializer());

        template.afterPropertiesSet();
        return template;
    }
}

package com.mallshop.mallsecurity.dto;

import lombok.AllArgsConstructor;
import lombok.Builder;
import lombok.Data;
import lombok.NoArgsConstructor;

import java.io.Serializable;

/**
 * 存储在 Redis 中的 Token 摘要信息。
 * 每个 Access Token 在 Redis 中对应一条此记录。
 */
@Data
@Builder
@NoArgsConstructor
@AllArgsConstructor
public class TokenInfo implements Serializable {

    /** 用户ID */
    private Long userId;

    /** 用户名 */
    private String username;

    /** 角色 */
    private String role;

    /** Token签发时间（时间戳ms） */
    private Long issuedAt;

    /** 登录IP */
    private String loginIp;

    /** 登录设备标识（User-Agent摘要） */
    private String deviceInfo;

    /** jti，用于关联和查询 */
    private String jti;
}

package com.mallshop.mallsecurity.service;

import com.mallshop.mallsecurity.dto.TokenInfo;
import com.mallshop.mallsecurity.util.JwtUtil;
import io.jsonwebtoken.Claims;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.stereotype.Service;

import java.util.Set;
import java.util.concurrent.TimeUnit;

@Service
public class TokenService {

    private final RedisTemplate<String, Object> redisTemplate;
    private final JwtUtil jwtUtil;
    private final String tokenKeyPrefix;
    private final String userTokensPrefix;

    public TokenService(
            RedisTemplate<String, Object> redisTemplate,
            JwtUtil jwtUtil,
            @Value("${auth.redis.key-prefix}") String tokenKeyPrefix,
            @Value("${auth.redis.user-tokens-prefix}") String userTokensPrefix) {
        this.redisTemplate = redisTemplate;
        this.jwtUtil = jwtUtil;
        this.tokenKeyPrefix = tokenKeyPrefix;
        this.userTokensPrefix = userTokensPrefix;
    }

    /**
     * 【核心方法】登录成功后：将 Token 存入 Redis
     *
     * @param token   已签发的JWT字符串
     * @param tokenInfo Token的摘要信息
     */
    public void storeAccessToken(String token, TokenInfo tokenInfo) {
        Claims claims = jwtUtil.parseToken(token);
        String jti = jwtUtil.getJti(claims);
        long ttl = jwtUtil.getRemainingTimeMillis(claims);

        if (ttl <= 0) {
            return; // Token 已过期，无需存储
        }

        // 1. 存主记录：auth:token:{jti} → TokenInfo
        String tokenKey = tokenKeyPrefix + jti;
        redisTemplate.opsForValue().set(tokenKey, tokenInfo, ttl, TimeUnit.MILLISECONDS);

        // 2. 维护用户Token集合：auth:user:{userId} → SET {jti1, jti2, ...}
        String userKey = userTokensPrefix + tokenInfo.getUserId();
        redisTemplate.opsForSet().add(userKey, jti);
        // 用户Token集合的过期时间设为Token最长时间的2倍（留冗余）
        redisTemplate.expire(userKey, ttl * 2, TimeUnit.MILLISECONDS);
    }

    /**
     * 【核心方法】每次请求时：检查 Token 在 Redis 中是否存在
     *
     * @param jti Token的jti
     * @return TokenInfo 如果存在，null 如果已失效
     */
    public TokenInfo validateAndGetTokenInfo(String jti) {
        String tokenKey = tokenKeyPrefix + jti;
        return (TokenInfo) redisTemplate.opsForValue().get(tokenKey);
    }

    /**
     * 【主动失效】登出：删除单个 Token
     *
     * @param jti 要删除的Token的jti
     * @param userId 用户ID（用于从集合中移除）
     */
    public void revokeToken(String jti, Long userId) {
        // 1. 删除主记录
        String tokenKey = tokenKeyPrefix + jti;
        redisTemplate.delete(tokenKey);

        // 2. 从用户集合中移除
        String userKey = userTokensPrefix + userId;
        redisTemplate.opsForSet().remove(userKey, jti);
    }

    /**
     * 【主动失效】强制下线：删除某用户的所有 Token
     *
     * @param userId 用户ID
     */
    public void revokeAllUserTokens(Long userId) {
        String userKey = userTokensPrefix + userId;

        // 1. 获取该用户的所有 jti
        Set<Object> jtis = redisTemplate.opsForSet().members(userKey);
        if (jtis == null || jtis.isEmpty()) {
            return;
        }

        // 2. 逐个删除 Token 主记录
        for (Object jtiObj : jtis) {
            String jti = jtiObj.toString();
            String tokenKey = tokenKeyPrefix + jti;
            redisTemplate.delete(tokenKey);
        }

