Spring Security实现5次密码错误触发账号自动锁定功能

CREATE TABLE user (
    id BIGINT PRIMARY KEY AUTO_INCREMENT,
    username VARCHAR(50) UNIQUE NOT NULL,
    password VARCHAR(255) NOT NULL,
    login_attempts INT DEFAULT 0, -- 登录失败次数
    lock_time TIMESTAMP NULL, -- 账号锁定时间
    account_non_locked BOOLEAN DEFAULT TRUE -- 账号是否锁定
);

public class SecurUsernamePasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
 
    @Autowired
    ISysUserService userService;
 
    @Override
    public Authentication attemptAuthentication(HttpServletRequest request,
                                                HttpServletResponse response) throws AuthenticationException {
 
        if (request.getContentType().equals(MediaType.APPLICATION_JSON_UTF8_VALUE)
                || request.getContentType().equals(MediaType.APPLICATION_JSON_VALUE)) {
 
            ObjectMapper mapper = new ObjectMapper();
            UsernamePasswordAuthenticationToken authRequest = null;
            //取authenticationBean
            Map<String, String> authenticationBean = null;
            //用try with resource，方便自动释放资源
            try (InputStream is = request.getInputStream()) {
                authenticationBean = mapper.readValue(is, Map.class);
            } catch (IOException e) {
                //将异常放到自定义的异常类中
                throw  new SecurAuthenticationException(e.getMessage());
            }
            try {
                if (!authenticationBean.isEmpty()) {
                    //获得账号、密码
                    String username = authenticationBean.get(SPRING_SECURITY_FORM_USERNAME_KEY);
                    String password = authenticationBean.get(SPRING_SECURITY_FORM_PASSWORD_KEY);
 
                    request.setAttribute(SPRING_SECURITY_FORM_USERNAME_KEY, username);
 
                    //检测账号、密码是否存在
                    if (userService.checkLogin(username, password)) {
                        //将账号、密码装入UsernamePasswordAuthenticationToken中
                        authRequest = new UsernamePasswordAuthenticationToken(username, password);
                        setDetails(request,authRequest );
                        return this.getAuthenticationManager().authenticate(authRequest);
                    }
 
                }
            } catch (Exception e) {
                throw new SecurAuthenticationException(e.getMessage());
            }
            return null;
        } else {
            return this.attemptAuthentication(request, response);
        }
    }
}

    public boolean checkLogin(String username, String rawPassword) throws Exception {
        SysUser userEntity = this.getUserByUserName(username);
        System.out.println("userEntity = " + userEntity);
        if (userEntity == null) {
            //System.out.println("checkLogin--------->账号不存在，请重新尝试！");
            //设置友好提示
            throw new Exception("账号不存在，请重新尝试！");
        } else {
            // 检查账号锁定状态
            handleAccountLock(userEntity);
            //加密的密码
            String encodedPassword = userEntity.getPassword();
            //和加密后的密码进行比配
            if (!passwordEncoder.matches(rawPassword, encodedPassword)) {
                //System.out.println("checkLogin--------->密码不正确！");
                //设置友好提示
                throw new Exception("密码不正确！");
            } else {
                return true;
            }
        }
    }

    /**
     * 检查并处理账号锁定逻辑
     */
    private void handleAccountLock(SysUser user) {
        if (!user.getAccountNonLocked() && user.getLockTime() != null) {
            // 当前时间
            Date now = new Date();
 
            // 解锁时间
            Date unlockTime = new Date(user.getLockTime().getTime() + LOCK_DURATION.toMillis());
 
            if (now.before(unlockTime)) {
                throw new LockedException("账号已锁定，请3分钟后再试");
            }
 
            // 解锁账号并重置状态
            user.setAccountNonLocked(true);
            user.setLoginAttempts(0);
            user.setLockTime(null);
            this.updateById(user);
        }
    }

    public void increaseFailedAttempts(SysUser user) {
        int attempts = user.getLoginAttempts() + 1;
        if (attempts >= MAX_LOGIN_ATTEMPTS) {
            user.setAccountNonLocked(false);
            user.setLockTime(new Date());
        }
        user.setLoginAttempts(attempts);
        this.updateById(user);
    }

    public void resetLoginAttempts(String username) {
        SysUser user = this.getUserByUserName(username);
        if(user==null){
            throw new UsernameNotFoundException(String.format("%s.这个用户不存在或已被禁用", username));
        }
        user.setLoginAttempts(0);
        user.setAccountNonLocked(true);
        user.setLockTime(null);
        this.updateById(user);
 
    }

@Component
public class SecurAuthenticationFailureHandler extends JSONAuthentication implements AuthenticationFailureHandler {
    @Autowired
    SysUserServiceImpl sysUserService;
 
 
    @Override
    public void onAuthenticationFailure(HttpServletRequest request,
                                        HttpServletResponse response,
                                        AuthenticationException e) throws IOException, ServletException {
 
        // 从请求体中解析 JSON，获取 username
        String username = (String) request.getAttribute(SPRING_SECURITY_FORM_USERNAME_KEY);
        // 登录失败时增加失败次数
        if (username != null) {
            SysUser user = sysUserService.getUserByUserName(username);
            if (user != null) {
                sysUserService.increaseFailedAttempts(user);
            }
        }
 
        ResponseStructure data = ResponseStructure.instance(ALL_RETURN_401.getCode(),"登录失败:"+e.getMessage());
        //输出
        this.WriteJSON(request, response, data);
    }
}