@RestController
@RequestMapping("/api/admin")
public class AdminController {

    @GetMapping("/users")
    public List<User> listAllUsers() {
        // 返回系统中所有用户信息
        return userService.findAll();
    }

    @DeleteMapping("/users/{id}")
    public String deleteUser(@PathVariable Long id) {
        userService.deleteById(id);
        return "删除成功";
    }
}

<dependencies>
    <!-- Spring Boot Web -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>

    <!-- Spring Security -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>

    <!-- Spring Boot Validation -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-validation</artifactId>
    </dependency>

    <!-- Hutool 工具库（包含 JWT 模块） -->
    <dependency>
        <groupId>cn.hutool</groupId>
        <artifactId>hutool-all</artifactId>
        <version>5.8.25</version>
    </dependency>

    <!-- Lombok -->
    <dependency>
        <groupId>org.projectlombok</groupId>
        <artifactId>lombok</artifactId>
        <optional>true</optional>
    </dependency>

    <!-- MyBatis-Plus（数据库操作） -->
    <dependency>
        <groupId>com.baomidou</groupId>
        <artifactId>mybatis-plus-boot-starter</artifactId>
        <version>3.5.5</version>
    </dependency>

    <!-- MySQL 驱动 -->
    <dependency>
        <groupId>com.mysql</groupId>
        <artifactId>mysql-connector-j</artifactId>
        <scope>runtime</scope>
    </dependency>
</dependencies>

server:
  port: 8080

spring:
  datasource:
    url: jdbc:mysql://localhost:3306/mall?useUnicode=true&characterEncoding=utf-8&serverTimezone=Asia/Shanghai
    username: root
    password: 123456
    driver-class-name: com.mysql.cj.jdbc.Driver

# JWT 配置
jwt:
  secret: my-super-secret-key-for-jwt-signing-2024-please-change-in-production
  access-token-expire: 1800000      # 30分钟（毫秒）
  refresh-token-expire: 604800000   # 7天（毫秒）

CREATE TABLE `t_user` (
    `id`          BIGINT       NOT NULL AUTO_INCREMENT COMMENT '用户ID',
    `username`    VARCHAR(50)  NOT NULL COMMENT '用户名',
    `password`    VARCHAR(200) NOT NULL COMMENT '加密后的密码',
    `role`        VARCHAR(50)  NOT NULL DEFAULT 'ROLE_USER' COMMENT '角色',
    `enabled`     TINYINT(1)   NOT NULL DEFAULT 1 COMMENT '是否启用 1:是 0:否',
    `create_time` DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
    PRIMARY KEY (`id`),
    UNIQUE KEY `uk_username` (`username`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='用户表';

-- 插入测试用户（密码都是 123456，BCrypt 加密后的结果）
INSERT INTO t_user (username, password, role) VALUES
('admin', '$2a$10$N.zmdr9k7uOCQb376NoUnuTJ8iAt6Z5EHsM8lE9lBOsl7iAt6Z5Eh', 'ROLE_ADMIN'),
('zhangsan', '$2a$10$N.zmdr9k7uOCQb376NoUnuTJ8iAt6Z5EHsM8lE9lBOsl7iAt6Z5Eh', 'ROLE_USER');

package com.mallshop.mallsecurity.entity;

import com.baomidou.mybatisplus.annotation.TableName;
import lombok.Data;

@Data
@TableName("t_user")
public class User {
    private Long id;
    private String username;
    private String password;  // BCrypt加密后的密码
    private String role;      // ROLE_ADMIN 或 ROLE_USER
    private Boolean enabled;  // 是否启用
}

package com.mallshop.mallsecurity.util;

import cn.hutool.jwt.JWT;
import cn.hutool.jwt.JWTUtil;
import java.util.HashMap;
import java.util.Map;

public class JwtUtil {

    // 密钥——教程版直接写在代码里，生产版应放在配置文件中
    private static final String SECRET = "my-super-secret-key-for-jwt-signing-2024-please-change-in-production";