        // 3. 删除用户集合本身
        redisTemplate.delete(userKey);
    }

    /**
     * 【查询】获取用户当前在线的所有设备
     *
     * @param userId 用户ID
     * @return 该用户所有活跃的jti集合
     */
    public Set<Object> getUserActiveTokens(Long userId) {
        String userKey = userTokensPrefix + userId;
        return redisTemplate.opsForSet().members(userKey);
    }
}

package com.mallshop.mallsecurity.filter;

import com.mallshop.mallsecurity.dto.TokenInfo;
import com.mallshop.mallsecurity.service.TokenService;
import com.mallshop.mallsecurity.util.JwtUtil;
import io.jsonwebtoken.Claims;
import io.jsonwebtoken.ExpiredJwtException;
import io.jsonwebtoken.JwtException;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Component;
import org.springframework.util.StringUtils;
import org.springframework.web.filter.OncePerRequestFilter;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.Collections;

@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {

    @Autowired
    private JwtUtil jwtUtil;

    @Autowired
    private TokenService tokenService;

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain filterChain)
            throws ServletException, IOException {

        // 1. 提取Token
        String token = extractToken(request);
        if (!StringUtils.hasText(token)) {
            filterChain.doFilter(request, response);
            return;
        }

        // 2. 解析JWT（验证签名和过期时间）
        Claims claims;
        try {
            claims = jwtUtil.parseToken(token);
        } catch (ExpiredJwtException e) {
            // Token已过期——JWT层面检查失败
            handleAuthFailure(response, 401, "Token已过期，请重新登录");
            return;
        } catch (JwtException e) {
            // Token签名无效——可能是伪造的
            handleAuthFailure(response, 401, "Token无效");
            return;
        }

        // 3. 确认是Access Token（不是Refresh Token）
        if (!jwtUtil.isAccessToken(claims)) {
            handleAuthFailure(response, 401, "请使用Access Token访问");
            return;
        }

        String jti = jwtUtil.getJti(claims);

        // 4. 【关键步骤】Redis检查：Token是否已被主动撤销
        TokenInfo tokenInfo = tokenService.validateAndGetTokenInfo(jti);
        if (tokenInfo == null) {
            // Redis中不存在 → Token已被删除（登出/踢下线/改密码）
            handleAuthFailure(response, 401, "Token已被撤销，请重新登录");
            return;
        }

        // 5. Token有效，设置Spring Security认证状态
        String username = tokenInfo.getUsername();
        String role = tokenInfo.getRole();

        UsernamePasswordAuthenticationToken authentication =
                new UsernamePasswordAuthenticationToken(
                    username,
                    null,
                    Collections.singletonList(new SimpleGrantedAuthority(role))
                );
        SecurityContextHolder.getContext().setAuthentication(authentication);

        // 6. 继续过滤器链
        filterChain.doFilter(request, response);
    }

    /**
     * 从请求头提取 Bearer Token
     */
    private String extractToken(HttpServletRequest request) {
        String bearerToken = request.getHeader("Authorization");
        if (StringUtils.hasText(bearerToken) && bearerToken.startsWith("Bearer ")) {
            return bearerToken.substring(7);
        }
        return null;
    }

    /**
     * 返回统一的JSON错误响应
     */
    private void handleAuthFailure(HttpServletResponse response,
                                   int status, String message) throws IOException {
        response.setContentType("application/json;charset=UTF-8");
        response.setStatus(status);
        response.getWriter().write(
            String.format("{\"code\":%d,\"message\":\"%s\"}", status, message));
    }
}

package com.mallshop.mallsecurity.config;

import com.mallshop.mallsecurity.filter.JwtAuthenticationFilter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Autowired
    private JwtAuthenticationFilter jwtAuthenticationFilter;

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public AuthenticationManager authenticationManager(
            AuthenticationConfiguration config) throws Exception {
        return config.getAuthenticationManager();
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            // 关闭CSRF：前后端分离+JWT方案不需要
            .csrf().disable()

            // 无状态模式：不创建Session
            .sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS)

            .and()
            .authorizeRequests()
            // 登录、刷新Token——无需认证
            .antMatchers("/api/auth/login", "/api/auth/refresh").permitAll()
            // 登出——需要认证（需要知道是谁在登出）
            .antMatchers("/api/auth/logout").authenticated()
            // 管理员接口——需要ADMIN角色
            .antMatchers("/api/admin/**").hasRole("ADMIN")
            // 其余接口——需要登录
            .anyRequest().authenticated()

            // 注册JWT过滤器
            .and()
            .addFilterBefore(jwtAuthenticationFilter,
                             UsernamePasswordAuthenticationFilter.class)

