//统一响应结果
@Data
@AllArgsConstructor
@NoArgsConstructor
public class Result<T> implements Serializable {
    @Serial
    private static final long serialVersionUID = 1L;

    private Integer code;//业务状态码  0-成功  1-失败
    private String message;//提示信息
    private T data;//响应数据

    //快速返回操作成功响应结果(带响应数据)
    public static <E> Result<E> success(E data) {
        return new Result<>(0, "操作成功", data);
    }

    //快速返回操作成功响应结果
    public static Result success() {
        return new Result(0, "操作成功", null);
    }

    public static Result error(String message) {
        return new Result(1, message, null);
    }
}

@RestController
public class TestController {
    @GetMapping("/testA")
    public Result testA(){
        return Result.success();
    }

    @GetMapping("/testB")
    public Result testB(){
        if (true){
            throw new RuntimeException("testB");
        }
        return Result.error("testB");
    }
}

@RestControllerAdvice
public class GlobalExceptionHandler {
    @ExceptionHandler(Exception.class)
    public Result handleException(Exception e){
        e.printStackTrace();
        return Result.error(StringUtils.hasLength(e.getMessage())?e.getMessage():"操作失败！");
    }
}

@Data
@AllArgsConstructor
@NoArgsConstructor
public class UsernameAuthentication {
    private String username;
    private String password;
}

@Data
@AllArgsConstructor
@NoArgsConstructor
public class SmsAuthentication {
    private String phone;
    private String code;
}

// 用户名登录
@PostMapping("/user/login/username")
public Result loginByUsername(@RequestBody UsernameAuthentication usernameAuthentication){
    // 1. 获取请求参数
    String username = usernameAuthentication.getUsername();
    String password = usernameAuthentication.getPassword();
    // 2. 验证用户名密码
    System.out.println("username"+ username + " password" + password);
    // 3. 认证通过，返回jwt token
    HashMap<Object, Object> responseData = new HashMap<>();
    responseData.put("token", "jwtToken...");
    responseData.put("refreshToken", "refreshToken...");
    return Result.success(responseData);
}
// 短信登录
@PostMapping("/user/login/sms")
public Result loginBySms(@RequestBody SmsAuthentication smsAuthentication){
    // 1. 获取请求参数
    String phone = smsAuthentication.getPhone();
    String code = smsAuthentication.getCode();
    // 2. 验证短信验证码
    System.out.println("phone:" + phone + " code:" + code);
    // 3. 认证通过，返回jwt token
    HashMap<Object, Object> responseData = new HashMap<>();
    responseData.put("token", "jwtToken...");
    responseData.put("refreshToken", "refreshToken...");
    return Result.success(responseData);
}

public class LoggingFilter implements Filter {

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        // 初始化Filter，如果需要的话
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        System.out.println("Incoming request data log: " + httpRequest.getMethod() + " " + httpRequest.getRequestURI());
        
        // 继续过滤器链
        chain.doFilter(request, response);
        
        // 可以在这里对响应进行后处理
    }

    @Override
    public void destroy() {
        // 清理资源，如果需要的话
    }
}

import org.springframework.stereotype.Component;

@Component
public class LoggingFilter implements Filter {
    // 实现方法同上
}

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.boot.web.servlet.FilterRegistrationBean;

@Configuration
public class FilterConfig {

    @Bean
    public FilterRegistrationBean<LoggingFilter> loggingFilter(){
        FilterRegistrationBean<LoggingFilter> registrationBean 
          = new FilterRegistrationBean<>();
        
        registrationBean.setFilter(new LoggingFilter());
        registrationBean.addUrlPatterns("/*"); // 拦截所有请求
        registrationBean.setOrder(1); // 设置Filter顺序
        
        return registrationBean;    
    }
}

public class AuthFilter implements Filter {

    private static final String AUTH_TOKEN = "SecretToken";

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        // 初始化逻辑
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        String token = httpRequest.getHeader("Authorization");

        if (AUTH_TOKEN.equals(token)) {
            // 认证通过，继续请求
            chain.doFilter(request, response);
        } else {
            // 认证失败，返回401
            HttpServletResponse httpResponse = (HttpServletResponse) response;
            httpResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized");
        }
    }

    @Override
    public void destroy() {
        // 清理资源
    }
}

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.boot.web.servlet.FilterRegistrationBean;

@Configuration
public class FilterConfig {

    @Bean
    public FilterRegistrationBean<AuthFilter> authFilter(){
        FilterRegistrationBean<AuthFilter> registrationBean 
          = new FilterRegistrationBean<>();
        
        registrationBean.setFilter(new AuthFilter());
        registrationBean.addUrlPatterns("/secure/*"); // 只拦截/secure/下的请求
        registrationBean.setOrder(2); // 设置Filter顺序
        
        return registrationBean;    
    }
}

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(authorize -> authorize
                .anyRequest().authenticated()
        );
    return http.build();
}