    /**
     * 生成 Access Token（30分钟有效）
     */
    public static String createAccessToken(Long userId, String username, String role) {
        Map<String, Object> payload = new HashMap<>();
        payload.put("userId", userId);
        payload.put("username", username);
        payload.put("role", role);
        // 过期时间：当前时间 + 30分钟
        payload.put("exp", System.currentTimeMillis() + 30 * 60 * 1000);
        return JWTUtil.createToken(payload, SECRET.getBytes());
    }

    /**
     * 生成 Refresh Token（7天有效）
     */
    public static String createRefreshToken(Long userId, String username) {
        Map<String, Object> payload = new HashMap<>();
        payload.put("userId", userId);
        payload.put("username", username);
        payload.put("type", "refresh");
        payload.put("exp", System.currentTimeMillis() + 7 * 24 * 60 * 60 * 1000);
        return JWTUtil.createToken(payload, SECRET.getBytes());
    }

    /**
     * 验证 Token 是否有效（签名正确 + 未过期）
     */
    public static boolean verify(String token) {
        return JWTUtil.verify(token, SECRET.getBytes());
    }

    /**
     * 从 Token 中解析 JWT 对象
     */
    public static JWT parseToken(String token) {
        return JWTUtil.parseToken(token);
    }

    /**
     * 从 Token 中获取用户ID
     */
    public static Long getUserId(String token) {
        JWT jwt = parseToken(token);
        return Long.valueOf(jwt.getPayload("userId").toString());
    }

    /**
     * 从 Token 中获取用户名
     */
    public static String getUsername(String token) {
        JWT jwt = parseToken(token);
        return (String) jwt.getPayload("username");
    }

    /**
     * 从 Token 中获取角色
     */
    public static String getRole(String token) {
        JWT jwt = parseToken(token);
        return (String) jwt.getPayload("role");
    }
}

package com.mallshop.mallsecurity.filter;

import cn.hutool.jwt.JWT;
import com.mallshop.mallsecurity.util.JwtUtil;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.web.filter.OncePerRequestFilter;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.Collections;

public class JwtAuthenticationFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request,
            HttpServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {

        // 1. 从请求头中提取 Token
        String authHeader = request.getHeader("Authorization");
        if (authHeader == null || !authHeader.startsWith("Bearer ")) {
            // 没有 Token，直接放行（后续 SecurityConfig 中的 URL 规则会拦截）
            filterChain.doFilter(request, response);
            return;
        }

        String token = authHeader.substring(7); // 去掉 "Bearer " 前缀

        // 2. 验证 Token
        if (!JwtUtil.verify(token)) {
            filterChain.doFilter(request, response);
            return;
        }

        // 3. 从 Token Payload 中解析用户信息
        String username = JwtUtil.getUsername(token);
        String role = JwtUtil.getRole(token);

        // 4. 构造 Authentication 对象，设置到 SecurityContext
        UsernamePasswordAuthenticationToken authentication =
                new UsernamePasswordAuthenticationToken(
                        username, null,
                        Collections.singletonList(new SimpleGrantedAuthority(role)));
        SecurityContextHolder.getContext().setAuthentication(authentication);

        // 5. 继续过滤器链
        filterChain.doFilter(request, response);
    }
}

package com.mallshop.mallsecurity.config;

import com.mallshop.mallsecurity.filter.JwtAuthenticationFilter;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            // JWT 方案不需要 CSRF 保护
            .csrf().disable()
            // 不创建 Session（无状态）
            .sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
            // URL 授权规则
            .authorizeRequests()
            // 登录和刷新 Token 接口放行
            .antMatchers("/api/auth/login", "/api/auth/refresh").permitAll()
            // 管理员接口需要 ADMIN 角色
            .antMatchers("/api/admin/**").hasRole("ADMIN")
            // 其余所有请求需要认证
            .anyRequest().authenticated()
            .and()
            // 把自定义 JWT 过滤器加到 UsernamePasswordAuthenticationFilter 之前
            .addFilterBefore(new JwtAuthenticationFilter(),
                    UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }
}

package com.mallshop.mallsecurity.service;

import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.mallshop.mallsecurity.entity.User;
import com.mallshop.mallsecurity.mapper.UserMapper;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

@Service
public class UserDetailsServiceImpl implements UserDetailsService {

    @Autowired
    private UserMapper userMapper;

