Spring Security 三链过滤器：不同端点的精细化权限控制

请求进来
    ↓
@Order(1) permitAllChain  →  匹配白名单路径？ → 是 → 直接放行
    ↓ 否
@Order(2) jwtChain        →  匹配 /api/**？   → 是 → JWT 认证
    ↓ 否
@Order(3) defaultChain    →  兜底：HTTP Basic 认证

@Bean
@Order(1)
public SecurityFilterChain permitAllChain(HttpSecurity http) throws Exception {
    List<String> urls = getSafePermitAllUrls();
    if (CollectionUtils.isEmpty(urls)) {
        // 防御性设计：空列表时该链不匹配任何请求
        http.securityMatcher(r -> false);
        return http.build();
    }
    http.securityMatcher(urls.toArray(new String[0]))
            .cors(Customizer.withDefaults())
            .authorizeHttpRequests(auth -> auth.anyRequest().permitAll())
            .csrf(AbstractHttpConfigurer::disable)
            .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
    return http.build();
}

# application.yaml
security:
  permit-all-urls:
    - /actuator/health
    - /actuator/info
    - /v3/api-docs/**
    - /swagger-ui/**
    - /swagger-ui.html

@Bean
@Order(2)
public SecurityFilterChain jwtChain(HttpSecurity http) throws Exception {
    http.securityMatcher("/api/**")
            .cors(Customizer.withDefaults())
            .csrf(AbstractHttpConfigurer::disable)
            .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authorizeHttpRequests(auth -> auth
                    // 认证相关 - 公开
                    .requestMatchers("/api/v1/auth/register", "/api/v1/auth/login").permitAll()
                    // 文章、分类、标签 - 公开只读
                    .requestMatchers("/api/v1/articles", "/api/v1/articles/**").permitAll()
                    .requestMatchers("/api/v1/categories/**", "/api/v1/tags/**").permitAll()
                    // 评论查询 - 公开
                    .requestMatchers("/api/v1/comments/tree", "/api/v1/comments").permitAll()
                    // 其他都需要认证
                    .anyRequest().authenticated())
            .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
    return http.build();
}

@Bean
@Order(3)
public SecurityFilterChain defaultChain(HttpSecurity http) throws Exception {
    http.csrf(AbstractHttpConfigurer::disable)
            .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
            .httpBasic(Customizer.withDefaults());
    return http.build();
}

@Component
@RequiredArgsConstructor
public class JwtAuthenticationFilter extends OncePerRequestFilter {

    private static final String BEARER_PREFIX = "Bearer ";

    private final JwtTokenProvider jwtTokenProvider;

    @Override
    protected void doFilterInternal(HttpServletRequest request,
            HttpServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {
        try {
            String jwt = extractJwtFromRequest(request);
            if (StringUtils.isNotBlank(jwt) && jwtTokenProvider.validateToken(jwt)) {
                authenticateUser(jwt, request);
            }
        } catch (Exception ex) {
            // 认证失败不中断过滤链，只是不设置 SecurityContext
            log.error("无法设置用户认证: {}", ex.getMessage());
        }
        filterChain.doFilter(request, response);
    }

    private void authenticateUser(String jwt, HttpServletRequest request) {
        String username = jwtTokenProvider.getUsernameFromToken(jwt);
        Long userId = jwtTokenProvider.getUserIdFromToken(jwt);
        List<String> roles = jwtTokenProvider.getRolesFromToken(jwt);

        // 将用户 ID 存入 Authentication details，供 SecurityUtils 读取
        JwtAuthenticationDetails details = new JwtAuthenticationDetails(request, userId);
        UsernamePasswordAuthenticationToken auth =
            new UsernamePasswordAuthenticationToken(userDetails, null, authorities);
        auth.setDetails(details);

        SecurityContextHolder.getContext().setAuthentication(auth);
    }
}

// SecurityUtils.java
public static Long getCurrentUserId() {
    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    if (auth != null && auth.getDetails() instanceof JwtAuthenticationDetails details) {
        return details.getUserId();
    }
    return null;
}

@Configuration
@EnableWebSecurity
@EnableMethodSecurity  // 启用 @PreAuthorize 等注解
public class SecurityConfig { ... }

// 只有管理员角色才能访问管理接口
@PreAuthorize("hasRole('ADMIN')")
@DeleteMapping("/admin/articles/{id}")
public Result<Void> deleteArticle(@PathVariable Long articleId) { ... }