// 禁用SpringSecurity默认filter。这些filter都是非前后端分离项目的产物，用不上.
// yml配置文件将日志设置DEBUG模式，就能看到加载了哪些filter
// logging:
//    level:
//       org.springframework.security: DEBUG
// 表单登录/登出、session管理、csrf防护等默认配置，如果不disable。会默认创建默认filter
http.formLogin(AbstractHttpConfigurer::disable)
    .httpBasic(AbstractHttpConfigurer::disable)
    .logout(AbstractHttpConfigurer::disable)
    .sessionManagement(AbstractHttpConfigurer::disable)
    .csrf(AbstractHttpConfigurer::disable)
    // requestCache用于重定向，前后端分析项目无需重定向，requestCache也用不上
    .requestCache(cache -> cache
        .requestCache(new NullRequestCache())
    )
    // 无需给用户一个匿名身份
    .anonymous(AbstractHttpConfigurer::disable);

@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
        throws IOException, ServletException {
    HttpServletRequest httpRequest = (HttpServletRequest) request;
    System.out.println("Incoming request data log: " + httpRequest.getMethod() + " " + httpRequest.getRequestURI());
    
    SecurityContext context = SecurityContextHolder.createEmptyContext();
    Authentication authentication =
            new TestingAuthenticationToken("username", "password", "ROLE_USER");
    context.setAuthentication(authentication);

    SecurityContextHolder.setContext(context);
    // 继续过滤器链
    chain.doFilter(request, response);

    // 可以在这里对响应进行后处理
}

// 自定义访问拒绝处理器
@Component
public class CustomAccessDeniedHandler implements AccessDeniedHandler {

    private final ObjectMapper objectMapper;

    public CustomAccessDeniedHandler(ObjectMapper objectMapper){
        this.objectMapper = objectMapper;
    }

    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response,
                       AccessDeniedException accessDeniedException) throws IOException, ServletException {
        Result<Void> result = Result.error("权限不足，拒绝访问！");
        response.setContentType("application/json;charset=UTF-8");
        response.setStatus(HttpServletResponse.SC_FORBIDDEN);
        response.getWriter().write(objectMapper.writeValueAsString(result));
    }
}

@Component
public class CustomAuthenticationExceptionHandler implements AuthenticationEntryPoint {

    private final ObjectMapper objectMapper;

    public CustomAuthenticationExceptionHandler(ObjectMapper objectMapper){
        this.objectMapper = objectMapper;
    }

    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, org.springframework.security.core.AuthenticationException authException) throws IOException, ServletException {
        Result<Void> result = Result.error("未认证，请登录！");
        response.setContentType("application/json;charset=UTF-8");
        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
        response.getWriter().write(objectMapper.writeValueAsString(result));
    }
}

@RestControllerAdvice
public class GlobalExceptionHandler {
    @ExceptionHandler(Exception.class)
    public Result handleException(Exception e){
        e.printStackTrace();
        return Result.error(StringUtils.hasLength(e.getMessage())?e.getMessage():"操作失败！");
    }
    // 处理认证异常
    @ExceptionHandler(AuthenticationException.class)
    public Result<Void> handleAuthenticationException(AuthenticationException e){
        e.printStackTrace();
        return Result.error(StringUtils.hasLength(e.getMessage()) ? e.getMessage() : "认证失败！");
    }

    // 处理授权异常
    @ExceptionHandler(AccessDeniedException.class)
    public Result<Void> handleAccessDeniedException(AccessDeniedException e){
        e.printStackTrace();
        return Result.error(StringUtils.hasLength(e.getMessage()) ? e.getMessage() : "权限不足！");
    }
}

@Service
public class UserService {

    @Autowired
    private PasswordEncoder passwordEncoder;

    /**
     * 通过openId获取用户信息
     * @param openId
     * @param thirdPlatform 三方平台，比如gitee/qq/wechat
     * @return
     */
    public User getUserByOpenId(String openId, String thirdPlatform) {
        System.out.println("通过openId从数据库查询user"); // todo
        if (thirdPlatform.equals("gitee")) {
            User testUser = new User();
            testUser.setUserId(1003L);
            testUser.setUsername("Tom");
            testUser.setRoleId("manager");
            testUser.setPassword(passwordEncoder.encode("manager"));
            testUser.setPhone("123000123");
            return testUser;
        }
        return null;
    }

    public User getUserByPhone(String phoneNumber) {
        if (phoneNumber.equals("1234567890")) {
            User testUser = new User();
            testUser.setUserId(1002L);
            testUser.setUsername("manager");
            testUser.setRoleId("manager");
            testUser.setPassword(passwordEncoder.encode("manager"));
            testUser.setPhone("1234567890");
            return testUser;
        }
        return null;
    }

    public User getUserFromDB(String username) {
        if (username.equals("admin")) {
            User testUser = new User();
            testUser.setUserId(1001L);
            testUser.setUsername("admin");
            testUser.setRoleId("admin");
            testUser.setPassword(passwordEncoder.encode("admin"));
            return testUser;
        }
        return null;
    }

    public void createUserWithOpenId(User user, String openId, String platform) {
        System.out.println("在数据库创建一个user"); // todo
        System.out.println("user绑定openId"); // todo
    }
}

@Service
public class JwtService implements InitializingBean {

    private static final Logger logger = LoggerFactory.getLogger(JwtService.class);

    private PrivateKey privateKey;

    private JwtParser jwtParser;

    public String createJwt(Object jwtPayload, long expiredAt) {
        //添加构成JWT的参数
        Map<String, Object> headMap = new HashMap();
        headMap.put("alg", SignatureAlgorithm.RS256.getValue());//使用RS256签名算法
        headMap.put("typ", "JWT");
        Map body = JSON.parse(JSON.stringify(jwtPayload), HashMap.class);
        String jwt = Jwts.builder()
                .setHeader(headMap)
                .setClaims(body)
                .setExpiration(new Date(expiredAt))
                .signWith(privateKey)
                .compact();
        return jwt;
    }

