/**
* 用户验证
* 通过账户信息返回认证信息
*
* @param token
* @return
* @throws AuthenticationException
*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
    logger.debug("------------Shiro开始验证------------");
    // 1.获取登录的username
    String userName = (String) token.getPrincipal();
    // 2.根据用户输入的账号username获取用户的信息
    UserLogin userLogin = loginDao.getUserLoginByUserName(userName);
    // 是否此用户是否存在
    if (userLogin == null) {
        throw new UnknownAccountException(LOGIN_PASS_ERROR_MSG);
    } else {
        password = userLogin.getPassword();
    }
    // 检测账号是否被锁定
//        if (Boolean.TRUE.equals(userLogin.getLocked())) {
//            throw new LockedAccountException();
//        }
    String credentials = password;
    // 3. 设置密码盐值
//        String salt = "weyoung";
//        ByteSource credentialsSalt = new Md5Hash(salt);
    String realmName = getName();
    SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(userName,
            credentials,
            realmName);
    // 4. 身份认证成功，返回认证信息
    logger.debug("------------Shiro完成验证------------");
    return info;
}
/**
* 授权并返回权限信息
*
* @param principalCollection
* @return
*/
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
    logger.debug("------------Shiro开始授权------------");
    // 1.从shiro中取出用户对象
    String userName = (String) principalCollection.getPrimaryPrincipal();
    // 2.从数据库或者缓存中加载用户的角色标识和权限列表
    List<SysRolePermission> rolePermissions = this.getRolesByUserName(userName);
    List<String> roleKeys = rolePermissions.stream().map(SysRolePermission::getRoleKey).distinct().collect(Collectors.toList());
    List<String> permissions = rolePermissions.stream().map(SysRolePermission::getPerms).distinct().collect(Collectors.toList());
    SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
    info.addStringPermissions(permissions);
    info.addRoles(roleKeys);
    logger.debug("------------Shiro完成授权------------");
    return info;
}

@RequestMapping(value = "/sys/login", method = RequestMethod.POST)
public String systemLogin(HttpServletRequest request, HttpServletResponse response) throws Exception {
    String userName = request.getParameter("userName");
    String password = request.getParameter("password");
    Subject currentUser = SecurityUtils.getSubject();
    UsernamePasswordToken token = new UsernamePasswordToken(userName, password);
    String viewName = REDIRECT_VIEW_URL_INDEX;
    try {
        // 这块执行shiro的登录，进入上面描述的自定义的Realm中的认证方法中
        currentUser.login(token);
    } catch (AuthenticationException e) {
        if (e instanceof IncorrectCredentialsException) {
            logger.error("登录失败!{}", LOGIN_PASS_ERROR_MSG);
        }
        return viewName;
    }
    // 获取用户信息存入session，通过Shiro管理的session，要获取依然必须通过Shiro
    UserInfo userInfo = loginService.getSysUserByUserName(userName);
    currentUser.getSession().setAttribute(SESSION_DEFAULT, userInfo);
    // 登录成功
    return REDIRECT_VIEW_URL_HOME;
}

public class RolesOrFilter extends AuthorizationFilter {
    @Override
    protected boolean isAccessAllowed(ServletRequest servletRequest, ServletResponse servletResponse, Object o) throws Exception {
        Subject subject = getSubject(servletRequest, servletResponse);

        String[] roles = (String[]) o;
        if (roles == null || roles.length == 0) {
            return true;
        }

        for (String role : roles) {
            if (subject.hasRole(role)) {
                return true;
            }
        }
        return false;
    }
}

@RequiresRoles("admin")
@RequestMapping(value = "/testRole", method = RequestMethod.GET)
@ResponseBody
public String testRole() {
    System.out.println("testRole");
    return "testRole success";
}

@RequiresPermissions("admin1")
@RequestMapping(value = "/testRole1", method = RequestMethod.GET)
@ResponseBody
public String testRole1() {
    System.out.println("testRole1");
    return "testRole1 success";
}

public class RedisSessionDao extends AbstractSessionDAO {

    @Resource
    private JedisUtil jedisUtil;

    private final String SHIRO_SESSION_PREFIX = "lucifer-session:";

    private byte[] getKey(String key) {
        return (SHIRO_SESSION_PREFIX + key).getBytes();
    }

    private void saveSession(Session session) {
        if (session != null && session.getId() != null) {
            byte[] key = getKey(session.getId().toString());
            byte[] value = SerializationUtils.serialize(session);
            jedisUtil.set(key, value);
            jedisUtil.expire(key, 600);
        }
    }

