content: package com.java2nb.novel.core.config;
  
  import lombok.RequiredArgsConstructor;
  import org.springframework.beans.factory.annotation.Value;
  import org.springframework.context.annotation.Bean;
  import org.springframework.context.annotation.Configuration;
  import org.springframework.security.config.Customizer;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  import org.springframework.security.core.userdetails.User;
  import org.springframework.security.core.userdetails.UserDetails;
  import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  import org.springframework.security.crypto.password.PasswordEncoder;
  import org.springframework.security.provisioning.InMemoryUserDetailsManager;
  import org.springframework.security.web.SecurityFilterChain;
  
  /**
   * SpringSecurity配置
   *
   * @author Administrator
   */
  @Configuration
  @EnableWebSecurity
  @RequiredArgsConstructor
  public class SecurityConfiguration {
  
      @Value("${admin.username}")
      private String username;
  
      @Value("${admin.password}")
      private String password;
  
      @Bean
      public PasswordEncoder passwordEncoder() {
          return new BCryptPasswordEncoder();
      }
  
      @Bean
      public InMemoryUserDetailsManager userDetailsService() {
          UserDetails admin = User.builder()
                  .username(username)
                  .password(passwordEncoder().encode(password))
                  .roles("ADMIN")
                  .build();
          return new InMemoryUserDetailsManager(admin);
      }
  
      @Bean
      public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
          http
                  .csrf(csrf -> csrf.disable()) // 禁用 CSRF
                  .authorizeHttpRequests(auth -> auth
                          .requestMatchers("/css/**", "/favicon.ico").permitAll() // 允许访问静态资源
                          .anyRequest().hasRole("ADMIN") // 其他请求需要 ADMIN 角色
                  )
                  .formLogin(form -> form
                          .loginPage("/login.html") // 自定义登录页面
                          .loginProcessingUrl("/login") // 登录处理 URL
                          .permitAll()
                  )
                  .logout(logout -> logout
                          .logoutUrl("/logout") // 登出 URL
                          .logoutSuccessUrl("/") // 登出成功后跳转的页面
                  )
                  .httpBasic(Customizer.withDefaults()); // 启用 HTTP Basic 认证
  
          return http.build();
      }
  }