Docker 部署 Spring Boot + Vue + PostgreSQL 實現一個會員註冊登入系統

services:
  # PostgreSQL 資料庫
  postgres:
    image: postgres:15-alpine
    container_name: apname-postgres
    environment:
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      TZ: Asia/Taipei
    ports:
      - "${POSTGRES_PORT}"
    volumes:
      - ./data/postgres:/var/lib/postgresql/data
    networks:
      - apname-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 30s
      timeout: 10s
      retries: 3

  # Spring Boot 後端
  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    container_name: apname-backend
    environment:
      - SPRING_PROFILES_ACTIVE=docker
      - DATABASE_URL=jdbc:postgresql://postgres:${POSTGRES_PORT}/${POSTGRES_DB}
      - JWT_SECRET=${JWT_SECRET}
    ports:
      - "${BACKEND_PORT}"
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - apname-network
    volumes:
      - ./logs/backend:/app/logs

  # Vue.js 前端
  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
    container_name: apname-frontend
    environment:
      - VITE_API_BASE_URL=http://${HOST}:${BACKEND_PORT}/api
    ports:
      - "${FRONTEND_PORT}"
    depends_on:
      - backend
    networks:
      - apname-network

  # pgAdmin (資料庫管理工具)
  pgadmin:
    image: dpage/pgadmin4:latest
    container_name: apname-pgadmin
    environment:
      PGADMIN_DEFAULT_EMAIL: ${PGADMIN_USE}
      PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_PASSWORD}
      TZ: Asia/Taipei
    ports:
      - "${PGADMIN_PORT}"
    depends_on:
      - postgres
    networks:
      - apname-network
    volumes:
      - ./data/pgadmin:/var/lib/pgadmin
      - /etc/localtime:/etc/localtime:ro
      
networks:
  apname-network:
    driver: bridge

# 資料庫配置
POSTGRES_USER=postgres
POSTGRES_PASSWORD=your_secure_password
POSTGRES_DB=apame_db
POSTGRES_PORT=5432
DATABASE_USERNAME=postgres
DATABASE_PASSWORD=your_secure_password
DATABASE_URL=jdbc:postgresql://localhost:5432/apame_db

# 資料庫管理工具配置
PGADMIN_USE=admin@apname.com
PGADMIN_PASSWORD=your_secure_password
PGADMIN_PORT=5050 

# JWT 配置
JWT_SECRET=your_very_long_secret_key_for_jwt_token
JWT_EXPIRATION=86400000
JWT_REFRESH_EXPIRATION=604800000

# 主機配置
HOST=localhost

# 前端、後端 port 配置
BACKEND_PORT=8080
FRONTEND_PORT=3000
SERVER_PORT=8080

# 郵件配置
MAIL_HOST=smtp.gmail.com
MAIL_PORT=587
MAIL_USERNAME=your_email@gmail.com
MAIL_PASSWORD=your_app_password

# 應用程式配置
FRONTEND_URL=http://localhost:3000
EMAIL_MOCK=false

// 路由配置
const routes: RouteRecordRaw[] = [
  {
    path: '/register',
    name: 'Register',
    component: () => import('@/views/auth/Register.vue'),
    meta: {
      title: '註冊'
    }
  },
  {
    path: '/verify-email',
    name: 'VerifyEmail',
    component: () => import('@/views/auth/VerifyEmail.vue'),
    meta: {
      title: '信箱驗證'
    }
  },
  {
    path: '/verification-sent',
    name: 'VerificationSent',
    component: () => import('@/views/auth/VerificationSent.vue'),
    meta: {
      title: '驗證連結已發送'
    }
  },
  {
    path: '/pending-verification',
    name: 'PendingVerification',
    component: () => import('@/views/auth/PendingVerification.vue'),
    meta: {
      title: '帳號待驗證'
    }
  }
]

<template>
  <div class="register-container">
    <div class="register-form">
      <div class="form-header">
        <h2>註冊</h2>
        <p>創建您的ＸＸＸＸＸ帳號</p>
      </div>
      
