<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>com.alibaba</groupId>
        <artifactId>fastjson</artifactId>
        <version>2.0.21</version>
    </dependency>

    <dependency>
        <groupId>com.mysql</groupId>
        <artifactId>mysql-connector-j</artifactId>
        <scope>runtime</scope>
    </dependency>
    <dependency>
        <groupId>org.projectlombok</groupId>
        <artifactId>lombok</artifactId>
        <optional>true</optional>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-test</artifactId>
        <scope>test</scope>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-test</artifactId>
        <scope>test</scope>
    </dependency>
</dependencies>

@Component
public class MyUserDetailsService implements UserDetailsService {

    /*
    *  UserDetailsService：提供查詢用戶功能，如根據(jù)用戶名查詢用戶，并返回UserDetails
     *UserDetails，SpringSecurity定義的類， 記錄用戶信息，如用戶名、密碼、權(quán)限等
    * */
    @Autowired
    private SysUserMapper sysUserMapper;
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
//根據(jù)用戶名從數(shù)據(jù)庫中查詢用戶
        SysUser sysUser = sysUserMapper.selectOne(new LambdaQueryWrapper<SysUser>()
                .eq(username != null, SysUser::getUsername, username));
if (sysUser==null){
    throw new UsernameNotFoundException("用戶不存在");
}
        MySysUserDetails mySysUserDetails=new MySysUserDetails(sysUser);
        return mySysUserDetails;
    }
}

@Data
@AllArgsConstructor
@NoArgsConstructor
public class MySysUserDetails implements UserDetails {


    private Integer id;

    private String username;

    private String password;

//    用戶擁有的權(quán)限集合，我這里先設(shè)置為null，將來會再更改的
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return null;
    }

    public MySysUserDetails(SysUser sysUser) {
        this.id = sysUser.getId();
        this.username = sysUser.getUsername();
        this.password = sysUser.getPassword();
    }

    //    后面四個方法都是用戶是否可用、是否過期之類的。我都設(shè)置為true
    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return true;
    }
}

@Configuration
@EnableWebSecurity //開啟webSecurity服務(wù)
public class SecurityConfig {

    
    @Autowired
    private MyUserDetailsService myUserDetailsService;

@Bean
public AuthenticationManager authenticationManager(PasswordEncoder passwordEncoder){
    DaoAuthenticationProvider provider=new DaoAuthenticationProvider();
//將編寫的UserDetailsService注入進(jìn)來
    provider.setUserDetailsService(myUserDetailsService);
//將使用的密碼編譯器加入進(jìn)來
    provider.setPasswordEncoder(passwordEncoder);
//將provider放置到AuthenticationManager 中
    ProviderManager providerManager=new ProviderManager(provider);
    return providerManager;
}
    /*
     * 在security安全框架中，提供了若干密碼解析器實(shí)現(xiàn)類型。
     * 其中BCryptPasswordEncoder 叫強(qiáng)散列加密?？梢员ＷC相同的明文，多次加密后，
     * 密碼有相同的散列數(shù)據(jù)，而不是相同的結(jié)果。
     * 匹配時，是基于相同的散列數(shù)據(jù)做的匹配。
     * Spring Security 推薦使用 BCryptPasswordEncoder 作為密碼加密和解析器。
     * */
@Bean
    public PasswordEncoder passwordEncoder(){
    return new BCryptPasswordEncoder();
}

//    用戶登錄
    @PostMapping("/login")
    public String login(@RequestBody LoginDto loginDto){

      String token=  sysUserService.login(loginDto);
        return token;
    }

@Autowired
    private AuthenticationManager authenticationManager;

//    登錄接口的具體實(shí)現(xiàn)
    @Override
    public String login(LoginDto loginDto) {
//        傳入用戶名和密碼
        UsernamePasswordAuthenticationToken usernamePassword =
                new UsernamePasswordAuthenticationToken(loginDto.getUsername(),loginDto.getPassword());
//是實(shí)現(xiàn)登錄邏輯，此時就回去調(diào)用LoadUserByUsername方法
        Authentication authenticate = authenticationManager.authenticate(usernamePassword);
//        獲取返回的用戶信息
        Object principal = authenticate.getPrincipal();
     //強(qiáng)轉(zhuǎn)為MySysUserDetails類型
MySysUserDetails mySysUserDetails = (MySysUserDetails) principal;
//        輸出用戶信息
        System.err.println(mySysUserDetails);
//返回token
        String token= UUID.randomUUID().toString();
        return token;
    }

