Spring Security + JWT + Redis实现双Token认证

{
  "alg": "hs256",   // 签名算法
  "typ": "jwt"      // token类型
}

{
  "sub": "1001",                    // 用户id
  "username": "zhangsan",           // 用户名
  "roles": ["admin", "user"],       // 角色列表
  "permissions": ["blog:read", "blog:write", "user:manage"],  // 权限列表
  "iat": 1720000000,                // 签发时间
  "exp": 1720000900,                // 过期时间（15分钟后）
  "jti": "a1b2c3d4-e5f6-7890"      // jwt唯一id（用于黑名单）
}

{
  "sub": "1001",                    // 用户id
  "tokenversion": 5,                // token版本（用于批量失效）
  "iat": 1720000000,
  "exp": 1720604800                 // 过期时间（7天后）
}

hmacsha256(
  base64urlencode(header) + "." + base64urlencode(payload),
  secret_key
)

┌─────────────┐     ┌──────────────────┐     ┌─────────┐
│   frontend   │────>│  spring boot     │────>│  redis  │
│  vue / react │<────│  spring security │<────│         │
└─────────────┘     └──────────────────┘     └─────────┘
                           │
                           v
                     ┌──────────┐
                     │  mysql   │
                     │ (users)  │
                     └──────────┘

@component
public class jwtutil {

    @value("${jwt.secret}")
    private string secret;

    @value("${jwt.access-token-expiry}")
    private long accesstokenexpiry; // 15 * 60 * 1000 (15分钟)

    @value("${jwt.refresh-token-expiry}")
    private long refreshtokenexpiry; // 7 * 24 * 3600 * 1000 (7天)

    /**
     * 生成access token
     */
    public string generateaccesstoken(long userid, string username,
                                       list<string> roles, list<string> permissions) {
        map<string, object> claims = new hashmap<>();
        claims.put("sub", string.valueof(userid));
        claims.put("username", username);
        claims.put("roles", roles);
        claims.put("permissions", permissions);
        claims.put("jti", uuid.randomuuid().tostring());

        return jwts.builder()
            .setclaims(claims)
            .setissuedat(new date())
            .setexpiration(new date(system.currenttimemillis() + accesstokenexpiry))
            .signwith(signaturealgorithm.hs256, secret)
            .compact();
    }

    /**
     * 生成refresh token
     */
    public string generaterefreshtoken(long userid, int tokenversion) {
        map<string, object> claims = new hashmap<>();
        claims.put("sub", string.valueof(userid));
        claims.put("tokenversion", tokenversion);
        claims.put("jti", uuid.randomuuid().tostring());

        return jwts.builder()
            .setclaims(claims)
            .setissuedat(new date())
            .setexpiration(new date(system.currenttimemillis() + refreshtokenexpiry))
            .signwith(signaturealgorithm.hs256, secret)
            .compact();
    }

    /**
     * 解析token（验证签名+过期）
     */
    public claims parsetoken(string token) {
        return jwts.parser()
            .setsigningkey(secret)
            .parseclaimsjws(token)
            .getbody();
    }

    /**
     * 判断token是否过期
     */
    public boolean istokenexpired(string token) {
        try {
            claims claims = parsetoken(token);
            return claims.getexpiration().before(new date());
        } catch (expiredjwtexception e) {
            return true;
        }
    }

    public string extractuserid(string token) {
        return parsetoken(token).getsubject();
    }

    public string extractjti(string token) {
        return parsetoken(token).getid();
    }
}

@data
public class loginuser implements userdetails {

    private long id;
    private string username;
    private string password;
    private list<string> roles;
    private list<string> permissions;
    private integer status;

    public loginuser(user user, list<string> roles, list<string> permissions) {
        this.id = user.getid();
        this.username = user.getusername();
        this.password = user.getpassword();
        this.roles = roles;
        this.permissions = permissions;
        this.status = user.getstatus();
    }

