// 1. 手動(dòng)查詢用戶
SysUser sysUser = userService.selectUserByUserName(username);
if (sysUser == null) {
    throw new UsernameNotFoundException("用戶不存在");
}
// 3. 查詢權(quán)限
Set<String> permissions = sysPermissionService.getMenuPermission(sysUser);
// 4. 構(gòu)造LoginUser對(duì)象
LoginUser loginUser = new LoginUser(sysUser.getUserId(),sysUser.getDeptId(),sysUser, permissions);
// 4. 構(gòu)造已認(rèn)證的Authentication對(duì)象
authentication = new UsernamePasswordAuthenticationToken(
        loginUser,           // principal - 這里傳遞的是完整的LoginUser對(duì)象
        null,                // credentials
        loginUser.getAuthorities() // authorities
);
// 5. 設(shè)置到Security上下文
SecurityContextHolder.getContext().setAuthentication(authentication);
Long userId = SecurityUtils.getUserId();

@Component
public class JwtTokenProvider {
    @Value("${jwt.secret}")
    private String secret;
    @Value("${jwt.expiration}")
    private Long expiration;
    public String generateToken(LoginUser loginUser) {
        Date now = new Date();
        Date expiryDate = new Date(now.getTime() + expiration);
        return Jwts.builder()
                .setSubject(loginUser.getUsername())
                .claim("userId", loginUser.getUserId())
                .claim("permissions", loginUser.getPermissions())
                .setIssuedAt(new Date())
                .setExpiration(expiryDate)
                .signWith(SignatureAlgorithm.HS512, secret)
                .compact();
    }
    public String validateTokenAndGetUserId(String token) {
        Claims claims = Jwts.parser()
                .setSigningKey(secret)
                .parseClaimsJws(token)
                .getBody();
        return claims.get("userId", String.class);
    }
}

@Component
public class SsoAuthenticationFilter extends OncePerRequestFilter {
    @Autowired
    private JwtTokenProvider tokenProvider;
    @Autowired
    private UserService userService;
    @Override
    protected void doFilterInternal(HttpServletRequest request, 
                                  HttpServletResponse response, 
                                  FilterChain filterChain) throws ServletException, IOException {
        String token = getJwtFromRequest(request);
        if (StringUtils.hasText(token) && tokenProvider.validateToken(token)) {
            try {
                String userId = tokenProvider.validateTokenAndGetUserId(token);
                SysUser sysUser = userService.selectUserById(userId);
                if (sysUser != null) {
                    Set<String> permissions = sysPermissionService.getMenuPermission(sysUser);
                    LoginUser loginUser = new LoginUser(sysUser.getUserId(), 
                                                       sysUser.getDeptId(), 
                                                       sysUser, 
                                                       permissions);
                    UsernamePasswordAuthenticationToken authentication = 
                        new UsernamePasswordAuthenticationToken(
                            loginUser, 
                            null, 
                            loginUser.getAuthorities()
                        );
                    authentication.setDetails(
                        new WebAuthenticationDetailsSource().buildDetails(request)
                    );
                    SecurityContextHolder.getContext().setAuthentication(authentication);
                }
            } catch (Exception ex) {
                logger.error("Could not set user authentication in security context", ex);
            }
        }
        filterChain.doFilter(request, response);
    }
    private String getJwtFromRequest(HttpServletRequest request) {
        String bearerToken = request.getHeader("Authorization");
        if (StringUtils.hasText(bearerToken) && bearerToken.startsWith("Bearer ")) {
            return bearerToken.substring(7);
        }
        return null;
    }
}

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private UserDetailsService userDetailsService;
    @Autowired
    private PersistentTokenRepository persistentTokenRepository;
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
            .antMatchers("/login", "/public/**").permitAll()
            .anyRequest().authenticated()
            .and()
            .formLogin()
            .loginPage("/login")
            .and()
            .rememberMe()
            .rememberMeParameter("remember-me")
            .tokenRepository(persistentTokenRepository)
            .tokenValiditySeconds(86400) // 24小時(shí)
            .userDetailsService(userDetailsService);
    }
}

