在 Spring Security 6 中集成外部数据库进行用户认证

package de.gabriel.vertretungsplan.security;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfiguration {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
                .authorizeHttpRequests((requests) -> requests
                        // 定义不同角色的访问权限
                        .requestMatchers("/vertretungsplan").hasAnyRole("SCHUELER", "LEHRER", "VERWALTUNG")
                        .requestMatchers("/account").hasAnyRole("LEHRER", "VERWALTUNG")
                        .requestMatchers("/administration").hasRole("VERWALTUNG")
                        // 允许所有用户访问根路径
                        .requestMatchers("/").permitAll()
                        // 任何其他请求都需要认证
                        .anyRequest().authenticated()
                )
                .formLogin(form -> form
                        // 可以指定自定义的登录页面路径，例如 "/login"
                        // .loginPage("/login")
                        // 允许所有用户访问登录页面
                        .permitAll()
                );
        return http.build();
    }

    /**
     * 配置密码编码器。强烈建议在生产环境中使用强密码编码器。
     */
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

// src/main/java/your/package/model/UserEntity.java
package your.package.model;

import java.util.List;

public class UserEntity {
    private String username;
    private String password; // 存储加密后的密码
    private List<String> roles; // 例如 "SCHUELER", "LEHRER", "VERWALTUNG"

    public UserEntity(String username, String password, List<String> roles) {
        this.username = username;
        this.password = password;
        this.roles = roles;
    }

    // Getters
    public String getUsername() { return username; }
    public String getPassword() { return password; }
    public List<String> getRoles() { return roles; }

    // Setters (根据需要添加)
}

// src/main/java/your/package/security/CustomUserDetailsService.java
package your.package.security;

import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import your.package.model.UserEntity;
import your.package.repository.UserRepository; // 引入你的用户数据访问接口

import java.util.List;
import java.util.stream.Collectors;

@Service // 声明为一个Spring服务组件，使其可被Spring容器管理
public class CustomUserDetailsService implements UserDetailsService {

    private final UserRepository userRepository; // 注入用户数据访问接口

    public CustomUserDetailsService(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        // 1. 从数据库获取用户实体
        UserEntity userEntity = userRepository.findByUsername(username)
                .orElseThrow(() -> new UsernameNotFoundException("用户未找到: " + username));

        // 2. 将用户实体中的角色转换为 Spring Security 期望的 SimpleGrantedAuthority 列表
        // 注意：Spring Security 默认期望角色以 "ROLE_" 开头，例如 "ROLE_SCHUELER"
        List<SimpleGrantedAuthority> authorities = userEntity.getRoles().stream()
                .map(role -> new SimpleGrantedAuthority("ROLE_" + role))
                .collect(Collectors.toList());

        // 3. 构建并返回 Spring Security 的 UserDetails 对象
        return new org.springframework.security.core.userdetails.User(
                userEntity.getUsername(),    // 用户名
                userEntity.getPassword(),    // 数据库中存储的加密密码
                authorities                  // 用户权限列表
        );
    }
}

// src/main/java/your/package/repository/UserRepository.java
package your.package.repository;

import your.package.model.UserEntity;
import java.util.Optional;

public interface UserRepository {
    Optional<UserEntity> findByUsername(String username);
}

// src/main/java/your/package/repository/JdbcUserRepository.java
package your.package.repository;

import org.springframework.jdbc.core.JdbcTemplate;
import org.springframework.jdbc.core.RowMapper;
import org.springframework.stereotype.Repository;
import your.package.model.UserEntity;

import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.Arrays;
import java.util.List;
import java.util.Optional;

@Repository // 声明为一个Spring数据访问组件
public class JdbcUserRepository implements UserRepository {

    private final JdbcTemplate jdbcTemplate;

    public JdbcUserRepository(JdbcTemplate jdbcTemplate) {
        this.jdbcTemplate = jdbcTemplate;
    }

    @Override
    public Optional<UserEntity> findByUsername(String username) {
        // 假设数据库中有一个名为 'users' 的表，包含 'username', 'password', 'roles' 列
        // 'roles' 列存储逗号分隔的角色字符串，例如 "SCHUELER,LEHRER"
        String sql = "SELECT username, password, roles FROM users WHERE username = ?";
        try {
            return Optional.ofNullable(jdbcTemplate.queryForObject(sql, new UserEntityRowMapper(), username));
        } catch (org.springframework.dao.EmptyResultDataAccessException e) {
            // 如果没有找到用户，JdbcTemplate 会抛出 EmptyResultDataAccessException
            return Optional.empty();
        }
    }

    // 辅助类，用于将 ResultSet 的一行映射到 UserEntity 对象
    private static class UserEntityRowMapper implements RowMapper<UserEntity> {
        @Override
        public UserEntity mapRow(ResultSet rs, int rowNum) throws SQLException {
            String rolesString = rs.getString("roles");
            List<String> roles = Arrays.asList(rolesString.split(",")); // 将逗号分隔的字符串转换为列表
            return new UserEntity(
                    rs.getString("username"),
                    rs.getString("password"),
                    roles
            );