qingsongping-AIDevelop/mydreamjob-server/src/main/java/com/mydreamjob/config/SecurityConfig.java

package com.mydreamjob.config;

import com.mydreamjob.auth.JwtAuthenticationFilter;
import com.mydreamjob.audit.AuditService;
import lombok.RequiredArgsConstructor;
import org.springframework.http.HttpMethod;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.data.jpa.repository.config.EnableJpaAuditing;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.security.web.access.AccessDeniedHandler;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;

import java.util.Arrays;
import java.util.List;

/**
 * Spring Security 配置
 */
@Configuration
@EnableWebSecurity
@RequiredArgsConstructor
@EnableJpaAuditing
public class SecurityConfig {

    private final JwtAuthenticationFilter jwtAuthenticationFilter;
    private final AuditService auditService;

    @Value("${app.cors.allowed-origins:http://localhost:5173,http://localhost:3000}")
    private String allowedOrigins;

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
                .csrf(AbstractHttpConfigurer::disable)
                .cors(cors -> cors.configurationSource(corsConfigurationSource()))
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                .exceptionHandling(ex -> ex
                        .authenticationEntryPoint((request, response, authException) -> {
                            response.setContentType("application/json;charset=UTF-8");
                            response.setStatus(401);
                            response.getWriter().write(
                                    "{\"code\":401,\"message\":\"not authenticated\",\"timestamp\":\"\"}");
                        })
                        .accessDeniedHandler((request, response, accessDeniedException) -> {
                            response.setContentType("application/json;charset=UTF-8");
                            response.setStatus(403);
                            response.getWriter().write(
                                    "{\"code\":403,\"message\":\"access denied\",\"timestamp\":\"\"}");
                        }))
                .authorizeHttpRequests(auth -> auth
                        // S03-C 整改：业务端口统一放行 /actuator/**。
                        // Actuator 端点仍只注册在独立管理端口（默认 127.0.0.1），业务端口上
                        // /actuator/** 全部落入 MVC 的不存在资源处理，由 GlobalExceptionHandler 的
                        // NoResourceFoundException 精确映射为 404 —— 避免匿名请求先被认证层
                        // 拦截成 401（未放行路径）或落入通用异常映射成 500（放行路径）。
                        // permitAll 不代表暴露指标，只保证所有 /actuator/** 都走到同一 404 语义；
                        // 业务端口不得新增任何 Actuator Controller 或端点映射。
                        .requestMatchers("/actuator/**").permitAll()
                        // Swagger UI
                        .requestMatchers("/swagger-ui/**", "/v3/api-docs/**", "/api-docs/**").permitAll()
                        // 健康检查 API
                        .requestMatchers("/health/**").permitAll()
                        .requestMatchers("/health").permitAll()
                        // 平台维护的岗位推荐分类字典（公开只读）
                        .requestMatchers(HttpMethod.GET, "/job-recommendation-taxonomies").permitAll()
                        // 认证相关
                        .requestMatchers("/auth/sms/send").permitAll()
                        .requestMatchers("/auth/login").permitAll()
                        .requestMatchers("/auth/register").permitAll()
                        // S02：刷新允许匿名进入 Controller；是否成功仍取决于 Refresh Token 校验。
                        // permitAll 只表示可进入，不代表 Token 有效。
                        .requestMatchers("/auth/refresh").permitAll()
                        // 当前用户
                        .requestMatchers("/auth/me").authenticated()
                        // S02：登出必须已认证
                        .requestMatchers("/auth/logout").authenticated()
                        // 企业资料（需登录）
                        .requestMatchers("/companies/me/**").authenticated()
                        // V41 学生人才发现授权与企业人才发现推荐（角色和归属由 Service 校验）
                        .requestMatchers("/profile/me/talent-discovery").authenticated()
                        .requestMatchers("/companies/me/jobs/*/talent-recommendations").authenticated()
                        // V42 企业人才邀约与学生决策（角色和租户归属由 Service 二次校验）
                        .requestMatchers("/companies/me/jobs/*/talent-invitations/**").authenticated()
                        .requestMatchers("/companies/me/talent-invitations/**").authenticated()
                        .requestMatchers("/profile/me/talent-invitations/**").authenticated()
