public class ResponseUtil {

    public static void out(HttpServletResponse response, R r) {
        ObjectMapper mapper = new ObjectMapper();
        response.setStatus(HttpStatus.OK.value());
        response.setContentType(MediaType.APPLICATION_JSON_VALUE);
        response.setCharacterEncoding("UTF-8");
        try {
            mapper.writeValue(response.getWriter(), r);
        } catch (IOException e) {
            throw new RuntimeException(e);
        }
    }
}

public class JwtHelper {

    private static long tokenExpiration = 60 * 60 * 1000;
    private static String tokenSignKey = "sw-code";

    public static String createToken(Long userId, String username) {
        return Jwts.builder()
                .setSubject("AUTH-USER")
                .setExpiration(new Date(System.currentTimeMillis() + tokenExpiration))
                .claim("userId", userId)
                .claim("username", username)
                .signWith(SignatureAlgorithm.HS512, tokenSignKey)
                .compressWith(CompressionCodecs.GZIP)
                .compact();

    }

    public static Long getUserId(String token) {
        if (StringUtils.isEmpty(token)) return null;
        Jws<Claims> claimsJws = Jwts.parser().setSigningKey(tokenSignKey).parseClaimsJws(token);
        Claims body = claimsJws.getBody();
        String userId = body.get("userId").toString();
        return Long.parseLong(userId);
    }

    public static String getUsername(String token) {
        if (StringUtils.isEmpty(token)) return null;
        Jws<Claims> claimsJws = Jwts.parser().setSigningKey(tokenSignKey).parseClaimsJws(token);
        Claims body = claimsJws.getBody();
        return (String) body.get("username");
    }

}

public class CustomUser extends User {

    private SysUser sysUser;

    public CustomUser(SysUser sysUser, Collection<? extends GrantedAuthority> authorities) {
        super(sysUser.getUsername(), sysUser.getPassword(), authorities);
        this.sysUser = sysUser;
    }

    public SysUser getSysUser() {
        return sysUser;
    }

    public void setSysUser(SysUser sysUser) {
        this.sysUser = sysUser;
    }
}

@Component
public class CustomMd5PasswordEncoder implements PasswordEncoder {
    @Override
    public String encode(CharSequence rawPassword) {
        return MD5.encrypt(rawPassword.toString());
    }

    @Override
    public boolean matches(CharSequence rawPassword, String encodedPassword) {
        return encodedPassword.equals(MD5.encrypt(rawPassword.toString()));
    }
}

@Component
public interface UserDetailsService extends org.springframework.security.core.userdetails.UserDetailsService {

    /**
     * 根据用户名获取用户对象，获取不到直接抛异常
     */
    @Override
    UserDetails loadUserByUsername(String username) throws UsernameNotFoundException;
}

@Service
public class UserDetailsServiceImpl implements UserDetailsService {

    private final SysUserService sysUserService;
    private final SysMenuService sysMenuService;

    public UserDetailsServiceImpl(SysUserService sysUserService, SysMenuService sysMenuService) {
        this.sysUserService = sysUserService;
        this.sysMenuService = sysMenuService;
    }

    /**
     * 根据用户名获取用户对象，获取不到直接抛异常
     */
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        // 根据用户名查询
        SysUser sysUser = sysUserService.getUserByUsername(username);
        if (null == sysUser) {
            throw new UsernameNotFoundException("用户名不存在！");
        }
        if (sysUser.getStatus() == 0) {
            throw new DisabledException("disable");
        }

        // 查询权限列表
        List<Permission> permissions = sysMenuService.queryUserAuthListByUserId(sysUser.getId());
        // 封装Spring Security的权限类型
        List<SimpleGrantedAuthority> authorities = new ArrayList<>();
        permissions.forEach(permission -> {
            authorities.add(new SimpleGrantedAuthority(permission.getAuth().trim()));
        });
        return new CustomUser(sysUser, authorities);
    }
}

/**
 * 获得输入的用户名和密码，封装成框架要求的对象，调用认证方法
 */
public class TokenLoginFilter extends UsernamePasswordAuthenticationFilter {

    private final RedisTemplate<String, String> redisTemplate;
    // 构造方法
    public TokenLoginFilter(AuthenticationManager authenticationManager, RedisTemplate<String, String> redisTemplate) {
        this.redisTemplate = redisTemplate;
        this.setAuthenticationManager(authenticationManager);
        this.setPostOnly(false);
        // 指定登陆接口及提交方式，可以指定任意路径
        this.setRequiresAuthenticationRequestMatcher(new AntPathRequestMatcher("/admin/system/index/login", "POST"));
    }

