create schema vulnscan_platform

-- 1. 用户表
CREATE TABLE `users` (
  `id` bigint NOT NULL AUTO_INCREMENT COMMENT '用户唯一标识',
  `username` varchar(50) NOT NULL COMMENT '用户名，用于登录',
  `password_hash` varchar(255) NOT NULL COMMENT '加密后的密码',
  `email` varchar(100) DEFAULT NULL COMMENT '电子邮箱',
  `role` varchar(20) NOT NULL DEFAULT 'USER' COMMENT '角色：ADMIN, USER',
  `is_active` tinyint(1) NOT NULL DEFAULT '1' COMMENT '账户是否启用（1启用，0禁用）',
  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT '账户创建时间',
  `updated_at` timestamp NULL DEFAULT NULL ON UPDATE CURRENT_TIMESTAMP COMMENT '最后更新时间',
  PRIMARY KEY (`id`),
  UNIQUE KEY `uk_users_username` (`username`),
  KEY `idx_users_role` (`role`),
  KEY `idx_users_created_at` (`created_at`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci COMMENT='系统用户表';

-- 2. 扫描任务主表
CREATE TABLE `scan_tasks` (
  `id` bigint NOT NULL AUTO_INCREMENT COMMENT '任务唯一标识',
  `user_id` bigint NOT NULL COMMENT '任务创建者ID',
  `task_name` varchar(100) NOT NULL COMMENT '任务名称',
  `target` text NOT NULL COMMENT '扫描目标（IP、域名、URL，支持逗号分隔）',
  `scan_policy` varchar(50) NOT NULL DEFAULT 'FULL' COMMENT '扫描策略：QUICK, FULL, WEB_ONLY等',
  `status` varchar(20) NOT NULL DEFAULT 'PENDING' COMMENT '任务状态：PENDING, RUNNING, COMPLETED, FAILED, CANCELLED',
  `progress` tinyint DEFAULT '0' COMMENT '任务进度（0-100）',
  `start_time` timestamp NULL DEFAULT NULL COMMENT '任务开始执行时间',
  `end_time` timestamp NULL DEFAULT NULL COMMENT '任务结束时间',
  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT '任务创建时间',
  PRIMARY KEY (`id`),
  KEY `idx_tasks_user_id` (`user_id`),
  KEY `idx_tasks_status` (`status`),
  KEY `idx_tasks_created_at` (`created_at`),
  CONSTRAINT `fk_tasks_user_id` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci COMMENT='扫描任务主表';

CREATE TABLE `task_status_logs` (
  `id` bigint NOT NULL AUTO_INCREMENT COMMENT '日志ID',
  `task_id` bigint NOT NULL COMMENT '关联的任务ID',
  `stage` varchar(50) NOT NULL COMMENT '当前阶段：PORT_SCAN, WEB_CRAWL, VULN_SCAN等',
  `status` varchar(20) NOT NULL COMMENT '阶段状态：START, SUCCESS, WARNING, ERROR',
  `message` text COMMENT '状态详细信息或错误日志',
  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT '日志记录时间',
  PRIMARY KEY (`id`),
  KEY `idx_logs_task_id` (`task_id`),
  KEY `idx_logs_created_at` (`created_at`),
  CONSTRAINT `fk_logs_task_id` FOREIGN KEY (`task_id`) REFERENCES `scan_tasks` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci COMMENT='任务状态详细日志表';

CREATE TABLE `assets` (
  `id` bigint NOT NULL AUTO_INCREMENT COMMENT '资产ID',
  `task_id` bigint NOT NULL COMMENT '所属扫描任务ID',
  `ip_address` varchar(45) DEFAULT NULL COMMENT 'IP地址（支持IPv6）',
  `hostname` varchar(255) DEFAULT NULL COMMENT '主机名',
  `os_guess` varchar(100) DEFAULT NULL COMMENT '猜测的操作系统',
  `last_seen` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT '最后一次被发现的时间',
  PRIMARY KEY (`id`),
  KEY `idx_assets_task_id` (`task_id`),
  KEY `idx_assets_ip` (`ip_address`),
  CONSTRAINT `fk_assets_task_id` FOREIGN KEY (`task_id`) REFERENCES `scan_tasks` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci COMMENT='发现的网络资产表';