    @Override
    public UserDetails loadUserByUsername(String username)
            throws UsernameNotFoundException {
        // 1. 从数据库查用户
        User user = userMapper.selectOne(
                new LambdaQueryWrapper<User>()
                        .eq(User::getUsername, username));

        if (user == null) {
            throw new UsernameNotFoundException("用户不存在: " + username);
        }

        // 2. 转换为 Spring Security 的 UserDetails
        return org.springframework.security.core.userdetails.User
                .withUsername(user.getUsername())
                .password(user.getPassword())
                .roles(user.getRole().replace("ROLE_", ""))
                .disabled(!user.getEnabled())
                .build();
    }
}

package com.mallshop.mallsecurity.controller;

import com.mallshop.mallsecurity.util.JwtUtil;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.web.bind.annotation.*;

import javax.validation.Valid;
import java.util.HashMap;
import java.util.Map;

@RestController
@RequestMapping("/api/auth")
public class AuthController {

    @Autowired
    private AuthenticationManager authenticationManager;

    @PostMapping("/login")
    public Map<String, Object> login(@Valid @RequestBody LoginRequest request) {
        // 1. 调用 Spring Security 认证
        UsernamePasswordAuthenticationToken authToken =
                new UsernamePasswordAuthenticationToken(
                        request.getUsername(), request.getPassword());
        Authentication authentication =
                authenticationManager.authenticate(authToken);

        // 2. 认证成功，从数据库查用户信息
        org.springframework.security.core.userdetails.User userDetails =
                (org.springframework.security.core.userdetails.User)
                        authentication.getPrincipal();
        String role = userDetails.getAuthorities().iterator().next().getAuthority();

        // 3. 生成双令牌
        String accessToken = JwtUtil.createAccessToken(
                1L, userDetails.getUsername(), role);
        String refreshToken = JwtUtil.createRefreshToken(
                1L, userDetails.getUsername());

        // 4. 返回
        Map<String, Object> result = new HashMap<>();
        result.put("accessToken", accessToken);
        result.put("refreshToken", refreshToken);
        result.put("tokenType", "Bearer");
        result.put("expiresIn", 1800);
        return result;
    }

    @PostMapping("/refresh")
    public Map<String, Object> refresh(@RequestBody Map<String, String> body) {
        String refreshToken = body.get("refreshToken");
        if (!JwtUtil.verify(refreshToken)) {
            throw new RuntimeException("Refresh Token 无效或已过期");
        }
        // 用 Refresh Token 中的信息生成新的 Access Token
        String username = JwtUtil.getUsername(refreshToken);
        String role = JwtUtil.getRole(refreshToken);
        Long userId = JwtUtil.getUserId(refreshToken);

        String newAccessToken = JwtUtil.createAccessToken(userId, username, role);
        String newRefreshToken = JwtUtil.createRefreshToken(userId, username);

        Map<String, Object> result = new HashMap<>();
        result.put("accessToken", newAccessToken);
        result.put("refreshToken", newRefreshToken);
        result.put("tokenType", "Bearer");
        result.put("expiresIn", 1800);
        return result;
    }
}

// 登录请求体
class LoginRequest {
    private String username;
    private String password;
    // getters & setters...
}

@RestController
@RequestMapping("/api/admin")
public class AdminController {

    @GetMapping("/dashboard")
    public String dashboard() {
        // 只有 ROLE_ADMIN 角色能访问
        return "管理员仪表盘——敏感数据";
    }
}

@RestController
@RequestMapping("/api/user")
public class UserController {

    @GetMapping("/info")
    public String userInfo() {
        // 登录用户均可访问
        return "用户个人信息";
    }
}

<!-- JJWT -->
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt</artifactId>
    <version>0.9.1</version>
</dependency>

@Slf4j
@Component
public class UserTokenHelper {

    private static final String TOKEN_PREFIX = "token:";
    private static final String USER_PREFIX = "user:";

    @Getter
    @Value("${mall.mgt.tokenSecret:123456test}")
    private String tokenSecret;
    @Value("${mall.mgt.tokenExpireTimeInRecord:3600}")
    private int tokenExpireTimeInRecord;

