# 安全配置与过滤器

<cite>
**本文引用的文件**   
- [SecurityConfig.java](file://crm-auth/src/main/java/com/crm/auth/config/SecurityConfig.java)
- [DataScopeInterceptor.java](file://crm-auth/src/main/java/com/crm/auth/security/DataScopeInterceptor.java)
- [DataScopeTables.java](file://crm-auth/src/main/java/com/crm/auth/security/DataScopeTables.java)
- [JwtAuthenticationFilter.java](file://crm-auth/src/main/java/com/crm/auth/security/JwtAuthenticationFilter.java)
- [TokenService.java](file://crm-auth/src/main/java/com/crm/auth/security/TokenService.java)
- [SecurityExceptionHandlers.java](file://crm-auth/src/main/java/com/crm/auth/security/SecurityExceptionHandlers.java)
- [AuthLoginUser.java](file://crm-auth/src/main/java/com/crm/auth/security/AuthLoginUser.java)
- [PermissionConfig.java](file://crm-auth/src/main/java/com/crm/auth/config/PermissionConfig.java)
- [DataInitializer.java](file://crm-auth/src/main/java/com/crm/auth/config/DataInitializer.java)
- [CorsConfig.java](file://crm-base/src/main/java/com/crm/base/config/CorsConfig.java)
- [GlobalExceptionHandlerAdvice.java](file://crm-base/src/main/java/com/crm/base/advice/GlobalExceptionHandlerAdvice.java)
- [DataScope.java](file://crm-base/src/main/java/com/crm/base/annotation/DataScope.java)
- [DataScopeHelper.java](file://crm-base/src/main/java/com/crm/base/security/DataScopeHelper.java)
- [DataVisibilityContext.java](file://crm-base/src/main/java/com/crm/base/security/DataVisibilityContext.java)
- [DataOwnership.java](file://crm-base/src/main/java/com/crm/base/security/DataOwnership.java)
- [DataScopeLevel.java](file://crm-base/src/main/java/com/crm/base/security/DataScopeLevel.java)
- [LoginUser.java](file://crm-base/src/main/java/com/crm/base/security/LoginUser.java)
- [SecurityUtils.java](file://crm-base/src/main/java/com/crm/base/security/SecurityUtils.java)
- [application.yml](file://crm-app/src/main/resources/application.yml)
- [application.yml](file://crm-auth/src/main/resources/application.yml)
</cite>

## 目录
1. [简介](#简介)
2. [项目结构](#项目结构)
3. [核心组件](#核心组件)
4. [架构总览](#架构总览)
5. [详细组件分析](#详细组件分析)
6. [依赖关系分析](#依赖关系分析)
7. [性能考虑](#性能考虑)
8. [故障排查指南](#故障排查指南)
9. [结论](#结论)
10. [附录](#附录)

## 简介
本文件围绕 CRM 后端项目的安全配置与数据权限过滤进行系统化说明，重点覆盖：
- Spring Security 配置与安全策略（认证、授权、跨域、异常处理）
- 自定义过滤器链（JWT 认证过滤器、数据权限拦截器）
- 数据权限拦截器实现（注解驱动、表级映射、上下文传递）
- 初始化数据配置（角色、菜单、用户等基础数据）
- 安全异常处理与统一返回
- 跨域配置与最佳实践