      <el-form
        ref="registerFormRef"
        :model="registerForm"
        :rules="registerRules"
        class="register-form-content"
        label-width="0"
        @submit.prevent="handleRegister"
      >
        <el-form-item prop="email">
          <el-input
            v-model="registerForm.email"
            size="large"
            placeholder="請輸入信箱"
            prefix-icon="Message"
            :disabled="loading"
            inputmode="email"
          />
        </el-form-item>
        
        <el-form-item prop="password">
          <el-input
            v-model="registerForm.password"
            type="password"
            size="large"
            placeholder="請輸入密碼"
            prefix-icon="Lock"
            show-password
            :disabled="loading"
            inputmode="text"
            @input="handlePasswordInput"
            @compositionstart="handleCompositionStart"
            @compositionend="handleCompositionEnd"
          />
        </el-form-item>
        
        <el-form-item prop="confirmPassword">
          <el-input
            v-model="registerForm.confirmPassword"
            type="password"
            size="large"
            placeholder="請確認密碼"
            prefix-icon="Lock"
            show-password
            :disabled="loading"
            inputmode="text"
            @input="handleConfirmPasswordInput"
            @compositionstart="handleCompositionStart"
            @compositionend="handleCompositionEnd"
          />
        </el-form-item>
        
        <el-form-item>
          <el-checkbox v-model="registerForm.agreeTerms" :disabled="loading">
            我已閱讀並同意
            <el-link @click="showTerms">服務協議</el-link>
            和
            <el-link @click="showPrivacy">隱私政策</el-link>
          </el-checkbox>
        </el-form-item>
        
        <el-form-item>
          <el-button
            size="large"
            :loading="loading"
            :disabled="!canRegister"
            class="register-button"
            @click="handleRegister"
          >
            <span v-if="!loading">註冊</span>
            <span v-else>註冊中...</span>
          </el-button>
        </el-form-item>
      </el-form>
      
      <div class="form-footer">
        <p>
          已有帳號？
          <el-link @click="router.push('/login')">
            立即登入
          </el-link>
        </p>
      </div>
    </div>
  </div>
</template>

// 組件結構
<script setup lang="ts">
import { ref, reactive, computed } from 'vue'
import { useRouter } from 'vue-router'
import { ElMessage, ElForm, ElMessageBox } from 'element-plus'
import type { FormInstance, FormRules } from 'element-plus'

// 狀態管理
const router = useRouter()
const loading = ref(false)
const registerFormRef = ref<FormInstance>()

const registerForm = reactive({
  email: '',
  password: '',
  confirmPassword: '',
  agreeTerms: false
})

// 檢查是否可以點擊註冊
const canRegister = computed(() => {
  return !loading.value &&
         isEmailValid.value &&
         registerForm.password &&
         registerForm.password.length >= 6 &&
         /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?`~]).{6,}$/.test(registerForm.password) &&
         registerForm.confirmPassword &&
         registerForm.confirmPassword === registerForm.password &&
         registerForm.agreeTerms
})

// 表單驗證規則
const registerRules: FormRules = {
  email: [
    { validator: validateEmail, trigger: 'blur' }
  ],
  password: [
    { validator: validatePassword, trigger: 'blur' }
  ],
  confirmPassword: [
    { validator: validateConfirmPassword, trigger: 'blur' }
  ],
  agreeTerms: [
    { validator: validateTerms, trigger: 'change' }
  ]
}
</script>

// 信箱格式驗證
const validateEmail = (_rule: any, value: string, callback: any) => {
  if (!value) {
    callback(new Error('請輸入信箱'))
  } else if (/[^\x00-\x7F]/.test(value)) {
    callback(new Error('信箱只能包含英文、數字和符號，且不能有空白'))
  } else if (!/^[A-Za-z0-9+_.-]+@([A-Za-z0-9.-]+\.[A-Za-z]{2,})$/.test(value)) {
    callback(new Error('請輸入正確的信箱格式'))
  } else {
    callback()
  }
}

// 密碼強度驗證
const validatePassword = (_rule: any, value: string, callback: any) => {
  if (!value) {
    callback(new Error('請輸入密碼'))
  } else if (value.length < 6) {
    callback(new Error('密碼長度不能少於6位'))
  } else if (!/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?`~]).{6,}$/.test(value)) {
    callback(new Error('密碼必須包含至少一個大寫字母、一個小寫字母、一個數字和一個符號'))
  } else {
    callback()
  }
}

