ការការពារ Application ជាមួយ Spring Security

<dependencies>
    <!-- Spring Security -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>

    <!-- JWT Library -->
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-api</artifactId>
        <version>0.12.3</version>
    </dependency>
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-impl</artifactId>
        <version>0.12.3</version>
        <scope>runtime</scope>
    </dependency>
</dependencies>

@Configuration
@EnableWebSecurity
@EnableMethodSecurity  // អនុញ្ញាតការប្រើ @PreAuthorize
public class SecurityConfig {

    @Autowired
    private JwtAuthenticationFilter jwtAuthFilter;

    @Autowired
    private UserDetailsService userDetailsService;

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http)
            throws Exception {

        return http
            // បិទ CSRF ព្រោះប្រើ JWT
            .csrf(csrf -> csrf.disable())

            // កំណត់ Authorization Rules
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/auth/**").permitAll()
                .requestMatchers("/api/public/**").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )

            // Stateless Session (ប្រើ JWT)
            .sessionManagement(session -> session
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            )

            // បន្ថែម JWT Filter
            .addFilterBefore(jwtAuthFilter,
                UsernamePasswordAuthenticationFilter.class)

            .build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public AuthenticationManager authenticationManager(
            AuthenticationConfiguration config) throws Exception {
        return config.getAuthenticationManager();
    }
}

@RestController
@RequestMapping("/api/auth")
public class AuthController {

    @Autowired
    private AuthenticationManager authManager;

    @Autowired
    private JwtService jwtService;

    @Autowired
    private UserService userService;

    // Login Endpoint
    @PostMapping("/login")
    public ResponseEntity<AuthResponse> login(
            @RequestBody LoginRequest request) {

        // ផ្ទៀងផ្ទាត់ username + password
        Authentication auth = authManager.authenticate(
            new UsernamePasswordAuthenticationToken(
                request.getUsername(),
                request.getPassword()
            )
        );

        // បង្កើត JWT Token
        UserDetails user = (UserDetails) auth.getPrincipal();
        String token = jwtService.generateToken(user);

        return ResponseEntity.ok(
            new AuthResponse(token, "Login successful")
        );
    }

    // Register Endpoint
    @PostMapping("/register")
    public ResponseEntity<String> register(
            @RequestBody RegisterRequest request) {

        userService.createUser(request);
        return ResponseEntity.ok("User registered successfully!");
    }
}

// Login Request
public record LoginRequest(
    String username,
    String password
) {}

// Auth Response ផ្ញើ Token ត្រឡប់
public record AuthResponse(
    String token,
    String message
) {}

// Register Request
public record RegisterRequest(
    String username,
    String email,
    String password,
    String role
) {}

@RestController
@RequestMapping("/api/products")
public class ProductController {

    // អ្នកប្រើគ្រប់គ្នា (Authenticated) អាចមើលបាន
    @GetMapping
    public List<Product> getAllProducts() {
        return productService.findAll();
    }

    // តែ ADMIN ប៉ុណ្ណោះអាចបន្ថែម
    @PostMapping
    @PreAuthorize("hasRole('ADMIN')")
    public Product createProduct(@RequestBody Product product) {
        return productService.save(product);
    }

    // User ដែល Login ហើយ ឬ ADMIN
    @DeleteMapping("/{id}")
    @PreAuthorize("hasRole('ADMIN') or #id == authentication.principal.id")
    public void deleteProduct(@PathVariable Long id) {
        productService.delete(id);
    }

    // ពិនិត្យ Permission ច្រើន
    @PutMapping("/{id}")
    @PreAuthorize("hasAuthority('WRITE_PRODUCTS') or hasRole('ADMIN')")
    public Product updateProduct(@PathVariable Long id,
            @RequestBody Product product) {
        return productService.update(id, product);
    }
}

@Service
public class JwtService {

    @Value("${jwt.secret}")
    private String secretKey;

    private static final long EXPIRATION = 86400000; // 24 ម៉ោង

    // បង្កើត Token ថ្មី
    public String generateToken(UserDetails userDetails) {
        return Jwts.builder()
            .subject(userDetails.getUsername())
            .claim("roles", userDetails.getAuthorities())
            .issuedAt(new Date())
            .expiration(new Date(System.currentTimeMillis() + EXPIRATION))
            .signWith(getSigningKey())
            .compact();
    }

    // ទាញ Username ពី Token
    public String extractUsername(String token) {
        return extractClaims(token, Claims::getSubject);
    }