目标是帮助开发者快速理解并正确使用系统的安全与数据权限能力。

## 项目结构
本项目采用多模块设计，安全相关能力主要分布在 crm-auth（认证与授权）和 crm-base（通用基础能力）两个模块中：
- crm-auth：Spring Security 配置、JWT 认证、数据权限拦截器、权限配置、初始化数据
- crm-base：跨域配置、全局异常处理、数据权限注解与工具、登录用户上下文

```mermaid
graph TB
subgraph "crm-auth"
A["SecurityConfig<br/>安全配置"]
B["JwtAuthenticationFilter<br/>JWT认证过滤器"]
C["DataScopeInterceptor<br/>数据权限拦截器"]
D["DataScopeTables<br/>表权限映射"]
E["TokenService<br/>令牌服务"]
F["PermissionConfig<br/>权限配置"]
G["DataInitializer<br/>初始化数据"]
H["SecurityExceptionHandlers<br/>安全异常处理"]
end
subgraph "crm-base"
I["CorsConfig<br/>跨域配置"]
J["GlobalExceptionHandlerAdvice<br/>全局异常处理"]
K["DataScope<br/>数据权限注解"]
L["DataScopeHelper<br/>数据权限工具"]
M["DataVisibilityContext<br/>可见性上下文"]
N["DataOwnership<br/>数据所有权注解"]
O["DataScopeLevel<br/>数据范围级别"]
P["LoginUser<br/>登录用户模型"]
Q["SecurityUtils<br/>安全工具"]
end
A --> B
A --> C
A --> F
A --> H
C --> D
C --> L
C --> M
B --> E
I --> A
J --> A
```

图表来源 
- [SecurityConfig.java](file://crm-auth/src/main/java/com/crm/auth/config/SecurityConfig.java)
- [JwtAuthenticationFilter.java](file://crm-auth/src/main/java/com/crm/auth/security/JwtAuthenticationFilter.java)
- [DataScopeInterceptor.java](file://crm-auth/src/main/java/com/crm/auth/security/DataScopeInterceptor.java)
- [DataScopeTables.java](file://crm-auth/src/main/java/com/crm/auth/security/DataScopeTables.java)
- [TokenService.java](file://crm-auth/src/main/java/com/crm/auth/security/TokenService.java)
- [PermissionConfig.java](file://crm-auth/src/main/java/com/crm/auth/config/PermissionConfig.java)
- [DataInitializer.java](file://crm-auth/src/main/java/com/crm/auth/config/DataInitializer.java)
- [SecurityExceptionHandlers.java](file://crm-auth/src/main/java/com/crm/auth/security/SecurityExceptionHandlers.java)
- [CorsConfig.java](file://crm-base/src/main/java/com/crm/base/config/CorsConfig.java)
- [GlobalExceptionHandlerAdvice.java](file://crm-base/src/main/java/com/crm/base/advice/GlobalExceptionHandlerAdvice.java)
- [DataScope.java](file://crm-base/src/main/java/com/crm/base/annotation/DataScope.java)
- [DataScopeHelper.java](file://crm-base/src/main/java/com/crm/base/security/DataScopeHelper.java)
- [DataVisibilityContext.java](file://crm-base/src/main/java/com/crm/base/security/DataVisibilityContext.java)
- [DataOwnership.java](file://crm-base/src/main/java/com/crm/base/security/DataOwnership.java)
- [DataScopeLevel.java](file://crm-base/src/main/java/com/crm/base/security/DataScopeLevel.java)
- [LoginUser.java](file://crm-base/src/main/java/com/crm/base/security/LoginUser.java)
- [SecurityUtils.java](file://crm-base/src/main/java/com/crm/base/security/SecurityUtils.java)

章节来源
- [SecurityConfig.java](file://crm-auth/src/main/java/com/crm/auth/config/SecurityConfig.java)
- [CorsConfig.java](file://crm-base/src/main/java/com/crm/base/config/CorsConfig.java)
- [GlobalExceptionHandlerAdvice.java](file://crm-base/src/main/java/com/crm/base/advice/GlobalExceptionHandlerAdvice.java)