// 密碼確認驗證
const validateConfirmPassword = (_rule: any, value: string, callback: any) => {
  if (value === '') {
    callback(new Error('請確認密碼'))
  } else if (value !== registerForm.password) {
    callback(new Error('兩次輸入的密碼不一致'))
  } else {
    callback()
  }
}

const handleRegister = async () => {
  try {
    await registerFormRef.value.validate()
    loading.value = true
    
    // 準備註冊數據
    const registerData = {
      username: registerForm.email.split('@')[0], // 使用信箱前綴作為用戶名
      email: registerForm.email,
      password: registerForm.password
    }
    
    // 調用註冊 API
    const response = await fetch('/api/auth/register', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json'
      },
      body: JSON.stringify(registerData)
    })
    
    const result = await response.json()
    
    if (!response.ok || !result.success) {
      ElMessage.error(result.message || '註冊失敗，請稍後再試')
      return
    }
    
    // 註冊成功後，發送驗證連結
    const sendResult = await sendVerificationLink(registerForm.email)
    
    if (!sendResult.success) {
      ElMessage.error(sendResult.message)
      return
    }
    
    // 跳轉到驗證連結發送提示頁面
    router.push({
      path: '/verification-sent',
      query: { email: registerForm.email }
    })
    
  } catch (error) {
    console.error('註冊失敗:', error)
    ElMessage.error('註冊失敗，請檢查網絡連接')
  } finally {
    loading.value = false
  }
}

/**
 * 認證 Controller
 * 處理用戶註冊、登入、信箱驗證等認證相關請求
 */
@RestController
@RequestMapping("/auth")
@CrossOrigin(origins = "*")
public class AuthController {
    
    private static final Logger logger = LoggerFactory.getLogger(AuthController.class);
    
    @Autowired
    private AuthService authService;
    
    @Autowired
    private UserService userService;
    
    @Autowired(required = false)
    private EmailService emailService;
    
    @Autowired(required = false)
    private MockEmailService mockEmailService;
    
    @Autowired
    private JwtUtil jwtUtil;

    /**
     * 用戶登入
     */
    @PostMapping("/login")
    public ResponseEntity<AuthResponse> login(@Valid @RequestBody LoginRequest loginRequest) {
        logger.info("收到登入請求: {}", loginRequest.getUsername());
        
        AuthResponse response = authService.login(loginRequest);
        
        if (response.isSuccess()) {
            return ResponseEntity.ok(response);
        } else {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body(response);
        }
    }

    /**
     * 用戶註冊端點
     */
    @PostMapping("/register")
    public ResponseEntity<AuthResponse> register(@Valid @RequestBody RegisterRequest registerRequest) {
        logger.info("收到註冊請求: {}", registerRequest.getUsername());
        
        AuthResponse response = authService.register(registerRequest);
        
        if (response.isSuccess()) {
            return ResponseEntity.status(HttpStatus.CREATED).body(response);
        } else {
            return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(response);
        }
    }

    /**
     * 發送郵件驗證連結
     */
    @PostMapping("/send-verification-code")
    public ResponseEntity<Map<String, Object>> sendVerificationCode(@RequestBody Map<String, String> request) {
        logger.info("收到發送驗證連結請求");
        
        Map<String, Object> response = new HashMap<>();
        String email = request.get("email");
        
        if (email == null || email.trim().isEmpty()) {
            response.put("success", false);
            response.put("message", "信箱不能為空");
            return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(response);
        }
        
        // 驗證信箱格式
        if (!email.matches("^[A-Za-z0-9+_.-]+@([A-Za-z0-9.-]+\\.[A-Za-z]{2,})$")) {
            response.put("success", false);
            response.put("message", "信箱格式不正確");
            return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(response);
        }
        
