<dependency>
    <groupId>com.baomidou</groupId>
    <artifactId>shaun-spring-boot-starter</artifactId>
    <version>Latest Version</version>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
    <version>spring-boot-version</version>
</dependency>

shaun:
  salt: 32位字符串,不配置则每次启动不一样导致重启前登录的用户token失效
  stateless: true # 默认 true,表示是前后端分离的
  session-on: false # 默认 false,表示不用session(会影响pac4j的类对session的操作)
  login-url: /login # 如果配置,则会加入 exclude-path 内,前后端不分离下鉴权失败会被重定向到此
  token-location: header # 默认 header,token 的存取位置
  exclude-path: # 排除具体的路径
    - /v2/api-docs
    - /swagger-resources
    - /doc.html
  exclude-branch: # 排除以此路径开头
    - /webjars
  expire-time: 1d # 不设置默认永久有效 
# 更多配置参见源码

@Service
@AllArgsConstructor
public class LoginServiceImpl implements LoginService {

    private final SecurityManager securityManager;

    @Override
    @Transactional
    public String login() {
        // 登录成功后把用户角色权限信息存储到profile中
        final TokenProfile profile = new TokenProfile();
        profile.setId(userId.toString());
        //profile.addRole(role:String);  
        //profile.setRoles(roles:Set);  
        //profile.addPermission(permission:String);
        //profile.setPermissions(permissions:Set);
        //profile.addAttribute("key","value");
        final String token = securityManager.login(profile);
        //如果选择token存cookie里,securityManager.login会进行自动操作
        return token;
    }

@HasPermission(value = {"add", "edit"}, logical = Logical.BOTH) //权限必须同时存在
@HasPermission(value = {"add", "edit"}, logical = Logical.ANY)  //权限任一存在(默认)

TokenProfile profile = ProfileHolder.getProfile();