    // ពិនិត្យ Token ស្ថិតស្ថេរ
    public boolean isTokenValid(String token, UserDetails user) {
        final String username = extractUsername(token);
        return username.equals(user.getUsername())
            && !isTokenExpired(token);
    }

    private boolean isTokenExpired(String token) {
        return extractExpiration(token).before(new Date());
    }

    private SecretKey getSigningKey() {
        byte[] bytes = Decoders.BASE64.decode(secretKey);
        return Keys.hmacShaKeyFor(bytes);
    }

    private <T> T extractClaims(String token,
            Function<Claims, T> resolver) {
        final Claims claims = Jwts.parser()
            .verifyWith(getSigningKey())
            .build()
            .parseSignedClaims(token)
            .getPayload();
        return resolver.apply(claims);
    }
}

jwt.secret=404E635266556A586E3272357538782F413F4428472B4B6250645367566B5970
jwt.expiration=86400000

@Service
public class CustomUserDetailsService
        implements UserDetailsService {

    @Autowired
    private UserRepository userRepository;

    @Override
    public UserDetails loadUserByUsername(String username)
            throws UsernameNotFoundException {

        User user = userRepository.findByUsername(username)
            .orElseThrow(() ->
                new UsernameNotFoundException(
                    "User not found: " + username
                )
            );

        // បំប្លែង User Entity ទៅ UserDetails
        return org.springframework.security.core.userdetails.User
            .withUsername(user.getUsername())
            .password(user.getPassword())
            .roles(user.getRole().name())
            .build();
    }
}

// User Entity
@Entity
@Table(name = "users")
public class User {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(unique = true)
    private String username;

    private String email;

    private String password; // BCrypt encoded

    @Enumerated(EnumType.STRING)
    private Role role;
}

@Component
public class JwtAuthenticationFilter
        extends OncePerRequestFilter {

    @Autowired
    private JwtService jwtService;

    @Autowired
    private UserDetailsService userDetailsService;

    @Override
    protected void doFilterInternal(
            HttpServletRequest request,
            HttpServletResponse response,
            FilterChain filterChain)
            throws ServletException, IOException {

        // ទាញ Authorization Header
        final String authHeader = request.getHeader("Authorization");

        // ពិនិត្យថា Header ចាប់ផ្តើមជា "Bearer "
        if (authHeader == null || !authHeader.startsWith("Bearer ")) {
            filterChain.doFilter(request, response);
            return;
        }

        // ទាញ Token (លុប "Bearer " ចេញ)
        final String jwt = authHeader.substring(7);
        final String username = jwtService.extractUsername(jwt);

        // ពិនិត្យថា User មិនទាន់ authenticated
        if (username != null &&
                SecurityContextHolder.getContext()
                    .getAuthentication() == null) {

            UserDetails user =
                userDetailsService.loadUserByUsername(username);

            if (jwtService.isTokenValid(jwt, user)) {
                // Set Authentication ក្នុង SecurityContext
                var authToken = new
                    UsernamePasswordAuthenticationToken(
                        user, null, user.getAuthorities()
                    );
                authToken.setDetails(
                    new WebAuthenticationDetailsSource()
                        .buildDetails(request)
                );
                SecurityContextHolder.getContext()
                    .setAuthentication(authToken);
            }
        }

        filterChain.doFilter(request, response);
    }
}

public enum Role {
    USER(
        Set.of(
            Permission.READ_OWN_PROFILE,
            Permission.READ_PRODUCTS
        )
    ),
    ADMIN(
        Set.of(
            Permission.READ_OWN_PROFILE,
            Permission.READ_PRODUCTS,
            Permission.WRITE_PRODUCTS,
            Permission.DELETE_PRODUCTS,
            Permission.MANAGE_USERS
        )
    );

    private final Set<Permission> permissions;

    Role(Set<Permission> permissions) {
        this.permissions = permissions;
    }

    public List<SimpleGrantedAuthority> getAuthorities() {
        var authorities = permissions.stream()
            .map(p -> new SimpleGrantedAuthority(p.name()))
            .collect(Collectors.toList());

        // បន្ថែម ROLE_ prefix
        authorities.add(new SimpleGrantedAuthority(
            "ROLE_" + this.name()
        ));
        return authorities;
    }
}

// Permission Enum
public enum Permission {
    READ_OWN_PROFILE,
    READ_PRODUCTS,
    WRITE_PRODUCTS,
    DELETE_PRODUCTS,
    MANAGE_USERS
}