    @Autowired
    protected RedisUtil redisUtil;

    /**
     * 生成 Token 并存入 Redis
     * @param username  用户名（作为 Token 的 subject）
     * @param json      用户完整信息的 JSON（存入 Redis）
     */
    public String generateToken(String username, String json) {
        // 生成 JWT——只存 sub + exp，不存任何业务字段
        String token = Jwts.builder()
                .setSubject(username)
                .setExpiration(new Date(System.currentTimeMillis()
                        + tokenExpireTimeInRecord * 1000))
                .signWith(SignatureAlgorithm.HS512, tokenSecret)
                .compact();

        // 双 key 写入 Redis——TTL 与 Token 一致
        redisUtil.set(getTokenKey(username), token, tokenExpireTimeInRecord);
        redisUtil.set(getUserKey(username), json, tokenExpireTimeInRecord);
        return token;
    }

    /**
     * 从 Token 中解析用户名
     */
    public String getUsernameFromToken(String token) {
        Claims claims = getClaimsFromToken(token);
        if (Objects.isNull(claims)) {
            return null;
        }
        return claims.getSubject();
    }

    /**
     * 解析 JWT Claims——验证签名 + 检查过期
     */
    public Claims getClaimsFromToken(String token) {
        Claims claims;
        try {
            claims = Jwts.parser()
                    .setSigningKey(getTokenSecret())
                    .parseClaimsJws(token)
                    .getBody();
        } catch (Exception e) {
            // 签名无效/过期 → 直接抛 BusinessException → GlobalExceptionHandler 统一处理
            throw new BusinessException(HttpStatus.FORBIDDEN.value(), "请先登录");
        }
        return claims;
    }

    protected String getTokenKey(String username) {
        return String.format("%s%s", TOKEN_PREFIX, username);
    }

    protected String getUserKey(String username) {
        return String.format("%s%s", USER_PREFIX, username);
    }
}

@Slf4j
@Component
public class TokenHelper extends UserTokenHelper {

    /**
     * 生成 Token——调用父类方法，传入 UserDetails 序列化后的 JSON
     */
    public String generateToken(UserDetails userDetails) {
        return super.generateToken(
                userDetails.getUsername(),
                JSON.toJSONString(userDetails)  // FastJSON 序列化整个 UserDetails
        );
    }

    /**
     * 从 Redis 中获取用户详情——供 JwtTokenFilter 使用
     */
    public UserDetails getUserDetailsFromUsername(String username) {
        String userDetailJson = redisUtil.get(getUserKey(username));
        if (!StringUtils.hasLength(userDetailJson)) {
            return null;
        }
        return JSON.parseObject(userDetailJson, JwtUserEntity.class);
    }
}

public void delToken(String token) {
    String username = getUsernameFromToken(token);
    redisUtil.del(getTokenKey(username));   // 删除 token → Token 验证失败
    redisUtil.del(getUserKey(username));   // 删除 user → 用户信息丢失
}

@Configuration(proxyBeanMethods = false)
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)  // ① 开启方法级权限注解
public class SpringSecurityConfig implements ApplicationContextAware {

    private ApplicationContext applicationContext;

    @Override
    public void setApplicationContext(ApplicationContext ctx) {
        this.applicationContext = ctx;
    }

    // ===== 认证提供者 =====

    @Bean
    public SmsAuthenticationProvider smsAuthenticationProvider() {
        return new SmsAuthenticationProvider(
                applicationContext.getBean(UserDetailsServiceImpl.class),
                applicationContext.getBean(RedisUtil.class),
                applicationContext.getBean(UserMapper.class));
    }

    @Bean
    public DaoAuthenticationProvider daoAuthenticationProvider() {
        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
        provider.setPasswordEncoder(passwordEncoder());
        provider.setUserDetailsService(
                applicationContext.getBean(UserDetailsServiceImpl.class));
        return provider;
    }

    // ② AuthenticationManager 管理两个 Provider——密码登录 + 短信登录
    @Bean
    public AuthenticationManager authenticationManager() {
        List<AuthenticationProvider> providers = new ArrayList<>();
        providers.add(smsAuthenticationProvider());   // 短信验证码登录
        providers.add(daoAuthenticationProvider());   // 用户名密码登录
        return new ProviderManager(providers);
    }

