// FilterSecurityInterceptor 關(guān)鍵部分
public class FilterSecurityInterceptor extends AbstractSecurityInterceptor {
    
    private final FilterInvocationSecurityMetadataSource securityMetadataSource;
    
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) 
            throws IOException, ServletException {
        // 封裝HTTP請(qǐng)求
        FilterInvocation fi = new FilterInvocation(request, response, chain);
        
        // 進(jìn)行安全攔截
        invoke(fi);
    }
    
    public void invoke(FilterInvocation fi) throws IOException, ServletException {
        // 檢查安全攔截器是否應(yīng)該被應(yīng)用
        if ((fi.getRequest() != null) && (fi.getRequest().getAttribute(FILTER_APPLIED) != null)) {
            // 安全攔截器已應(yīng)用，繼續(xù)執(zhí)行過(guò)濾器鏈
            fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
            return;
        }
        
        // 標(biāo)記攔截器已應(yīng)用
        fi.getRequest().setAttribute(FILTER_APPLIED, Boolean.TRUE);
        
        // 執(zhí)行安全攔截
        InterceptorStatusToken token = super.beforeInvocation(fi);
        
        try {
            // 繼續(xù)執(zhí)行過(guò)濾器鏈
            fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
        } finally {
            // 清理安全上下文
            super.finallyInvocation(token);
        }
        
        // 執(zhí)行后處理
        super.afterInvocation(token, null);
    }
    
    @Override
    public Class<?> getSecureObjectClass() {
        return FilterInvocation.class;
    }
    
    @Override
    public SecurityMetadataSource obtainSecurityMetadataSource() {
        return this.securityMetadataSource;
    }
}

// AccessDecisionManager接口定義
public interface AccessDecisionManager {
    /**
     * 對(duì)給定的安全對(duì)象做出訪問(wèn)控制決策
     * @param authentication 當(dāng)前用戶的認(rèn)證信息
     * @param object 要訪問(wèn)的安全對(duì)象
     * @param configAttributes 安全對(duì)象的安全配置屬性
     * @throws AccessDeniedException 如果拒絕訪問(wèn)
     * @throws InsufficientAuthenticationException 如果認(rèn)證不足
     */
    void decide(Authentication authentication, Object object, 
            Collection<ConfigAttribute> configAttributes) 
            throws AccessDeniedException, InsufficientAuthenticationException;
    
    /**
     * 檢查此AccessDecisionManager是否支持指定的ConfigAttribute
     * @param attribute 要檢查的配置屬性
     * @return 如果支持該屬性返回true
     */
    boolean supports(ConfigAttribute attribute);
    
    /**
     * 檢查此AccessDecisionManager是否支持指定的安全對(duì)象類(lèi)型
     * @param clazz 安全對(duì)象的類(lèi)型
     * @return 如果支持該類(lèi)型返回true
     */
    boolean supports(Class<?> clazz);
}

// AffirmativeBased實(shí)現(xiàn)關(guān)鍵代碼
public class AffirmativeBased extends AbstractAccessDecisionManager {
    
    public AffirmativeBased(List<AccessDecisionVoter<?>> decisionVoters) {
        super(decisionVoters);
    }
    
    @Override
    public void decide(Authentication authentication, Object object, 
            Collection<ConfigAttribute> attributes) 
            throws AccessDeniedException {
        int deny = 0;
        
        // 遍歷所有投票者
        for (AccessDecisionVoter voter : getDecisionVoters()) {
            // 獲取投票結(jié)果
            int result = voter.vote(authentication, object, attributes);
            
            switch (result) {
            case AccessDecisionVoter.ACCESS_GRANTED: // 投票通過(guò)
                return; // 立即返回允許訪問(wèn)
            case AccessDecisionVoter.ACCESS_DENIED: // 投票拒絕
                deny++; // 計(jì)數(shù)拒絕票
                break;
            default: // 棄權(quán)
                break;
            }
        }
        
        // 如果有拒絕票且沒(méi)有通過(guò)票，則拒絕訪問(wèn)
        if (deny > 0) {
            throw new AccessDeniedException("訪問(wèn)被拒絕，安全投票失敗");
        }
        
        // 所有投票者棄權(quán)，根據(jù)配置決定（默認(rèn)允許）
        if (getAllowIfAllAbstainDecisions()) {
            return;
        }
        
        // 默認(rèn)拒絕訪問(wèn)
        throw new AccessDeniedException("訪問(wèn)被拒絕，沒(méi)有投票者同意");
    }
}

// AccessDecisionVoter接口
public interface AccessDecisionVoter<S> {
    /**
     * 贊成訪問(wèn)的常量
     */
    int ACCESS_GRANTED = 1;
    
    /**
     * 拒絕訪問(wèn)的常量
     */
    int ACCESS_DENIED = -1;
    
    /**
     * 棄權(quán)的常量
     */
    int ACCESS_ABSTAIN = 0;
    
    /**
     * 對(duì)訪問(wèn)請(qǐng)求進(jìn)行投票
     * @param authentication 當(dāng)前用戶的認(rèn)證信息
     * @param object 要訪問(wèn)的安全對(duì)象
     * @param attributes 安全對(duì)象的配置屬性
     * @return 投票結(jié)果：ACCESS_GRANTED、ACCESS_DENIED或ACCESS_ABSTAIN
     */
    int vote(Authentication authentication, S object, Collection<ConfigAttribute> attributes);
    
    /**
     * 檢查此投票者是否支持指定的配置屬性
     * @param attribute 要檢查的配置屬性
     * @return 如果支持該屬性返回true
     */
    boolean supports(ConfigAttribute attribute);
    