## 核心组件
- SecurityConfig：集中定义 Spring Security 策略，包括放行路径、鉴权规则、过滤器链装配、跨域与异常处理器集成。
- JwtAuthenticationFilter：从请求头解析 JWT 并构建认证信息，注入到 SecurityContext。
- DataScopeInterceptor：基于 @DataScope 注解与 DataScopeTables 映射，动态拼装 SQL 条件，实现行级数据权限控制。
- TokenService：提供令牌生成、校验、刷新等能力，支撑无状态认证。
- PermissionConfig：权限相关的配置项（如角色-菜单映射、接口权限白名单）。
- DataInitializer：启动时初始化基础数据（角色、菜单、用户、部门等），保障系统可用。
- SecurityExceptionHandlers：统一捕获认证与授权异常，转换为标准错误响应。
- CorsConfig：跨域配置，允许前端调用。
- GlobalExceptionHandlerAdvice：全局异常处理，统一错误码与消息。
- 数据权限注解与工具：@DataScope、@DataOwnership、DataScopeHelper、DataVisibilityContext、DataScopeLevel、LoginUser、SecurityUtils。

章节来源
- [SecurityConfig.java](file://crm-auth/src/main/java/com/crm/auth/config/SecurityConfig.java)
- [JwtAuthenticationFilter.java](file://crm-auth/src/main/java/com/crm/auth/security/JwtAuthenticationFilter.java)
- [DataScopeInterceptor.java](file://crm-auth/src/main/java/com/crm/auth/security/DataScopeInterceptor.java)
- [DataScopeTables.java](file://crm-auth/src/main/java/com/crm/auth/security/DataScopeTables.java)
- [TokenService.java](file://crm-auth/src/main/java/com/crm/auth/security/TokenService.java)
- [PermissionConfig.java](file://crm-auth/src/main/java/com/crm/auth/config/PermissionConfig.java)
- [DataInitializer.java](file://crm-auth/src/main/java/com/crm/auth/config/DataInitializer.java)
- [SecurityExceptionHandlers.java](file://crm-auth/src/main/java/com/crm/auth/security/SecurityExceptionHandlers.java)
- [CorsConfig.java](file://crm-base/src/main/java/com/crm/base/config/CorsConfig.java)
- [GlobalExceptionHandlerAdvice.java](file://crm-base/src/main/java/com/crm/base/advice/GlobalExceptionHandlerAdvice.java)
- [DataScope.java](file://crm-base/src/main/java/com/crm/base/annotation/DataScope.java)
- [DataScopeHelper.java](file://crm-base/src/main/java/com/crm/base/security/DataScopeHelper.java)
- [DataVisibilityContext.java](file://crm-base/src/main/java/com/crm/base/security/DataVisibilityContext.java)
- [DataOwnership.java](file://crm-base/src/main/java/com/crm/base/security/DataOwnership.java)
- [DataScopeLevel.java](file://crm-base/src/main/java/com/crm/base/security/DataScopeLevel.java)
- [LoginUser.java](file://crm-base/src/main/java/com/crm/base/security/LoginUser.java)
- [SecurityUtils.java](file://crm-base/src/main/java/com/crm/base/security/SecurityUtils.java)

## 架构总览
下图展示了典型请求在安全与数据权限层面的处理流程：客户端请求进入后，先经过跨域与全局异常处理，再进入 Spring Security 过滤器链；未认证的请求由 JWT 过滤器处理，认证成功后进入业务控制器；在执行数据访问前，数据权限拦截器根据注解与表映射动态注入 WHERE 条件，确保数据隔离。

```mermaid
sequenceDiagram
participant Client as "客户端"
participant Web as "Web层"
participant Security as "Spring Security"
participant Jwt as "JwtAuthenticationFilter"
participant Controller as "Controller"
participant Interceptor as "DataScopeInterceptor"
participant DB as "数据库"
Client->>Web : HTTP 请求
Web->>Security : 进入过滤器链
alt 未认证
Security->>Jwt : 解析JWT并构建认证
Jwt-->>Security : 设置SecurityContext
else 已认证
Security-->>Controller : 放行至控制器
end
Controller->>Interceptor : 执行方法前触发拦截
Interceptor->>Interceptor : 读取@DataScope与表映射
Interceptor-->>Controller : 注入SQL条件
Controller->>DB : 执行查询/更新
DB-->>Controller : 返回结果
Controller-->>Client : 统一响应
```