@Component
public class PersistentTokenRepositoryImpl implements PersistentTokenRepository {
    @Autowired
    private RememberMeTokenMapper rememberMeTokenMapper;
    @Override
    public void createNewToken(PersistentRememberMeToken token) {
        RememberMeToken entity = new RememberMeToken();
        entity.setSeries(token.getSeries());
        entity.setUsername(token.getUsername());
        entity.setToken(token.getTokenValue());
        entity.setLastUsed(token.getDate());
        rememberMeTokenMapper.insert(entity);
    }
    @Override
    public void updateToken(String series, String tokenValue, Date lastUsed) {
        RememberMeToken entity = new RememberMeToken();
        entity.setSeries(series);
        entity.setToken(tokenValue);
        entity.setLastUsed(lastUsed);
        rememberMeTokenMapper.updateByPrimaryKey(entity);
    }
    @Override
    public PersistentRememberMeToken getTokenForSeries(String seriesId) {
        RememberMeToken entity = rememberMeTokenMapper.selectByPrimaryKey(seriesId);
        if (entity != null) {
            return new PersistentRememberMeToken(
                entity.getUsername(),
                entity.getSeries(),
                entity.getToken(),
                entity.getLastUsed()
            );
        }
        return null;
    }
    @Override
    public void removeUserTokens(String username) {
        rememberMeTokenMapper.deleteByUsername(username);
    }
}

@Service
public class SysLoginService {
    @Autowired
    private AuthenticationManager authenticationManager;
    @Autowired
    private JwtTokenProvider tokenProvider;
    @Autowired
    private UserService userService;
    @Autowired
    private SysPermissionService sysPermissionService;
    /**
     * 用戶登錄
     */
    public String login(String username, String password, String code, String uuid) {
        // 1. 驗(yàn)證碼校驗(yàn)
        validateCaptcha(code, uuid);
        // 2. 用戶認(rèn)證
        Authentication authentication = authenticationManager.authenticate(
            new UsernamePasswordAuthenticationToken(username, password)
        );
        // 3. 認(rèn)證成功后生成JWT Token
        SecurityContextHolder.getContext().setAuthentication(authentication);
        LoginUser loginUser = (LoginUser) authentication.getPrincipal();
        return tokenProvider.generateToken(loginUser);
    }
    /**
     * 自動(dòng)登錄處理
     */
    public String autoLogin(String token) {
        if (StringUtils.hasText(token) && tokenProvider.validateToken(token)) {
            String userId = tokenProvider.validateTokenAndGetUserId(token);
            SysUser sysUser = userService.selectUserById(userId);
            if (sysUser != null) {
                Set<String> permissions = sysPermissionService.getMenuPermission(sysUser);
                LoginUser loginUser = new LoginUser(sysUser.getUserId(), 
                                                   sysUser.getDeptId(), 
                                                   sysUser, 
                                                   permissions);
                UsernamePasswordAuthenticationToken authentication = 
                    new UsernamePasswordAuthenticationToken(
                        loginUser, 
                        null, 
                        loginUser.getAuthorities()
                    );
                SecurityContextHolder.getContext().setAuthentication(authentication);
                // 生成新的token
                return tokenProvider.generateToken(loginUser);
            }
        }
        throw new AuthenticationException("自動(dòng)登錄失敗");
    }
    private void validateCaptcha(String code, String uuid) {
        // 驗(yàn)證碼校驗(yàn)邏輯
        String verifyKey = Constants.CAPTCHA_CODE_KEY + uuid;
        String captcha = redisCache.getCacheObject(verifyKey);
        redisCache.deleteObject(verifyKey);
        if (captcha == null || !code.equalsIgnoreCase(captcha)) {
            throw new CaptchaException("驗(yàn)證碼錯(cuò)誤");
        }
    }
}

public class SecurityUtils {
    /**
     * 獲取用戶ID
     */
    public static Long getUserId() {
        try {
            return getLoginUser().getUserId();
        } catch (Exception e) {
            throw new CustomException("獲取用戶ID異常", HttpStatus.UNAUTHORIZED);
        }
    }
    /**
     * 獲取登錄用戶信息
     */
    public static LoginUser getLoginUser() {
        try {
            return (LoginUser) getAuthentication().getPrincipal();
        } catch (Exception e) {
            throw new CustomException("獲取用戶信息異常", HttpStatus.UNAUTHORIZED);
        }
    }
    /**
     * 獲取Authentication
     */
    public static Authentication getAuthentication() {
        return SecurityContextHolder.getContext().getAuthentication();
    }
}

@Component
public class LoginLogAspect {
    @Around("execution(* com.example.service.SysLoginService.login(..))")
    public Object logLogin(ProceedingJoinPoint joinPoint) throws Throwable {
        long startTime = System.currentTimeMillis();
        Object result = null;
        try {
            result = joinPoint.proceed();
            // 記錄成功日志
            logLoginSuccess(joinPoint.getArgs());
            return result;
        } catch (Exception e) {
            // 記錄失敗日志
            logLoginFailure(joinPoint.getArgs(), e);
            throw e;
        } finally {
            long endTime = System.currentTimeMillis();
            logger.info("登錄耗時(shí): {}ms", endTime - startTime);
        }
    }
}