devbox
Cpp五条
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

实践指南：使用SpringBoot构建API后端服务

作者：Cpp五条 | 2024-02-08 11:53:46

赞

踩

spring boot 做纯api服务

2019独角兽企业重金招聘Python工程师标准>>> hot3.png

#介绍

这个指南非常简单，不是从入门到进阶,不会面面俱到的讲如何从零起步，覆盖所有知识点。只是通过构建了一个小后端API工程，实现了基本功能。 这个指南中包含了Spring boot, Spring data, Spring Security的配置使用及单元测试的创建。

#Spring Boot简单配置

Spring Boot中提供了profile的概念，通过profile可以选择性的使用或者不适用应用程序的某些部分。

通过profile来选择使用一个class

  1. @Component
  2. @Profile("dev")
  3. public class LoggingEmailGateway implements EmailGateway {
  4. ...
  5. }

上面的代码中，@Profile注解标注了这个class的profile是“dev”,那么, 在application.properties中使用spring.profiles.active=dev 或者在命令行中使用这个参数来激活这个profile: java -jar application.jar --spring.profiles.active=dev

某个profile专用的一组配置

默认情况下，spring boot是会把所有的配置放在application.properties中配置。如果需要为某个profile配置专用的一组配置内容，可以使用命名规范符合application-<profileName>.properties的配置文件来实现：

application-prod.properties

server.port = 5000

配置日志

spring boot默认使用logback来记录日志，把日志内容输出到控制台上。

生产环境的日志配置

我们需要把生产环境的日志输出到文件中。这需要在配置文件中实现这个配置。在src/main/resources下面创建logback-spring.xml文件：

logback-spring.xml

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <configuration>
  3.     <!-- spring boot默认的logback配置 -->
  4.     <include resource="org/springframework/boot/logging/logback/defaults.xml"/>
  5. 	
  6. 	<!-- dev和local这两个profile的配置，日志输出到控制台 -->
  7.     <springProfile name="dev,local">
  8.         <include resource="org/springframework/boot/logging/logback/console-appender.xml"/>
  9.         <root level="INFO">
  10.             <appender-ref ref="CONSOLE" />
  11.         </root>
  12.     </springProfile>
  13. 	
  14. 	<!-- staging和prod这两个profile的配置，日志输出到文件中-->
  15.     <springProfile name="staging,prod">
  16.         <include resource="org/springframework/boot/logging/logback/file-appender.xml"/>
  17.         <root level="INFO">
  18.             <appender-ref ref="FILE"/>
  19.         </root>
  20.     </springProfile>
  21. </configuration>

要指定日志文件名，需要修改application-staging.properties 和 application-prod.proerties 文件：

  1. logging.file=babyrabbit.log
  2. logging.level.root=INFO

测试环境的日志配置

要为测试环境配置日志，可以在src/test/resources目录下创建logback-test.xml。在运行测试时，这个文件会被放在classpath的前端，并被LogBack自动使用。 这个文件很简单，就是把调试日志输出到控制台：

  1. <configuration>
  2.     <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
  3.         <encoder>
  4.             <pattern>%date{YYYY-MM-dd HH:mm:ss} %level [%thread] %logger{0} - %msg%n%ex</pattern>
  5.         </encoder>
  6.     </appender>
  7.     <root level="WARN">
  8.         <appender-ref ref="STDOUT"/>
  9.     </root>
  10. 	
  11. 	<!-- 输出指定包的调试日志 -->
  12.     <logger name="com.springbook.application">
  13.         <level value="DEBUG"/>
  14.     </logger>
  15.     <logger name="org.hibernate">
  16.         <level value="WARN"/>
  17.     </logger>
  18.     <logger name="org.hibernate.type">
  19.         <level value="WARN"/> <!-- set to TRACE to view parameter binding in queries -->
  20.     </logger>
  21.     <logger name="org.springframework.security">
  22.         <level value="WARN"/>
  23.     </logger>
  24. </configuration>

在执行命令 mvn clean install 编译程序的时候，就会运行测试代码并在控制台输出调试日志。 如果不想在编译的时候看调试日志，可以让maven把所有的输出写入到一个文件里，这需要在pom.xml中配置surefire插件：

  1. <plugin>
  2.     <groupId>org.apache.maven.plugins</groupId>
  3.     <artifactId>maven-surefire-plugin</artifactId>
  4.     <configuration>
  5.         <redirectTestOutputToFile>true</redirectTestOutputToFile>
  6.         <printSummary>false</printSummary>
  7.     </configuration>
  8. </plugin>

这个插件将把每个测试的输出写入到一个独立的文件中。

Demo工程

添加依赖组件

指南的工程中需要使用jpa, spring security, h2 database, sprint boot test, spring security test，lombok，mockmvc，google guava，因此，工程的pom.xml 中需要添加如下依赖：