@Autowired private SysUserMapper sysUserMapper;
@Autowired private PasswordEncoder passwordEncoder;
@Test void contextLoads() { //導(dǎo)入了一個用戶
SysUser sysUser=new SysUser();
sysUser.setUsername("zhangsan"); sysUser.setPassword(passwordEncoder.encode("123456")); sysUserMapper.insert(sysUser);
}

/*
     * 配置權(quán)限相關(guān)的配置
     * 安全框架本質(zhì)上是一堆的過濾器，稱之為過濾器鏈，每一個過濾器鏈的功能都不同
     * 設(shè)置一些鏈接不要攔截
     * */
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception {
//       關(guān)閉csrf
        httpSecurity.csrf(it->it.disable());
httpSecurity.authorizeHttpRequests(it->
        it.requestMatchers("/sys-user/login").permitAll()  //設(shè)置登錄路徑所有人都可以訪問
                .anyRequest().authenticated()  //其他路徑都要進(jìn)行攔截
        );

        return httpSecurity.build();
    }

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8" xmlns:th="http://www.thymeleaf.org">
    <title>自定義的登錄頁面</title>
</head>
<body>

<form action="/sys-user/login" method="post">
   用戶名： <input type="text" name="username" >
    <br>
    密碼： <input type="password" name="password">
    <br>
<input type="submit" value="登錄">
</form>

</body>
</html>

/*
     * 配置權(quán)限相關(guān)的配置
     * 安全框架本質(zhì)上是一堆的過濾器，稱之為過濾器鏈，每一個過濾器鏈的功能都不同
     * 設(shè)置一些鏈接不要攔截
     * */

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception {
//       關(guān)閉csrf
        httpSecurity.csrf(it->it.disable());
//        配置路徑相關(guān)
httpSecurity.authorizeHttpRequests(it->
        it.requestMatchers("/login","sys-user/login").permitAll()  //設(shè)置登錄路徑所有人都可以訪問
                .anyRequest().authenticated()  //其他路徑都要進(jìn)行攔截
        );
//表單
httpSecurity.formLogin(from->
        from.loginPage("/login")   //跳轉(zhuǎn)到自定義的登錄頁面
.loginProcessingUrl("/sys-user/login")  //處理前端的請求，與from表單的action一致即可
     .defaultSuccessUrl("/index")  //默認(rèn)的請求成功之后的跳轉(zhuǎn)頁面，直接訪問登錄頁面
        );

        return httpSecurity.build();
    }

@Controller
public class Login {


@GetMapping("/login")
public String login(){
    System.out.println("用戶進(jìn)入登錄頁面");
    return "login";   //沒使用json返回，直接映射到自定義登錄的頁面
}

@GetMapping("/index")
@ResponseBody
    public String index(){
    return "用戶登錄成功";
}
}

httpSecurity.logout(logout->{
   logout.logoutUrl("/user/login")   //自定義退出接口
           .logoutSuccessHandler(logoutSuccess);  //退出成功之后的邏輯

});

@Component
public class LogoutSuccess implements LogoutSuccessHandler {

    @Resource
    private RedisTemplate<String,String> redisTemplate;

/*
* 登錄成功之后的邏輯
* */
    @Override
    public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {

        String token = request.getHeader("token");
        //    刪除redis中的數(shù)據(jù)
        redisTemplate.delete(token);
        Map<String,Object> map=new HashMap<>();
        map.put("msg","退出成功");
        map.put("code",200);

response.getWriter().write(JSON.toJSONString(map));
        response.setContentType("application/json;charset=utf-8");
    }

}

@Component
public class MyUserDetailsService implements UserDetailsService {

    /*
    *  UserDetailsService：提供查詢用戶功能，如根據(jù)用戶名查詢用戶，并返回UserDetails
     *UserDetails，SpringSecurity定義的類， 記錄用戶信息，如用戶名、密碼、權(quán)限等
    * */
    @Autowired
    private SysUserMapper sysUserMapper;

@Autowired
private SysRoleMapper sysRoleMapper;
@Autowired
private SysPermissionsMapper sysPermissionsMapper;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
//根據(jù)用戶名從數(shù)據(jù)庫中查詢用戶
        SysUser sysUser = sysUserMapper.selectOne(new LambdaQueryWrapper<SysUser>()
                .eq(username != null, SysUser::getUsername, username));
if (sysUser==null){
    throw new UsernameNotFoundException("用戶不存在");
}
        MySysUserDetails mySysUserDetails=new MySysUserDetails(sysUser);
if ("zhangsan".equals(username)){
//zhangsan用戶是超級管理員，擁有一切權(quán)限
    SysRole sysRole = sysRoleMapper.selectOne(new LambdaQueryWrapper<SysRole>().eq(SysRole::getRoleName, "超級管理員"));
    Set<SysRole> roles=new HashSet<>();
    roles.add(sysRole);
    mySysUserDetails.setRoles(roles);
    SysPermissions sysPermissions = sysPermissionsMapper.selectById(1);
    Set<String> permissions=new HashSet<>();
    permissions.add(sysPermissions.getPermissionsName());
    mySysUserDetails.setPermissions(permissions);
}

