Class SecurityConfig

back/src/main/java/com/smarthr/config/SecurityConfig.java:35–124

import java.util.List;

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
@RequiredArgsConstructor
public class SecurityConfig {

    private final JwtAuthenticationFilter jwtAuthenticationFilter;
    private final UserDetailsService userDetailsService;

    /**
     * 白名单路径 - 无需认证
     */
    private static final String[] WHITE_LIST = {
            "/api/auth/login",
            "/api/auth/register",
            "/api/auth/refresh",
            "/api/public/**",
            "/swagger-ui/**",
            "/swagger-ui.html",
            "/v3/api-docs/**",
            "/doc.html",
            "/webjars/**",
            "/actuator/**"
    };

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
                // 禁用 CSRF（使用 JWT 无状态认证）
                .csrf(AbstractHttpConfigurer::disable)
                // 启用 CORS
                .cors(cors -> cors.configurationSource(corsConfigurationSource()))
                // 配置授权规则
                .authorizeHttpRequests(auth -> auth
                        // 白名单路径
                        .requestMatchers(WHITE_LIST).permitAll()
                        // 面试官和 HR 均可读取岗位列表（供面试官选择岗位出题）
                        .requestMatchers(HttpMethod.GET, "/api/hr/positions/**").hasAnyRole("HR", "INTERVIEWER")
                        // HR 相关接口
                        .requestMatchers("/api/hr/**").hasRole("HR")
                        // 面试官相关接口
                        .requestMatchers("/api/interviewer/**").hasRole("INTERVIEWER")
                        // 其他请求需要认证
                        .anyRequest().authenticated()
                )
                // 无状态会话管理
                .sessionManagement(session -> session
                        .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                )
                // 认证提供者
                .authenticationProvider(authenticationProvider())
                // JWT 过滤器
                .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }

    @Bean