    @Value("${login.jwt.private-key:MI}")
    private String privateKeyBase64;
    //获取私钥，用于生成Jwt
    private PrivateKey getPrivateKey() {
        try {
            // 利用JDK自带的工具生成私钥
            KeyFactory kf = KeyFactory.getInstance("RSA");
            PKCS8EncodedKeySpec ks = new PKCS8EncodedKeySpec(Decoders.BASE64.decode(privateKeyBase64));
            return kf.generatePrivate(ks);
        } catch (Exception e) {
            logger.error(e.getMessage(), e);
//            ExceptionTool.throwException("获取Jwt私钥失败");
            throw new BaseException("获取Jwt私钥失败");
//            return null;
        }
    }

    @Value("${login.jwt.public-Key:MI}")
    private String publicKeyBase64;
    // 公钥，用于解析Jwt
    private JwtParser getJwtParser() {
        try {
            X509EncodedKeySpec keySpec = new X509EncodedKeySpec(Decoders.BASE64.decode(publicKeyBase64));
            KeyFactory keyFactory = KeyFactory.getInstance("RSA");
            PublicKey pk = keyFactory.generatePublic(keySpec);
            return Jwts.parserBuilder().setSigningKey(pk).build();
        } catch (Exception e) {
            // 获取公钥失败
//            ExceptionTool.throwException("获取Jwt公钥失败");
//            return null;
            throw new BaseException("获取Jwt公钥失败");
        }
    }

    @Override
    public void afterPropertiesSet() throws Exception {
        privateKey = getPrivateKey();
        jwtParser = getJwtParser();
    }

    public <T> T verifyJwt(String jwt, Class<T> jwtPayloadClass) {
        if (jwt == null || jwt.equals("")) {
            return null;
        }
        Jws<Claims> jws = this.jwtParser.parseClaimsJws(jwt); // 会校验签名，校验过期时间
        Claims jwtPayload = jws.getBody();
        if (jwtPayload == null) {
            return null;
        }
        return JSON.convert(jwtPayload, jwtPayloadClass);
    }

    public static <T> T getPayload(String jwt, Class<T> jwtPayloadClass) {
        if (jwt == null || jwt.equals("")) {
            return null;
        }

        try {
            // jwt字符串由3部分组成，用英文的点分割：herder.payload.sign
            // 可以直接取中间一段，进行Base64解码
            byte[] decodedBytes = Base64.getDecoder().decode(jwt.split("\\.")[1]);
            return JSON.parse(new String(decodedBytes), jwtPayloadClass);
        } catch (Exception e) {
            return null;
        }
    }
}

public class JSON {

  private static final ObjectMapper objectMapper = new ObjectMapper();

  static {
    // 反序列时，遇到未知的字段，不报错。比如Json中有key1字段，Java的object中没有key1字段，如果不设置成false，反序列时会报错
    objectMapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
    // 数字类型统一转成String， 因为前端Js不支持long类型的数据，前端读取到long类型数据会丢失后三位数
    objectMapper.configure(JsonWriteFeature.WRITE_NUMBERS_AS_STRINGS.mappedFeature(), true);
  }

  public static <T> T convert(Object obj, Class<T> returnType) {
    if (obj == null) {
      return null;
    }
    return parse(stringify(obj), returnType);
  }

  /**
   * Object to json
   *
   * @param obj
   * @return
   */
  public static String stringify(Object obj) {
    try {
      if (obj == null) {
        return null;
      } else if (obj instanceof String) {
        return obj.toString();
      }
      return objectMapper.writeValueAsString(obj);
    } catch (Exception e) {
      throw new IllegalArgumentException("对象转化成json字符串出错", e);
    }
  }

  /**
   * json to Object
   *
   * @param json
   * @param targetType
   * @param <T>
   * @return
   */
  public static <T> T parse(String json, Type targetType) {
    try {
      return objectMapper.readValue(json, TypeFactory.defaultInstance().constructType(targetType));
    } catch (IOException e) {
      throw new IllegalArgumentException("将JSON转换为对象时发生错误:" + json, e);
    }
  }

  public static <T> T parse(String json, Class<T> targetType) {
    try {
      return objectMapper.readValue(json, TypeFactory.defaultInstance().constructType(targetType));
    } catch (IOException e) {
      throw new IllegalArgumentException("将JSON转换为对象时发生错误:" + json, e);
    }
  }