    /**
     * 檢查此投票者是否支持指定的安全對(duì)象類(lèi)型
     * @param clazz 安全對(duì)象的類(lèi)型
     * @return 如果支持該類(lèi)型返回true
     */
    boolean supports(Class<?> clazz);
}

// RoleVoter實(shí)現(xiàn)
public class RoleVoter implements AccessDecisionVoter<Object> {
    
    private String rolePrefix = "ROLE_";
    
    public int vote(Authentication authentication, Object object, 
            Collection<ConfigAttribute> attributes) {
        // 如果沒(méi)有屬性，棄權(quán)
        if (attributes.isEmpty()) {
            return ACCESS_ABSTAIN;
        }
        
        // 獲取用戶權(quán)限
        Collection<? extends GrantedAuthority> authorities = 
                authentication.getAuthorities();
        
        // 檢查每個(gè)配置屬性
        for (ConfigAttribute attribute : attributes) {
            if (this.supports(attribute)) {
                // 屬性值作為需要的角色
                String role = attribute.getAttribute();
                
                // 檢查用戶是否擁有該角色
                for (GrantedAuthority authority : authorities) {
                    if (role.equals(authority.getAuthority())) {
                        return ACCESS_GRANTED; // 用戶有所需角色，允許訪問(wèn)
                    }
                }
                
                // 走到這里說(shuō)明用戶沒(méi)有所需角色，返回拒絕
                return ACCESS_DENIED;
            }
        }
        
        // 沒(méi)有可支持的屬性，棄權(quán)
        return ACCESS_ABSTAIN;
    }
    
    @Override
    public boolean supports(ConfigAttribute attribute) {
        // 檢查屬性是否以角色前綴開(kāi)頭
        return (attribute.getAttribute() != null) && 
                attribute.getAttribute().startsWith(rolePrefix);
    }
    
    @Override
    public boolean supports(Class<?> clazz) {
        return true; // 支持所有類(lèi)型的安全對(duì)象
    }
}

// 自定義的工作時(shí)間投票者，只允許在工作時(shí)間訪問(wèn)
public class BusinessHoursVoter implements AccessDecisionVoter<Object> {
    
    private final int startHour = 9;  // 工作開(kāi)始時(shí)間
    private final int endHour = 17;   // 工作結(jié)束時(shí)間
    
    @Override
    public int vote(Authentication authentication, Object object, 
            Collection<ConfigAttribute> attributes) {
        // 檢查是否有工作時(shí)間限制的屬性
        boolean businessHoursRequired = attributes.stream()
                .anyMatch(a -> "BUSINESS_HOURS_ONLY".equals(a.getAttribute()));
        
        // 如果沒(méi)有時(shí)間限制，棄權(quán)
        if (!businessHoursRequired) {
            return ACCESS_ABSTAIN;
        }
        
        // 獲取當(dāng)前時(shí)間
        LocalTime now = LocalTime.now();
        int currentHour = now.getHour();
        
        // 檢查是否在工作時(shí)間內(nèi)
        if (currentHour >= startHour && currentHour < endHour) {
            return ACCESS_GRANTED;
        } else {
            return ACCESS_DENIED;
        }
    }
    
    @Override
    public boolean supports(ConfigAttribute attribute) {
        return attribute != null && "BUSINESS_HOURS_ONLY".equals(attribute.getAttribute());
    }
    
    @Override
    public boolean supports(Class<?> clazz) {
        return true;
    }
}

// 自定義配置
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/public/**").permitAll()
                .antMatchers("/admin/**").access("hasRole('ADMIN') and hasAuthority('BUSINESS_HOURS_ONLY')")
                .anyRequest().authenticated()
            .and()
                .formLogin()
                .loginPage("/login").permitAll();
        
        // 替換默認(rèn)的AccessDecisionManager
        http.authorizeRequests()
                .accessDecisionManager(accessDecisionManager());
    }
    
    @Bean
    public AccessDecisionManager accessDecisionManager() {
        List<AccessDecisionVoter<?>> voters = new ArrayList<>();
        voters.add(new WebExpressionVoter());
        voters.add(new RoleVoter());
        voters.add(new AuthenticatedVoter());
        voters.add(new BusinessHoursVoter());  // 添加自定義投票者
        
        // 使用"一票通過(guò)"策略
        return new AffirmativeBased(voters);
    }
}

// 啟用方法級(jí)安全
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
    
    @Override
    protected AccessDecisionManager accessDecisionManager() {
        // 自定義方法級(jí)安全的AccessDecisionManager
        AffirmativeBased accessDecisionManager = (AffirmativeBased) super.accessDecisionManager();
        
        // 獲取現(xiàn)有的投票者并添加自定義投票者
        List<AccessDecisionVoter<?>> voters = new ArrayList<>(
                accessDecisionManager.getDecisionVoters());
        voters.add(new BusinessHoursVoter());
        
        // 創(chuàng)建新的AccessDecisionManager
        return new AffirmativeBased(voters);
    }
}

// 在服務(wù)類(lèi)中使用方法級(jí)安全
@Service
public class UserService {
    
    @PreAuthorize("hasRole('ADMIN') and hasAuthority('BUSINESS_HOURS_ONLY')")
    public void deleteUser(Long userId) {
        // 刪除用戶的邏輯
    }
    
    @PreAuthorize("hasRole('USER') or hasRole('ADMIN')")
    public UserDetails viewUserProfile(Long userId) {
        // 查看用戶資料的邏輯
        return userProfile;
    }
    
    @PostAuthorize("returnObject.username == authentication.name or hasRole('ADMIN')")
    public UserDetails loadUserById(Long userId) {
        // 只允許查看自己的詳細(xì)信息或者管理員查看
        return userDetails;
    }
}