    @override
    public collection<? extends grantedauthority> getauthorities() {
        list<grantedauthority> authorities = new arraylist<>();
        roles.foreach(r -> authorities.add(new simplegrantedauthority("role_" + r)));
        permissions.foreach(p -> authorities.add(new simplegrantedauthority(p)));
        return authorities;
    }

    @override
    public string getpassword() { return password; }

    @override
    public string getusername() { return username; }

    @override
    public boolean isaccountnonexpired() { return true; }

    @override
    public boolean isaccountnonlocked() { return status == 1; }

    @override
    public boolean iscredentialsnonexpired() { return true; }

    @override
    public boolean isenabled() { return status == 1; }
}

# 1. refresh token存储（用户维度）
key: auth:refresh:{userid}
value: refreshtokenstring
ttl: 7天
# 2. access token黑名单（token维度，用于登出后使token失效）
key: auth:blacklist:{jti}
value: 1
ttl: access token剩余有效期（最多30分钟）
# 3. token版本号（用户维度，用于批量失效所有token）
key: auth:token:version:{userid}
value: versionnumber
ttl: 30天
# 4. 登录失败计数（用于防 暴 力 破 解）
key: auth:login:fail:{username}
value: failcount
ttl: 15分钟

post /auth/login
content-type: application/json
{
  "username": "zhangsan",
  "password": "***"
}

usernamepasswordauthenticationtoken authrequest = 
    new usernamepasswordauthenticationtoken(username, password);

authentication authentication = authenticationmanager.authenticate(authrequest);

@override
public userdetails loaduserbyusername(string username) {
    user user = usermapper.selectbyusername(username);
    if (user == null) {
        throw new usernamenotfoundexception("用户不存在");
    }
    // 查询用户的角色和权限
    list<string> permissions = permissionmapper.selectbyuserid(user.getid());
    return new loginuser(user, permissions);
}

// daoauthenticationprovider内部调用
passwordencoder.matches(rawpassword, encodedpassword)
// bcrypt加密，每次结果不同（加盐），不可逆

// 生成access token（有效期15分钟）
string accesstoken = jwtutil.generateaccesstoken(user.getid(), 
    user.getusername(), roles, permissions);

// 生成refresh token（有效期7天）
string refreshtoken = jwtutil.generaterefreshtoken(user.getid());

redistemplate.opsforvalue().set(
    "auth:refresh:" + user.getid(),
    refreshtoken,
    7, timeunit.days
);

responsecookie refreshcookie = responsecookie.from("refreshtoken", refreshtoken)
    .httponly(true)      // js无法读取（防xss）
    .secure(true)        // 只在https下传输
    .samesite("strict")  // 防csrf
    .path("/")
    .maxage(7 * 24 * 3600)
    .build();
response.addheader("set-cookie", refreshcookie.tostring());

{
  "code": 200,
  "data": {
    "accesstoken": "eyjhbgcioijiuzi1niis...",
    "user": {
      "id": 1001,
      "username": "zhangsan",
      "roles": ["admin", "user"],
      "permissions": ["blog:read", "blog:write", "user:manage"]
    }
  }
}

// access token存在内存变量中（刷新页面会丢失，需要重新用refresh token获取）
const accesstoken = response.data.accesstoken;

// refresh token在httponly cookie中（前端代码无法访问，但浏览器会自动携带）
// 前端不需要做任何处理！

@restcontroller
@requestmapping("/auth")
@slf4j
public class authenticationcontroller {

    @autowired
    private authenticationmanager authenticationmanager;
    @autowired
    private jwtutil jwtutil;
    @autowired
    private userservice userservice;
    @autowired
    private redistemplate<string, string> redistemplate;

    private static final int max_login_fail = 5;
    private static final int login_fail_lock_minutes = 15;