  /**
   * json to Object
   */
  public static <T> T parse(String json, TypeReference<T> typeReference) {
    if (json != null && !json.isEmpty()) {
      try {
        return objectMapper.readValue(json, typeReference);
      } catch (IOException e) {
        throw new RuntimeException(e);
      }
    } else {
      return null;
    }
  }

  public static Map<String, Object> parseToMap(String json) {
    return parse(json, HashMap.class);
  }
}

public class TimeTool {

  public static Date nowDate() {
    return Date.from(LocalDateTime.now().atZone(ZoneId.systemDefault()).toInstant());
  }

  public static long nowMilli() {
    return System.currentTimeMillis();
  }
}

/**
 * SpringSecurity传输登录认证的数据的载体，相当一个Dto
 * 必须是 {@link Authentication} 实现类
 * 这里选择extends{@link AbstractAuthenticationToken}，而不是直接implements Authentication,
 * 是为了少些写代码。因为{@link Authentication}定义了很多接口，我们用不上。
 */
public class UsernameAuthentication extends AbstractAuthenticationToken {

  private String username; // 前端传过来
  private String password; // 前端传过来
  private UserLoginInfo currentUser; // 认证成功后，后台从数据库获取信息

  public UsernameAuthentication() {
    // 权限，用不上，直接null
    super(null);
  }

  @Override
  public Object getCredentials() {
    // 根据SpringSecurity的设计，授权成后，Credential（比如，登录密码）信息需要被清空
    return isAuthenticated() ? null : password;
  }

  @Override
  public Object getPrincipal() {
    // 根据SpringSecurity的设计，授权成功之前，getPrincipal返回的客户端传过来的数据。授权成功后，返回当前登陆用户的信息
    return isAuthenticated() ? currentUser : username;
  }

  public String getUsername() {
    return username;
  }

  public void setUsername(String username) {
    this.username = username;
  }

  public String getPassword() {
    return password;
  }

  public void setPassword(String password) {
    this.password = password;
  }

  public UserLoginInfo getCurrentUser() {
    return currentUser;
  }

  public void setCurrentUser(UserLoginInfo currentUser) {
    this.currentUser = currentUser;
  }
}

/**
 * 用户名密码登录
 * AbstractAuthenticationProcessingFilter 的实现类要做的工作：
 * 1. 从HttpServletRequest提取授权凭证。假设用户使用 用户名/密码 登录，就需要在这里提取username和password。
 *    然后，把提取到的授权凭证封装到的Authentication对象，并且authentication.isAuthenticated()一定返回false
 * 2. 将Authentication对象传给AuthenticationManager进行实际的授权操作
 */
public class UsernameAuthenticationFilter extends AbstractAuthenticationProcessingFilter {

  private static final Logger logger = LoggerFactory.getLogger(UsernameAuthenticationFilter.class);

  public UsernameAuthenticationFilter(
          AntPathRequestMatcher pathRequestMatcher,     // url 对应@PostMapping("/user/login/username")
          AuthenticationManager authenticationManager,
          AuthenticationSuccessHandler authenticationSuccessHandler,
          AuthenticationFailureHandler authenticationFailureHandler) {
    super(pathRequestMatcher);
    setAuthenticationManager(authenticationManager);
    setAuthenticationSuccessHandler(authenticationSuccessHandler);
    setAuthenticationFailureHandler(authenticationFailureHandler);
  }

  @Override
  public Authentication attemptAuthentication(HttpServletRequest request,
      HttpServletResponse response) throws AuthenticationException, IOException, ServletException {
    logger.debug("use UsernameAuthenticationFilter");

    // 提取请求数据
    String requestJsonData = request.getReader().lines()
        .collect(Collectors.joining(System.lineSeparator()));
    Map<String, Object> requestMapData = JSON.parseToMap(requestJsonData);
    String username = requestMapData.get("username").toString();
    String password = requestMapData.get("password").toString();

    // 封装成Spring Security需要的对象
    UsernameAuthentication authentication = new UsernameAuthentication();
    authentication.setUsername(username);
    authentication.setPassword(password);
    authentication.setAuthenticated(false); // 还没开始认证

    // 开始登录认证。SpringSecurity会利用 Authentication对象去寻找 AuthenticationProvider进行登录认证
    return getAuthenticationManager().authenticate(authentication);
  }

}

/**
 * 帐号密码登录认证
 */
@Component
public class UsernameAuthenticationProvider implements AuthenticationProvider {

  @Autowired
  private UserService userService;

  @Autowired
  private PasswordEncoder passwordEncoder;

  public UsernameAuthenticationProvider() {
    super();
  }

  @Override
  public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    // 用户提交的用户名 + 密码：
    String username = (String)authentication.getPrincipal();
    String password = (String) authentication.getCredentials();
    System.out.println("校验：" + username + ":" + password);
    // 查数据库，匹配用户信息
    User user = userService.getUserFromDB(username);
    if (user == null
        || !passwordEncoder.matches(password, user.getPassword())) {
      // 密码错误，直接抛异常。
      // 根据SpringSecurity框架的代码逻辑，认证失败时，应该抛这个异常：org.springframework.security.core.AuthenticationException
      // BadCredentialsException就是这个异常的子类
      // 抛出异常后后，AuthenticationFailureHandler的实现类会处理这个异常。
      throw new BadCredentialsException("用户名或密码不正确");
    }

    UsernameAuthentication token = new UsernameAuthentication();
    token.setCurrentUser(JSON.convert(user, UserLoginInfo.class));
    token.setAuthenticated(true); // 认证通过，这里一定要设成true
    return token;
  }

  @Override
  public boolean supports(Class<?> authentication) {
    return authentication.isAssignableFrom(UsernameAuthentication.class);
  }
}