        if ("lisi".equals(username)){
//lisi用戶是普通管理員，擁有基本權(quán)限
            SysRole sysRole = sysRoleMapper.selectOne(new LambdaQueryWrapper<SysRole>().eq(SysRole::getRoleName, "普通管理員"));
            Set<SysRole> roles=new HashSet<>();
            roles.add(sysRole);
            mySysUserDetails.setRoles(roles);
            SysPermissions sysPermissions = sysPermissionsMapper.selectById(2);
            Set<String> permissions=new HashSet<>();
            permissions.add(sysPermissions.getPermissionsName());
            mySysUserDetails.setPermissions(permissions);
        }

        return mySysUserDetails;
    }
}

//    角色信息
    private Set<SysRole> roles;
//    權(quán)限信息
    private Set<String> permissions;
    
//    用戶擁有的權(quán)限集合，我這里先設(shè)置為null，將來會再更改的
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        System.err.println("進(jìn)入權(quán)限的獲取方法");

        List<GrantedAuthority> authorities = new ArrayList<>(); // 授權(quán)信息列表
// 將角色名稱添加到授權(quán)信息列表中
        roles.forEach(role->
        authorities.add(new SimpleGrantedAuthority(role.getRoleName())));
        // 將權(quán)限名稱添加到授權(quán)信息列表中
        permissions.forEach(permission->
        authorities.add(new SimpleGrantedAuthority(permission))
                );
        return authorities; // 返回授權(quán)信息列表
    }

httpSecurity.authorizeHttpRequests(it->
//hello地址只有超級管理員角色才能訪問
it.requestMatchers("/hello").hasRole("超級管理員")
//hello2地址只有"擁有所有權(quán)限"的權(quán)限才能訪問
.requestMatchers("hello2").hasAuthority("擁有所有權(quán)限")
                .requestMatchers("/login","sys-user/login").permitAll()  //設(shè)置登錄路徑所有人都可以訪問
                .anyRequest().authenticated()  //其他路徑都要進(jìn)行攔截
        );

/*測試@PreAuthorize注解
* 作用：使用在類或方法上，擁有指定的權(quán)限才能訪問（在方法運(yùn)行前進(jìn)行校驗）
* String類型的參數(shù)：語法是Spring的EL表達(dá)式
* 有權(quán)限：test3權(quán)限
* hasRole：會去匹配authorities，但是會在hasRole的參數(shù)前加上一個ROLE_前綴，
* 所以在定義權(quán)限的時候需要加上ROLE_前綴
* role和authorities的關(guān)系是：role是一種復(fù)雜的寫法，有ROLE_前綴，authorities是role的簡化寫法
* 如果使用
* hasAnyRole：則匹配的權(quán)限是在authorities加上前綴ROLE_
* 推薦使用
* hasAnyAuthority：匹配authorities，但是不用在authorities的參數(shù)前加上ROLE_前綴
* */
@PreAuthorize("hasAnyAuthority('擁有所有權(quán)限')")
@ResponseBody
@GetMapping("/test3")
public String test3(){
    System.out.println("一個請求");

    return "一個test3請求";
}

/*
 @PostAuthorize：在方法返回時進(jìn)行校驗。
 可以還是校驗權(quán)限、或者校驗一些其他的東西（接下來我們校驗返回值的長度）
*返回結(jié)果的長度大于3、則認(rèn)為是合法的
returnObject：固定寫法，代指返回對象
* */
@ResponseBody
@PostAuthorize("returnObject.length()>4")
@GetMapping("/test4")
public String test4(){
    System.out.println("一個test4請求");

    return "小張自傲張最終";
}

/*
* @PreFilter：過濾符合條件的數(shù)據(jù)進(jìn)入到接口
* */
    @PostFilter("filterObject.length()>3")
    @ResponseBody
    @GetMapping("/test5")
    public String test5(){
        System.out.println("一個test4請求");
List<String> list = new ArrayList<>();
list.add("張三");
list.add("王麻子");
list.add("狗叫什么");

        return "一個test5請求";
    }

/*
* @PreFilter：過濾符合條件的數(shù)據(jù)返回，數(shù)據(jù)必須是Collection、map、Array【數(shù)組】
* */
@PreFilter("filterObject.length()>5")
@ResponseBody
@PostMapping("/test6")
public List<String> test6(@RequestBody List<String> list){
    return list;
}