    @postmapping("/login")
    public result<loginvo> login(@requestbody logindto dto, httpservletresponse response) {
        // 1. 检查登录失败次数
        string failkey = "auth:login:fail:" + dto.getusername();
        string failcount = redistemplate.opsforvalue().get(failkey);
        if (failcount != null && integer.parseint(failcount) >= max_login_fail) {
            return result.fail("登录失败次数过多，请稍后重试");
        }
        // 2. 认证
        authentication authentication;
        try {
            authentication = authenticationmanager.authenticate(
                new usernamepasswordauthenticationtoken(dto.getusername(), dto.getpassword()));
        } catch (badcredentialsexception e) {
            redistemplate.opsforvalue().increment(failkey);
            redistemplate.expire(failkey, login_fail_lock_minutes, timeunit.minutes);
            return result.fail("用户名或密码错误");
        }
        redistemplate.delete(failkey);
        // 3. 生成token对
        loginuser loginuser = (loginuser) authentication.getprincipal();
        int version = gettokenversion(loginuser.getid());
        string accesstoken = jwtutil.generateaccesstoken(loginuser.getid(),
            loginuser.getusername(), loginuser.getroles(), loginuser.getpermissions());
        string refreshtoken = jwtutil.generaterefreshtoken(loginuser.getid(), version);
        // 4. 存redis + 设cookie
        redistemplate.opsforvalue().set("auth:refresh:" + loginuser.getid(), refreshtoken, 7, timeunit.days);
        setrefreshtokencookie(response, refreshtoken);
        return result.ok(new loginvo(accesstoken, loginuser.touserinfovo()));
    }

    @postmapping("/refresh")
    public result<tokenvo> refresh(
            @cookievalue(value = "refreshtoken", required = false) string refreshtoken,
            httpservletresponse response) {
        if (refreshtoken == null) return result.fail(401, "缺少refresh token");
        claims claims;
        try { claims = jwtutil.parsetoken(refreshtoken); }
        catch (expiredjwtexception e) { return result.fail(401, "refresh token已过期"); }
        catch (exception e) { return result.fail(401, "refresh token无效"); }
        string userid = claims.getsubject();
        string stored = redistemplate.opsforvalue().get("auth:refresh:" + userid);
        if (stored == null || !stored.equals(refreshtoken)) return result.fail(401, "token已被撤销");
        integer currentver = gettokenversion(long.parselong(userid));
        if (!currentver.equals(claims.get("tokenversion", integer.class))) return result.fail(401, "版本不匹配");
        loginuser user = userservice.loaduserbyid(long.parselong(userid));
        string newaccess = jwtutil.generateaccesstoken(user.getid(), user.getusername(), user.getroles(), user.getpermissions());
        string newrefresh = jwtutil.generaterefreshtoken(user.getid(), currentver);
        redistemplate.opsforvalue().set("auth:refresh:" + userid, newrefresh, 7, timeunit.days);
        setrefreshtokencookie(response, newrefresh);
        return result.ok(new tokenvo(newaccess));
    }

    @postmapping("/logout")
    public result<void> logout(httpservletrequest request, httpservletresponse response) {
        string header = request.getheader("authorization");
        if (header != null && header.startswith("bearer ")) {
            try {
                claims claims = jwtutil.parsetoken(header.substring(7));
                long remaining = claims.getexpiration().gettime() - system.currenttimemillis();
                if (remaining > 0) redistemplate.opsforvalue().set("auth:blacklist:" + claims.getid(), "1", remaining, timeunit.milliseconds);
                redistemplate.delete("auth:refresh:" + claims.getsubject());
            } catch (exception ignored) {}
        }
        clearrefreshtokencookie(response);
        return result.ok();
    }

    @postmapping("/logout-all")
    @preauthorize("isauthenticated()")
    public result<void> logoutall() {
        string userid = securitycontextholder.getcontext().getauthentication().getprincipal().tostring();
        redistemplate.opsforvalue().increment("auth:token:version:" + userid);
        redistemplate.expire("auth:token:version:" + userid, 30, timeunit.days);
        redistemplate.delete("auth:refresh:" + userid);
        return result.ok();
    }

    private int gettokenversion(long userid) {
        string v = redistemplate.opsforvalue().get("auth:token:version:" + userid);
        return v != null ? integer.parseint(v) : 0;
    }

    private void setrefreshtokencookie(httpservletresponse response, string token) {
        response.addheader("set-cookie",
            responsecookie.from("refreshtoken", token)
                .httponly(true).secure(true).samesite("strict").path("/").maxage(7*24*3600).tostring());
    }

    private void clearrefreshtokencookie(httpservletresponse response) {
        response.addheader("set-cookie",
            responsecookie.from("refreshtoken", "")
                .httponly(true).secure(true).samesite("strict").path("/").maxage(0).tostring());
    }
}

