CREATE TABLE user (
    id BIGINT PRIMARY KEY AUTO_INCREMENT,
    username VARCHAR(50) UNIQUE NOT NULL,
    password VARCHAR(255) NOT NULL,
    login_attempts INT DEFAULT 0, -- 登錄失敗次數(shù)
    lock_time TIMESTAMP NULL, -- 賬號鎖定時間
    account_non_locked BOOLEAN DEFAULT TRUE -- 賬號是否鎖定
);

public class SecurUsernamePasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
 
    @Autowired
    ISysUserService userService;
 
    @Override
    public Authentication attemptAuthentication(HttpServletRequest request,
                                                HttpServletResponse response) throws AuthenticationException {
 
        if (request.getContentType().equals(MediaType.APPLICATION_JSON_UTF8_VALUE)
                || request.getContentType().equals(MediaType.APPLICATION_JSON_VALUE)) {
 
            ObjectMapper mapper = new ObjectMapper();
            UsernamePasswordAuthenticationToken authRequest = null;
            //取authenticationBean
            Map<String, String> authenticationBean = null;
            //用try with resource，方便自動釋放資源
            try (InputStream is = request.getInputStream()) {
                authenticationBean = mapper.readValue(is, Map.class);
            } catch (IOException e) {
                //將異常放到自定義的異常類中
                throw  new SecurAuthenticationException(e.getMessage());
            }
            try {
                if (!authenticationBean.isEmpty()) {
                    //獲得賬號、密碼
                    String username = authenticationBean.get(SPRING_SECURITY_FORM_USERNAME_KEY);
                    String password = authenticationBean.get(SPRING_SECURITY_FORM_PASSWORD_KEY);
 
                    request.setAttribute(SPRING_SECURITY_FORM_USERNAME_KEY, username);
 
                    //檢測賬號、密碼是否存在
                    if (userService.checkLogin(username, password)) {
                        //將賬號、密碼裝入UsernamePasswordAuthenticationToken中
                        authRequest = new UsernamePasswordAuthenticationToken(username, password);
                        setDetails(request,authRequest );
                        return this.getAuthenticationManager().authenticate(authRequest);
                    }
 
                }
            } catch (Exception e) {
                throw new SecurAuthenticationException(e.getMessage());
            }
            return null;
        } else {
            return this.attemptAuthentication(request, response);
        }
    }
}

    public boolean checkLogin(String username, String rawPassword) throws Exception {
        SysUser userEntity = this.getUserByUserName(username);
        System.out.println("userEntity = " + userEntity);
        if (userEntity == null) {
            //System.out.println("checkLogin--------->賬號不存在，請重新嘗試！");
            //設(shè)置友好提示
            throw new Exception("賬號不存在，請重新嘗試！");
        } else {
            // 檢查賬號鎖定狀態(tài)
            handleAccountLock(userEntity);
            //加密的密碼
            String encodedPassword = userEntity.getPassword();
            //和加密后的密碼進行比配
            if (!passwordEncoder.matches(rawPassword, encodedPassword)) {
                //System.out.println("checkLogin--------->密碼不正確！");
                //設(shè)置友好提示
                throw new Exception("密碼不正確！");
            } else {
                return true;
            }
        }
    }

    /**
     * 檢查并處理賬號鎖定邏輯
     */
    private void handleAccountLock(SysUser user) {
        if (!user.getAccountNonLocked() && user.getLockTime() != null) {
            // 當前時間
            Date now = new Date();
 
            // 解鎖時間
            Date unlockTime = new Date(user.getLockTime().getTime() + LOCK_DURATION.toMillis());
 
            if (now.before(unlockTime)) {
                throw new LockedException("賬號已鎖定，請3分鐘后再試");
            }
 
            // 解鎖賬號并重置狀態(tài)
            user.setAccountNonLocked(true);
            user.setLoginAttempts(0);
            user.setLockTime(null);
            this.updateById(user);
        }
    }

    public void increaseFailedAttempts(SysUser user) {
        int attempts = user.getLoginAttempts() + 1;
        if (attempts >= MAX_LOGIN_ATTEMPTS) {
            user.setAccountNonLocked(false);
            user.setLockTime(new Date());
        }
        user.setLoginAttempts(attempts);
        this.updateById(user);
    }

    public void resetLoginAttempts(String username) {
        SysUser user = this.getUserByUserName(username);
        if(user==null){
            throw new UsernameNotFoundException(String.format("%s.這個用戶不存在或已被禁用", username));
        }
        user.setLoginAttempts(0);
        user.setAccountNonLocked(true);
        user.setLockTime(null);
        this.updateById(user);
 
    }

@Component
public class SecurAuthenticationFailureHandler extends JSONAuthentication implements AuthenticationFailureHandler {
    @Autowired
    SysUserServiceImpl sysUserService;
 
 
    @Override
    public void onAuthenticationFailure(HttpServletRequest request,
                                        HttpServletResponse response,
                                        AuthenticationException e) throws IOException, ServletException {
 
        // 從請求體中解析 JSON，獲取 username
        String username = (String) request.getAttribute(SPRING_SECURITY_FORM_USERNAME_KEY);
        // 登錄失敗時增加失敗次數(shù)
        if (username != null) {
            SysUser user = sysUserService.getUserByUserName(username);
            if (user != null) {
                sysUserService.increaseFailedAttempts(user);
            }
        }
 
        ResponseStructure data = ResponseStructure.instance(ALL_RETURN_401.getCode(),"登錄失敗:"+e.getMessage());
        //輸出
        this.WriteJSON(request, response, data);
    }
}