import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
import org.springframework.security.web.util.matcher.RequestMatcher;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class CustomJwtAuthenticationFilter extends AbstractAuthenticationProcessingFilter {

    // 構(gòu)造函數(shù)，接收一個(gè)RequestMatcher，該匹配器定義了哪些請(qǐng)求需要此過濾器處理
    public CustomJwtAuthenticationFilter(RequestMatcher requiresAuthenticationRequestMatcher) {
        super(requiresAuthenticationRequestMatcher);
    }

    // 實(shí)際的認(rèn)證邏輯
    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
            throws AuthenticationException, IOException, ServletException {
        // 從請(qǐng)求中提取JWT令牌的邏輯
        String token = extractJwtFromRequest(request);

        if (token == null) {
            // 如果沒有令牌，則拋出認(rèn)證異常，由AuthenticationEntryPoint處理
            throw new BadCredentialsException("No JWT token found in request.");
        }

        // 假設(shè)JwtAuthenticationToken是一個(gè)自定義的Authentication實(shí)現(xiàn)，
        // 包含了JWT令牌信息，等待AuthenticationManager處理
        JwtAuthenticationToken authenticationToken = new JwtAuthenticationToken(token);

        // 將令牌提交給AuthenticationManager進(jìn)行認(rèn)證
        // AuthenticationManager會(huì)找到對(duì)應(yīng)的AuthenticationProvider來驗(yàn)證令牌
        return this.getAuthenticationManager().authenticate(authenticationToken);
    }

    // 輔助方法：從請(qǐng)求中提取JWT令牌
    private String extractJwtFromRequest(HttpServletRequest request) {
        // 示例：從Authorization頭中提取Bearer Token
        String bearerToken = request.getHeader("Authorization");
        if (bearerToken != null && bearerToken.startsWith("Bearer ")) {
            return bearerToken.substring(7); // 移除"Bearer "前綴
        }
        return null;
    }

    // 可以選擇性地覆蓋successfulAuthentication和unsuccessfulAuthentication方法
    // 來處理認(rèn)證成功或失敗后的邏輯，例如設(shè)置安全上下文或記錄日志。
}

import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.security.web.util.matcher.RequestMatcher;

// ...
// 在您的Security配置類中或單獨(dú)定義
RequestMatcher apiPathsMatcher = new AntPathRequestMatcher("/api/**");

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.security.web.AuthenticationEntryPoint; // 假設(shè)您有自定義的認(rèn)證入口點(diǎn)

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    private final UserDetailsService userDetailsService; // 假設(shè)您有UserDetailsService
    private final AuthenticationEntryPoint jwtAuthenticationEntryPoint; // 假設(shè)您有JWT認(rèn)證入口點(diǎn)

    public SecurityConfig(UserDetailsService userDetailsService, AuthenticationEntryPoint jwtAuthenticationEntryPoint) {
        this.userDetailsService = userDetailsService;
        this.jwtAuthenticationEntryPoint = jwtAuthenticationEntryPoint;
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        // 配置您的AuthenticationManager，例如使用UserDetailsService和密碼編碼器
        auth.userDetailsService(userDetailsService);
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        // 暴露AuthenticationManager為Bean，供CustomJwtAuthenticationFilter使用
        return super.authenticationManagerBean();
    }

    // 定義CustomJwtAuthenticationFilter為Bean
    @Bean
    public CustomJwtAuthenticationFilter customJwtAuthenticationFilter() throws Exception {
        // 創(chuàng)建一個(gè)匹配器，指定只有/api/**路徑的請(qǐng)求才會(huì)被此JWT過濾器處理
        AntPathRequestMatcher apiMatcher = new AntPathRequestMatcher("/api/**");
        CustomJwtAuthenticationFilter filter = new CustomJwtAuthenticationFilter(apiMatcher);
        // 必須設(shè)置AuthenticationManager，因?yàn)锳bstractAuthenticationProcessingFilter需要它來執(zhí)行認(rèn)證
        filter.setAuthenticationManager(authenticationManagerBean());
        // 可以選擇性設(shè)置認(rèn)證成功/失敗處理器
        // filter.setAuthenticationSuccessHandler(...)
        // filter.setAuthenticationFailureHandler(...)
        return filter;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable() // 禁用CSRF，因?yàn)镴WT通常是無狀態(tài)的
            .authorizeRequests()
                // 確保/api/**路徑需要認(rèn)證。當(dāng)請(qǐng)求到達(dá)這些路徑時(shí)，如果尚未認(rèn)證，
                // customJwtAuthenticationFilter會(huì)嘗試處理
                .antMatchers("/api/**").authenticated()
                // 其他路徑可以設(shè)置為permitAll()或根據(jù)需求配置
                .antMatchers("/users", "/login", "/").permitAll()
                .anyRequest().authenticated() // 任何其他未匹配的請(qǐng)求也需要認(rèn)證
            .and()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS) // JWT是無狀態(tài)的
            .and()
            .exceptionHandling()
                .authenticationEntryPoint(jwtAuthenticationEntryPoint) // 未認(rèn)證或認(rèn)證失敗的入口點(diǎn)
                .accessDeniedPage("/403") // 訪問被拒絕的頁面
            .and()
            // 將自定義的JWT過濾器添加到UsernamePasswordAuthenticationFilter之前
            // CustomJwtAuthenticationFilter現(xiàn)在只處理/api/**路徑
            .addFilterBefore(customJwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
    }
}