// stores/auth.ts
import { definestore } from 'pinia';
import axios from 'axios';

export const useauthstore = definestore('auth', {
  state: () => ({
    accesstoken: null as string | null,  // 内存变量，刷新页面丢失
    user: null as any,
    isrefreshing: false,
    failedqueue: [] as array<{ resolve: function; reject: function }>,
  }),
  getters: {
    isauthenticated: (s) => !!s.accesstoken,
    hasrole: (s) => (role: string) => s.user?.roles?.includes(role) ?? false,
    haspermission: (s) => (perm: string) => s.user?.permissions?.includes(perm) ?? false,
  },
  actions: {
    async login(username: string, password: string) {
      const res = await axios.post('/auth/login', { username, password });
      this.accesstoken = res.data.data.accesstoken;
      this.user = res.data.data.userinfo;
      axios.defaults.headers.common['authorization'] = `bearer ${this.accesstoken}`;
    },
    async refreshtoken() {
      const res = await axios.post('/auth/refresh');
      this.accesstoken = res.data.data.accesstoken;
      axios.defaults.headers.common['authorization'] = `bearer ${this.accesstoken}`;
      return this.accesstoken;
    },
    async logout() {
      try { await axios.post('/auth/logout'); } catch {}
      this.accesstoken = null;
      this.user = null;
      delete axios.defaults.headers.common['authorization'];
    },
    processqueue(error: any, token: string | null) {
      this.failedqueue.foreach(({ resolve, reject }) => error ? reject(error) : resolve(token));
      this.failedqueue = [];
    },
  },
});

// axios拦截器配置（在main.ts中初始化）
let isrefreshing = false;
axios.interceptors.response.use(
  (res) => res,
  async (error) => {
    const original = error.config;
    if (error.response?.status === 401 && !original._retry && original.url !== '/auth/refresh') {
      if (isrefreshing) {
        return new promise((resolve, reject) => {
          useauthstore().failedqueue.push({ resolve, reject });
        }).then((token) => {
          original.headers.authorization = `bearer ${token}`;
          return axios(original);
        });
      }
      original._retry = true;
      isrefreshing = true;
      try {
        const newtoken = await useauthstore().refreshtoken();
        useauthstore().processqueue(null, newtoken);
        original.headers.authorization = `bearer ${newtoken}`;
        return axios(original);
      } catch (e) {
        useauthstore().processqueue(e, null);
        useauthstore().logout();
        window.location.href = '/login';
        return promise.reject(e);
      } finally {
        isrefreshing = false;
      }
    }
    return promise.reject(error);
  }
);

@component
public class jwtauthenticationfilter extends onceperrequestfilter {

    @autowired
    private jwtutil jwtutil;
    @autowired
    private redistemplate<string, string> redistemplate;

    @override
    protected void dofilterinternal(httpservletrequest request,
                                     httpservletresponse response,
                                     filterchain filterchain)
            throws servletexception, ioexception {

        // 1. 提取token
        string authheader = request.getheader("authorization");
        if (authheader == null || !authheader.startswith("bearer ")) {
            filterchain.dofilter(request, response);  // 没有token，放行（后续过滤器处理）
            return;
        }
        string token = authheader.substring(7);

        try {
            // 2. 解析token（验签 + 检查过期）
            claims claims = jwtutil.parsetoken(token);
            string jti = claims.getid();
            string userid = claims.getsubject();

            // 3. 检查redis黑名单（是否已登出）
            if (boolean.true.equals(redistemplate.haskey("auth:blacklist:" + jti))) {
                throw new runtimeexception("token已被撤销");
            }