图表来源 
- [SecurityConfig.java](file://crm-auth/src/main/java/com/crm/auth/config/SecurityConfig.java)
- [JwtAuthenticationFilter.java](file://crm-auth/src/main/java/com/crm/auth/security/JwtAuthenticationFilter.java)
- [DataScopeInterceptor.java](file://crm-auth/src/main/java/com/crm/auth/security/DataScopeInterceptor.java)
- [DataScopeTables.java](file://crm-auth/src/main/java/com/crm/auth/security/DataScopeTables.java)

## 详细组件分析

### SecurityConfig 安全策略配置
- 功能要点
  - 定义放行路径（静态资源、健康检查、开放接口等）
  - 配置认证与授权规则（按角色或权限标识控制）
  - 装配自定义过滤器（JWT 认证过滤器）
  - 集成跨域配置与异常处理器
  - 禁用默认表单登录/CSRF（适用于前后端分离场景）
- 关键配置项
  - 白名单路径集合
  - 需要鉴权的 URL 模式与对应权限
  - 过滤器链顺序（CORS -> 认证 -> 授权）
  - 异常处理器注册
- 使用示例
  - 新增需鉴权接口：在权限配置中添加 URL 与权限标识
  - 新增放行接口：添加到白名单列表
  - 调整跨域策略：通过 CorsConfig 统一配置

章节来源
- [SecurityConfig.java](file://crm-auth/src/main/java/com/crm/auth/config/SecurityConfig.java)
- [PermissionConfig.java](file://crm-auth/src/main/java/com/crm/auth/config/PermissionConfig.java)
- [CorsConfig.java](file://crm-base/src/main/java/com/crm/base/config/CorsConfig.java)

### JwtAuthenticationFilter 认证过滤器
- 功能要点
  - 从请求头提取 JWT 令牌
  - 校验令牌有效性（签名、过期时间）
  - 加载用户信息与权限，构建 Authentication 对象
  - 将认证信息写入 SecurityContext
- 异常处理
  - 令牌无效或缺失时抛出安全异常，交由统一异常处理器处理
- 使用示例
  - 客户端在请求头携带 Authorization: Bearer <token>
  - 服务端无需额外代码即可获取当前用户信息

章节来源
- [JwtAuthenticationFilter.java](file://crm-auth/src/main/java/com/crm/auth/security/JwtAuthenticationFilter.java)
- [TokenService.java](file://crm-auth/src/main/java/com/crm/auth/security/TokenService.java)
- [SecurityExceptionHandlers.java](file://crm-auth/src/main/java/com/crm/auth/security/SecurityExceptionHandlers.java)

### DataScopeInterceptor 数据权限拦截器
- 功能要点
  - 基于 @DataScope 注解识别需要数据权限控制的接口
  - 结合 DataScopeTables 的表名与字段映射，动态拼接 WHERE 条件
  - 支持多种数据范围级别（全部、本部门、本人、自定义）
  - 通过 DataVisibilityContext 传递当前用户的可见范围
- 处理流程
  - 解析注解参数（表名、主键列、关联列、范围级别）
  - 从登录用户上下文获取组织/角色信息
  - 生成 SQL 片段并注入 MyBatis/MyBatis-Plus 查询
- 使用示例
  - 在 Service 方法上添加 @DataScope(table="sys_user", scope=DataScopeLevel.DEPT)
  - 查询自动附加 dept_id IN (当前用户所属部门) 的条件

