@Configuration
@EnableMethodSecurity // 關(guān)鍵！替代過(guò)時(shí)的 @EnableGlobalMethodSecurity
public class SecurityConfig {
    // 配置其他安全規(guī)則...
}

// 過(guò)時(shí)且可能不生效
//@EnableGlobalMethodSecurity(prePostEnabled = true)
@Configuration
public class OldSecurityConfig {
    // 沒有啟用新注解支持，@PreAuthorize 可能被忽略
}

@RestController
public class UserController {
    @PreAuthorize("hasRole('ADMIN')")
    public String deleteUser(Long id) {
        return "User " + id + " deleted.";
    }
    // 普通接口，未做權(quán)限控制
    @GetMapping("/unsafe-delete")
    public String unsafeDelete() {
        // ?? 直接內(nèi)部調(diào)用！繞過(guò)AOP代理，@PreAuthorize 不會(huì)觸發(fā)！
        return deleteUser(1L);
    }
}

@RestController
public class UserController {
    @Autowired
    private UserController self; // 自注入，獲取代理對(duì)象
    @PreAuthorize("hasRole('ADMIN')")
    public String deleteUser(Long id) {
        return "User " + id + " deleted.";
    }
    @GetMapping("/safe-delete")
    public String safeDelete() {
        // ? 通過(guò)代理調(diào)用，觸發(fā)AOP攔截
        return self.deleteUser(1L);
    }
}

@GetMapping("/data")
@PostFilter("filterObject.owner == authentication.name")
public List<Data> getData() {
    List<Data> data = dataService.findAll();
    try {
        processSensitiveData(data); // 可能拋出 AccessDeniedException
    } catch (Exception e) {
        log.warn("處理失敗，忽略"); // ?? 吞掉了安全異常！
    }
    return data; // 即使權(quán)限不通過(guò)，依然返回?cái)?shù)據(jù)
}

@GetMapping("/data")
@PostFilter("filterObject.owner == authentication.name")
public ResponseEntity<List<Data>> getData() {
    try {
        List<Data> data = dataService.findAll();
        return ResponseEntity.ok(data);
    } catch (AccessDeniedException e) {
        log.warn("用戶 {} 訪問越權(quán)", SecurityContextHolder.getContext().getAuthentication().getName());
        return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
    } catch (AuthenticationCredentialsNotFoundException e) {
        return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
    }
}

@ControllerAdvice
public class SecurityExceptionHandler {
    @ExceptionHandler(AccessDeniedException.class)
    public ResponseEntity<String> handleAccessDenied() {
        return ResponseEntity.status(HttpStatus.FORBIDDEN).body("權(quán)限不足");
    }
}

// ? 錯(cuò)誤1：user 寫成了 usre
@PreAuthorize("hasRole('MODERATOR') or #usre.name == authentication.name")
public void updateData(@RequestBody Data data, @AuthenticationPrincipal UserDetails user) {
    // ...
}
// ? 錯(cuò)誤2：filterObject 是集合元素，不是整個(gè)列表
@PostFilter("filterObject.owner == authentication.name")
public List<Project> getAllProjects(List<Project> projects) {
    // 注意：projects 是參數(shù)，但 filterObject 指的是每個(gè) Project 元素
    // 如果這里傳 null 或空 list，不會(huì)報(bào)錯(cuò)，但也不會(huì)過(guò)濾
    return projects;
}

@PreAuthorize("hasRole('MODERATOR') or #user.username == authentication.name")
public void updateData(@RequestBody Data data, @AuthenticationPrincipal UserDetails user) {
    // ...
}
@Test
@WithMockUser(username = "alice", roles = {"USER"})
void shouldDenyWhenNotOwner() throws Exception {
    UserDetails user = new User("bob", "", List.of());
    assertThatThrownBy(() -> service.updateData(new Data(), user))
        .isInstanceOf(AccessDeniedException.class);
}