            // 4. 提取权限信息
            list<string> roles = claims.get("roles", list.class);
            list<string> permissions = claims.get("permissions", list.class);
            list<grantedauthority> authorities = new arraylist<>();
            roles.foreach(r -> authorities.add(new simplegrantedauthority("role_" + r)));
            permissions.foreach(p -> authorities.add(new simplegrantedauthority(p)));

            // 5. 构建authentication对象
            usernamepasswordauthenticationtoken authentication =
                new usernamepasswordauthenticationtoken(userid, null, authorities);
            authentication.setdetails(claims);

            // 6. 设置到securitycontext
            securitycontextholder.getcontext().setauthentication(authentication);

        } catch (exception e) {
            // token无效，不设置authentication，后续会返回401
            log.warn("jwt验证失败: {}", e.getmessage());
        }

        // 7. 继续执行过滤链
        filterchain.dofilter(request, response);
    }
}

请求到达
    │
    ▼
有authorization头？
    │
    ├── 否 → 直接放行（后续检查是否permitall）
    │
    ▼ 是
解析jwt
    │
    ├── 解析失败（签名错误/格式错误）→ 不设置认证，放行 → 401
    │
    ├── token过期 → 不设置认证，放行 → 401 token_expired
    │
    ├── 在redis黑名单中 → 不设置认证，放行 → 401 token_revoked
    │
    ▼ 有效
提取用户信息 + 权限
    │
    ▼
创建authentication对象，放入securitycontext
    │
    ▼
继续执行过滤链 → controller处理请求
    │
    ▼
@preauthorize检查权限 → 通过则返回数据 / 不通过则403

post /auth/refresh
cookie: refreshtoken=eyjhbgcioijiuzi1niis...

@postmapping("/auth/refresh")
public result<tokenvo> refreshtoken(
        @cookievalue("refreshtoken") string refreshtoken,
        httpservletresponse response) {
    
    // 1. 验证refresh token签名和过期
    claims claims;
    try {
        claims = jwtutil.parsetoken(refreshtoken);
    } catch (expiredjwtexception e) {
        return result.fail(401, "refresh token已过期，请重新登录");
    } catch (exception e) {
        return result.fail(401, "refresh token无效");
    }
    
    string userid = claims.getsubject();
    
    // 2. 检查redis中是否存在（是否被撤销）
    string storedtoken = redistemplate.opsforvalue().get("auth:refresh:" + userid);
    if (storedtoken == null || !storedtoken.equals(refreshtoken)) {
        return result.fail(401, "refresh token已被撤销");
    }
    
    // 3. 检查tokenversion（是否被批量撤销）
    integer currentversion = redistemplate.opsforvalue().get("auth:token:version:" + userid);
    integer tokenversion = claims.get("tokenversion", integer.class);
    if (currentversion != null && !currentversion.equals(tokenversion)) {
        return result.fail(401, "token版本不匹配，请重新登录");
    }
    
    // 4. 生成新的token对（rotation：轮转）
    user user = userservice.getbyid(long.parselong(userid));
    string newaccesstoken = jwtutil.generateaccesstoken(user);
    string newrefreshtoken = jwtutil.generaterefreshtoken(user);
    
    // 5. 更新redis（旧的refresh token自动失效）
    redistemplate.opsforvalue().set(
        "auth:refresh:" + userid, 
        newrefreshtoken, 
        7, timeunit.days
    );
    
    // 6. 设置新的cookie
    setrefreshtokencookie(response, newrefreshtoken);
    
    // 7. 返回新的access token
    return result.ok(new tokenvo(newaccesstoken));
}

// axios响应拦截器
let isrefreshing = false;
let failedqueue = [];

const processqueue = (error, token = null) => {
    failedqueue.foreach(prom => {
        if (error) {
            prom.reject(error);
        } else {
            prom.resolve(token);
        }
    });
    failedqueue = [];
};

axios.interceptors.response.use(
    response => response,
    async error => {
        const originalrequest = error.config;
        