    // 登陆认证
    // 获取输入的用户名和密码，调用方法认证
    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
        try {
            // 获取用户信息
            LoginVo loginVo = new ObjectMapper().readValue(request.getInputStream(), LoginVo.class);
            // 封装对象
            UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(loginVo.getUsername(), loginVo.getPassword());
            // 调用方法
            return this.getAuthenticationManager().authenticate(authenticationToken);
        } catch (IOException e) {
            throw new RuntimeException(e);
        }
    }

    // 认证成功调用的方法
    @Override
    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
        // 获取当前用户
        CustomUser customUser = (CustomUser) authResult.getPrincipal();
        // 生成Token
        String token = JwtHelper.createToken(customUser.getSysUser().getId(), customUser.getSysUser().getUsername());
        // 获取当前用户的权限数据，放到Redis中，key: username  value: permissions
        redisTemplate.opsForValue().set(
                customUser.getUsername(),
                JSON.toJSONString(customUser.getAuthorities()));
        // 返回
        HashMap<String, Object> map = new HashMap<>();
        map.put("token", token);
        ResponseUtil.out(response, R.success(map));
    }

    // 认证失败调用的方法
    @Override
    protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, AuthenticationException failed) throws IOException, ServletException {
      	// 封装错误信息，用于返回
        R r = R.fail(ResultCode.LOGIN_AUTH_FAIL);
        Throwable ex = failed.getCause();
        if (ex instanceof DisabledException) {
            r.setResultCode(ResultCode.USER_DISABLE);
        } else if (failed instanceof UsernameNotFoundException || failed instanceof BadCredentialsException) {
            r.setResultCode(ResultCode.USER_LOGIN_ERROR);
        }
        ResponseUtil.out(response, r);
    }
}

/**
 * 判断是否完成认证
 */
public class TokenAuthenticationFilter extends OncePerRequestFilter {

    private final RedisTemplate<String, String> redisTemplate;

    public TokenAuthenticationFilter(RedisTemplate<String, String> redisTemplate) {
        this.redisTemplate = redisTemplate;
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {
        // 如果是登陆接口，直接放行
        if ("/admin/system/index/login".equals(request.getRequestURI())) {
            chain.doFilter(request, response);
            return;
        }
        try {
            UsernamePasswordAuthenticationToken authentication = getAuthentication(request);
            if (null != authentication) {
                SecurityContextHolder.getContext().setAuthentication(authentication);
                chain.doFilter(request, response);
            } else {
                ResponseUtil.out(response, R.fail(ResultCode.LOGIN_AUTH_FAIL));
            }
        } catch (JwtException e) {
            SecurityContextHolder.getContext().setAuthentication(null);
            R r = R.fail(ResultCode.TOKEN_INVALID);
            if (e instanceof UnsupportedJwtException) {
                r.setResultCode(ResultCode.TOKEN_UNSUPPORTED);
            }
            ResponseUtil.out(response, r);
        }
    }

    private UsernamePasswordAuthenticationToken getAuthentication(HttpServletRequest request) {
        String token = request.getHeader("Authorization");
        if (!StringUtils.isEmpty(token)) {
            String username = JwtHelper.getUsername(token);
            if (!StringUtils.isEmpty(username)) {
                // 从redis中获取权限数据
                String authString = redisTemplate.opsForValue().get(username);
                if (!StringUtils.isEmpty(authString)) {
                    List<Map> mapList = JSON.parseArray(authString, Map.class);
                    System.out.println(mapList);
                    List<SimpleGrantedAuthority> authorities = new ArrayList<>();
                    mapList.forEach(map -> {
                        String authority = (String) map.get("authority");
                        authorities.add(new SimpleGrantedAuthority(authority));
                    });
                    return new UsernamePasswordAuthenticationToken(username, null, authorities);
                } else {
                    return new UsernamePasswordAuthenticationToken(username, null, Collections.emptyList());
                }
            }
        }
        return null;
    }
}