  1. 	<dependencies>
  2. 		<dependency>
  3. 			<groupId>org.springframework.boot</groupId>
  4. 			<artifactId>spring-boot-starter-data-jpa</artifactId>
  5. 		</dependency>
  6. 		<dependency>
  7. 			<groupId>org.springframework.boot</groupId>
  8. 			<artifactId>spring-boot-starter-security</artifactId>
  9. 		</dependency>
  10. 		<dependency>
  11. 			<groupId>org.springframework.boot</groupId>
  12. 			<artifactId>spring-boot-starter-web</artifactId>
  13. 		</dependency>
  14.  
  15. 		<dependency>
  16. 			<groupId>com.h2database</groupId>
  17. 			<artifactId>h2</artifactId>
  18. 			<scope>runtime</scope>
  19. 		</dependency>
  20. 		<dependency>
  21. 			<groupId>org.springframework.boot</groupId>
  22. 			<artifactId>spring-boot-configuration-processor</artifactId>
  23. 			<optional>true</optional>
  24. 		</dependency>
  25. 		<dependency>
  26. 			<groupId>org.projectlombok</groupId>
  27. 			<artifactId>lombok</artifactId>
  28. 			<optional>true</optional>
  29. 		</dependency>
  30. 		<dependency>
  31. 			<groupId>org.springframework.boot</groupId>
  32. 			<artifactId>spring-boot-starter-test</artifactId>
  33. 			<scope>test</scope>
  34. 		</dependency>
  35. 		<dependency>
  36. 			<groupId>org.springframework.restdocs</groupId>
  37. 			<artifactId>spring-restdocs-mockmvc</artifactId>
  38. 			<scope>test</scope>
  39. 		</dependency>
  40. 		<dependency>
  41. 			<groupId>org.springframework.security</groupId>
  42. 			<artifactId>spring-security-test</artifactId>
  43. 			<scope>test</scope>
  44. 		</dependency>
  45. 		<dependency>
  46. 			<groupId>com.google.guava</groupId>
  47. 			<artifactId>guava</artifactId>
  48. 			<version>18.0</version>
  49. 		</dependency>
  50. 	</dependencies>

用户管理

这个工程首先要做的是构建用户管理和安全。

首先创建User领域类：

User.java

  1. package com.babyrabbit.demo.user;
  2.  
  3. import lombok.AllArgsConstructor;
  4. import lombok.Data;
  5.  
  6. import java.util.Set;
  7. import java.util.UUID;
  8.  
  9. /**
  10.  * Created by kevin on 2018/9/13.
  11.  */
  12. @Data
  13. @AllArgsConstructor
  14. public class User {
  15.     private UUID id;
  16.     private String email;
  17.     private String password;
  18.     private Set<UserRole> roles;
  19. }

UserRole类是定义用户的角色：

UserRole.java

  1. package com.babyrabbit.demo.user;
  2.  
  3. /**
  4.  * Created by kevin on 2018/9/13.
  5.  */
  6. public enum UserRole {
  7.     OFFICER,CAPTAIN,ADMIN
  8. }

通常我们会把用户信息存储在数据库里，这首先要根据JPA规范把User添加上数据库存储信息：

User.java

  1. package com.babyrabbit.demo.user;
  2.  
  3. import lombok.AllArgsConstructor;
  4. import lombok.Data;
  5. import lombok.NoArgsConstructor;
  6.  
  7. import javax.persistence.*;
  8. import javax.validation.constraints.NotNull;
  9. import java.util.Set;
  10. import java.util.UUID;
  11.  
  12. /**
  13.  * Created by kevin on 2018/9/13.
  14.  */
  15. @Data
  16. @AllArgsConstructor
  17. @NoArgsConstructor
  18. @Entity
  19. @Table(name="tb_user")
  20. public class User {
  21.     @Id
  22.     private UUID id;
  23.     private String email;
  24.     private String password;
  25.  
  26.     @ElementCollection(fetch = FetchType.EAGER)
  27.     @Enumerated(EnumType.STRING)
  28.     @NotNull
  29.     private Set<UserRole> roles;
  30. }

在这个新版本的User类中，有下面几点变化：

  • 使用@Entity和@Table将User类变成JPA实体
  • 使用@Id将id字段标注为主键
  • 由于jpa要求所有的实体对象有无参数的构造方法，在类上添加了@NoArgsConstructor自动生成无参数的构造方法

User仓库

要存储User，需要使用存储仓库。

UserRepository.java

  1. package com.babyrabbit.demo.user;
  2.  
  3. import org.springframework.data.repository.CrudRepository;
  4.  
  5. import java.util.UUID;
  6.  
  7. /**
  8.  * Created by kevin on 2018/9/13.
  9.  */
  10. public interface UserRepository extends CrudRepository<User,UUID>{
  11. }
  12.