    // ③ 去掉 ROLE_ 前缀——权限码直接是 "admin:user:delete" 而不是 "ROLE_admin:user:delete"
    @Bean
    public GrantedAuthorityDefaults grantedAuthorityDefaults() {
        return new GrantedAuthorityDefaults("");
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    // ===== 安全过滤器链 =====

    @Bean
    SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception {
        // ④ 启动时扫描所有 @NoLogin 注解，构建免登录 URL 集合
        initNoLogin(applicationContext);

        return httpSecurity
                .csrf().disable()           // JWT 方案不需要 CSRF
                .headers().frameOptions().disable()  // 允许 iframe（Druid 监控页需要）
                .and()
                .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)

                .and()
                .authorizeRequests()
                // 静态资源
                .antMatchers(HttpMethod.GET,
                        "/*.html", "/**/*.html", "/**/*.css", "/**/*.js",
                        "/websocket/**", "/job/**", "/init/**").permitAll()
                // Swagger 文档
                .antMatchers("/swagger-ui.html", "/swagger-resources/**",
                        "/webjars/**", "/*/api-docs").permitAll()
                // Druid 监控 + 头像
                .antMatchers("/druid/**", "/avatar/**").permitAll()
                // OPTIONS 预检请求
                .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
                // ⑤ @NoLogin 注解标记的接口——运行时动态构建的 permitAll 列表
                .antMatchers(NoLoginMap.getNoLoginUrlSet()
                        .toArray(new String[0])).permitAll()
                // 其余所有请求需要认证
                .anyRequest().authenticated()
                .and()
                .apply(new JwtTokenConfigurer())  // ⑥ 注册自定义 JWT 过滤器
                .and()
                .build();
    }

    /**
     * ⑦ 自动扫描：启动时遍历所有 @RequestMapping，收集标了 @NoLogin 的 URL
     */
    private void initNoLogin(ApplicationContext applicationContext) {
        RequestMappingHandlerMapping mapping = applicationContext
                .getBean(RequestMappingHandlerMapping.class);
        Map<RequestMappingInfo, HandlerMethod> handlerMethods =
                mapping.getHandlerMethods();

        Set<String> noLoginUrls = new HashSet<>();
        for (Map.Entry<RequestMappingInfo, HandlerMethod> entry
                : handlerMethods.entrySet()) {
            HandlerMethod handlerMethod = entry.getValue();
            NoLogin noLogin = handlerMethod.getMethodAnnotation(NoLogin.class);
            if (null != noLogin) {
                noLoginUrls.addAll(entry.getKey()
                        .getPatternsCondition().getPatterns());
            }
        }
        NoLoginMap.initSet(noLoginUrls);
    }
}

public class JwtTokenFilter extends GenericFilterBean {

    public final static String FILTER_ERROR = "filterError";
    public final static String FILTER_ERROR_PATH = "/throw-error";

    @Override
    public void doFilter(ServletRequest servletRequest,
            ServletResponse servletResponse, FilterChain filterChain)
            throws IOException, ServletException {

        HttpServletRequest httpServletRequest = (HttpServletRequest) servletRequest;

        // ① NoLoginMap 判断：标了 @NoLogin 的接口 → 直接放行
        if (!NoLoginMap.notExist(httpServletRequest.getRequestURI())) {
            filterChain.doFilter(httpServletRequest, servletResponse);
            return;
        }

        // ② 从 Authorization 头提取 Token
        String token = TokenUtil.getTokenForAuthorization(httpServletRequest);

        if (Objects.isNull(token)) {
            if (NoLoginMap.notExist(httpServletRequest.getRequestURI())) {
                // ③ 需要登录但没有 Token → 转发给 FilterExceptionController
                handleException((HttpServletRequest) servletRequest,
                        (HttpServletResponse) servletResponse,
                        new BusinessException(HttpStatus.FORBIDDEN.value(), "请先登录"));
            } else {
                filterChain.doFilter(httpServletRequest, servletResponse);
            }
            return;
        }