            // 自定义401/403响应
            .exceptionHandling()
            .authenticationEntryPoint((request, response, authException) -> {
                response.setContentType("application/json;charset=UTF-8");
                response.setStatus(401);
                response.getWriter().write(
                    "{\"code\":401,\"message\":\"请先登录\"}");
            })
            .accessDeniedHandler((request, response, accessDeniedException) -> {
                response.setContentType("application/json;charset=UTF-8");
                response.setStatus(403);
                response.getWriter().write(
                    "{\"code\":403,\"message\":\"权限不足\"}");
            });

        return http.build();
    }
}

package com.mallshop.mallsecurity.controller;

import com.mallshop.mallsecurity.dto.*;
import com.mallshop.mallsecurity.service.TokenService;
import com.mallshop.mallsecurity.util.JwtUtil;
import io.jsonwebtoken.Claims;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.web.bind.annotation.*;

import javax.servlet.http.HttpServletRequest;
import javax.validation.Valid;
import javax.validation.constraints.NotBlank;

@RestController
@RequestMapping("/api/auth")
public class AuthController {

    @Autowired
    private AuthenticationManager authenticationManager;

    @Autowired
    private JwtUtil jwtUtil;

    @Autowired
    private TokenService tokenService;

    /**
     * 登录
     */
    @PostMapping("/login")
    public LoginResponse login(@Valid @RequestBody LoginRequest request,
                               HttpServletRequest httpRequest) {
        // 1. 认证用户名密码
        Authentication authentication = authenticationManager.authenticate(
                new UsernamePasswordAuthenticationToken(
                    request.getUsername(), request.getPassword()));

        UserDetails userDetails = (UserDetails) authentication.getPrincipal();
        String role = userDetails.getAuthorities().stream()
                .findFirst().get().getAuthority();

        // TODO: 实际项目中从数据库查询userId，这里简化处理
        Long userId = 1001L;
        String username = userDetails.getUsername();

        // 2. 生成 Access Token（含jti）
        String accessToken = jwtUtil.createAccessToken(userId, username, role);
        String refreshToken = jwtUtil.createRefreshToken(userId);

        // 3. 【关键】将Access Token存入Redis
        Claims accessClaims = jwtUtil.parseToken(accessToken);
        String jti = jwtUtil.getJti(accessClaims);
        String ip = getClientIp(httpRequest);

        TokenInfo tokenInfo = TokenInfo.builder()
                .userId(userId)
                .username(username)
                .role(role)
                .jti(jti)
                .issuedAt(System.currentTimeMillis())
                .loginIp(ip)
                .deviceInfo(httpRequest.getHeader("User-Agent"))
                .build();

        tokenService.storeAccessToken(accessToken, tokenInfo);

        return LoginResponse.builder()
                .accessToken(accessToken)
                .refreshToken(refreshToken)
                .tokenType("Bearer")
                .expiresIn(30 * 60L)  // 30分钟，秒
                .build();
    }

    /**
     * 登出——主动删除Redis中的Token
     */
    @PostMapping("/logout")
    public String logout(@RequestHeader("Authorization") String authHeader) {
        // 1. 从请求头提取Token
        String token = authHeader.startsWith("Bearer ")
                ? authHeader.substring(7) : authHeader;

        // 2. 解析JWT获取jti和userId
        Claims claims = jwtUtil.parseToken(token);
        String jti = jwtUtil.getJti(claims);
        Long userId = jwtUtil.getUserId(claims);

        // 3. 【关键】从Redis中删除该Token
        tokenService.revokeToken(jti, userId);

        // 4. 清除Spring Security上下文
        SecurityContextHolder.clearContext();

        return "已登出";
    }

    /**
     * 强制下线——踢出某个用户的所有设备
     */
    @PostMapping("/kick-out/{userId}")
    public String kickOut(@PathVariable Long userId) {
        tokenService.revokeAllUserTokens(userId);
        return "用户 " + userId + " 已被强制下线";
    }

    /**
     * 刷新Token
     */
    @PostMapping("/refresh")
    public LoginResponse refresh(@Valid @RequestBody RefreshRequest request,
                                  HttpServletRequest httpRequest) {
        String refreshToken = request.getRefreshToken();
        Claims claims = jwtUtil.parseToken(refreshToken);

        // 确认是Refresh Token
        if (!"refresh".equals(claims.get("type", String.class))) {
            throw new RuntimeException("请使用Refresh Token刷新");
        }

        Long userId = jwtUtil.getUserId(claims);

        // TODO: 从数据库查用户最新信息
        String username = "zhangsan";
        String role = "ROLE_USER";