-- 5. 端口表
CREATE TABLE `ports` (
  `id` bigint NOT NULL AUTO_INCREMENT COMMENT '端口记录ID',
  `asset_id` bigint NOT NULL COMMENT '所属资产ID',
  `port_number` int NOT NULL COMMENT '端口号',
  `protocol` varchar(10) DEFAULT 'tcp' COMMENT '协议：tcp, udp',
  `service_name` varchar(100) DEFAULT NULL COMMENT '服务名称（如ssh, http）',
  `version_info` varchar(255) DEFAULT NULL COMMENT '服务版本信息',
  `state` varchar(20) NOT NULL DEFAULT 'unknown' COMMENT '端口状态：open, closed, filtered, unknown',
  PRIMARY KEY (`id`),
  UNIQUE KEY `uk_ports_asset_port` (`asset_id`, `port_number`, `protocol`), -- 防止重复记录
  KEY `idx_ports_service` (`service_name`),
  CONSTRAINT `fk_ports_asset_id` FOREIGN KEY (`asset_id`) REFERENCES `assets` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci COMMENT='资产开放端口及服务表';

CREATE TABLE `vulnerabilities` (
  `id` bigint NOT NULL AUTO_INCREMENT COMMENT '漏洞记录ID',
  `task_id` bigint NOT NULL COMMENT '发现该漏洞的任务ID',
  `asset_id` bigint DEFAULT NULL COMMENT '关联的资产ID（可为空，如纯域名漏洞）',
  `port_id` bigint DEFAULT NULL COMMENT '关联的端口ID（可为空）',
  `vuln_type` varchar(50) NOT NULL COMMENT '漏洞类型：SQLi, XSS, WEAK_PASSWORD等',
  `title` varchar(255) NOT NULL COMMENT '漏洞标题',
  `risk_level` varchar(20) NOT NULL DEFAULT 'MEDIUM' COMMENT '风险等级：CRITICAL, HIGH, MEDIUM, LOW, INFO',
  `is_fixed` tinyint(1) NOT NULL DEFAULT '0' COMMENT '是否已修复（0未修复，1已修复）',
  `discovered_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT '漏洞发现时间',
  PRIMARY KEY (`id`),
  KEY `idx_vulns_task_id` (`task_id`),
  KEY `idx_vulns_asset_id` (`asset_id`),
  KEY `idx_vulns_risk_level` (`risk_level`), -- 便于按风险级别筛选
  KEY `idx_vulns_discovered_at` (`discovered_at`),
  CONSTRAINT `fk_vulns_task_id` FOREIGN KEY (`task_id`) REFERENCES `scan_tasks` (`id`) ON DELETE CASCADE,
  CONSTRAINT `fk_vulns_asset_id` FOREIGN KEY (`asset_id`) REFERENCES `assets` (`id`) ON DELETE SET NULL,
  CONSTRAINT `fk_vulns_port_id` FOREIGN KEY (`port_id`) REFERENCES `ports` (`id`) ON DELETE SET NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci COMMENT='漏洞主表';

CREATE TABLE `vulnerability_details` (
  `id` bigint NOT NULL AUTO_INCREMENT COMMENT '详情ID',
  `vulnerability_id` bigint NOT NULL COMMENT '关联的漏洞ID',
  `description` text COMMENT '漏洞详细描述',
  `proof` text COMMENT '漏洞证据（如请求/响应包）',
  `recommendation` text COMMENT '修复建议',
  `cve_id` varchar(20) DEFAULT NULL COMMENT '关联的CVE编号（如CVE-2021-12345）',
  `scanner_source` varchar(50) DEFAULT NULL COMMENT '发现此漏洞的扫描器或插件名称',
  PRIMARY KEY (`id`),
  UNIQUE KEY `uk_details_vuln_id` (`vulnerability_id`), -- 确保一个漏洞只有一条详情记录
  KEY `idx_details_cve_id` (`cve_id`),
  CONSTRAINT `fk_details_vuln_id` FOREIGN KEY (`vulnerability_id`) REFERENCES `vulnerabilities` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci COMMENT='漏洞详情表';

CREATE TABLE `reports` (
  `id` bigint NOT NULL AUTO_INCREMENT COMMENT '报告ID',
  `task_id` bigint NOT NULL COMMENT '关联的扫描任务ID',
  `user_id` bigint NOT NULL COMMENT '报告生成者ID',
  `title` varchar(255) NOT NULL COMMENT '报告标题',
  `summary` json DEFAULT NULL COMMENT '报告摘要JSON（包含统计信息）',
  `file_path` varchar(500) DEFAULT NULL COMMENT '生成的报告文件（PDF/HTML）存储路径',
  `generated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT '报告生成时间',
  PRIMARY KEY (`id`),
  KEY `idx_reports_task_id` (`task_id`),
  KEY `idx_reports_user_id` (`user_id`),
  CONSTRAINT `fk_reports_task_id` FOREIGN KEY (`task_id`) REFERENCES `scan_tasks` (`id`) ON DELETE CASCADE,
  CONSTRAINT `fk_reports_user_id` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci COMMENT='扫描报告表';

com.xueqiu.vulnscanpro
├── controller       # 控制层
│   ├── api
│   └── advice
├── service          # 业务逻辑层
│   ├── impl
├── repository       # 数据访问层（对应Mapper层）
├── model            # 模型层
│   ├── entity
│   ├── dto
│   │   ├── request
│   │   └── response
│   └── vo
└── config           # 配置类等