        // 檢查信箱是否已經在users表中存在
        if (userService.existsByEmail(email)) {
            Optional<User> userOptional = userService.findByEmail(email);
            if (userOptional.isPresent()) {
                User user = userOptional.get();
                if (user.getStatus() == UserStatus.ACTIVE) {
                    response.put("success", false);
                    response.put("message", "該信箱已被註冊，請使用其他信箱");
                    return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(response);
                }
            }
        }
        
        boolean result;
        if (emailService != null) {
            result = emailService.sendVerificationCode(email);
        } else if (mockEmailService != null) {
            result = mockEmailService.sendVerificationCode(email);
        } else {
            response.put("success", false);
            response.put("message", "郵件服務暫時不可用");
            return ResponseEntity.status(HttpStatus.SERVICE_UNAVAILABLE).body(response);
        }
        
        if (result) {
            response.put("success", true);
            response.put("message", "驗證連結已發送到您的信箱");
            return ResponseEntity.ok(response);
        } else {
            response.put("success", false);
            response.put("message", "發送失敗，請稍後再試");
            return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(response);
        }
    }
    
    /**
     * 驗證郵件驗證連結
     */
    @PostMapping("/verify-email")
    public ResponseEntity<Map<String, Object>> verifyEmail(@RequestBody Map<String, String> request) {
        logger.info("收到郵件驗證請求");
        
        Map<String, Object> response = new HashMap<>();
        String email = request.get("email");
        String token = request.get("token");
        
        if (email == null || email.trim().isEmpty() || token == null || token.trim().isEmpty()) {
            response.put("success", false);
            response.put("message", "信箱和驗證token不能為空");
            return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(response);
        }
        
        boolean result;
        if (emailService != null) {
            result = emailService.verifyCode(email, token);
        } else if (mockEmailService != null) {
            result = mockEmailService.verifyCode(email, token);
        } else {
            response.put("success", false);
            response.put("message", "郵件服務暫時不可用");
            return ResponseEntity.status(HttpStatus.SERVICE_UNAVAILABLE).body(response);
        }
        
        if (result) {
            // 驗證成功後，獲取用戶信息並返回登入token
            Optional<User> userOptional = userService.findByEmail(email);
            if (userOptional.isPresent()) {
                User user = userOptional.get();
                
                // 生成JWT Token
                String jwtToken = jwtUtil.generateToken(
                    user.getUsername(), 
                    user.getRole().name(), 
                    user.getId()
                );
                
                String refreshToken = jwtUtil.generateRefreshToken(user.getUsername());
                UserResponse userResponse = userService.convertToUserResponse(user);
                
                response.put("success", true);
                response.put("message", "信箱驗證成功");
                response.put("token", jwtToken);
                response.put("refreshToken", refreshToken);
                response.put("user", userResponse);
                return ResponseEntity.ok(response);
            } else {
                response.put("success", false);
                response.put("message", "用戶信息獲取失敗");
                return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body(response);
            }
        } else {
            response.put("success", false);
            response.put("message", "驗證token錯誤或已過期");
            return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(response);
        }
    }
}

/**
 * JWT Util
 * 負責 JWT Token 的生成、驗證和解析
 */
@Component
public class JwtUtil {
    
    @Value("${jwt.secret}") //  secret key 參數 從 .env 帶到 application.yml
    private String secret;
    
    @Value("${jwt.expiration:86400000}") // 24小時 (毫秒)
    private Long expiration;
    
    @Value("${jwt.refresh-expiration:604800000}") // 7天 (毫秒)
    private Long refreshExpiration;
    
    private SecretKey getSigningKey() {
        return Keys.hmacShaKeyFor(secret.getBytes());
    }
    
    /**
     * 從Token中提取用戶名
     */
    public String getUsernameFromToken(String token) {
        return getClaimFromToken(token, Claims::getSubject);
    }
    
    /**
     * 從Token中提取過期時間
     */
    public Date getExpirationDateFromToken(String token) {
        return getClaimFromToken(token, Claims::getExpiration);
    }
    
    /**
     * 從Token中提取指定的聲明
     */
    public <T> T getClaimFromToken(String token, Function<Claims, T> claimsResolver) {
        final Claims claims = getAllClaimsFromToken(token);
        return claimsResolver.apply(claims);
    }
    
    /**
     * 從Token中提取所有聲明
     */
    private Claims getAllClaimsFromToken(String token) {
        return Jwts.parser()
                .verifyWith(getSigningKey())
                .build()
                .parseSignedClaims(token)
                .getPayload();
    }
    