章节来源
- [DataScopeInterceptor.java](file://crm-auth/src/main/java/com/crm/auth/security/DataScopeInterceptor.java)
- [DataScopeTables.java](file://crm-auth/src/main/java/com/crm/auth/security/DataScopeTables.java)
- [DataScope.java](file://crm-base/src/main/java/com/crm/base/annotation/DataScope.java)
- [DataScopeHelper.java](file://crm-base/src/main/java/com/crm/base/security/DataScopeHelper.java)
- [DataVisibilityContext.java](file://crm-base/src/main/java/com/crm/base/security/DataVisibilityContext.java)
- [DataScopeLevel.java](file://crm-base/src/main/java/com/crm/base/security/DataScopeLevel.java)

#### 数据权限处理流程图
```mermaid
flowchart TD
Start(["进入拦截器"]) --> CheckAnnotation["检查是否包含@DataScope注解"]
CheckAnnotation --> |否| Skip["跳过数据权限处理"]
CheckAnnotation --> |是| ResolveParams["解析注解参数<br/>表名/字段/范围级别"]
ResolveParams --> LoadContext["加载当前用户上下文"]
LoadContext --> BuildCondition["根据范围级别构建SQL条件"]
BuildCondition --> Inject["注入到查询语句"]
Inject --> End(["继续执行业务逻辑"])
Skip --> End
```

图表来源 
- [DataScopeInterceptor.java](file://crm-auth/src/main/java/com/crm/auth/security/DataScopeInterceptor.java)
- [DataScopeHelper.java](file://crm-base/src/main/java/com/crm/base/security/DataScopeHelper.java)
- [DataVisibilityContext.java](file://crm-base/src/main/java/com/crm/base/security/DataVisibilityContext.java)

### DataScopeTables 表权限映射
- 功能要点
  - 维护表名与数据权限字段的映射关系
  - 支持主键列、关联列、外键列的配置
  - 便于拦截器快速定位需要注入条件的列
- 使用示例
  - 为新表添加映射条目，指定主键与关联字段
  - 配合 @DataScope 注解生效

章节来源
- [DataScopeTables.java](file://crm-auth/src/main/java/com/crm/auth/security/DataScopeTables.java)

### TokenService 令牌服务
- 功能要点
  - 生成 JWT 令牌（含用户标识、角色、权限）
  - 校验令牌签名与有效期
  - 支持刷新与黑名单管理（可选）
- 使用示例
  - 登录成功后调用生成令牌
  - 后续请求携带令牌进行认证

章节来源
- [TokenService.java](file://crm-auth/src/main/java/com/crm/auth/security/TokenService.java)
- [JwtAuthenticationFilter.java](file://crm-auth/src/main/java/com/crm/auth/security/JwtAuthenticationFilter.java)

### SecurityExceptionHandlers 安全异常处理
- 功能要点
  - 捕获认证失败、授权拒绝等安全异常
  - 统一转换为 Result 响应体（错误码、消息）
  - 与全局异常处理器协作，保证一致性
- 使用示例
  - 无需业务代码处理，直接返回标准错误响应

章节来源
- [SecurityExceptionHandlers.java](file://crm-auth/src/main/java/com/crm/auth/security/SecurityExceptionHandlers.java)
- [GlobalExceptionHandlerAdvice.java](file://crm-base/src/main/java/com/crm/base/advice/GlobalExceptionHandlerAdvice.java)

### 初始化数据配置 DataInitializer
- 功能要点
  - 启动时检查并插入基础数据（角色、菜单、用户、部门）
  - 避免重复初始化，支持幂等
  - 为权限与数据权限提供初始环境
- 使用示例
  - 首次部署后自动创建管理员账号与基础菜单

章节来源
- [DataInitializer.java](file://crm-auth/src/main/java/com/crm/auth/config/DataInitializer.java)

### 跨域配置 CorsConfig
- 功能要点
  - 允许指定域名、方法、头部与凭证
  - 与 Spring Security 集成，确保预检请求放行
- 使用示例
  - 配置前端域名与允许的请求头

章节来源
- [CorsConfig.java](file://crm-base/src/main/java/com/crm/base/config/CorsConfig.java)