        // 如果是401且不是刷新请求本身，且没有重试过
        if (error.response?.status === 401 
            && !originalrequest._retry 
            && originalrequest.url !== '/auth/refresh') {
            
            if (isrefreshing) {
                // 正在刷新中，将请求加入队列
                return new promise((resolve, reject) => {
                    failedqueue.push({ resolve, reject });
                }).then(token => {
                    originalrequest.headers.authorization = 'bearer ' + token;
                    return axios(originalrequest);
                });
            }
            
            originalrequest._retry = true;
            isrefreshing = true;
            
            try {
                // 调用刷新接口
                const res = await axios.post('/auth/refresh');
                const newtoken = res.data.data.accesstoken;
                
                // 更新内存中的token
                store.setaccesstoken(newtoken);
                
                // 重试队列中的请求
                processqueue(null, newtoken);
                
                // 重试原始请求
                originalrequest.headers.authorization = 'bearer ' + newtoken;
                return axios(originalrequest);
                
            } catch (refresherror) {
                processqueue(refresherror, null);
                // refresh token也过期了，跳转登录页
                store.logout();
                router.push('/login');
                return promise.reject(refresherror);
            } finally {
                isrefreshing = false;
            }
        }
        
        return promise.reject(error);
    }
);

// 在app启动时设置定时器
const access_token_expiry = 14 * 60 * 1000; // 14分钟（token有效期15分钟，提前1分钟刷新）
setinterval(async () => {
  if (useauthstore().isauthenticated) {
    try {
      await useauthstore().refreshtoken();
    } catch (e) {
      console.warn('token refresh failed:', e);
    }
  }
}, access_token_expiry);

@postmapping("/auth/logout")
public result<void> logout(httpservletrequest request, httpservletresponse response) {
    // 1. 从当前请求中获取access token
    string authheader = request.getheader("authorization");
    string accesstoken = authheader.substring(7);
    claims claims = jwtutil.parsetoken(accesstoken);
    string jti = claims.getid();
    string userid = claims.getsubject();
    
    // 2. 将access token的jti加入黑名单
    // ttl设为token的剩余有效期（过期后自动清理）
    long remainingtime = claims.getexpiration().gettime() - system.currenttimemillis();
    if (remainingtime > 0) {
        redistemplate.opsforvalue().set(
            "auth:blacklist:" + jti, 
            "1", 
            remainingtime, timeunit.milliseconds
        );
    }
    
    // 3. 删除redis中的refresh token
    redistemplate.delete("auth:refresh:" + userid);
    
    // 4. 清除cookie
    responsecookie clearcookie = responsecookie.from("refreshtoken", "")
        .httponly(true)
        .secure(true)
        .samesite("strict")
        .path("/")
        .maxage(0)  // 立即过期
        .build();
    response.addheader("set-cookie", clearcookie.tostring());
    
    return result.ok();
}

@postmapping("/auth/logout-all")
public result<void> logoutalldevices(@authenticationprincipal string userid) {
    // 递增tokenversion，所有旧版本的token都会失效
    string key = "auth:token:version:" + userid;
    redistemplate.opsforvalue().increment(key);
    redistemplate.expire(key, 30, timeunit.days);
    
    // 删除refresh token
    redistemplate.delete("auth:refresh:" + userid);
    
    return result.ok();
}

-- 用户表
create table sys_user (
    id bigint primary key auto_increment,
    username varchar(50) unique not null,
    password varchar(100) not null,  -- bcrypt加密
    status tinyint default 1,
    created_at datetime default current_timestamp
);
-- 角色表
create table sys_role (
    id bigint primary key auto_increment,
    role_name varchar(50) not null,
    role_key varchar(50) unique not null  -- 如 admin, user
);
-- 权限表
create table sys_permission (
    id bigint primary key auto_increment,
    perm_name varchar(100) not null,
    perm_key varchar(100) unique not null  -- 如 blog:read, blog:write
);
-- 用户-角色关联表
create table sys_user_role (
    user_id bigint not null,
    role_id bigint not null,
    primary key (user_id, role_id)
);
-- 角色-权限关联表
create table sys_role_permission (
    role_id bigint not null,
    perm_id bigint not null,
    primary key (role_id, perm_id)
);

