限制JWT刷新令牌访问特定端点：Spring Security教程

@Service
@RequiredArgsConstructor
public class JwtTokenServiceImpl implements JwtTokenService {

    private final JwtEncoder jwtEncoder;

    @Override
    public String generateAccessToken(User user) {
        Instant now = Instant.now();
        // 获取用户现有权限，并拼接成字符串
        String scope = user.getAuthorities().stream()
                .map(GrantedAuthority::getAuthority)
                .collect(Collectors.joining(" "));

        // 为访问令牌额外添加一个“access”权限标识
        String accessScope = scope.concat(" ROLE_access"); // 注意：Spring Security通常以"ROLE_"作为权限前缀

        JwtClaimsSet claims = JwtClaimsSet.builder()
                .issuer("self")
                .issuedAt(now)
                .expiresAt(now.plus(2, ChronoUnit.MINUTES))
                .subject(user.getUsername())
                // 使用统一的声明名称，例如"roles"
                .claim("roles", accessScope) // 将权限信息存储在"roles"声明中
                .build();
        return this.jwtEncoder.encode(JwtEncoderParameters.from(claims)).getTokenValue();
    }

    @Override
    public String generateRefreshToken(User user) {
        Instant now = Instant.now();
        // 刷新令牌仅包含刷新权限
        String scope = "ROLE_REFRESH_TOKEN"; 

        JwtClaimsSet claims = JwtClaimsSet.builder()
                .issuer("self")
                .issuedAt(now)
                .expiresAt(now.plus(10, ChronoUnit.MINUTES))
                .subject(user.getUsername())
                // 同样使用统一的声明名称"roles"
                .claim("roles", scope) // 将权限信息存储在"roles"声明中
                .build();
        return this.jwtEncoder.encode(JwtEncoderParameters.from(claims)).getTokenValue();
    }

    // ... 其他方法保持不变
}

@Configuration
@RequiredArgsConstructor
@EnableWebSecurity
public class WebSecurityConfig {

    // ... 其他配置保持不变

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.cors().and().csrf().disable();
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
        http.exceptionHandling(
                exceptions ->
                        exceptions
                                .authenticationEntryPoint(new BearerTokenAuthenticationEntryPoint())
                                .accessDeniedHandler(new BearerTokenAccessDeniedHandler()));

        http.authorizeHttpRequests()
                .requestMatchers("/auth/sign-in").permitAll()
                .requestMatchers("/auth/sign-up").permitAll()
                // 刷新令牌端点需要ROLE_REFRESH_TOKEN权限
                .requestMatchers("/auth/token/refresh").hasAuthority("ROLE_REFRESH_TOKEN") 
                // 所有其他请求都必须拥有ROLE_access权限
                .anyRequest().hasAuthority("ROLE_access") 
                .and()
                .httpBasic(Customizer.withDefaults())
                .oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt);

        return http.build();
    }

    // ... 其他Bean配置保持不变

    @Bean
    public JwtAuthenticationConverter jwtAuthenticationConverter() {
        var jwtGrantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
        // 确保这里设置的声明名称与JWT中存储权限的声明名称一致
        jwtGrantedAuthoritiesConverter.setAuthoritiesClaimName("roles"); 
        jwtGrantedAuthoritiesConverter.setAuthorityPrefix("ROLE_");

        var jwtAuthenticationConverter = new JwtAuthenticationConverter();
        jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(jwtGrantedAuthoritiesConverter);
        return jwtAuthenticationConverter;
    }

    // ... 其他Bean配置保持不变
}

@RestController
@RequestMapping("/auth")
@RequiredArgsConstructor
public class AuthController {
    // ... 其他字段和方法

    // @PreAuthorize("hasRole('REFRESH_TOKEN')") // 此注解现在可以移除
    @GetMapping("/token/refresh")
    public TokensResponse refreshToken(HttpServletRequest request) {
        String headerAuth = request.getHeader("Authorization");
        String previousRefreshToken = headerAuth.substring(7);

        String username = tokenService.parseToken(previousRefreshToken);
        var user = (User) usrDetailsService.loadUserByUsername(username);
        String accessToken = tokenService.generateAccessToken(user);
        String refreshToken = tokenService.generateRefreshToken(user);

        return new TokensResponse(accessToken, refreshToken);
    }

    // ... 其他方法
}