### 数据权限注解与工具
- @DataScope：标注在方法上，声明数据权限策略
- @DataOwnership：标注实体类，声明数据所有权字段
- DataScopeHelper：提供 SQL 片段生成与上下文操作
- DataVisibilityContext：线程局部存储当前可见范围
- DataScopeLevel：枚举定义数据范围级别
- LoginUser：登录用户信息模型
- SecurityUtils：便捷获取当前用户与权限

章节来源
- [DataScope.java](file://crm-base/src/main/java/com/crm/base/annotation/DataScope.java)
- [DataOwnership.java](file://crm-base/src/main/java/com/crm/base/security/DataOwnership.java)
- [DataScopeHelper.java](file://crm-base/src/main/java/com/crm/base/security/DataScopeHelper.java)
- [DataVisibilityContext.java](file://crm-base/src/main/java/com/crm/base/security/DataVisibilityContext.java)
- [DataScopeLevel.java](file://crm-base/src/main/java/com/crm/base/security/DataScopeLevel.java)
- [LoginUser.java](file://crm-base/src/main/java/com/crm/base/security/LoginUser.java)
- [SecurityUtils.java](file://crm-base/src/main/java/com/crm/base/security/SecurityUtils.java)

## 依赖关系分析
- SecurityConfig 依赖 JwtAuthenticationFilter、PermissionConfig、CorsConfig、SecurityExceptionHandlers
- DataScopeInterceptor 依赖 DataScopeTables、DataScopeHelper、DataVisibilityContext、DataScopeLevel
- JwtAuthenticationFilter 依赖 TokenService、SecurityContext
- 全局异常处理依赖 GlobalExceptionHandlerAdvice

```mermaid
classDiagram
class SecurityConfig {
+配置放行路径()
+配置鉴权规则()
+装配过滤器链()
}
class JwtAuthenticationFilter {
+解析JWT()
+构建认证()
}
class DataScopeInterceptor {
+解析注解()
+构建SQL条件()
+注入查询()
}
class DataScopeTables {
+表字段映射()
}
class TokenService {
+生成令牌()
+校验令牌()
}
class PermissionConfig {
+权限映射()
}
class SecurityExceptionHandlers {
+处理安全异常()
}
class CorsConfig {
+配置跨域()
}
class GlobalExceptionHandlerAdvice {
+统一异常处理()
}
SecurityConfig --> JwtAuthenticationFilter : "装配"
SecurityConfig --> PermissionConfig : "读取"
SecurityConfig --> SecurityExceptionHandlers : "注册"
SecurityConfig --> CorsConfig : "集成"
DataScopeInterceptor --> DataScopeTables : "读取映射"
DataScopeInterceptor --> TokenService : "间接依赖(用户上下文)"
JwtAuthenticationFilter --> TokenService : "使用"
```

图表来源 
- [SecurityConfig.java](file://crm-auth/src/main/java/com/crm/auth/config/SecurityConfig.java)
- [JwtAuthenticationFilter.java](file://crm-auth/src/main/java/com/crm/auth/security/JwtAuthenticationFilter.java)
- [DataScopeInterceptor.java](file://crm-auth/src/main/java/com/crm/auth/security/DataScopeInterceptor.java)
- [DataScopeTables.java](file://crm-auth/src/main/java/com/crm/auth/security/DataScopeTables.java)
- [TokenService.java](file://crm-auth/src/main/java/com/crm/auth/security/TokenService.java)
- [PermissionConfig.java](file://crm-auth/src/main/java/com/crm/auth/config/PermissionConfig.java)
- [SecurityExceptionHandlers.java](file://crm-auth/src/main/java/com/crm/auth/security/SecurityExceptionHandlers.java)
- [CorsConfig.java](file://crm-base/src/main/java/com/crm/base/config/CorsConfig.java)
- [GlobalExceptionHandlerAdvice.java](file://crm-base/src/main/java/com/crm/base/advice/GlobalExceptionHandlerAdvice.java)