LoginSuccessHandler loginSuccessHandler = applicationContext.getBean(LoginSuccessHandler.class);
        LoginFailHandler loginFailHandler = applicationContext.getBean(LoginFailHandler.class);
        // 加一个登录方式。用户名、密码登录
        String usernameLoginPath = "/user/login/username";
        UsernameAuthenticationFilter usernameLoginFilter = new UsernameAuthenticationFilter(
                // @PostMapping("/user/login/username")
                new AntPathRequestMatcher(usernameLoginPath, HttpMethod.POST.name()),
                // 校验
                new ProviderManager(List.of(applicationContext.getBean(UsernameAuthenticationProvider.class))),
                // 成功失败处理
                loginSuccessHandler,
                loginFailHandler);
        http.addFilterBefore(usernameLoginFilter, UsernamePasswordAuthenticationFilter.class);

public class SmsAuthentication extends AbstractAuthenticationToken {

  private String phone; // 前端传过来
  private String captcha; // 前端传过来
  private UserLoginInfo currentUser; // 认证成功后，后台从数据库获取信息

  public SmsAuthentication() {
    // 权限，用不上，直接null
    super(null);
  }

  @Override
  public Object getCredentials() {
    // 根据SpringSecurity的设计，授权成后，Credential（比如，登录密码）信息需要被清空
    return isAuthenticated() ? null : captcha;
  }

  @Override
  public Object getPrincipal() {
    // 根据SpringSecurity的设计，授权成功之前，getPrincipal返回的客户端传过来的数据。授权成功后，返回当前登陆用户的信息
    return isAuthenticated() ? currentUser : phone;
  }

  public String getPhone() {
    return phone;
  }

  public void setPhone(String phone) {
    this.phone = phone;
  }

  public String getCaptcha() {
    return captcha;
  }

  public void setCaptcha(String captcha) {
    this.captcha = captcha;
  }

  public UserLoginInfo getCurrentUser() {
    return currentUser;
  }

  public void setCurrentUser(UserLoginInfo currentUser) {
    this.currentUser = currentUser;
  }
}

public class SmsAuthenticationFilter extends AbstractAuthenticationProcessingFilter {

  private static final Logger logger = LoggerFactory.getLogger(SmsAuthenticationFilter.class);

  public SmsAuthenticationFilter(
          AntPathRequestMatcher pathRequestMatcher,     // url 对应@PostMapping("/user/login/sms")
          AuthenticationManager authenticationManager,
          AuthenticationSuccessHandler authenticationSuccessHandler,
          AuthenticationFailureHandler authenticationFailureHandler) {
    super(pathRequestMatcher);
    setAuthenticationManager(authenticationManager);
    setAuthenticationSuccessHandler(authenticationSuccessHandler);
    setAuthenticationFailureHandler(authenticationFailureHandler);
  }

  @Override
  public Authentication attemptAuthentication(HttpServletRequest request,
      HttpServletResponse response) throws AuthenticationException, IOException, ServletException {
    logger.debug("use SmsAuthenticationFilter");

    // 提取请求数据
    String requestJsonData = request.getReader().lines()
        .collect(Collectors.joining(System.lineSeparator()));
    Map<String, Object> requestMapData = JSON.parseToMap(requestJsonData);
    String phone = requestMapData.get("phone").toString();
    String captcha = requestMapData.get("captcha").toString();

    // 封装成Spring Security需要的对象
    SmsAuthentication authentication = new SmsAuthentication();
    authentication.setPhone(phone);
    authentication.setCaptcha(captcha);
    authentication.setAuthenticated(false); // 还没开始认证

    // 开始登录认证。SpringSecurity会利用 Authentication对象去寻找 AuthenticationProvider进行登录认证
    return getAuthenticationManager().authenticate(authentication);
  }

}

@Component
public class SmsAuthenticationProvider implements AuthenticationProvider {

  @Autowired
  private UserService userService;

  @Autowired
  private PasswordEncoder passwordEncoder;

  public SmsAuthenticationProvider() {
    super();
  }

  @Override
  public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    // 用户提交的用户名 + 密码：
    String phone = (String)authentication.getPrincipal();
    String captcha = (String) authentication.getCredentials();
    System.out.println("校验：" + phone + ":" + captcha);
    // 查数据库，匹配用户信息
    User user = userService.getUserByPhone(phone);

    if (user == null
        || !"123abc".equals(captcha)){
      throw new BadCredentialsException("验证码不正确");
    }
    SmsAuthentication token = new SmsAuthentication();
    token.setCurrentUser(JSON.convert(user, UserLoginInfo.class));
    token.setAuthenticated(true); // 认证通过，这里一定要设成true
    return token;
  }

  @Override
  public boolean supports(Class<?> authentication) {
    return authentication.isAssignableFrom(SmsAuthentication.class);
  }
}

// 加一个登录方式。短信，验证码登录
String smsLoginPath = "/user/login/sms";
SmsAuthenticationFilter smsLoginFilter = new SmsAuthenticationFilter(
        new AntPathRequestMatcher(smsLoginPath, HttpMethod.POST.name()),
        new ProviderManager(
                List.of(applicationContext.getBean(SmsAuthenticationProvider.class))),
        loginSuccessHandler,
        loginFailHandler);
http.addFilterBefore(smsLoginFilter, UsernamePasswordAuthenticationFilter.class);