    @Override
    protected Serializable doCreate(Session session) {
        Serializable sessionId = generateSessionId(session);
        // 对session和sessionId进行捆绑
        assignSessionId(session, sessionId);
        saveSession(session);
        return sessionId;
    }

    @Override
    protected Session doReadSession(Serializable sessionId) {
        System.out.println("doReadSession");
        if (sessionId == null) {
            return null;
        }
        byte[] key = getKey(sessionId.toString());
        byte[] value = jedisUtil.get(key);
        return (Session) SerializationUtils.deserialize(value);
    }

    @Override
    public void update(Session session) throws UnknownSessionException {
        saveSession(session);
    }

    @Override
    public void delete(Session session) {
        if (session == null || session.getId() == null) {
            return;
        }
        byte[] key = getKey(session.getId().toString());
        jedisUtil.del(key);
    }

    @Override
    public Collection<Session> getActiveSessions() {
        Set<byte[]> keys = jedisUtil.keys(SHIRO_SESSION_PREFIX);
        Set<Session> sessions = new HashSet<>();
        if (CollectionUtils.isEmpty(keys)) {
            return sessions;
        }
        for (byte[] key : keys
                ) {
            Session session = (Session) SerializationUtils.deserialize(jedisUtil.get(key));
            sessions.add(session);
        }
        return sessions;
    }
}

public class CustomSessionManager extends DefaultWebSessionManager {
    /**
     * 解决多次访问redis
     * @param sessionKey
     * @return
     * @throws UnknownSessionException
     */
    @Override
    protected Session retrieveSession(SessionKey sessionKey) throws UnknownSessionException {
        Serializable sessionId = getSessionId(sessionKey);
        ServletRequest request = null;
        if (sessionKey instanceof WebSessionKey) {
            request = ((WebSessionKey) sessionKey).getServletRequest();
        }
        if (request != null && sessionId != null) {
            Session session = (Session) request.getAttribute(sessionId.toString());
            if (session != null){
                return session;
            }
        }
        Session session = super.retrieveSession(sessionKey);
        if (request != null && sessionId != null) {
            request.setAttribute(sessionId.toString(), session);
        }
        return session;
    }
}

public class RedisCacheManager implements CacheManager {

    @Resource
    private RedisCache redisCache;
    @Override
    public <K, V> Cache<K, V> getCache(String s) throws CacheException {
        return redisCache;
    }
}

@Component
public class RedisCache<K, V> implements Cache<K, V> {

    @Resource
    private JedisUtil jedisUtil;

    private final String CACHE_PREFIX = "lucifer-cache:";

    private byte[] getKey(K k) {
        if (k instanceof String) {
            return (CACHE_PREFIX + k).getBytes();
        }

        return SerializationUtils.serialize(k);
    }

    @Override
    public V get(K k) throws CacheException {
        System.out.println("从redis中获取数据");
        byte[] value = jedisUtil.get(getKey(k));
        if (value != null) {
            return (V) SerializationUtils.deserialize(value);
        }
        return null;
    }

    @Override
    public V put(K k, V v) throws CacheException {
        byte[] key = getKey(k);
        byte[] value = SerializationUtils.serialize(v);
        jedisUtil.set(key, value);
        jedisUtil.expire(key, 600);
        return v;
    }

    @Override
    public V remove(K k) throws CacheException {
        byte[] key = getKey(k);
        byte[] value = jedisUtil.get(key);
        jedisUtil.del(key);
        if (value != null) {
            return (V) SerializationUtils.deserialize(value);
        }
        return null;
    }

    @Override
    public void clear() throws CacheException {
        //
    }

    @Override
    public int size() {
        return 0;
    }

    @Override
    public Set<K> keys() {
        return null;
    }

    @Override
    public Collection<V> values() {
        return null;
    }
}

@RequestMapping(value = "/subLogin", method = RequestMethod.POST, produces = "application/json;charset=utf-8")
@ResponseBody
public String subLogin(User user) {
........
        token.setRememberMe(user.isRememberMe());
........
}