后端进阶之路——Spring Security构建强大的身份验证和授权系统（四）

@Service
public class CustomUserDetailsService implements UserDetailsService {
    @Autowired
    private UserRepository userRepository;
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userRepository.findByUsername(username);
        if (user == null) {
            throw new UsernameNotFoundException("User not found with username: " + username);
        }
        // 构建UserDetails对象并返回（通常使用User实体类的实例）
        return new org.springframework.security.core.userdetails.User(user.getUsername(), user.getPassword(),
                user.isEnabled(), user.isAccountNonExpired(), user.isCredentialsNonExpired(),
                user.isAccountNonLocked(), user.getAuthorities());
    }
}

public class CustomSecurityInterceptor extends AbstractSecurityInterceptor implements Filter {
    // 通过注入自定义的AccessDecisionManager和AuthenticationManager实现类
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        // 创建FilterInvocation对象，表示当前过滤器链的调用
        FilterInvocation filterInvocation = new FilterInvocation(httpRequest, httpResponse, chain);
        // 执行授权过程
        invoke(filterInvocation);
    }
    @Override
    public Class<?> getSecureObjectClass() {
        return FilterInvocation.class;
    }
    @Override
    public SecurityMetadataSource obtainSecurityMetadataSource() {
        return null;
    }
    // 调用AccessDecisionManager执行访问控制逻辑
    @Override
    public void invoke(FilterInvocation fi) throws IOException, ServletException {
        InterceptorStatusToken token = super.beforeInvocation(fi);
        try {
            // 执行下一个拦截器
            fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
        } finally {
            super.afterInvocation(token, null);
        }
    }
}

@PreAuthorize("hasRole('ROLE_ADMIN')")
public void adminOnlyMethod() {
    // 只有具有ROLE_ADMIN角色的用户才能执行该方法
}

@PostAuthorize("returnObject.author == principal.username")
public Book getBook(String bookId) {
    // 根据bookId获取书籍对象，并返回
}

@Secured("ROLE_ADMIN")
public void adminOnlyMethod() {
    // 只有具有ROLE_ADMIN角色的用户才能执行该方法
}

@PreFilter("hasRole('ROLE_ADMIN') or filterObject.userId == principal.username")
public void updateUserInfo(List<User> userList) {
    // 根据userId更新用户信息
}