@GetMapping("/business-1")
public Result getA() {
    UserLoginInfo userLoginInfo = (UserLoginInfo) SecurityContextHolder
            .getContext()
            .getAuthentication()
            .getPrincipal();
    System.out.println("自家用户登录信息：" + JSON.stringify(userLoginInfo));
    return Result.success(userLoginInfo);
}

public class MyJwtAuthentication extends AbstractAuthenticationToken {

    private String jwtToken; // 前端传过来
    private UserLoginInfo currentUser; // 认证成功后，后台从数据库获取信息

    public MyJwtAuthentication() {
        // 权限，用不上，直接null
        super(null);
    }

    @Override
    public Object getCredentials() {
        // 根据SpringSecurity的设计，授权成后，Credential（比如，登录密码）信息需要被清空
        return isAuthenticated() ? null : jwtToken;
    }

    @Override
    public Object getPrincipal() {
        // 根据SpringSecurity的设计，授权成功之前，getPrincipal返回的客户端传过来的数据。授权成功后，返回当前登陆用户的信息
        return isAuthenticated() ? currentUser : jwtToken;
    }

    public String getJwtToken() {
        return jwtToken;
    }

    public void setJwtToken(String jwtToken) {
        this.jwtToken = jwtToken;
    }

    public UserLoginInfo getCurrentUser() {
        return currentUser;
    }

    public void setCurrentUser(UserLoginInfo currentUser) {
        this.currentUser = currentUser;
    }
}

public class MyJwtAuthenticationFilter extends OncePerRequestFilter {

  private static final Logger logger = LoggerFactory.getLogger(MyJwtAuthenticationFilter.class);

  private JwtService jwtService;

  public MyJwtAuthenticationFilter(JwtService jwtService) {
    this.jwtService = jwtService;
  }

  @Override
  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
      FilterChain filterChain) throws ServletException, IOException {
    logger.debug("Use OpenApi1AuthenticationFilter");

    String jwtToken = request.getHeader("Authorization");
    if (StringUtils.isEmpty(jwtToken)) {

      ExceptionTool.throwException("JWT token is missing!", 10086);

    }
    if (jwtToken.startsWith("Bearer ")) {
      jwtToken = jwtToken.substring(7);
    }


    try {
      UserLoginInfo userLoginInfo = jwtService.verifyJwt(jwtToken, UserLoginInfo.class);

      MyJwtAuthentication authentication = new MyJwtAuthentication();
      authentication.setJwtToken(jwtToken);
      authentication.setAuthenticated(true); // 设置true，认证通过。
      authentication.setCurrentUser(userLoginInfo);
      // 认证通过后，一定要设置到SecurityContextHolder里面去。
      SecurityContextHolder.getContext().setAuthentication(authentication);
    }catch (ExpiredJwtException e) {
      // TODO 转换异常，指定code，让前端知道时token过期，去调刷新token接口
//      throw new BaseException("token过期",HttpStatus.BAD_REQUEST);
      ExceptionTool.throwException("jwt过期", HttpStatus.UNAUTHORIZED, 10087);
    } catch (Exception e) {
      ExceptionTool.throwException("jwt过期", HttpStatus.UNAUTHORIZED, 10087);
    }
    // 放行
    filterChain.doFilter(request, response);
  }
}

// 自家用户
@Bean
public SecurityFilterChain bussiness1FilterChain(HttpSecurity http) throws Exception {
    commonHttpSetting(http);
    // 使用securityMatcher限定当前配置作用的路径
    http.securityMatcher("/open-api/business-1");
    http.authorizeHttpRequests(authorize -> authorize.anyRequest().authenticated());
    // JWT Filter
    MyJwtAuthenticationFilter myJwtAuthenticationFilter = new MyJwtAuthenticationFilter(applicationContext.getBean(JwtService.class));
    http.addFilterBefore(myJwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
    return http.build();
}

@GetMapping("/business-2")
public Result getB() {
    OpenApi2LoginInfo userLoginInfo = (OpenApi2LoginInfo)SecurityContextHolder
            .getContext()
            .getAuthentication()
            .getPrincipal();
    System.out.println("三方API登录信息：" + JSON.stringify(userLoginInfo));
    return Result.success(userLoginInfo);
}

public class OpenApi2Authentication extends AbstractAuthenticationToken {

  private String appId; // 前端传过来
  private String appSecurity; // 前端传过来
  private OpenApi2LoginInfo currentUser; // 认证成功后，后台从数据库获取信息

  public OpenApi2Authentication() {
    // 权限，用不上，直接null
    super(null);
  }

  @Override
  public Object getCredentials() {
    // 根据SpringSecurity的设计，授权成后，Credential（比如，登录密码）信息需要被清空
    return isAuthenticated() ? null : appSecurity;
  }

  @Override
  public Object getPrincipal() {
    // 根据SpringSecurity的设计，授权成功之前，getPrincipal返回的客户端传过来的数据。授权成功后，返回当前登陆用户的信息
    return isAuthenticated() ? currentUser : appId;
  }

  public String getAppId() {
    return appId;
  }

  public void setAppId(String appId) {
    this.appId = appId;
  }

  public String getAppSecurity() {
    return appSecurity;
  }

  public void setAppSecurity(String appSecurity) {
    this.appSecurity = appSecurity;
  }

  public OpenApi2LoginInfo getCurrentUser() {
    return currentUser;
  }

  public void setCurrentUser(
      OpenApi2LoginInfo currentUser) {
    this.currentUser = currentUser;
  }
}

public class OpenApi2AuthenticationFilter extends OncePerRequestFilter {

  private static final Logger logger = LoggerFactory.getLogger(OpenApi2AuthenticationFilter.class);

  public OpenApi2AuthenticationFilter() {
  }

  @Override
  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
      FilterChain filterChain) throws ServletException, IOException {
    logger.debug("Use OpenApi2AuthenticationFilter...");