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    private final UserDetailsService userDetailsService;

    private final CustomMd5PasswordEncoder customMd5PasswordEncoder;

    private final RedisTemplate<String, String> redisTemplate;

    public WebSecurityConfig(UserDetailsService userDetailsService, CustomMd5PasswordEncoder customMd5PasswordEncoder, RedisTemplate<String, String> redisTemplate) {
        this.userDetailsService = userDetailsService;
        this.customMd5PasswordEncoder = customMd5PasswordEncoder;
        this.redisTemplate = redisTemplate;
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .csrf().disable()
                .cors().and()
                .authorizeRequests()
                .antMatchers("/admin/system/index/login").permitAll()
                .anyRequest().authenticated()
                .and()
                .addFilterBefore(new TokenAuthenticationFilter(redisTemplate), UsernamePasswordAuthenticationFilter.class)
                .addFilter(new TokenLoginFilter(authenticationManager(), redisTemplate));
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.NEVER);
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService).passwordEncoder(customMd5PasswordEncoder);
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/favicon.icon", "/swagger-resources/**", "webjars/**", "/v2/**", "swagger-ui.html/**", "doc.html");
    }
}

@Api(tags = "角色管理接口")
@RestController
@ResponseResult
@RequestMapping("/admin/system/sysRole")
public class SysRoleController {

    private final SysRoleService sysRoleService;

    public SysRoleController(SysRoleService sysRoleService) {
        this.sysRoleService = sysRoleService;
    }

    @ApiOperation("为用户分配角色")
    @PreAuthorize("hasAuthority('system_role_assign')")
    @PostMapping("/doAssign")
    public void doAssign(@RequestBody AssignRoleVo assignRoleVo) {
        sysRoleService.doAssign(assignRoleVo);
    }

    @ApiOperation("查询所有角色")
    @PreAuthorize("hasAuthority('system_role_list')")
    @GetMapping("/findAll")
    public List<SysRole> findAll() {
        return sysRoleService.list();
    }

    /**
     *
     * @param page  当前页
     * @param limit 记录数
     * @param sysRoleQueryVo 查询参数
     * @return 分页信息
     */
    @ApiOperation("条件分页查询")
    @PreAuthorize("hasAuthority('system_role_list')")
    @GetMapping("{page}/{limit}")
    public IPage<SysRole> pageQueryRole(@PathVariable Long page,
                                        @PathVariable Long limit,
                                       SysRoleQueryVo sysRoleQueryVo) {
        // 自定义Page，修改current为page，和前端保持一致
        CustomPage<SysRole> pageParam = new CustomPage<>(page, limit);
        LambdaQueryWrapper<SysRole> wrapper = new LambdaQueryWrapper<>();
        String roleName = sysRoleQueryVo.getRoleName();
        if (!StringUtils.isEmpty(roleName)) {
            wrapper.like(SysRole::getRoleName, roleName);
        }
        IPage<SysRole> iPage = sysRoleService.page(pageParam, wrapper);
        return iPage;
    }

    @ApiOperation("添加角色")
    @PreAuthorize("hasAuthority('system_role_add')")
    @PostMapping("")
    public void save(@RequestBody SysRole role) {
        boolean save = sysRoleService.save(role);
        if (!save) {
            throw new BizException("添加失败");
        }
    }

    /**
     * 根据id查询角色
     * @param id 角色id
     * @return 角色
     */
    @ApiOperation("根据ID查询")
    @PreAuthorize("hasAuthority('system_role_list')")
    @GetMapping("{id}")
    public SysRole get(@PathVariable Long id) {
        return sysRoleService.getById(id);
    }

    /**
     * 更新角色
     * @param role 角色信息
     */
    @ApiOperation("更新角色")
    @PreAuthorize("hasAuthority('system_role_update')")
    @PutMapping("")
    public void update(@RequestBody SysRole role) {
        boolean update = sysRoleService.updateById(role);
        if (!update) {
            throw new BizException("更新失败");
        }
    }

    @ApiOperation("根据id删除")
    @PreAuthorize("hasAuthority('system_role_remove')")
    @DeleteMapping("{id}")
    public void delete(@PathVariable Long id) {
        boolean delete = sysRoleService.removeById(id);
        if (!delete) {
            throw new BizException("删除失败");
        }
    }

    @ApiOperation("批量删除")
    @PreAuthorize("hasAuthority('system_role_remove')")
    @DeleteMapping("batch")
    public void batchRemove(@RequestBody List<Long> ids) {
        boolean delete = sysRoleService.removeByIds(ids);
        if (!delete) {
            throw new BizException("删除失败");
        }
    }

}