                        // 企业公开岗位列表（匿名 GET）
                        .requestMatchers(HttpMethod.GET, "/companies/*/jobs").permitAll()
                        // 企业公开主页（匿名 GET）
                        .requestMatchers(HttpMethod.GET, "/companies/*").permitAll()
                        // 管理后台（需登录+ADMIN角色）
                        .requestMatchers("/admin/**").authenticated()
                        // 权重模板（登录即可）
                        .requestMatchers(HttpMethod.GET, "/review-weight-templates").authenticated()
                        // 个人权重配置（需登录，仅 STUDENT，Service 层校验）
                        .requestMatchers(HttpMethod.GET, "/profile/me/review-weights").authenticated()
                        .requestMatchers(HttpMethod.PUT, "/profile/me/review-weights").authenticated()
                        // 求职者评分卡（需登录，仅 STUDENT，Service 层校验）
                        .requestMatchers(HttpMethod.GET, "/profile/me/candidate-score-card").authenticated()
                        .requestMatchers(HttpMethod.GET, "/profile/me/candidate-score-trend").authenticated()
                        .requestMatchers(HttpMethod.GET, "/profile/me/candidate-percentile").authenticated()
                        // 个人资料（需登录）
                        .requestMatchers("/profile/me").authenticated()
                        // 岗位评价查询、详情、评分汇总、岗位对比（公开）
                        .requestMatchers(HttpMethod.GET, "/jobs/compare").permitAll()
                        .requestMatchers(HttpMethod.GET, "/jobs/*/reviews/summary").permitAll()
                        .requestMatchers(HttpMethod.GET, "/jobs/*/reviews/*").permitAll()
                        .requestMatchers(HttpMethod.GET, "/jobs/*/reviews").permitAll()
                        // 岗位收藏和评价接口（需登录）
                        .requestMatchers("/jobs/*/favorite").authenticated()
                        .requestMatchers("/jobs/favorites").authenticated()
                        .requestMatchers("/jobs/*/reviews/**").authenticated()
                        // 个性化评分（需登录，仅 STUDENT，Service 层校验）
                        .requestMatchers(HttpMethod.GET, "/jobs/*/personalized-review-score").authenticated()
                        // 岗位公开查询
                        .requestMatchers("/jobs/public/**").permitAll()
                        // 仅公开岗位列表为匿名可读；写操作必须命中下方的 /jobs/** → authenticated
                        .requestMatchers(HttpMethod.GET, "/jobs").permitAll()
                        // 岗位搜索与筛选（公开）
                        .requestMatchers(HttpMethod.GET, "/jobs/search").permitAll()
                        .requestMatchers(HttpMethod.GET, "/jobs/filters").permitAll()
                        // 岗位管理（需登录）
                        .requestMatchers("/jobs/**").authenticated()
                        // 投递（需登录）
                        .requestMatchers("/applications/**").authenticated()
                        .requestMatchers("/company/applications").authenticated()
                        // 企业候选人看板（需登录，COMPANY 角色，Service 层校验）
                        .requestMatchers("/company/candidates/**").authenticated()
                        // 企业评分运营看板（需登录，COMPANY/ADMIN 角色，Service 层校验）
                        .requestMatchers("/company/scoring/dashboard/**").authenticated()
                        // 面试（需登录）
                        .requestMatchers("/interviews/**").authenticated()
                        // RIASEC 职业兴趣测评（需登录；类型/题目任意登录用户，答卷仅 STUDENT 由 Service 层校验）
                        .requestMatchers("/assessments/**").authenticated()
                        // 四维能力测评（需登录；类型任意登录用户，答卷仅 STUDENT 本人由 Service 层校验）
                        .requestMatchers("/abilities/**").authenticated()
                        // API 信息入口
                        .requestMatchers("/").permitAll()
                        .anyRequest().authenticated()
                )
                .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }

    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration config = new CorsConfiguration();
        config.setAllowedOrigins(List.of(allowedOrigins.split(",")));
        config.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"));
        config.setAllowedHeaders(List.of("Authorization", "Content-Type", "X-Request-Id"));
        config.setExposedHeaders(List.of("X-Request-Id"));
        config.setAllowCredentials(true);
        config.setMaxAge(3600L);

        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/api/**", config);
        return source;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}