Authentication

// 手写做法：混乱且不统一
HttpSession session = request.getSession();
session.setAttribute("user", username);           // 项目A这么写
session.setAttribute("loginUser", userObj);       // 项目B这么写
session.setAttribute("currentUser", userId);        // 项目C这么写
session.setAttribute("roles", roleList);            // 有的单独存权限

UsernamePasswordAuthenticationToken token = 
    new UsernamePasswordAuthenticationToken("zhangsan", "123456");
// token.getPrincipal() → "zhangsan"（String 类型）
// token.getCredentials() → "123456"（String 类型）
// token.isAuthenticated() → false

// DaoAuthenticationProvider 验证通过后新建的 Token
UsernamePasswordAuthenticationToken authenticatedToken = 
    new UsernamePasswordAuthenticationToken(
        userDetails,                    // principal → UserDetails 对象
        null,                           // credentials → 已擦除
        userDetails.getAuthorities()    // authorities → 权限列表
    );
// authenticatedToken.getPrincipal() → UserDetails 对象
// authenticatedToken.isAuthenticated() → true

// 认证成功后，credentials 被擦除
System.out.println(auth.getCredentials());  // 输出 null（不是 Bug，是安全设计）

// 认证前
Collection<? extends GrantedAuthority> authorities = token.getAuthorities();
// authorities → 空集合（不可修改的空列表）

// 认证后
Collection<? extends GrantedAuthority> authorities = auth.getAuthorities();
// authorities → [ROLE_STUDENT, ROLE_USER]（从 UserDetails 复制）

// 默认的 WebAuthenticationDetails 包含 IP 和 SessionId
Object details = auth.getDetails();
if (details instanceof WebAuthenticationDetails) {
    WebAuthenticationDetails webDetails = (WebAuthenticationDetails) details;
    System.out.println("IP: " + webDetails.getRemoteAddress());
    System.out.println("SessionId: " + webDetails.getSessionId());
}

// ❌ 错误：自定义 Token 时直接设为 true，可能触发安全警告
token.setAuthenticated(true);
// 异常：Cannot set this token to trusted - use constructor which takes a GrantedAuthority list instead

// ✅ 正确：通过构造函数标记已认证状态
new UsernamePasswordAuthenticationToken(principal, credentials, authorities);

// 源码示意（UsernamePasswordAuthenticationFilter）
UsernamePasswordAuthenticationToken authRequest =
    new UsernamePasswordAuthenticationToken(
        username,     // principal
        password      // credentials
    );
// authRequest.isAuthenticated() → false（默认）

// ProviderManager 核心逻辑（简化）
for (AuthenticationProvider provider : getProviders()) {
    if (provider.supports(authRequest.getClass())) {
        Authentication result = provider.authenticate(authRequest);
        if (result != null) {
            return result;  // 认证成功，返回新的 Authentication
        }
    }
}

// DaoAuthenticationProvider 验证成功后的构造（简化）
UsernamePasswordAuthenticationToken result =
    new UsernamePasswordAuthenticationToken(
        userDetails,                    // principal → UserDetails
        null,                           // credentials → 擦除
        userDetails.getAuthorities()    // authorities → 权限列表
    );
result.setDetails(authRequest.getDetails());  // 保留原 details
// result.isAuthenticated() → true

SecurityContextHolder.getContext().setAuthentication(result);

// 请求结束后，SecurityContext 被存入 Session
HttpSession session = request.getSession();
session.setAttribute("SPRING_SECURITY_CONTEXT", securityContext);

// ❌ 手写做法：混乱、不安全、不可移植
@GetMapping("/profile")
public String profile(HttpSession session) {
    // 项目A：session.getAttribute("user")
    // 项目B：session.getAttribute("loginUser")
    // 项目C：session.getAttribute("currentUser")
    Object user = session.getAttribute("user");
    if (user == null) {
        return "redirect:/login";
    }
    // 权限检查？每个项目自己实现，逻辑不同
    return "profile";
}

@RestController
@RequestMapping("/student")
public class StudentProfileController {

    @GetMapping("/profile")
    public Map<String, Object> getProfile() {
        // 统一获取当前 Authentication（无论认证方式）
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();

        Map<String, Object> result = new HashMap<>();

        // 1. 判断认证状态
        result.put("isAuthenticated", auth.isAuthenticated());
        result.put("authClass", auth.getClass().getSimpleName());