public string generateaccesstoken(loginuser loginuser) {
    map<string, object> claims = new hashmap<>();
    claims.put("sub", string.valueof(loginuser.getuser().getid()));
    claims.put("username", loginuser.getusername());
    claims.put("roles", loginuser.getroles());          // ["admin", "user"]
    claims.put("permissions", loginuser.getpermissions()); // ["blog:read", "blog:write"]
    claims.put("jti", uuid.randomuuid().tostring());
    
    return jwts.builder()
        .setclaims(claims)
        .setissuedat(new date())
        .setexpiration(new date(system.currenttimemillis() + 15 * 60 * 1000))
        .signwith(signaturealgorithm.hs256, secret)
        .compact();
}

// router/guard.ts — 路由守卫
import { useauthstore } from '@/stores/auth';
import router from '@/router';

// 动态路由表（根据权限生成）
const asyncroutes = [
  {
    path: '/admin',
    component: () => import('@/layouts/adminlayout.vue'),
    meta: { roles: ['admin'] },  // 需要admin角色
    children: [
      { path: 'users', component: () => import('@/views/admin/users.vue'), meta: { roles: ['admin'] } },
      { path: 'roles', component: () => import('@/views/admin/roles.vue'), meta: { roles: ['admin'] } },
    ]
  },
  {
    path: '/blog',
    component: () => import('@/layouts/mainlayout.vue'),
    children: [
      { path: 'list', component: () => import('@/views/blog/list.vue') },  // 已登录即可
      { path: 'create', component: () => import('@/views/blog/create.vue'), meta: { permissions: ['blog:write'] } },
      { path: 'edit/:id', component: () => import('@/views/blog/edit.vue'), meta: { permissions: ['blog:write'] } },
    ]
  },
];

// 路由前置守卫
router.beforeeach(async (to, from, next) => {
  const authstore = useauthstore();

  // 1. 白名单直接放行
  if (['/login', '/register', '/404'].includes(to.path)) return next();

  // 2. 未登录 -> 尝试用refresh token恢复
  if (!authstore.isauthenticated) {
    try {
      await authstore.refreshtoken();
    } catch {
      return next('/login');
    }
  }

  // 3. 首次访问 -> 加载动态路由
  if (!router.hasroute('admin')) {
    asyncroutes.foreach(route => {
      if (!route.meta?.roles || authstore.hasrole(route.meta.roles[0])) {
        router.addroute(route);
      }
    });
    return next({ ...to, replace: true });  // 重新进入以匹配新路由
  }

  // 4. 检查路由权限
  if (to.meta?.roles && !to.meta.roles.some((r: string) => authstore.hasrole(r))) {
    return next('/403');
  }
  if (to.meta?.permissions && !to.meta.permissions.some((p: string) => authstore.haspermission(p))) {
    return next('/403');
  }

  next();
});

<!-- 权限按钮组件 components/permbutton.vue -->
<template>
  <button v-if="hasperm" @click="$emit('click')" :class="btnclass">
    <slot />
  </button>
</template>
<script setup lang="ts">
import { computed } from 'vue';
import { useauthstore } from '@/stores/auth';
const props = defineprops<{
  permission?: string;  // 如 'blog:write'
  role?: string;        // 如 'admin'
  btnclass?: string;
}>();
const authstore = useauthstore();
const hasperm = computed(() => {
  if (props.permission) return authstore.haspermission(props.permission);
  if (props.role) return authstore.hasrole(props.role);
  return true;
});
</script>
<!-- 使用：只有有blog:write权限的用户才能看到“编辑”按钮 -->
<!-- <permbutton permission="blog:write" @click="editblog">编辑</permbutton> -->

@restcontroller
@requestmapping("/api/blog")
public class blogcontroller {

    // 只有admin角色才能访问
    @preauthorize("hasrole('admin')")
    @deletemapping("/{id}")
    public result<void> deleteblog(@pathvariable long id) {
        blogservice.delete(id);
        return result.ok();
    }

