AuthService.java

package com.baasid.service;

import com.baasid.dto.LoginRequest;
import com.baasid.dto.LoginResponse;
import com.baasid.entity.SystemUser;
import com.baasid.exception.UnauthorizedException;
import com.baasid.repository.SystemUserRepository;
import com.baasid.security.JwtUtil;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Service;

/**
 * 登入流程：依帳號查詢使用者、BCrypt 比對密碼、簽發 JWT。
 */
@Service
public class AuthService {

    private final SystemUserRepository userRepository;
    private final PasswordEncoder passwordEncoder;
    private final JwtUtil jwtUtil;

    public AuthService(SystemUserRepository userRepository,
                       PasswordEncoder passwordEncoder,
                       JwtUtil jwtUtil) {
        this.userRepository = userRepository;
        this.passwordEncoder = passwordEncoder;
        this.jwtUtil = jwtUtil;
    }

    /**
     * 登入成功後回傳給控制層的兩部分：JSON body（{@link LoginResponse}）與原始 JWT 字串（用於塞入 HTTP Header）。
     */
    public record LoginResult(LoginResponse body, String token) {}

    /**
     * 驗證帳密；失敗時拋 {@link UnauthorizedException}（由 {@link com.baasid.exception.GlobalExceptionHandler} 轉為 401）。
     */
    public LoginResult login(LoginRequest request) {
        SystemUser user = userRepository.findByAccount(request.account())
                .orElseThrow(() -> new UnauthorizedException("帳號密碼錯誤"));

        if (!passwordEncoder.matches(request.password(), user.getPassword())) {
            throw new UnauthorizedException("帳號密碼錯誤");
        }

        String token = jwtUtil.generateToken(user.getId(), user.getAccount());
        LoginResponse body = new LoginResponse(user.getAccount(), user.getName());

        return new LoginResult(body, token);
    }
}