        // ④ 通过 SpringBeanUtil 获取 TokenHelper（Filter 不是 Spring Bean，不能 @Autowired）
        TokenHelper tokenHelper = SpringBeanUtil.getBean("tokenHelper");

        if (Objects.nonNull(tokenHelper)) {
            try {
                // ⑤ 从 Token 解析用户名 → 从 Redis 获取完整 UserDetails
                String username = tokenHelper.getUsernameFromToken(token);
                if (StringUtils.hasLength(username)
                        && SecurityContextHolder.getContext().getAuthentication() == null) {
                    UserDetails userDetails =
                            tokenHelper.getUserDetailsFromUsername(username);  // 从 Redis 取
                    if (Objects.nonNull(userDetails)) {
                        UsernamePasswordAuthenticationToken authentication =
                                new UsernamePasswordAuthenticationToken(
                                        userDetails, null,
                                        userDetails.getAuthorities());
                        authentication.setDetails(
                                new WebAuthenticationDetailsSource()
                                        .buildDetails(httpServletRequest));
                        SecurityContextHolder.getContext()
                                .setAuthentication(authentication);
                    }
                }
                filterChain.doFilter(httpServletRequest, servletResponse);
            } catch (BusinessException e) {
                // ⑥ Token 解析异常 → 转发给 FilterExceptionController
                handleException((HttpServletRequest) servletRequest,
                        (HttpServletResponse) servletResponse, e);
            }
        } else {
            filterChain.doFilter(httpServletRequest, servletResponse);
        }
    }

    /**
     * ⑦ Filter 不能直接返回 JSON——通过 forward 交给 Controller
     */
    private void handleException(HttpServletRequest request,
            HttpServletResponse response, BusinessException e)
            throws ServletException, IOException {
        request.setAttribute(FILTER_ERROR, e);
        request.getRequestDispatcher(FILTER_ERROR_PATH).forward(request, response);
    }
}

public class JwtTokenConfigurer
        extends SecurityConfigurerAdapter<DefaultSecurityFilterChain, HttpSecurity> {

    @Override
    public void configure(HttpSecurity httpSecurity) {
        JwtTokenFilter jwtTokenFilter = new JwtTokenFilter();
        // 插在 UsernamePasswordAuthenticationFilter 之前
        httpSecurity.addFilterBefore(jwtTokenFilter,
                UsernamePasswordAuthenticationFilter.class);
    }
}

@Slf4j
@RestController
public class FilterExceptionController {

    @RequestMapping(FILTER_ERROR_PATH)  // "/throw-error"
    public void handleException(HttpServletRequest request) {
        Object exception = request.getAttribute(FILTER_ERROR);
        if (exception instanceof BusinessException) {
            BusinessException businessException = (BusinessException) exception;
            throw businessException;  // 重新抛出 → GlobalExceptionHandler 捕获
        }
        throw new BusinessException(
                HttpStatus.INTERNAL_SERVER_ERROR.value(),
                "服务器内部错误，请联系系统管理员！");
    }
}

@Service("userDetailsService")
public class UserDetailsServiceImpl implements UserDetailsService {

    @Autowired
    private UserMapper userMapper;
    @Autowired
    private RoleMapper roleMapper;
    @Autowired
    private MenuMapper menuMapper;

    @Override
    public UserDetails loadUserByUsername(String username) {
        // ① 查用户
        UserEntity userEntity = userMapper.findByUserName(username);
        if (Objects.isNull(userEntity)) {
            return null;  // 返回 null → DaoAuthenticationProvider 抛出 BadCredentialsException
        }

        // ② 查用户拥有的角色 → 查角色关联的菜单权限
        List<SimpleGrantedAuthority> authorities = new ArrayList<>();
        fillUserAuthority(userEntity, authorities);

        // ③ 提取角色名列表（用于前端菜单展示）
        List<String> roles = authorities.stream()
                .map(SimpleGrantedAuthority::getAuthority)
                .collect(Collectors.toList());