章节来源
- [SecurityConfig.java](file://crm-auth/src/main/java/com/crm/auth/config/SecurityConfig.java)
- [DataScopeInterceptor.java](file://crm-auth/src/main/java/com/crm/auth/security/DataScopeInterceptor.java)
- [JwtAuthenticationFilter.java](file://crm-auth/src/main/java/com/crm/auth/security/JwtAuthenticationFilter.java)

## 性能考虑
- JWT 校验开销：建议缓存用户权限与角色信息，减少频繁查询
- 数据权限 SQL 拼接：避免复杂子查询，优先使用索引字段（如 dept_id、user_id）
- 拦截器粒度：仅在必要方法上使用 @DataScope，降低不必要的解析成本
- 跨域预检：合理配置预检缓存，减少 OPTIONS 请求频率
- 异常处理：统一异常处理避免重复日志与堆栈打印

[本节为通用指导，不直接分析具体文件]

## 故障排查指南
- 认证失败
  - 检查请求头 Authorization 是否正确携带 Bearer 令牌
  - 确认 TokenService 的密钥与算法配置一致
  - 查看 SecurityExceptionHandlers 的错误码与消息
- 授权拒绝
  - 核对 PermissionConfig 中的 URL 与权限标识
  - 确认用户角色与菜单权限是否匹配
- 数据权限不生效
  - 检查 @DataScope 注解参数是否与 DataScopeTables 映射一致
  - 验证 DataVisibilityContext 中用户上下文是否正确设置
  - 查看生成的 SQL 片段是否符合预期
- 跨域问题
  - 检查 CorsConfig 的域名、方法与头部配置
  - 确认预检请求是否被放行

章节来源
- [SecurityExceptionHandlers.java](file://crm-auth/src/main/java/com/crm/auth/security/SecurityExceptionHandlers.java)
- [GlobalExceptionHandlerAdvice.java](file://crm-base/src/main/java/com/crm/base/advice/GlobalExceptionHandlerAdvice.java)
- [DataScopeInterceptor.java](file://crm-auth/src/main/java/com/crm/auth/security/DataScopeInterceptor.java)
- [DataScopeTables.java](file://crm-auth/src/main/java/com/crm/auth/security/DataScopeTables.java)
- [CorsConfig.java](file://crm-base/src/main/java/com/crm/base/config/CorsConfig.java)

## 结论
本项目的安全与数据权限体系以 Spring Security 为核心，结合 JWT 无状态认证与注解驱动的数据权限拦截器，实现了灵活且可扩展的安全控制。通过统一的异常处理与跨域配置，保障了前后端分离场景下的稳定交互。建议在新增接口时遵循以下最佳实践：
- 明确接口是否需要鉴权与数据权限
- 正确配置 @DataScope 与表映射
- 完善权限配置与白名单
- 使用统一异常处理与返回格式

[本节为总结性内容，不直接分析具体文件]

## 附录
- 配置文件参考
  - application.yml（应用配置）
- 常用注解与工具
  - @DataScope、@DataOwnership
  - DataScopeHelper、DataVisibilityContext、SecurityUtils

章节来源
- [application.yml](file://crm-app/src/main/resources/application.yml)
- [application.yml](file://crm-auth/src/main/resources/application.yml)
- [DataScope.java](file://crm-base/src/main/java/com/crm/base/annotation/DataScope.java)
- [DataOwnership.java](file://crm-base/src/main/java/com/crm/base/security/DataOwnership.java)
- [DataScopeHelper.java](file://crm-base/src/main/java/com/crm/base/security/DataScopeHelper.java)
- [DataVisibilityContext.java](file://crm-base/src/main/java/com/crm/base/security/DataVisibilityContext.java)
- [SecurityUtils.java](file://crm-base/src/main/java/com/crm/base/security/SecurityUtils.java)