    /**
     * 檢查Token是否過期
     */
    public Boolean isTokenExpired(String token) {
        try {
            final Date expiration = getExpirationDateFromToken(token);
            return expiration.before(new Date());
        } catch (Exception e) {
            logger.warn("Token過期檢查失敗: {}", e.getMessage());
            return true;
        }
    }
    
    /**
     * 生成訪問Token
     */
    public String generateToken(String username, String role, Long userId) {
        Map<String, Object> claims = new HashMap<>();
        claims.put("role", role);
        claims.put("userId", userId);
        return createToken(claims, username, expiration);
    }
    
    /**
     * 生成刷新Token
     */
    public String generateRefreshToken(String username) {
        Map<String, Object> claims = new HashMap<>();
        claims.put("tokenType", "refresh");
        return createToken(claims, username, refreshExpiration);
    }
    
    /**
     * 創建Token
     */
    private String createToken(Map<String, Object> claims, String subject, Long expiration) {
        return Jwts.builder()
                .setClaims(claims)
                .setSubject(subject)
                .setIssuedAt(new Date(System.currentTimeMillis()))
                .setExpiration(new Date(System.currentTimeMillis() + expiration))
                .signWith(getSigningKey(), SignatureAlgorithm.HS512)
                .compact();
    }
    
    /**
     * 驗證Token
     */
    public Boolean validateToken(String token, String username) {
        try {
            final String tokenUsername = getUsernameFromToken(token);
            return (tokenUsername.equals(username) && !isTokenExpired(token));
        } catch (Exception e) {
            logger.warn("Token驗證失敗: {}", e.getMessage());
            return false;
        }
    }
    
    /**
     * 從Token中獲取用戶ID
     */
    public Long getUserIdFromToken(String token) {
        try {
            Claims claims = getAllClaimsFromToken(token);
            return claims.get("userId", Long.class);
        } catch (Exception e) {
            logger.warn("從Token獲取用戶ID失敗: {}", e.getMessage());
            return null;
        }
    }
    
    /**
     * 從Token中獲取用戶角色
     */
    public String getRoleFromToken(String token) {
        try {
            Claims claims = getAllClaimsFromToken(token);
            return claims.get("role", String.class);
        } catch (Exception e) {
            logger.warn("從Token獲取用戶角色失敗: {}", e.getMessage());
            return null;
        }
    }
}

/**
 * 認證服務類別
 * 處理用戶登入、註冊等認證相關業務邏輯
 */
@Service
public class AuthService {
    
    @Autowired
    private UserService userService
    
    @Autowired
    private PasswordEncoder passwordEncoder
    
    @Autowired(required = false)
    private EmailService emailService;
    
    @Autowired(required = false)
    private MockEmailService mockEmailService;
    
    @Autowired
    private JwtUtil jwtUtil;
    
    /**
     * 用戶登入處理
     * @param loginRequest 登入請求
     * @return AuthResponse 認證響應
     */
    public AuthResponse login(LoginRequest loginRequest) {
        logger.info("用戶登入請求: {}", loginRequest.getUsername());
        
        try {
            // 查找用戶
            Optional<User> userOptional = userService.findByUsernameOrEmail(loginRequest.getUsername());
            if (!userOptional.isPresent()) {
                logger.warn("登入失敗: 用戶不存在 - {}", loginRequest.getUsername());
                return AuthResponse.failure("用戶名或密碼錯誤");
            }
            
            User user = userOptional.get();
            
            // 檢查用戶狀態
            if (user.getStatus() == UserStatus.INACTIVE) {
                logger.warn("登入失敗: 用戶尚未驗證 - {}, 狀態: {}", user.getUsername(), user.getStatus());
                return AuthResponse.pendingVerification("帳號待驗證", user.getEmail());
            } else if (!userService.isUserActive(user)) {
                logger.warn("登入失敗: 用戶狀態不正常 - {}, 狀態: {}", user.getUsername(), user.getStatus());
                return AuthResponse.failure("用戶帳號已被暫停或停用");
            }
            