        // ④ 返回自定义 UserDetails——除了权限，还带了 userId 和 roles
        return new JwtUserEntity(userEntity.getId(), username,
                userEntity.getPassword(), authorities, roles);
    }

    private void fillUserAuthority(UserEntity userEntity,
            List<SimpleGrantedAuthority> authorities) {
        // ⑤ 查用户关联的角色
        List<RoleEntity> roleEntities =
                roleMapper.findRoleByUserId(userEntity.getId());
        if (CollectionUtils.isEmpty(roleEntities)) {
            return;
        }

        // ⑥ 收集角色自身的权限码（如 "admin:user:list"）
        Set<String> permissionSet = roleEntities.stream()
                .filter(x -> StringUtils.hasLength(x.getPermission()))
                .map(RoleEntity::getPermission)
                .collect(Collectors.toSet());

        // ⑦ 查角色关联的菜单 → 收集菜单的权限码（如 "user:delete"）
        fillRoleMenu(roleEntities, permissionSet);

        if (CollectionUtils.isNotEmpty(permissionSet)) {
            authorities.addAll(permissionSet.stream()
                    .map(SimpleGrantedAuthority::new)
                    .collect(Collectors.toList()));
        }
    }

    private void fillRoleMenu(List<RoleEntity> roleEntities,
            Set<String> permissionSet) {
        List<Long> roleIdList = roleEntities.stream()
                .map(RoleEntity::getId).collect(Collectors.toList());
        List<MenuEntity> menuList =
                menuMapper.findMenuByRoleIdList(roleIdList);
        if (CollectionUtils.isEmpty(menuList)) {
            return;
        }
        for (MenuEntity menuEntity : menuList) {
            if (StringUtils.hasLength(menuEntity.getPermission())) {
                // ⑧ 菜单权限可能是逗号分隔的多个权限码，如 "user:add,user:delete"
                Set<String> menuPermSet = Arrays
                        .stream(menuEntity.getPermission().split(","))
                        .collect(Collectors.toSet());
                permissionSet.addAll(menuPermSet);
            }
        }
    }
}

@Data
@NoArgsConstructor
@AllArgsConstructor
public class JwtUserEntity implements UserDetails {

    private Long id;                              // 用户ID——后续填充审计字段时用
    private String username;
    @JsonIgnore
    private String password;                      // 密码不序列化到 Redis 的 JSON 中
    private List<SimpleGrantedAuthority> authorities;  // 权限码集合
    private List<String> roles;                   // 角色名集合（前端菜单用）

    @Override
    public boolean isAccountNonExpired() { return true; }
    @Override
    public boolean isAccountNonLocked() { return true; }
    @Override
    public boolean isCredentialsNonExpired() { return true; }
    @Override
    public boolean isEnabled() { return true; }
}

public class SmsAuthenticationProvider implements AuthenticationProvider {

    @Override
    public Authentication authenticate(Authentication authentication) {
        String phone = (String) authentication.getPrincipal();
        String captcha = (String) authentication.getCredentials();

        // ① 验证短信验证码
        String smsCodeKey = getSmsCodePrefixKey(phone, SmsTypeEnum.LOGIN);
        String smsCode = redisUtil.get(smsCodeKey);
        AssertUtil.hasLength(smsCode, "该短信验证码已失效");
        AssertUtil.isTrue(smsCode.trim().equals(captcha), "短信验证码错误");

        try {
            // ② 根据手机号查用户——没有就自动注册
            List<UserEntity> userEntities = userMapper.searchByPhone(phone);
            UserEntity userEntity;
            if (CollectionUtils.isEmpty(userEntities)) {
                userEntity = registerUser(phone);  // 自动注册
            } else {
                userEntity = userEntities.get(0);
            }

            // ③ 走正常的 UserDetailsService 加载权限
            UserDetails userDetails = userDetailsService
                    .loadUserByUsername(userEntity.getUserName());

            // ④ 返回已认证的 Token
            return new SmsAuthenticationToken(
                    userDetails, null, userDetails.getAuthorities());
        } finally {
            redisUtil.del(smsCodeKey);  // 用完即删
        }
    }

    @Override
    public boolean supports(Class<?> authentication) {
        // ⑤ 只有 SmsAuthenticationToken 才交给我处理
        return SmsAuthenticationToken.class.isAssignableFrom(authentication);
    }
}