    // 需要blog:write权限
    @preauthorize("hasauthority('blog:write')")
    @postmapping
    public result<void> createblog(@requestbody blogdto dto) {
        blogservice.create(dto);
        return result.ok();
    }

    // 自定义权限表达式：只能操作自己的博客
    @preauthorize("#blog.userid == authentication.principal")
    @putmapping("/{id}")
    public result<void> updateblog(@pathvariable long id, @requestbody blogdto dto) {
        blogservice.update(id, dto);
        return result.ok();
    }

    // 已登录即可访问
    @preauthorize("isauthenticated()")
    @getmapping("/{id}")
    public result<blogvo> getblog(@pathvariable long id) {
        return result.ok(blogservice.getbyid(id));
    }
}

@configuration
@enablemethodsecurity  // 启用方法级权限控制
public class securityconfig {

    @autowired
    private jwtauthenticationfilter jwtauthenticationfilter;
    
    @autowired
    private authenticationentrypoint authentrypoint;
    
    @autowired
    private accessdeniedhandler accessdeniedhandler;

    @bean
    public securityfilterchain filterchain(httpsecurity http) throws exception {
        http
            // 禁用csrf（jwt api不需要）
            .csrf(csrf -> csrf.disable())
            
            // 无状态session（不使用session）
            .sessionmanagement(session -> 
                session.sessioncreationpolicy(sessioncreationpolicy.stateless))
            
            // 请求授权规则
            .authorizehttprequests(auth -> auth
                // 公开接口
                .requestmatchers("/auth/login", "/auth/refresh").permitall()
                .requestmatchers("/public/**").permitall()
                .requestmatchers("/actuator/health").permitall()
                // 管理接口
                .requestmatchers("/admin/**").hasrole("admin")
                // 其他所有请求需要认证
                .anyrequest().authenticated()
            )
            
            // 异常处理
            .exceptionhandling(exception -> exception
                .authenticationentrypoint(authentrypoint)  // 401
                .accessdeniedhandler(accessdeniedhandler)  // 403
            )
            
            // 添加jwt过滤器（在usernamepasswordauthenticationfilter之前）
            .addfilterbefore(jwtauthenticationfilter, 
                usernamepasswordauthenticationfilter.class);
        
        return http.build();
    }

    @bean
    public passwordencoder passwordencoder() {
        return new bcryptpasswordencoder();  // 密码加密
    }
    
    @bean
    public authenticationmanager authenticationmanager(
            authenticationconfiguration config) throws exception {
        return config.getauthenticationmanager();
    }
}

@component
public class authentrypoint implements authenticationentrypoint {
    @override
    public void commence(httpservletrequest request, 
                         httpservletresponse response,
                         authenticationexception authexception) throws ioexception {
        response.setcontenttype("application/json;charset=utf-8");
        response.setstatus(401);
        response.getwriter().write("{\"code\":401,\"message\":\"未认证，请先登录\"}");
    }
}

@component
public class customaccessdeniedhandler implements accessdeniedhandler {
    @override
    public void handle(httpservletrequest request, 
                       httpservletresponse response,
                       accessdeniedexception accessdeniedexception) throws ioexception {
        response.setcontenttype("application/json;charset=utf-8");
        response.setstatus(403);
        response.getwriter().write("{\"code\":403,\"message\":\"权限不足\"}");
    }
}

responsecookie cookie = responsecookie.from("refreshtoken", token)
    .httponly(true)       // js无法通过document.cookie读取（防xss）
    .secure(true)         // 只在https连接下传输（防中间人）
    .samesite("strict")   // 跨站请求不携带cookie（防csrf）
    .path("/")            // cookie的作用路径
    .maxage(7 * 24 * 3600) // 7天过期
    .build();

// bcrypt加密（每次结果不同，因为加了随机盐）
string encoded = passwordencoder.encode("mypassword");
// $2a$10$n9qo8uloickgx2zmrzomyeijzagcfl7p92ldgxad68ljzdl17lhwy

// 验证
boolean matches = passwordencoder.matches("mypassword", encoded); // true