            // 驗證密碼
            if (!userService.validatePassword(user, loginRequest.getPassword())) {
                logger.warn("登入失敗: 密碼錯誤 - {}", loginRequest.getUsername());
                return AuthResponse.failure("用戶名或密碼錯誤");
            }
            
            // 生成JWT Token
            String token = jwtUtil.generateToken(
                user.getUsername(), 
                user.getRole().name(), 
                user.getId()
            );
            
            String refreshToken = jwtUtil.generateRefreshToken(user.getUsername());
            
            UserResponse userResponse = userService.convertToUserResponse(user);
            
            logger.info("用戶登入成功: {}", user.getUsername());
            return AuthResponse.success("登入成功", token, refreshToken, userResponse);
            
        } catch (Exception e) {
            logger.error("登入過程中發生錯誤: {}", e.getMessage(), e);
            return AuthResponse.failure("登入失敗，請稍後再試");
        }
    }
    
    /**
     * 用戶註冊處理
     * @param registerRequest 註冊請求
     * @return AuthResponse 認證響應
     */
    public AuthResponse register(RegisterRequest registerRequest) {
        logger.info("用戶註冊請求: {}", registerRequest.getUsername());
        
        try {
            // 檢查信箱是否已存在（信箱是登入帳號，不允許重複）
            if (userService.existsByEmail(registerRequest.getEmail())) {
                logger.warn("註冊失敗: 信箱已存在 - {}", registerRequest.getEmail());
                return AuthResponse.failure("信箱已存在");
            }
            
            // 註冊時不需要檢查信箱驗證，因為用戶狀態為 INACTIVE，需要後續驗證才能啟用
            
            // 創建新用戶
            User user = userService.createUser(registerRequest);
            
            // 生成JWT Token
            String token = jwtUtil.generateToken(
                user.getUsername(), 
                user.getRole().name(), 
                user.getId()
            );
            
            String refreshToken = jwtUtil.generateRefreshToken(user.getUsername());
            
            UserResponse userResponse = userService.convertToUserResponse(user);
            
            logger.info("用戶註冊成功: {}", user.getUsername());
            return AuthResponse.success("註冊成功", token, refreshToken, userResponse);
            
        } catch (RuntimeException e) {
            logger.warn("註冊失敗: {}", e.getMessage());
            return AuthResponse.failure(e.getMessage());
        } catch (Exception e) {
            logger.error("註冊過程中發生錯誤: {}", e.getMessage(), e);
            return AuthResponse.failure("註冊失敗，請稍後再試");
        }
    }
    
    /**
     * 刷新Token
     */
    public AuthResponse refreshToken(String refreshToken) {
        logger.info("刷新Token請求");
        
        try {
            // 驗證刷新Token
            String username = jwtUtil.getUsernameFromToken(refreshToken);
            if (username == null || !jwtUtil.validateToken(refreshToken, username)) {
                logger.warn("刷新Token失敗: Token無效");
                return AuthResponse.failure("Token無效");
            }
            
            // 查找用戶
            Optional<User> userOptional = userService.findByUsername(username);
            if (!userOptional.isPresent()) {
                logger.warn("刷新Token失敗: 用戶不存在 - {}", username);
                return AuthResponse.failure("用戶不存在");
            }
            
            User user = userOptional.get();
            
            // 檢查用戶狀態
            if (!userService.isUserActive(user)) {
                logger.warn("刷新Token失敗: 用戶狀態不正常 - {}", username);
                return AuthResponse.failure("用戶帳號已被暫停或停用");
            }
            
            // 生成新的Token
            String newToken = jwtUtil.generateToken(
                user.getUsername(), 
                user.getRole().name(), 
                user.getId()
            );
            
            String newRefreshToken = jwtUtil.generateRefreshToken(user.getUsername());
            
            UserResponse userResponse = userService.convertToUserResponse(user);
            
            logger.info("Token刷新成功: {}", username);
            return AuthResponse.success("Token刷新成功", newToken, newRefreshToken, userResponse);
            
        } catch (Exception e) {
            logger.error("刷新Token過程中發生錯誤: {}", e.getMessage(), e);
            return AuthResponse.failure("Token刷新失敗");
        }
    }
}

