public class JsCodeAuthenticationToken extends AbstractAuthenticationToken {
    private static final long serialVersionUID = 5615450055779559101L;
    private String code;

    /**
     * Creates a token with the supplied array of authorities.
     *
     * @param authorities the collection of <tt>GrantedAuthority</tt>s for the principal
     *                    represented by this authentication object.
     */
    public JsCodeAuthenticationToken(Collection<? extends GrantedAuthority> authorities, String code) {
        super(authorities);
        this.code = code;
    }

    public JsCodeAuthenticationToken(String code) {
        this(Collections.emptyList(), code);
    }

    @Override
    public Object getCredentials() {
        return null;
    }

    @Override
    public Object getPrincipal() {
        return code;
    }

    public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
        if (isAuthenticated) {
            throw new IllegalArgumentException(
                    "Cannot set this token to trusted - use constructor which takes a GrantedAuthority list instead");
        }

        super.setAuthenticated(false);
    }

    @Override
    public void eraseCredentials() {
        super.eraseCredentials();
    }
}

@Slf4j
public class JsCodeAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
    private static String jsCode = "code";

    private static boolean postOnly = true;

    protected JsCodeAuthenticationFilter(WechatProperties properties) {
        super(new AntPathRequestMatcher(properties.getAuthUrl(), "POST"));
    }

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException, IOException, ServletException {
        if (postOnly && !request.getMethod().equalsIgnoreCase("post")) {
            throw new AuthenticationServiceException("該接口不支持：" + request.getMethod());
        }

        String code = obtainCode(request);
        code = code.trim();
        log.info("得到的code:{}", code);
        JsCodeAuthenticationToken authenticationTokenRequest = new JsCodeAuthenticationToken(code);
        setDetails(request, authenticationTokenRequest);
        return this.getAuthenticationManager().authenticate(authenticationTokenRequest);
    }

    public String obtainCode(HttpServletRequest request) {
        if (request.getHeader("Content-Type").contains("application/json")) {
            return obtainCodeJson(request, jsCode);
        }

        return request.getParameter(jsCode);
    }

    public String obtainCodeJson(HttpServletRequest request, String param) {
        StringBuilder builder = new StringBuilder();
        String line = null;
        String code = null;
        try{
            BufferedReader reader = request.getReader();
            while ((line = reader.readLine()) != null) {
                builder.append(line);
            }

            Map<String, String> map = JsonUtils.fromString(builder.toString(), Map.class, String.class, String.class);
            code = map.get(param);
        }catch (RuntimeException | IOException e) {
            throw new AuthenticationServiceException("獲取參數(shù)失敗");
        }

        return code;
    }

    /**
     * Provided so that subclasses may configure what is put into the
     * authentication request's details property.
     *
     * @param request     that an authentication request is being created for
     * @param authRequest the authentication request object that should have its details
     *                    set
     */
    protected void setDetails(HttpServletRequest request, JsCodeAuthenticationToken authRequest) {
        authRequest.setDetails(authenticationDetailsSource.buildDetails(request));
    }

public class JsCodeAuthenticationProvider implements AuthenticationProvider {

    private WxOAuth2Service weChatService;

    private UserDetailsService userDetailsService;

    private WxMpProperties wxMpProperties;

    public JsCodeAuthenticationProvider(WxOAuth2Service weChatService, WxMpProperties wxMpProperties) {
        this.weChatService = weChatService;
        this.wxMpProperties = wxMpProperties;
    }

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        JsCodeAuthenticationToken token = (JsCodeAuthenticationToken) authentication;
        String code = (String) token.getPrincipal();
        log.info("得到的code:{}", code);
        if (StringUtils.isBlank(code)) {
            throw new AuthenticationServiceException("jscode 不能為空");
        }

        WxOAuth2AccessToken wxOAuth2AccessToken;
        try {
            wxOAuth2AccessToken = weChatService.getAccessToken(wxMpProperties.getAppId(), wxMpProperties.getSecret(), code);
        } catch (WxErrorException e) {
            throw new AuthenticationServiceException("授權(quán)登錄失敗");
        }



