（五）基于数据库的动态用户认证：传统RBAC角色模型实战开发

@Data
@TableName("sys_user")
public class SysUser implements UserDetails {
    
    @TableId(type = IdType.AUTO)
    private Long userId;
    
    @TableField("login_name")
    private String username; // Spring Security认证使用的字段
    
    private String password;
    
    private String status; // 状态（0正常 1锁定）
    
    private String delFlag; // 删除标志（0代表存在 1代表删除）
    
    @TableField(exist = false)
    private List<SysRole> roles;
    
    // 实现UserDetails接口
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        // 组装 GrantedAuthority 集合，将角色和菜单权限都加入
        Set<GrantedAuthority> authorities = new HashSet<>();
        // 加入角色
        authorities.addAll(roles.stream()
                .map(role -> new SimpleGrantedAuthority("ROLE_" + role.getRoleKey()))
                .collect(Collectors.toList()));
        // 加入菜单资源
        authorities.addAll(roles.stream()
                .flatMap(role -> role.getMenus().stream())
                .map(menu -> new SimpleGrantedAuthority(menu.getPerms()))
                .collect(Collectors.toList()));
        return authorities;
    }
    
    @Override
    public boolean isAccountNonExpired() { return true; }
    
    @Override
    public boolean isAccountNonLocked() {
        return "0".equals(status);
    }
    
    @Override
    public boolean isCredentialsNonExpired() { return true; }
    
    @Override
    public boolean isEnabled() {
        return "0".equals(delFlag);
    }
}

@Data
@TableName("sys_role")
public class SysRole {
    @TableId(type = IdType.AUTO)
    private Long roleId;
    private String roleName;
    private String roleKey;
    
    @TableField(exist = false)
    private List<SysMenu> menus;
}

@Data
@TableName("sys_menu")
public class SysMenu {
    @TableId(type = IdType.AUTO)
    private Long menuId;
    private String menuName;
    private String perms;
}

@Mapper
public interface UserMapper extends BaseMapper<SysUser> {
    
    @Select("SELECT r.* FROM sys_role r " +
            "JOIN sys_user_role ur ON r.role_id = ur.role_id " +
            "WHERE ur.user_id = #{userId}")
    @Results({
            @Result(property = "roleId", column = "role_id"),
            @Result(property = "menus", column = "role_id",
                    many = @Many(select = "com.toher.springsecurity.demo.db.mapper.MenuMapper.selectByUserId"))
    })
    List<SysRole> selectRolesByUserId(Long userId);
}

@Mapper
public interface RoleMapper extends BaseMapper<SysRole> {
    
    @Select("SELECT m.* FROM sys_menu m " +
            "JOIN sys_role_menu rm ON m.menu_id = rm.menu_id " +
            "WHERE rm.role_id = #{roleId}")
    List<SysMenu> selectMenusByRoleId(Long roleId);
}

@Mapper
public interface MenuMapper extends BaseMapper<SysMenu> {
    
    @Select("SELECT DISTINCT m.* FROM sys_menu m " +
            "JOIN sys_role_menu rm ON m.menu_id = rm.menu_id " +
            "JOIN sys_user_role ur ON rm.role_id = ur.role_id " +
            "WHERE ur.user_id = #{userId}")
    List<SysMenu> selectByUserId(Long userId);
}

@Service
@RequiredArgsConstructor
public class UserDetailsServiceImpl implements UserDetailsService {
    
    private final UserMapper userMapper;
    private final RoleMapper roleMapper;
    
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        
        // 1. 查询基础用户信息
        LambdaQueryWrapper<SysUser> wrapper = new LambdaQueryWrapper<>();
        wrapper.eq(SysUser::getUsername, username);
        SysUser user = userMapper.selectOne(wrapper);
        
        if (user == null) {
            throw new UsernameNotFoundException("用户不存在");
        }
        
        // 2. 加载角色和权限
        List<SysRole> roles = userMapper.selectRolesByUserId(user.getUserId());
        roles.forEach(role ->
                role.setMenus(roleMapper.selectMenusByRoleId(role.getRoleId()))
        );
        user.setRoles(roles);
        
        // 3. 检查账户状态
        if (!user.isEnabled()) {
            throw new DisabledException("用户已被禁用");
        }
        return user;
    }
}

@Configuration
// 开启方法级的安全控制
@EnableMethodSecurity
@RequiredArgsConstructor
public class DbSecurityConfig {
    
    private final UserDetailsServiceImpl userDetailsService;
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authorize -> authorize
                // 配置形式：ADMIN角色可以访问/admin/view
                .requestMatchers("/admin/view").hasAnyAuthority("ADMIN")
                .anyRequest().authenticated()
            )
            .userDetailsService(userDetailsService)
            .formLogin(withDefaults())
            .logout(withDefaults());
        return http.build();
    }
    
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

@RestController
@RequiredArgsConstructor
public class DemoAbacController {
    
    private final UserMapper userMapper;
    private final PasswordEncoder passwordEncoder;
    
    @GetMapping("/")
    public ResponseEntity<SysUser> index(Authentication authentication) {
        System.out.println(authentication);
        SysUser principal = (SysUser) authentication.getPrincipal();
        return ResponseEntity.ok(principal);
    }
    
    /**
     * 基于SecurityConfig配置角色访问
     */
    @GetMapping("/admin/view")
    public ResponseEntity<String> admin() {
        return ResponseEntity.ok("基于SecurityConfig配置ROLE_ADMIN角色访问ok");
    }
    
    /**
     * 根据角色权限访问
     */
    @PreAuthorize("hasRole('ADMIN')")
    @GetMapping("/system/view")
    public ResponseEntity<String> system() {
        return ResponseEntity.ok("方法的授权hasRole ADMIN 角色访问ok");
    }
    
    /**
     * 根据菜单权限访问
     */
    @PreAuthorize("hasAuthority('admin:menu:add')")
    @GetMapping("/system/add")
    public ResponseEntity<String> add() {
        return ResponseEntity.ok("方法的授权admin:menu:add,访问ok");
    }
    
    /**
     * 管理员角色且用户名是admin方可访问
     */
    @PreAuthorize("hasRole('ADMIN') and authentication.name == 'admin'")
    @GetMapping("/system/del")
    public ResponseEntity<String> del() {
        return ResponseEntity.ok("方法的授权admin:menu:delete,访问ok");
    }
}