<!--    lombok依赖    -->
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <optional>true</optional>
        </dependency>

<!--   mybatis依赖     -->
        <dependency>
            <groupId>org.mybatis.spring.boot</groupId>
            <artifactId>mybatis-spring-boot-starter</artifactId>
            <version>2.3.0</version>
        </dependency>

package com.xueqiu.vulnscanpro.model.entity;

import lombok.AllArgsConstructor;
import lombok.Data;
import lombok.NoArgsConstructor;
import java.time.LocalDateTime;

// 用户实体类
@Data
@NoArgsConstructor
@AllArgsConstructor
public class Users {
    private Long id;
    private String username;
    private String passwordHash;
    private String email;
    private String role;
    private Boolean isActive;
    private LocalDateTime createdAt;
    private LocalDateTime updatedAt;
}

    A[“客户端<br>提交登录表单”] --> B[“AuthController.login()”]
    B --> C[“AuthService.login()”]
    C --> D[“1. 认证 AuthenticationManager”]
    D --> E[“CustomUserDetailsService”]
    E --> F[“UserMapper.selectByUsername()”]
    F --> G[(“数据库”)]
    G --> E
    E --> H[“Spring Security UserDetails”]
    H --> D
    D --> I[“认证成功<br>设置SecurityContext”]
    I --> J[“2. 生成令牌 JwtTokenProvider”]
    J --> K[“3. 构建响应 LoginResponse”]
    K --> B
    B --> L[“返回JSON响应给客户端”]

<!--   Spring Security依赖   -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>

<!--        jwt依赖     -->
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt-api</artifactId>
            <version>0.11.5</version>
        </dependency>
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt-impl</artifactId>
            <version>0.11.5</version>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt-jackson</artifactId>
            <version>0.11.5</version>
            <scope>runtime</scope>
        </dependency>

jwt:
	secret: "输入64B长度的字符串作为密钥" 
	expiration-ms: 86400000 # 24小时（单位：毫秒）

package com.xueqiu.vulnscanpro.utils;

import io.jsonwebtoken.*;
import io.jsonwebtoken.io.Decoders;
import io.jsonwebtoken.security.Keys;
import io.jsonwebtoken.security.SecurityException;
import jakarta.annotation.PostConstruct;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.stereotype.Component;

import javax.crypto.SecretKey;
import java.nio.charset.StandardCharsets;
import java.security.Key;
import java.util.Date;
import java.util.stream.Collectors;

@Slf4j
@Component
public class JwtTokenProvider {

    @Value ("${app.jwt.secret}")
    private String jwtSecret;

    @Value("${app.jwt.expiration-ms}")
    private long jwtExpirationInMs;

    private Key key;

    @PostConstruct
    public void init(){

        byte[] keyBytes = Decoders.BASE64.decode(jwtSecret);
        log.info("原始密钥字节长度: {} 位 ({}字节)", keyBytes.length * 8, keyBytes.length);
        if (keyBytes.length < 64) { // HS512需要至少64字节
            log.error("密钥长度不足！需要至少64字节(512位)，当前仅{}字节。", keyBytes.length);
            // 方案1: 抛异常让应用启动失败
            throw new IllegalArgumentException("JWT密钥长度不足，请使用至少64字节的Base64密钥");
        }




        // 将密钥字符串转换为Key对象
        this.key = Keys.hmacShaKeyFor(jwtSecret.getBytes());

        log.info("JWT密钥初始化成功，密钥长度: {} 位", keyBytes.length * 8);
    }


    /**
     * 根据认证信息生成JWT令牌
     */
    public String generateToken(Authentication authentication) {

        UserDetails userDetails = (UserDetails) authentication.getPrincipal();

        Date now = new Date();
        Date expiryDate = new Date(now.getTime() + jwtExpirationInMs);