        WeChatDetailsService weChatDetailsService = (WeChatDetailsService)userDetailsService;
        UserDetails details = weChatDetailsService.loadByToken(wxOAuth2AccessToken.getOpenId(), wxOAuth2AccessToken.getAccessToken());
        if (details == null) {
            throw new AuthenticationServiceException("無法獲取公眾號用戶");
        }

        JsCodeAuthenticationToken authenticationResult = new JsCodeAuthenticationToken(details.getUsername());
        authenticationResult.setDetails(token.getDetails());
        return authenticationResult;
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return JsCodeAuthenticationToken.class.isAssignableFrom(authentication);
    }

    public void setUserDetailsService(UserDetailsService userDetailsService) {
        this.userDetailsService = userDetailsService;
    }
}

public interface AuthenticationProvider {
 Authentication authenticate(Authentication authentication) throws AuthenticationException;
 boolean supports(Class<?> authentication);
}

@Component
@EnableConfigurationProperties(WxMpProperties.class)
public class JsCodeAuthenticationSecurityConfig  extends SecurityConfigurerAdapter<DefaultSecurityFilterChain, HttpSecurity> {
    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private AuthenticationSuccessHandler jsCodeAuthenticationSuccessHandler;

    @Autowired
    private AuthenticationFailureHandler jsCodeAuthenticationFailureHandler;

    @Autowired
    private WxOAuth2Service weChatService;

    @Autowired
    private WechatProperties weChatProperties;

    @Autowired
    private WxMpProperties wxMpProperties;

    @Override
    public void configure(HttpSecurity http) throws Exception {
        JsCodeAuthenticationFilter mobilePasswordAuthenticationFilter = new JsCodeAuthenticationFilter(weChatProperties);
        mobilePasswordAuthenticationFilter.setAuthenticationSuccessHandler(jsCodeAuthenticationSuccessHandler);
        mobilePasswordAuthenticationFilter.setAuthenticationFailureHandler(jsCodeAuthenticationFailureHandler);
        mobilePasswordAuthenticationFilter.setAuthenticationManager(http.getSharedObject(AuthenticationManager.class));
        JsCodeAuthenticationProvider provider = new JsCodeAuthenticationProvider(weChatService, wxMpProperties);
        provider.setUserDetailsService(userDetailsService);
        // 將當前服務(wù)注冊到 mobilePasswordAuthenticationFilter 連之后
        http.authenticationProvider(provider).addFilterAfter(mobilePasswordAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
    }
}

public abstract class SecurityConfigurerAdapter<O extends SecurityFilterChain, B extends SecurityBuilder<O>> implements SecurityConfigurer<O, B> {
 // 提供一個空實現(xiàn)的configure方法，供子類進行覆蓋定制
  public void configure(B builder) throws Exception {}
 // 提供一個空實現(xiàn)的init方法，供子類進行覆蓋定制 
 public void init(B builder) throws Exception {}
 // 提供一個空實現(xiàn)的configure方法，供子類進行覆蓋定制 
 public void configure(O object) throws Exception {}
 // 提供一個空實現(xiàn)的postProcess方法，供子類進行覆蓋定制 
 protected void postProcess(O object) throws Exception {}
}

    public void configure(HttpSecurity http) throws Exception {
        String[] auth = StringUtils.split( securityProperties.getAuthUrl(), ",");
        http.formLogin().failureHandler(authenticationFailureHandler)
                .successHandler(authenticationSuccessHandler)
                .loginProcessingUrl(SecurityConstants.DEFAULT_LOGIN_PROCESSING_URL_FORM)
                .loginPage(SecurityConstants.DEFAULT_UNAUTHENTICATION_URL)
                .and().apply(jsCodeAuthenticationSecurityConfig)
                .and().apply(usernameAuthenticationSecurityConfig())
                .and().authorizeRequests().antMatchers(auth).authenticated()
                .and().authorizeRequests().anyRequest().permitAll()
                .and().csrf().disable();
    }