使用Spring MVC拦截器自定义注解实现审计日志收集

 public interface HandlerInterceptor {
    // 在执行目标方法之前执行
    boolean preHandle(HttpServletRequest request,HttpServletResponse response, Object handler)throws Exception;
    // 执行目标方法之后执行
    void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView)throws Exception;
    // 在请求已经返回之后执行
    void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex)throws Exception;
}

 @Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
    System.out.println(handler.getClass());
    return true;
}

import java.lang.annotation.*;
@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface AuditLog {
    String url() default "";
    String module() default "";
    String operation() default "";
    String description() default "";
    String objType() default "";
}

public enum ElementType {
    /** Class, interface (including annotation type), or enum declaration */
    // TYPE类型可以声明在类上或枚举上或者是注解上
    TYPE,
    /** Field declaration (includes enum constants) */
    // FIELD声明在字段上
    FIELD,
    /** Method declaration */
    // 声明在方法上
    METHOD,
    /** Formal parameter declaration */
    // 声明在形参列表中
    PARAMETER,
    /** Constructor declaration */
    // 声明在构造方法上
    CONSTRUCTOR,
    /** Local variable declaration */
    // 声明在局部变量上
    LOCAL_VARIABLE,
    /** Annotation type declaration */
    ANNOTATION_TYPE,
    /** Package declaration */
    PACKAGE,
    /**
     * Type parameter declaration
     *
     * @since 1.8
     */
    TYPE_PARAMETER,
    /**
     * Use of a type
     *
     * @since 1.8
     */
    TYPE_USE
}

 public enum RetentionPolicy {
    /**
     * Annotations are to be discarded by the compiler.
     */
    // 源代码时期
    SOURCE,
    /**
     * Annotations are to be recorded in the class file by the compiler
     * but need not be retained by the VM at run time.  This is the default
     * behavior.
     */
    // 字节码时期, 编译之后
    CLASS,
    /**
     * Annotations are to be recorded in the class file by the compiler and
     * retained by the VM at run time, so they may be read reflectively.
     *
     * @see java.lang.reflect.AnnotatedElement
     */
     // 运行时期, 也就是一直保留, 通常也都用这个
    RUNTIME
}

  @ResponseBody
    @RequestMapping(value = "/{id}", method = RequestMethod.DELETE)
    @AuditLog(module = AuditLogModule.CHANNEL, operation = AuditLogOperate.DELETE, description = "deleteBuild",
            objType = AuditLogObjType.CHANNELBUILD)
    public ResponseEntity deleteBuild(HttpServletRequest request, @PathVariable(value = "id") long id) {
        //其它代码省略
}

@Override
   public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex)
           throws Exception {
       if (handler instanceof HandlerMethod) {
           HandlerMethod handlerMethod = (HandlerMethod) handler;
           LOGGER.error("auditlog create");
           Method method = handlerMethod.getMethod();
           AuditLog auditLog = method.getAnnotation(AuditLog.class);
           if (auditLog == null) {
               return;
           }
           try {
               
               AuditLogInfo auditLogInfo = createAuditLog(auditLog, request, response);
               if (auditLogInfo != null) {
                 AuditLogHandler.createAuditLog(auditLogInfo);
               }
               
           } catch (Exception e) {
               LOGGER.error("auditlog create error", e);
           }
       }
   }

 @Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface Access {
    String[] value() default {};
    String[] authorities() default {};
    String[] roles() default {};
}

 @RestController
public class HelloController {
    @RequestMapping(value = "/admin", produces = MediaType.APPLICATION_JSON_UTF8_VALUE, method = RequestMethod.GET)
    // 配置注解权限, 允许身份为admin, 或者说允许权限为admin的人访问
    @Access(authorities = {"admin"})
    public String hello() {
        return "Hello, admin";
    }
}

 // 自定义一个权限拦截器, 继承HandlerInterceptorAdapter类
public class AuthenticationInterceptor extends HandlerInterceptorAdapter {
    // 在调用方法之前执行拦截
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        // 将handler强转为HandlerMethod, 前面已经证实这个handler就是HandlerMethod
        HandlerMethod handlerMethod = (HandlerMethod) handler;
        // 从方法处理器中获取出要调用的方法
        Method method = handlerMethod.getMethod();
        // 获取出方法上的Access注解
        Access access = method.getAnnotation(Access.class);
        if (access == null) {
        // 如果注解为null, 说明不需要拦截, 直接放过
            return true;
        }
        if (access.authorities().length > 0) {
            // 如果权限配置不为空, 则取出配置值
            String[] authorities = access.authorities();
            Set<String> authSet = new HashSet<>();
            for (String authority : authorities) {
            // 将权限加入一个set集合中
                authSet.add(authority);
            }
            String role = request.getParameter("role");
            if (StringUtils.isNotBlank(role)) {
                if (authSet.contains(role)) {
                // 校验通过返回true, 否则拦截请求
                    return true;
                }
            }
        }
        // 拦截之后应该返回公共结果, 这里没做处理
        return false;
    }
}