        // 将权限列表转换为逗号分隔的字符串
        String authorities = authentication.getAuthorities().stream()
                .map(GrantedAuthority::getAuthority)
                .collect(Collectors.joining(","));

        return Jwts.builder()
                .setSubject(userDetails.getUsername())
                .claim("authorities",authorities) // 自定义声明：权限
                .setIssuedAt(now)
                .setExpiration(expiryDate)
                .signWith(key, SignatureAlgorithm.HS512)
                .compact();
    }

    /**
     * 从 Token 中提取用户名
     */
    public String getUsernameFromToken(String token) {

        Claims claims = Jwts.parserBuilder()
                .setSigningKey(key)
                .build()
                .parseClaimsJws(token)
                .getBody();

        return claims.getSubject();
    }

    /**
     * 验证JWT令牌是否有效
     */
    public boolean validateToken(String token) {
        try {
            Jwts.parserBuilder()
                    .setSigningKey(key)
                    .build()
                    .parseClaimsJws(token);
            return true;
        } catch (SecurityException | MalformedJwtException e) {
            log.error("无效的JWT签名", e);
        } catch (ExpiredJwtException e) {
            log.error("JWT令牌已过期", e);
        } catch (UnsupportedJwtException e) {
            log.error("不支持的JWT令牌", e);
        } catch (IllegalArgumentException e) {
            log.error("JWT claims字符串为空", e);
        } catch (Exception e) {
            log.error("验证JWT令牌时发生错误", e);
        }
        return false;
    }

    public long getJwtExpirationInMs(){
        return jwtExpirationInMs;
    }

}

package com.xueqiu.vulnscanpro.config;

import com.xueqiu.vulnscanpro.filter.JwtAuthenticationFilter;
import com.xueqiu.vulnscanpro.service.impl.UserDetailsServiceImpl;
import lombok.RequiredArgsConstructor;
import org.springframework.boot.web.servlet.server.ServletWebServerFactory;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;


@Configuration
@EnableWebSecurity // 该注解启用 Spring Security 的 web 安全功能。
@EnableMethodSecurity
@RequiredArgsConstructor
public class SecurityConfig {
    
    private final JwtAuthenticationFilter jwtAuthenticationFilter;

    /**
     *
     * 配置http安全规则
     */
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            // 禁用CSRF、CORS、表单登录、HTTP Basic 认证（API项目通常不需要）
            .csrf(csrf -> csrf.disable())
            .cors(cors -> cors.disable())
            .formLogin(form -> form.disable())
            .httpBasic(basic -> basic.disable())

            // 配置会话管理为无状态（适合前后端分离）
            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))

            // 配置授权规则
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/**").permitAll()  // 测试暂时允许所有接口访问

                   /*

                    // 公开访问的接口（不需要登录）
                    .requestMatchers("/api/auth/**").permitAll()  // 放行认证相关接口
                    // 其他所有请求都需要认证
                    .anyRequest().authenticated()

                    */
            )


                // 添加jwt过滤器
                .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class)

                // ✅ 添加异常处理
                .exceptionHandling(ex -> ex
                        // 未认证时返回 401
                        .authenticationEntryPoint((request, response, authException) -> {
                            response.setStatus(401);
                            response.setContentType("application/json;charset=UTF-8");
                            response.getWriter().write("{\"error\":\"未登录，请先登录\"}");
                        })
                        // 没有权限时返回 403
                        .accessDeniedHandler((request, response, accessDeniedException) -> {
                            response.setStatus(403);
                            response.setContentType("application/json;charset=UTF-8");
                            response.getWriter().write("{\"error\":\"权限不足\"}");
                        })
                );

        return http.build();
    }


    /**
     *
     * 密码加密器配置
     */
    @Bean
    public PasswordEncoder passwordEncoder(){
        // 使用BCrypt强哈希算法加密密码
        return new BCryptPasswordEncoder();
    }


    /**
     * AuthenticationManager Bean（登录时需要用到）
     */
    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
        return config.getAuthenticationManager();
    }



}

<!--       Jakarta 数据验证依赖   -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-validation</artifactId>
        </dependency>

// LoginResponse类
package com.xueqiu.vulnscanpro.model.dto.response;

import lombok.AllArgsConstructor;
import lombok.Builder;
import lombok.Data;
import lombok.NoArgsConstructor;

@Data
@Builder
@AllArgsConstructor
@NoArgsConstructor
public class LoginResponse {
    // JWT访问令牌
    private String accessToken;
    // 令牌类型，通常是 "Bearer"
    private String tokenType = "Bearer";
    // 令牌过期时间（毫秒时间戳）
    private Long expiresIn;
    // 用户基本信息
    private UserInfo userInfo;

    @Data
    @Builder
    public static class UserInfo{
        private Long id;
        private String username;
        private String email;
        private String role;
    }
}