@Entity
public class Role {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Integer id;
    private String name; // e.g., "ROLE_USER", "ROLE_ADMIN"
    // Constructors, getters, setters...
}
@Entity
public class User {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    private String username;
    private String password;
    private Boolean enabled;
    @ManyToMany(fetch = FetchType.EAGER) // 急加載，獲取用戶時(shí)立刻獲取角色
    @JoinTable(
        name = "users_roles",
        joinColumns = @JoinColumn(name = "user_id"),
        inverseJoinColumns = @JoinColumn(name = "role_id")
    )
    private Set<Role> roles = new HashSet<>();
    // Constructors, getters, setters...
}

@Service
public class MyUserDetailsService implements UserDetailsService {
    @Autowired
    private UserRepository userRepository; // 你的JPA Repository
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        // 1. 從數(shù)據(jù)庫查詢用戶
        User user = userRepository.findByUsername(username);
        if (user == null) {
            throw new UsernameNotFoundException("User not found");
        }
        // 2. 將數(shù)據(jù)庫中的 User 對(duì)象，轉(zhuǎn)換為 Spring Security 認(rèn)識(shí)的 UserDetails 對(duì)象
        return org.springframework.security.core.userdetails.User
                .withUsername(user.getUsername())
                .password(user.getPassword())
                .disabled(!user.getEnabled())
                .authorities(getAuthorities(user.getRoles())) // 這里設(shè)置權(quán)限/角色
                .build();
    }
    // 將數(shù)據(jù)庫中的 Role 集合轉(zhuǎn)換為 Spring Security 認(rèn)識(shí)的 GrantedAuthority 集合
    private Collection<? extends GrantedAuthority> getAuthorities(Set<Role> roles) {
        return roles.stream()
                .map(role -> new SimpleGrantedAuthority(role.getName()))
                .collect(Collectors.toList());
    }
}

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Autowired
    private MyUserDetailsService userDetailsService;
    // 配置密碼編碼器。Spring Security 強(qiáng)制要求密碼必須加密。
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            // 授權(quán)配置：定義哪些請(qǐng)求需要什么權(quán)限
            .authorizeHttpRequests(authz -> authz
                .requestMatchers("/", "/home", "/public/**").permitAll() // 允許所有人訪問
                .requestMatchers("/admin/**").hasRole("ADMIN") // 只有ADMIN角色可以訪問
                .requestMatchers("/user/**").hasAnyRole("USER", "ADMIN") // USER或ADMIN角色可以訪問
                .anyRequest().authenticated() // 所有其他請(qǐng)求都需要認(rèn)證（登錄）
            )
            // 表單登錄配置
            .formLogin(form -> form
                .loginPage("/login") // 自定義登錄頁面路徑
                .permitAll() // 允許所有人訪問登錄頁面
                .defaultSuccessUrl("/dashboard") // 登錄成功后的默認(rèn)跳轉(zhuǎn)頁面
            )
            // 登出配置
            .logout(logout -> logout
                .permitAll()
                .logoutSuccessUrl("/login?logout") // 登出成功后跳轉(zhuǎn)的頁面
            )
            // 記住我功能
            .rememberMe(remember -> remember
                .key("uniqueAndSecret") // 用于對(duì) token 進(jìn)行哈希的密鑰
                .tokenValiditySeconds(86400) // 記住我有效期為1天
            )
            // 異常處理：權(quán)限不足時(shí)
            .exceptionHandling(handling -> handling
                .accessDeniedPage("/access-denied")
            )
            // 關(guān)鍵：配置自定義的 UserDetailsService
            .userDetailsService(userDetailsService);
        return http.build();
    }
}

@Controller
public class HomeController {
    @GetMapping("/")
    public String home() {
        return "home"; // home.html
    }
    @GetMapping("/admin/dashboard")
    public String adminDashboard() {
        return "admin-dashboard";
    }
    @GetMapping("/user/dashboard")
    public String userDashboard() {
        return "user-dashboard";
    }
    @GetMapping("/login")
    public String login() {
        return "login";
    }
    @GetMapping("/access-denied")
    public String accessDenied() {
        return "access-denied";
    }
}

<form th:action="@{/login}" method="post">
    <input type="text" name="username" placeholder="Username"/>
    <input type="password" name="password" placeholder="Password"/>
    <input type="checkbox" name="remember-me"/> Remember Me
    <button type="submit">Login</button>
</form>

// 在Controller中獲取當(dāng)前用戶
@GetMapping("/profile")
public String profile(Model model) {
    Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
    if (principal instanceof UserDetails) {
        String username = ((UserDetails) principal).getUsername();
        model.addAttribute("username", username);
    }
    return "profile";
}
// 更優(yōu)雅的方式：使用 Principal 對(duì)象直接注入
@GetMapping("/profile2")
public String profile2(Principal principal, Model model) {
    model.addAttribute("username", principal.getName());
    return "profile";
}

<div th:if="${#authorization.expression('isAuthenticated()')}">
    <p>Welcome, <span th:text="${#authentication.name}">User</span>!</p>
    <p>You have roles: <span th:text="${#authentication.authorities}">[]</span></p>
</div>

@PreAuthorize("hasRole('ADMIN') or #userId == authentication.principal.id")
public User getUserById(Long userId) { ... }