// 手写滤镜式鉴权：每个接口自己判
if (session.getAttribute("user") == null) {
    response.sendRedirect("/login");
    return;
}
if (!user.hasRole("ADMIN")) {
    response.sendError(403);
    return;
}

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/login", "/public/**").permitAll()
                .requestMatchers("/admin/**").hasRole("ADMIN")   // 注意：hasRole 会自动补 ROLE_ 前缀
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login")
                .defaultSuccessUrl("/home")
            )
            .csrf(csrf -> csrf.disable()); // 纯无状态 API 可关；带 Session 的表单站点不建议关
        return http.build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();   // 自适应成本因子，推荐
    }
}

@RestController
@RequestMapping("/api/auth")
public class AuthController {

    private final AuthenticationManager authenticationManager;
    private final JwtService jwtService;

    @PostMapping("/login")
    public Map<String, String> login(@RequestBody LoginReq req) {
        // ① 构造未认证凭证并交给 AuthenticationManager
        Authentication auth = authenticationManager.authenticate(
            new UsernamePasswordAuthenticationToken(req.username(), req.password())
        );
        // ② 认证成功 → 生成 JWT 返回（框架已把认证结果写入上下文，但无状态 API 不必依赖 Session）
        String token = jwtService.generate(auth.getName(), auth.getAuthorities());
        return Map.of("token", token);
    }
}

// BCrypt：$2a$10$... 前缀自带盐与成本因子，相同明文每次结果都不同
String hash = passwordEncoder.encode("123456");
boolean ok  = passwordEncoder.matches("123456", hash); // true

// 基于请求路径的规则（配置期）
http.authorizeHttpRequests(auth -> auth
    .requestMatchers("/admin/**").hasAuthority("ROLE_ADMIN") // 等价 hasRole("ADMIN")
    .requestMatchers("/api/user/**").hasAnyAuthority("ROLE_USER", "ROLE_ADMIN")
    .anyRequest().authenticated()
);

@Configuration
@EnableMethodSecurity   // 6.x 推荐；旧版用 @EnableGlobalMethodSecurity(prePostEnabled = true)
public class MethodSecurityConfig {}

@Service
public class OrderService {

    // 只有 ADMIN 能调用
    @PreAuthorize("hasRole('ADMIN')")
    public void deleteAll() { /* ... */ }

    // 只能操作属于自己的订单（SpEL 访问方法参数）
    @PreAuthorize("#order.owner == authentication.name")
    public void cancel(Order order) { /* ... */ }

    // 调用后才校验返回值
    @PostAuthorize("returnObject.owner == authentication.name")
    public Order get(Long id) { /* ... */ }
}

@Component
public class JwtService {
    private final String secret = "至少32字节的强随机密钥-base64-...";
    private final long EXPIRE = 3600_000L; // 1 小时

    public String generate(String username, Collection<? extends GrantedAuthority> authorities) {
        return Jwts.builder()
            .setSubject(username)
            .claim("authorities", authorities.stream().map(GrantedAuthority::getAuthority).toList())
            .setIssuedAt(new Date())
            .setExpiration(new Date(System.currentTimeMillis() + EXPIRE))
            .signWith(SignatureAlgorithm.HS256, secret)  // 对称签名
            .compact();
    }

    public Claims parse(String token) {
        return Jwts.parser().setSigningKey(secret).parseClaimsJws(token).getBody();
    }
}

public class JwtAuthFilter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest req, HttpServletResponse res, FilterChain chain)
            throws ServletException, IOException {
        String token = resolveToken(req);
        if (token != null && jwtService.validate(token)) {
            Claims c = jwtService.parse(token);
            Authentication auth = new UsernamePasswordAuthenticationToken(
                c.getSubject(), null,
                ((List<?>) c.get("authorities")).stream()
                    .map(a -> new SimpleGrantedAuthority(a.toString())).toList());
            SecurityContextHolder.getContext().setAuthentication(auth);
        }
        chain.doFilter(req, res);
    }
}

@Bean
public SecurityFilterChain resourceServer(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
        .oauth2ResourceServer(oauth -> oauth
            .jwt(jwt -> jwt.decoder(jwtDecoder()))   // 用授权服务器的 JWK 验签
        );
    return http.build();
}

@Bean
public JwtDecoder jwtDecoder() {
    // 从授权服务器的 /.well-known/jwks.json 拉取公钥验签，无需共享密钥
    return NimbusJwtDecoder.withIssuerLocation("https://auth.example.com").build();
}