AnonymousAuthenticationFilter

// AnonymousAuthenticationToken 构造（简化）
AnonymousAuthenticationToken token = new AnonymousAuthenticationToken(
    "anonymousUserKey",           // 唯一标识 key（防止伪造）
    "anonymousUser",              // principal（主体）
    AuthorityUtils.createAuthorityList("ROLE_ANONYMOUS")  // 权限
);
// isAuthenticated() 返回 true（匿名身份被视为已认证的一种特殊状态）

// 在 AccessDecisionManager 或自定义 Voter 中
Authentication auth = SecurityContextHolder.getContext().getAuthentication();

if (auth instanceof AnonymousAuthenticationToken) {
    // 匿名用户
}

// 或在 SpEL 表达式中
// anonymous() → 匹配 AnonymousAuthenticationToken
// authenticated() → 不匹配匿名用户（因为匿名不是真正的认证）

// AnonymousConfigurer 配置（简化）
http.anonymous(anonymous -> anonymous
    .principal("guest")                           // 自定义主体名
    .authorities("ROLE_GUEST", "ROLE_VISITOR")   // 自定义角色
    .key(UUID.randomUUID().toString())            // 自定义 key（增强安全性）
);

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/products/**").permitAll()  // 完全开放，无法区分访客和登录用户
            .requestMatchers("/orders/**").authenticated()
            .anyRequest().authenticated()
        )
        .formLogin(Customizer.withDefaults())
        .anonymous(Customizer.withDefaults());  // 默认 ROLE_ANONYMOUS
    return http.build();
}

@Configuration
@EnableWebSecurity
public class GuestModeConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                // 商品列表：访客和登录用户都能看
                .requestMatchers(HttpMethod.GET, "/products/list").hasAnyRole("GUEST", "USER", "ADMIN")
                // 商品价格：仅登录用户（非访客）
                .requestMatchers(HttpMethod.GET, "/products/*/price").hasAnyRole("USER", "ADMIN")
                // 下单：仅登录用户
                .requestMatchers(HttpMethod.POST, "/orders").hasAnyRole("USER", "ADMIN")
                // 管理后台：仅管理员
                .requestMatchers("/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            .formLogin(Customizer.withDefaults())
            .anonymous(anonymous -> anonymous
                .principal("guest_visitor")
                .authorities("ROLE_GUEST")  // 自定义匿名角色
            );
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
        manager.createUser(User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build());
        manager.createUser(User.withDefaultPasswordEncoder()
            .username("admin")
            .password("password")
            .roles("ADMIN")
            .build());
        return manager;
    }
}

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/public/**").permitAll()
            .anyRequest().authenticated()
        )
        .formLogin(Customizer.withDefaults())
        .anonymous(anonymous -> anonymous.disable());  // 禁用匿名过滤器
    return http.build();
}

@Configuration
@EnableWebSecurity
public class SafeNullHandlingConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/public/**").permitAll()
                .requestMatchers("/api/**").authenticated()
                .anyRequest().authenticated()
            )
            .formLogin(Customizer.withDefaults())
            // 保持匿名过滤器启用（默认已启用，此处显式说明）
            .anonymous(Customizer.withDefaults());
        return http.build();
    }

    // 在自定义组件中安全获取当前用户（无论是否登录）
    @Component
    public class CurrentUserResolver {
        
        public String getCurrentUsernameSafely() {
            Authentication auth = SecurityContextHolder.getContext().getAuthentication();
            
            if (auth == null) {
                // 理论上不会发生（AnonymousAuthenticationFilter 已填充）
                return "system";
            }
            
            if (auth instanceof AnonymousAuthenticationToken) {
                return "anonymous";
            }
            
            return auth.getName();
        }
        
        public boolean isAnonymousUser() {
            Authentication auth = SecurityContextHolder.getContext().getAuthentication();
            return auth instanceof AnonymousAuthenticationToken;
        }
        
        public boolean isAuthenticatedUser() {
            Authentication auth = SecurityContextHolder.getContext().getAuthentication();
            return auth != null && 
                   auth.isAuthenticated() && 
                   !(auth instanceof AnonymousAuthenticationToken);
        }
    }
}

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
        .formLogin(Customizer.withDefaults())
        .addFilterAfter(new CustomAuthFilter(), AnonymousAuthenticationFilter.class);
    return http.build();
}

public class CustomAuthFilter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest request, 
                                    HttpServletResponse response, 
                                    FilterChain chain) {
        String customToken = request.getHeader("X-Custom-Token");
        if (customToken != null) {
            // 解析并设置认证
            Authentication auth = parseToken(customToken);
            SecurityContextHolder.getContext().setAuthentication(auth);
        } else {
            // 错误：没有自定义 Token 时清空了 SecurityContext！
            SecurityContextHolder.clearContext();
        }
        chain.doFilter(request, response);
    }
}

public class CustomAuthFilter extends OncePerRequestFilter {
    
    @Override
    protected void doFilterInternal(HttpServletRequest request, 
                                    HttpServletResponse response, 
                                    FilterChain chain) throws ServletException, IOException {
        String customToken = request.getHeader("X-Custom-Token");
        
        // 仅当存在自定义 Token 且当前无认证（或匿名）时才处理
        if (customToken != null && customToken.startsWith("Custom ")) {
            Authentication existingAuth = SecurityContextHolder.getContext().getAuthentication();
            
            // 如果当前已有非匿名认证（如 Session 登录），不覆盖
            if (existingAuth == null || existingAuth instanceof AnonymousAuthenticationToken) {
                Authentication auth = parseToken(customToken);
                if (auth != null && auth.isAuthenticated()) {
                    SecurityContextHolder.getContext().setAuthentication(auth);
                }
            }
        }
        // 没有 X-Custom-Token 时：保留 SecurityContext 中的现有内容
        // 不做任何修改！
        
        chain.doFilter(request, response);
    }
    
    private Authentication parseToken(String token) {
        // 解析逻辑...
        return new UsernamePasswordAuthenticationToken(
            "customUser", null, List.of(new SimpleGrantedAuthority("ROLE_CUSTOM"))
        );
    }
}