### Generate Mybatis code with Maven

Source: https://github.com/dolyw/shirojwt/blob/master/README.md

This command uses the Maven Mybatis Generator plugin to automatically generate basic code based on the database schema. Ensure `generatorConfig.xml` is configured correctly and Maven is installed. It can be executed from the project root directory.

```Shell
mvn mybatis-generator:generate
```

--------------------------------

### Shiro + Java-JWT Stateless Authentication Flow

Source: https://github.com/dolyw/shirojwt/blob/master/README.md

Details the authentication process using Shiro and Java-JWT for stateless API security. It covers user login, token usage, and the role of the custom JWTFilter in handling requests.

```APIDOC
1. User Login:
   - Method: POST
   - Endpoint: user/login
   - Request: Username and password
   - Response (Success): Encrypted AccessToken
   - Response (Failure): 401 error (incorrect account/password)

2. Subsequent API Access:
   - Include AccessToken in request headers (Authorization field).

3. Authentication Flow (JWTFilter):
   - JWTFilter (overrides BasicHttpAuthenticationFilter) checks for "Authorization" header.
   - If "Authorization" header exists: Shiro performs Token login authentication/authorization.
   - If "Authorization" header is missing: User accesses as guest (subject to permission control).
```

--------------------------------

### JWT Refresh Token Management and Auto-Refresh with Redis

Source: https://github.com/dolyw/shirojwt/blob/master/README.md

Explains how Refresh Tokens are used with Redis to manage JWT controllability and automatic Access Token refreshing. It details the lifecycle of tokens, how user sessions are controlled, and the conditions for token renewal.

```APIDOC
RefreshToken Management:
  1. Login Success:
     - Return AccessToken (contains current timestamp and account).
     - Store RefreshToken in Redis: Key=Account, Value=Current Timestamp (login time).

  2. Authentication Validation:
     - AccessToken must be valid.
     - Corresponding RefreshToken must exist in Redis.
     - RefreshToken timestamp must match AccessToken's embedded timestamp.

  3. Token Control:
     - Re-login generates new AccessToken; old AccessTokens become invalid (due to timestamp mismatch with latest RefreshToken).
     - Deleting a RefreshToken from Redis invalidates its corresponding AccessToken, effectively logging out the user.

AccessToken Auto-Refresh:
  1. Token Expiration:
     - AccessToken expires after 5 minutes (configurable).
     - RefreshToken expires after 30 minutes (configurable).

  2. Expiration Handling:
     - When AccessToken expires (TokenExpiredException), check for refresh.

  3. Refresh Condition:
     - Query Redis for user's RefreshToken.
     - Check if RefreshToken exists AND its timestamp matches the expired AccessToken's timestamp.

  4. Refresh Process (if conditions met):
     - Generate new AccessToken: 5-minute expiration, current timestamp.
     - Update RefreshToken in Redis: Set timestamp to current, reset expiration to 30 minutes.
     - Return new AccessToken in Response Header (Authorization field) for client update.
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.