        // 2. 获取 principal 类型
        Object principal = auth.getPrincipal();
        result.put("principalType", principal.getClass().getSimpleName());

        if (principal instanceof UserDetails) {
            UserDetails userDetails = (UserDetails) principal;
            result.put("username", userDetails.getUsername());
            result.put("accountNonExpired", userDetails.isAccountNonExpired());
            result.put("accountNonLocked", userDetails.isAccountNonLocked());
        } else {
            // 匿名用户或 JWT 场景可能返回 String
            result.put("username", principal.toString());
        }

        // 3. 获取权限列表
        Collection<? extends GrantedAuthority> authorities = auth.getAuthorities();
        List<String> authorityList = authorities.stream()
            .map(GrantedAuthority::getAuthority)
            .collect(Collectors.toList());
        result.put("authorities", authorityList);

        // 4. credentials（认证后已被擦除）
        result.put("credentials", auth.getCredentials());  // 通常为 null

        // 5. details（额外上下文）
        Object details = auth.getDetails();
        if (details instanceof WebAuthenticationDetails) {
            WebAuthenticationDetails webDetails = (WebAuthenticationDetails) details;
            result.put("remoteAddress", webDetails.getRemoteAddress());
            result.put("sessionId", webDetails.getSessionId());
        }

        return result;
    }
}

@Service
public class DataCleanupService {

    @PreAuthorize("hasRole('ADMIN')")
    public void cleanupOldRecords() {
        // 清理 90 天前的记录
    }
}

// 定时任务中直接调用
@Component
public class CleanupJob {
    @Autowired
    private DataCleanupService cleanupService;

    @Scheduled(cron = "0 0 2 * * ?")
    public void run() {
        cleanupService.cleanupOldRecords();
        // ❌ 抛出 AccessDeniedException：没有 Authentication 上下文
    }
}

@Component
public class CleanupJob {

    @Autowired
    private DataCleanupService cleanupService;

    @Scheduled(cron = "0 0 2 * * ?")
    public void run() {
        // 1. 构造管理员权限列表
        List<GrantedAuthority> authorities = Arrays.asList(
            new SimpleGrantedAuthority("ROLE_ADMIN"),
            new SimpleGrantedAuthority("ROLE_SYSTEM")
        );

        // 2. 构造已认证的 Authentication Token
        // 注意：使用带 authorities 的构造函数，自动标记 isAuthenticated = true
        UsernamePasswordAuthenticationToken authToken =
            new UsernamePasswordAuthenticationToken(
                "system_admin",     // principal（可以是用户名或 UserDetails）
                null,                // credentials（无需密码，设为 null）
                authorities          // 权限列表
            );

        // 3. 可选：填充额外详情
        authToken.setDetails("ScheduledTask: DataCleanupJob");

        // 4. 存入 SecurityContextHolder
        SecurityContextHolder.getContext().setAuthentication(authToken);

        try {
            // 5. 执行受保护的方法
            cleanupService.cleanupOldRecords();
            System.out.println("数据清理完成");
        } finally {
            // 6. ✅ 必须清理上下文！防止泄漏到后续线程或任务
            SecurityContextHolder.clearContext();
            System.out.println("SecurityContext 已清理");
        }
    }
}

Authentication auth = SecurityContextHolder.getContext().getAuthentication();
System.out.println(auth.getCredentials());  // 输出 null
// 开发者疑惑："密码怎么不见了？是不是认证失败了？"

// 在 ProviderManager 中，认证成功后调用
Authentication result = provider.authenticate(authentication);
if (result != null) {
    // 擦除凭据（如果配置了）
    if (eraseCredentialsAfterAuthentication) {
        eraseCredentials(result);  // 将 credentials 设为 null
    }
    return result;
}

// ❌ 错误：自定义过滤器中直接 setAuthenticated(true)
UsernamePasswordAuthenticationToken token = 
    new UsernamePasswordAuthenticationToken(userDetails, password);
token.setAuthenticated(true);  // 抛出异常！

// ✅ 正确：使用带 authorities 的构造函数
UsernamePasswordAuthenticationToken token = 
    new UsernamePasswordAuthenticationToken(
        userDetails, 
        null, 
        userDetails.getAuthorities()
    );
// 此时 isAuthenticated 自动为 true，无需手动设置

// 安全的手动构造模板
UsernamePasswordAuthenticationToken auth = new UsernamePasswordAuthenticationToken(
    principal, null, authorities
);
SecurityContextHolder.getContext().setAuthentication(auth);
try {
    // 执行受保护操作
} finally {
    SecurityContextHolder.clearContext();
}