@Component
public class JwtUtil {

    // ⭐ 从 application.yaml 的 jwt.secret 读, 外部化避免硬编码泄漏
    @Value("${jwt.secret}")
    private String secret;

    private SecretKey key;

    // 注入完成后初始化 key (因为 @Value 在构造后才生效)
    @PostConstruct
    public void init() {
        this.key = Keys.hmacShaKeyFor(secret.getBytes());
    }

    // token 有效期：这里设 24 小时（学习方便；真实项目常更短 + 配刷新机制）
    private static final long EXPIRE_MS = 24 * 60 * 60 * 1000L;

    // 签发：把 userId 装进 token，签名，返回 "xxx.yyy.zzz" 字符串
    public String generateToken(Long userId) {
        Date now = new Date();
        return Jwts.builder()
                .subject(String.valueOf(userId))              // 载荷里放 userId（subject 标准字段）
                .issuedAt(now)                                // 签发时间
                .expiration(new Date(now.getTime() + EXPIRE_MS)) // 过期时间
                .signWith(key)                                // 用服务器密钥签名（第三段）
                .compact();                                   // 拼成最终字符串
    }

// 解析+验签：合法则返回里面的 userId；被篡改/过期/伪造会抛异常（上层处理）
public Long parseUserId(String token) {
    Claims claims = Jwts.parser()
            .verifyWith(key)            // 用同一把密钥验签——签名对不上这里就抛异常
            .build()
            .parseSignedClaims(token)   // 解析；过期也会在这抛异常
            .getPayload();              // 拿到载荷
    return Long.valueOf(claims.getSubject());  // 取出当初放进去的 userId
}

import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

import java.io.IOException;
import java.util.Collections;

// 职责：验 token → 把"你是谁"登记进 SecurityContext。它【不】决定放行/拦截
// extends OncePerRequestFilter：Spring 提供的过滤器基类，保证每个请求只过一次
@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {

    private final JwtUtil jwtUtil;

    public JwtAuthenticationFilter(JwtUtil jwtUtil) {
        this.jwtUtil = jwtUtil;
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain filterChain) throws ServletException, IOException {
        // 取 Authorization: Bearer xxx
        String authHeader = request.getHeader("Authorization");
        if (authHeader != null && authHeader.startsWith("Bearer ")) {
            String token = authHeader.substring(7);
            try {
                Long userId = jwtUtil.parseUserId(token);   // 验签，合法则拿到 userId

                // 造一个 Spring Security 的"已认证"凭证对象
                //   参数：principal(谁=userId)、credentials(密码=null,已用JWT验过)、authorities(权限=暂空)
                //   用这个三参构造 → 该对象被标记为"已认证"
                UsernamePasswordAuthenticationToken authentication =
                        new UsernamePasswordAuthenticationToken(userId, null, Collections.emptyList());

                // 把身份登记进 SecurityContext —— 这是过滤器的核心动作
                SecurityContextHolder.getContext().setAuthentication(authentication);
            } catch (Exception e) {
                // token 无效/过期：不登记身份。不拦、不抛——后续授权规则会因"无身份"而拒
            }
        }
        // 不管认没认证成功，都要放行到过滤器链下一环（拦不拦由授权规则决定，不是这里）
        filterChain.doFilter(request, response);
    }
}

.authorizeHttpRequests(auth -> auth
        .dispatcherTypeMatchers(DispatcherType.ASYNC, DispatcherType.ERROR).permitAll()
        .requestMatchers("/api/internal/**").permitAll()
        .requestMatchers("/api/auth/me").authenticated()
        .requestMatchers("/api/auth/register").denyAll()
        .requestMatchers("/api/auth/**").permitAll()
        .requestMatchers("/swagger-ui/**", "/swagger-ui.html", "/v3/api-docs/**").permitAll()
        .anyRequest().authenticated()
)

import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.stereotype.Component;
import tools.jackson.databind.ObjectMapper;

import java.io.IOException;

// 认证失败入口：Spring Security 遇到"未认证访问受保护接口"时调用 commence
// 作用：把默认的空 401 换成统一的 Result 信封
@Component
public class JwtAuthenticationEntryPoint implements AuthenticationEntryPoint {

    private final ObjectMapper objectMapper;

    public JwtAuthenticationEntryPoint(ObjectMapper objectMapper) {
        this.objectMapper = objectMapper;
    }

    @Override
    public void commence(HttpServletRequest request,
                         HttpServletResponse response,
                         AuthenticationException authException) throws IOException {
        response.setContentType("application/json;charset=UTF-8");
        response.setStatus(HttpServletResponse.SC_OK);   // 统一信封风格：HTTP 200，结果看 body.code
        Result<Void> body = Result.fail(401, "未登录或 token 无效");
        response.getWriter().write(objectMapper.writeValueAsString(body));
    }
}

@GetMapping("/me")
@Operation(summary = "当前登录用户信息", description = "从 token 解析出 userId，返回用户基本信息（不含密码）")
public Result<UserResponse> me(@AuthenticationPrincipal Long userId) {
    User dbuser = service.findById(userId);
    UserResponse user = new UserResponse();
    user.setId(dbuser.getId());
    user.setUsername(dbuser.getUsername());
    user.setCreatedAt(dbuser.getCreatedAt());
    return Result.success(user);
}

// SecurityConfig 里
.requestMatchers("/api/internal/**").permitAll()