Spring Boot中医生-患者关系的高效数据模型与安全实践

import javax.persistence.*;
import lombok.Getter;
import lombok.Setter;

@Entity
@Table(name = "app_users") // 避免与数据库保留字冲突
@Getter
@Setter
public class User {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(unique = true, nullable = false)
    private String username; // 用户名，用于登录

    @Column(nullable = false)
    private String password; // 密码，应加密存储

    private String name;
    private String surname;

    @Enumerated(EnumType.STRING)
    @Column(nullable = false)
    private UserType userType; // 用户类型，如医生、患者
}

// UserType 枚举定义
public enum UserType {
    DOCTOR,
    PATIENT,
    ADMIN // 可根据需求扩展
}

import javax.persistence.*;
import java.util.HashSet;
import java.util.Set;
import lombok.Getter;
import lombok.Setter;

@Entity
@Getter
@Setter
public class Doctor {
    @Id
    private Long id; // 与User的ID保持一致

    @OneToOne
    @MapsId // 表示Doctor的主键也是其关联User的外键
    @JoinColumn(name = "id") // 外键列名
    private User user;

    @ManyToMany(cascade = {CascadeType.PERSIST, CascadeType.MERGE})
    @JoinTable(
        name = "doctor_patient", // 中间表名
        joinColumns = @JoinColumn(name = "doctor_id"), // 医生在中间表中的列名
        inverseJoinColumns = @JoinColumn(name = "patient_id") // 患者在中间表中的列名
    )
    private Set<Patient> patients = new HashSet<>();

    // 辅助方法，用于维护双向关系
    public void addPatient(Patient patient) {
        this.patients.add(patient);
        patient.getDoctors().add(this);
    }

    public void removePatient(Patient patient) {
        this.patients.remove(patient);
        patient.getDoctors().remove(this);
    }
}

import javax.persistence.*;
import java.util.HashSet;
import java.util.Set;
import lombok.Getter;
import lombok.Setter;

@Entity
@Getter
@Setter
public class Patient {
    @Id
    private Long id; // 与User的ID保持一致

    @OneToOne
    @MapsId
    @JoinColumn(name = "id")
    private User user;

    @ManyToMany(mappedBy = "patients", fetch = FetchType.LAZY) // 由Doctor实体中的patients字段映射
    private Set<Doctor> doctors = new HashSet<>();

    @ManyToMany(cascade = {CascadeType.PERSIST, CascadeType.MERGE})
    @JoinTable(
        name = "patient_medicine",
        joinColumns = @JoinColumn(name = "patient_id"),
        inverseJoinColumns = @JoinColumn(name = "medicine_id")
    )
    private Set<Medicine> medicines = new HashSet<>();

    // 辅助方法，用于维护双向关系
    public void addMedicine(Medicine medicine) {
        this.medicines.add(medicine);
        medicine.getPatients().add(this);
    }

    public void removeMedicine(Medicine medicine) {
        this.medicines.remove(medicine);
        medicine.getPatients().remove(this);
    }
}

import javax.persistence.*;
import java.util.HashSet;
import java.util.Set;
import lombok.Getter;
import lombok.Setter;

@Entity
@Getter
@Setter
public class Medicine {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    private String name;

    @ManyToMany(mappedBy = "medicines", fetch = FetchType.LAZY) // 由Patient实体中的medicines字段映射
    private Set<Patient> patients = new HashSet<>();
}

import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.stereotype.Service;
import java.util.Collections;
import java.util.List;
import java.util.stream.Collectors;

@Service
public class CustomUserDetailsService implements UserDetailsService {

    private final UserRepository userRepository; // 假设您有一个UserRepository接口

    public CustomUserDetailsService(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userRepository.findByUsername(username)
                .orElseThrow(() -> new UsernameNotFoundException("用户未找到: " + username));

        // 根据UserType构建Spring Security的权限列表
        List<SimpleGrantedAuthority> authorities = Collections.singletonList(
            new SimpleGrantedAuthority("ROLE_" + user.getUserType().name())
        );

        // 返回Spring Security的User对象
        return new org.springframework.security.core.userdetails.User(
                user.getUsername(),
                user.getPassword(), // 密码应为加密后的形式
                authorities
        );
    }
}

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Service;
import java.util.Optional;

@Service
public class HealthCareService {

    private final UserRepository userRepository;
    private final DoctorRepository doctorRepository; // 假设有DoctorRepository
    private final PatientRepository patientRepository; // 假设有PatientRepository

    public HealthCareService(UserRepository userRepository, DoctorRepository doctorRepository, PatientRepository patientRepository) {
        this.userRepository = userRepository;
        this.doctorRepository = doctorRepository;
        this.patientRepository = patientRepository;
    }

    // 医生特有操作：查看其所有患者
    @PreAuthorize