/**
 * 用戶服務類別
 * 處理用戶相關的業務邏輯，包含創建、查詢、更新等功能
 */
@Service
@Transactional
public class UserService {
    
    private static final Logger logger = LoggerFactory.getLogger(UserService.class);
    
    @Autowired
    private UserRepository userRepository;
    
    @Autowired
    private PasswordEncoder passwordEncoder;
    
    /**
     * 創建新用戶
     * 處理用戶註冊時的用戶創建邏輯
     */
    public User createUser(RegisterRequest registerRequest) {
        logger.info("創建新用戶: {}", registerRequest.getEmail());
        
        // 檢查信箱是否已存在（信箱是登入帳號，不允許重複）
        if (userRepository.existsByEmail(registerRequest.getEmail())) {
            throw new RuntimeException("信箱已存在");
        }
        
        // 創建新用戶
        User user = new User();
        // username可以為空，後續在會員維護時再填寫
        user.setUsername(registerRequest.getUsername());
        user.setEmail(registerRequest.getEmail());
        user.setPassword(passwordEncoder.encode(registerRequest.getPassword()));
        user.setRole(UserRole.USER);
        user.setStatus(UserStatus.INACTIVE); // 註冊時狀態為非啟用，需要信箱驗證後才能啟用
        
        User savedUser = userRepository.save(user);
        logger.info("用戶創建成功: {}", savedUser.getEmail());
        
        return savedUser;
    }
    
    /**
     * 根據用戶名查找用戶
     */
    public Optional<User> findByUsername(String username) {
        return userRepository.findByUsername(username);
    }
    
    /**
     * 根據信箱查找用戶
     */
    public Optional<User> findByEmail(String email) {
        return userRepository.findByEmail(email);
    }
    
    /**
     * 根據用戶名或信箱查找用戶
     * 支援用戶使用用戶名或信箱登入
     */
    public Optional<User> findByUsernameOrEmail(String usernameOrEmail) {
        return userRepository.findByUsernameOrEmail(usernameOrEmail);
    }
    
    /**
     * 根據ID查找用戶
     */
    public Optional<User> findById(Long id) {
        return userRepository.findById(id);
    }
    
    /**
     * 檢查用戶名是否存在
     */
    public boolean existsByUsername(String username) {
        return userRepository.existsByUsername(username);
    }
    
    /**
     * 檢查信箱是否存在
     */
    public boolean existsByEmail(String email) {
        return userRepository.existsByEmail(email);
    }
    
    /**
     * 更新用戶信息
     */
    public User updateUser(User user) {
        logger.info("更新用戶信息: {}", user.getUsername());
        return userRepository.save(user);
    }
    
    /**
     * 更新用戶狀態
     * 用於啟用、停用或暫停用戶帳戶
     */
    public User updateUserStatus(Long userId, UserStatus status) {
        logger.info("更新用戶狀態: userId={}, status={}", userId, status);
        
        User user = userRepository.findById(userId)
                .orElseThrow(() -> new RuntimeException("用戶不存在"));
        
        user.setStatus(status);
        return userRepository.save(user);
    }
    
    /**
     * 驗證用戶密碼
     * 使用 Spring Security 的 PasswordEncoder 進行密碼比對
     */
    public boolean validatePassword(User user, String rawPassword) {
        return passwordEncoder.matches(rawPassword, user.getPassword());
    }
    
    /**
     * 更新用戶密碼
     * 新密碼會自動加密後儲存
     */
    public User updatePassword(Long userId, String newPassword) {
        logger.info("更新用戶密碼: userId={}", userId);
        
        User user = userRepository.findById(userId)
                .orElseThrow(() -> new RuntimeException("用戶不存在"));
        
        user.setPassword(passwordEncoder.encode(newPassword));
        return userRepository.save(user);
    }
    
    /**
     * 檢查用戶是否處於活躍狀態
     * 只有 ACTIVE 狀態的用戶才能正常登入
     */
    public boolean isUserActive(User user) {
        return user.getStatus() == UserStatus.ACTIVE;
    }
    
    /**
     * 將User實體轉換為UserResponse
     * 用於API回應，避免直接暴露實體類別
     */
    public UserResponse convertToUserResponse(User user) {
        return UserResponse.fromUser(user);
    }
}