        // 签发新的Access Token
        String newAccessToken = jwtUtil.createAccessToken(userId, username, role);
        String newRefreshToken = jwtUtil.createRefreshToken(userId);

        // 新Token存入Redis
        Claims newClaims = jwtUtil.parseToken(newAccessToken);
        String newJti = jwtUtil.getJti(newClaims);

        TokenInfo tokenInfo = TokenInfo.builder()
                .userId(userId)
                .username(username)
                .role(role)
                .jti(newJti)
                .issuedAt(System.currentTimeMillis())
                .loginIp(getClientIp(httpRequest))
                .build();

        tokenService.storeAccessToken(newAccessToken, tokenInfo);

        return LoginResponse.builder()
                .accessToken(newAccessToken)
                .refreshToken(newRefreshToken)
                .tokenType("Bearer")
                .expiresIn(30 * 60L)
                .build();
    }

    private String getClientIp(HttpServletRequest request) {
        String ip = request.getHeader("X-Forwarded-For");
        if (ip == null || ip.isEmpty()) {
            ip = request.getRemoteAddr();
        }
        return ip;
    }
}

// 登录请求
@Data
public class LoginRequest {
    @NotBlank(message = "用户名不能为空")
    private String username;
    @NotBlank(message = "密码不能为空")
    private String password;
}

// 登录响应
@Data
@Builder
public class LoginResponse {
    private String accessToken;
    private String refreshToken;
    private String tokenType;
    private Long expiresIn;
}

// 刷新Token请求
@Data
public class RefreshRequest {
    @NotBlank(message = "Refresh Token不能为空")
    private String refreshToken;
}

@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {

    // ... 其他代码 ...

    @Override
    protected void doFilterInternal(...) {
        // ... JWT验证 ...

        // Redis检查（带降级）
        TokenInfo tokenInfo;
        try {
            tokenInfo = tokenService.validateAndGetTokenInfo(jti);
        } catch (Exception e) {
            // Redis不可用时的降级策略
            log.error("Redis异常，启用降级", e);
            if (authProperties.isStrictMode()) {
                // 严格模式：拒绝请求（金融、交易系统）
                handleAuthFailure(response, 503, "服务暂时不可用");
                return;
            } else {
                // 宽松模式：放行（JWT已通过签名验证）
                tokenInfo = TokenInfo.builder()
                    .userId(jwtUtil.getUserId(claims))
                    .username(jwtUtil.getUsername(claims))
                    .role(jwtUtil.getRole(claims))
                    .build();
            }
        }

        // ... 设置认证状态 ...
    }
}

auth:
  redis:
    fallback-mode: lenient    # strict=严格模式（Redis故障拒绝）
                              # lenient=宽松模式（Redis故障降级为纯JWT）

@PostMapping("/refresh")
public LoginResponse refresh(@RequestBody RefreshRequest request) {
    // ... 验证Refresh Token ...

    // 如果请求中携带了旧的Access Token，撤销它
    String oldAccessToken = request.getOldAccessToken();
    if (StringUtils.hasText(oldAccessToken)) {
        try {
            Claims oldClaims = jwtUtil.parseToken(oldAccessToken);
            String oldJti = jwtUtil.getJti(oldClaims);
            tokenService.revokeToken(oldJti, userId);
        } catch (Exception e) {
            // 旧Token可能已经过期，忽略
        }
    }

    // ... 签发新Token ...
}

@Component
public class TokenCleanupTask {

    @Autowired
    private RedisTemplate<String, Object> redisTemplate;

    @Value("${auth.redis.key-prefix}")
    private String tokenKeyPrefix;

    @Value("${auth.redis.user-tokens-prefix}")
    private String userTokensPrefix;

    /**
     * 每天凌晨4点清理一次
     * 遍历所有用户的Token集合，删除Redis中已经不存在的jti引用
     */
    @Scheduled(cron = "0 0 4 * * ?")
    public void cleanExpiredJtiReferences() {
        Set<String> userKeys = redisTemplate.keys(userTokensPrefix + "*");
        if (userKeys == null) return;

        int cleaned = 0;
        for (String userKey : userKeys) {
            Set<Object> jtis = redisTemplate.opsForSet().members(userKey);
            if (jtis == null) continue;

            for (Object jtiObj : jtis) {
                String jti = jtiObj.toString();
                String tokenKey = tokenKeyPrefix + jti;
                // Token主记录不存在 → jti已过期，从集合中移除
                if (Boolean.FALSE.equals(redisTemplate.hasKey(tokenKey))) {
                    redisTemplate.opsForSet().remove(userKey, jti);
                    cleaned++;
                }
            }
        }
        log.info("Token清理完成，清理了 {} 条过期引用", cleaned);
    }
}