    String appId = request.getHeader("x-app-id");
    if (StringUtils.isEmpty(appId)) {
     throw new BaseException("x-app-id token is missing!", HttpStatus.BAD_REQUEST);
    }

    // 认证开始前，按SpringSecurity设计，要将Authentication设置到SecurityContext里面去。
    System.out.println("appId认证通过...");

    OpenApi2Authentication authentication = new OpenApi2Authentication();

    OpenApi2LoginInfo userLoginInfo = new OpenApi2LoginInfo();
    userLoginInfo.setAppId(appId);
    userLoginInfo.setMerchantName("三方系统商户名称");

    authentication.setAuthenticated(true); // 设置true，认证通过。
    authentication.setCurrentUser(userLoginInfo);
    SecurityContextHolder.getContext().setAuthentication(authentication); // 一定要设置到ThreadLocal

    // 放行
    filterChain.doFilter(request, response);
  }
}

// 第三方用户
@Bean
public SecurityFilterChain bussiness2FilterChain(HttpSecurity http) throws Exception {
    commonHttpSetting(http);
    // 使用securityMatcher限定当前配置作用的路径
    http.securityMatcher("/open-api/business-2");
    http.authorizeHttpRequests(authorize -> authorize.anyRequest().authenticated());
    // Third Filter
    http.addFilterBefore(new OpenApi2AuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
    return http.build();
}

@GetMapping("/business-3")
public Result getC() {
    Authentication authentication = SecurityContextHolder
            .getContext()
            .getAuthentication();
    System.out.println("登录信息：" + JSON.stringify(authentication));
    return Result.success("模拟访问成功的响应数据");
}

// 不需要鉴权
@Bean
public SecurityFilterChain bussiness3FilterChain(HttpSecurity http) throws Exception {
    commonHttpSetting(http);
    // 使用securityMatcher限定当前配置作用的路径
    http.securityMatcher("/open-api/business-3");
    http.authorizeHttpRequests(authorize -> authorize.anyRequest().permitAll());
    return http.build();
}

@RestController
@RequestMapping("/public/login/gitee")
public class GiteeLoginConfigController {

  @Value("${login.gitee.clientId}")
  private String giteeClientId;

  @Value("${login.gitee.redirectUri}")
  private String giteeCallbackEndpoint;

  @GetMapping("/config")
  public Result getA() {
    HashMap<String, Object> config = new HashMap<>();
    config.put("clientId", giteeClientId);
    config.put("redirectUri", giteeCallbackEndpoint);
    return Result.success(config);
  }

}

public class GiteeAuthentication extends AbstractAuthenticationToken {

  private String code; // 前端传过来
  private UserLoginInfo currentUser; // 认证成功后，后台从数据库获取信息

  public GiteeAuthentication() {
    // 权限，用不上，直接null
    super(null);
  }

  @Override
  public Object getCredentials() {
    // 根据SpringSecurity的设计，授权成后，Credential（比如，登录密码）信息需要被清空
    return isAuthenticated() ? null : code;
  }

  @Override
  public Object getPrincipal() {
    // 根据SpringSecurity的设计，授权成功之前，getPrincipal返回的客户端传过来的数据。授权成功后，返回当前登陆用户的信息
    return isAuthenticated() ? currentUser : null;
  }

  public String getCode() {
    return code;
  }

  public void setCode(String code) {
    this.code = code;
  }

  public UserLoginInfo getCurrentUser() {
    return currentUser;
  }

  public void setCurrentUser(UserLoginInfo currentUser) {
    this.currentUser = currentUser;
  }
}

public class GiteeAuthenticationFilter extends AbstractAuthenticationProcessingFilter {

  private static final Logger logger = LoggerFactory.getLogger(GiteeAuthenticationFilter.class);

  public GiteeAuthenticationFilter(
          AntPathRequestMatcher pathRequestMatcher,     // url 对应@PostMapping("/user/login/sms")
          AuthenticationManager authenticationManager,
          AuthenticationSuccessHandler authenticationSuccessHandler,
          AuthenticationFailureHandler authenticationFailureHandler) {
    super(pathRequestMatcher);
    setAuthenticationManager(authenticationManager);
    setAuthenticationSuccessHandler(authenticationSuccessHandler);
    setAuthenticationFailureHandler(authenticationFailureHandler);
  }

  @Override
  public Authentication attemptAuthentication(HttpServletRequest request,
      HttpServletResponse response) throws AuthenticationException, IOException, ServletException {
    logger.debug("use GiteeAuthenticationFilter");

    // 提取请求数据
    String requestJsonData = request.getReader().lines()
        .collect(Collectors.joining(System.lineSeparator()));
    Map<String, Object> requestMapData = JSON.parseToMap(requestJsonData);
    String code = requestMapData.get("code").toString();

    // 封装成Spring Security需要的对象
    GiteeAuthentication authentication = new GiteeAuthentication();
    authentication.setCode(code);
    authentication.setAuthenticated(false); // 还没开始认证

    // 开始登录认证。SpringSecurity会利用 Authentication对象去寻找 AuthenticationProvider进行登录认证
    return getAuthenticationManager().authenticate(authentication);
  }

}

@Component
public class GiteeAuthenticationProvider implements AuthenticationProvider {

  @Autowired
  private UserService userService;

  @Autowired
  private GiteeApiClient giteeApiClient;

  public static final String PLATFORM = "gitee";

  @Override
  public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    String code = authentication.getCredentials().toString();
    try {
      String token = giteeApiClient.getTokenByCode(code);
      if (token == null) {
        // 乱传code过来。用户根本没授权！
        ExceptionTool.throwException("${gitee.get.open.id.fail:Gitee授权失败！}");
      }
      Map<String, Object> thirdUser = giteeApiClient.getThirdUserInfo(token);
      if (thirdUser == null) {
        // 未知异常。获取不到用户openId，也就无法继续登录了
        ExceptionTool.throwException("${gitee.get.open.id.fail:Gitee授权失败！}");
      }
      String openId = thirdUser.get("openId").toString();

      // 通过第三方的账号唯一id，去匹配数据库中已有的账号信息
      User user = userService.getUserByOpenId(openId, PLATFORM);
      boolean notBindAccount = user == null; // gitee账号没有绑定我们系统的用户
      if (notBindAccount) {
        // 没找到账号信息，那就是第一次使用gitee登录，可能需要创建一个新用户
        user = new User();
        userService.createUserWithOpenId(user, openId, PLATFORM);
      }

      GiteeAuthentication successAuth = new GiteeAuthentication();
      successAuth.setCurrentUser(JSON.convert(user, UserLoginInfo.class));
      successAuth.setAuthenticated(true); // 认证通过，一定要设成true

      HashMap<String, Object> loginDetail = new HashMap<>();
      // 第一次使用三方账号登录，需要告知前端，让前端跳转到初始化账号页面（可能需要）
      loginDetail.put("needInitUserInfo", notBindAccount);
      loginDetail.put("nickname", thirdUser.get("nickname").toString()); // sayHello
      successAuth.setDetails(loginDetail);
      return successAuth;
    } catch (BaseException e) {
      // 转换已知异常，将异常内容返回给前端
      throw new BadCredentialsException(e.getMessage());
    } catch (Exception e) {
      // 未知异常
      throw new BadCredentialsException("Gitee Authentication Failed");
    }
  }

  @Override
  public boolean supports(Class<?> authentication) {
    return authentication.isAssignableFrom(GiteeAuthentication.class);
  }
}

@Component
public class GiteeApiClient {

  private RestTemplate restTemplate = new RestTemplate();

  @Value("${login.gitee.clientId}")
  private String clientId;

  @Value("${login.gitee.clientSecret}")
  private String clientSecret;

  @Value("${login.gitee.redirectUri}")
  private String redirectUri;

  public String getTokenByCode(String code) {
    String url = "https://gitee.com/oauth/token?grant_type=authorization_code"
        + "&code=" + code
        + "&client_id=" + clientId
        + "&redirect_uri=" + redirectUri
        + "&client_secret=" + clientSecret;
    String responseJson = sendPostRequest(url, null);
    Map<String, Object> responseMap = JSON.parseToMap(responseJson);
    Object accessToken = responseMap.get("access_token");
    if (accessToken == null) {
      ExceptionTool.throwException("{gitee.get.token.fail:获取GiteeToken失败！}");
    }
    return accessToken.toString();
  }

  public Map<String, Object> getThirdUserInfo(String token) {
    // {"id":1483966,"login":"用户名"}
    String responseJson = sendGetRequest("https://gitee.com/api/v5/user?access_token=" + token);
    Map<String, Object> responseMap = JSON.parseToMap(responseJson);
    Object openId = responseMap.get("id");
    if (openId == null) {
      return null;
    }

    HashMap<String, Object> thirdUser = new HashMap<>();
    thirdUser.put("openId", openId);
    thirdUser.put("nickname", responseMap.get("login"));
    return thirdUser;
  }

  public String sendPostRequest(String url, Map<String, Object> body) {
    // 请求头
    HttpHeaders headers = new HttpHeaders();
    headers.setContentType(MediaType.APPLICATION_JSON);
    // 创建HttpEntity对象
    HttpEntity<Map<String, Object>> requestEntity = new HttpEntity<>(body, headers);
    // 发送POST请求
    try {
      ResponseEntity<String> response = restTemplate.exchange(url, HttpMethod.POST, requestEntity,
          String.class);
      // 返回响应体
      return response.getBody();
    } catch (HttpClientErrorException e) {
      return e.getResponseBodyAsString();
    }
  }

  public String sendGetRequest(String url) {
    // 请求头
    HttpHeaders headers = new HttpHeaders();
    headers.setContentType(MediaType.APPLICATION_JSON);
    // 创建HttpEntity对象
    HttpEntity<Map<String, Object>> requestEntity = new HttpEntity<>(headers);
    // 发送GET请求
    try {
      ResponseEntity<String> response = restTemplate.exchange(url, HttpMethod.GET, requestEntity,
          String.class);
      // 返回响应体
      return response.getBody();
    } catch (HttpClientErrorException e) {
      return e.getResponseBodyAsString();
    }
  }
}