到此为止，已经有比较完备的用户管理核心部分了。有了这么多代码，先创建个测试，检测代码的正确度。

UserRepositoryTest.java

  1. package com.babyrabbit.demo.user;
  2.  
  3. import org.junit.Test;
  4. import org.junit.runner.RunWith;
  5. import org.springframework.beans.factory.annotation.Autowired;
  6. import org.springframework.boot.test.autoconfigure.orm.jpa.DataJpaTest;
  7. import org.springframework.test.context.junit4.SpringRunner;
  8. import java.util.HashSet;
  9. import java.util.UUID;
  10.  
  11. import static org.assertj.core.api.Assertions.assertThat;
  12.  
  13. @RunWith(SpringRunner.class)
  14. @DataJpaTest
  15. public class UserRepositoryTest {
  16.     @Autowired
  17.     private UserRepository repository;
  18. 	
  19.     @Test
  20.     public void testStoreUser() {
  21.         HashSet<UserRole> roles = new HashSet<>();
  22.         roles.add(UserRole.OFFICER);
  23.         User user = repository.save(new User(UUID.randomUUID(),
  24.                 "alex.foley@beverly-hills.com",
  25.                 "my-secret-pwd",
  26.                 roles));
  27.  
  28.         assertThat(user).isNotNull();
  29.         assertThat(repository.count()).isEqualTo(1L);
  30.     }
  31. }

上面的测试代码中，

  • @DataJpaTest告诉测试系统，这是个与jpa有关的测试
  • 使用注入的方式将UserRepository注入到了这个测试中

重构User

上面的User亦可以完成用户信息的存储，但是有三个可以改进的地方：

  1. 使用专门的类来表示主键
  2. 为所有实体类抽象一个父类，使用统一方式来定义主键
  3. 将生成主键的逻辑集中放在仓库的一个地方

在上面的代码中，使用UUID作为实体类的主键，但是如果使用专门的类而不是long或者UUID来做主键，有一下好处：

  1. 能更清楚的表达含义，例如，使用UserId类作为User的主键，这样比UUID或者long更能表达含义。
  2. 对于特定的实体使用特定类型的主键，可以防止主键混用，也就是不能把Uer的主键UserId赋值给Department。
  3. 当可能会修改主键的类型时，使用专门的主键类可以减少底层键值类型变化所带来的影响。

下面就为主键和实体创建父类。

首先定义主键类接口EntityId:

EntityId.java

  1. package com.babyrabbit.demo.orm.jpa;
  2.  
  3. import java.io.Serializable;
  4. /**
  5.  * Interface for primary keys of entities.
  6.  *
  7.  * @param <T> the underlying type of the entity id
  8.  */
  9. public interface EntityId<T> extends Serializable {
  10.     T getId();
  11.     String asString();
  12. }

定义主键父类AbstractEntityId，实现主键接口EntityId:

AbstractEntityId.java

  1. package com.babyrabbit.demo.orm.jpa;
  2.  
  3. import com.babyrabbit.demo.util.ArtifactForFramework;
  4. import lombok.Data;
  5.  
  6. import javax.persistence.MappedSuperclass;
  7. import java.io.Serializable;
  8. import java.util.Objects;
  9.  
  10. import static com.google.common.base.MoreObjects.toStringHelper;
  11.  
  12. @Data
  13. @MappedSuperclass
  14. public abstract class AbstractEntityId<T extends Serializable>
  15.         implements Serializable,EntityId<T> {
  16.  
  17.     private T id;
  18.  
  19.     @ArtifactForFramework
  20.     protected AbstractEntityId() {
  21.     }
  22.  
  23.     protected AbstractEntityId(T id) {
  24.         this.id = Objects.requireNonNull(id);
  25.     }
  26.  
  27.     @Override
  28.     public boolean equals(Object o) {
  29.         boolean result = false;
  30.         if (this == o) {
  31.             result = true;
  32.         } else if (o instanceof AbstractEntityId) {
  33.             AbstractEntityId other = (AbstractEntityId) o;
  34.             result = Objects.equals(id, other.id);
  35.         }
  36.         return result;
  37.     }
  38.  
  39.     @Override
  40.     public int hashCode() {
  41.         return Objects.hash(id);
  42.     }
  43.  
  44.     @Override
  45.     public String toString() {
  46.         return toStringHelper(this)
  47.                 .add("id", id)
  48.                 .toString();
  49.     }
  50. }

上面的代码中，@MappedSuperclass是jpa提供的一个注解，通过这个注解，可以将该实体类当成基类实体，它不会隐射到数据库表，但继承它的子类实体在隐射时会自动扫描该基类实体的隐射属性，添加到子类实体的对应数据库表中。

这个注解使用规则如下：

  1. 使用在父类上面，是用来标识父类的
  2. 使用这个注解标识的类表示其不能映射到数据库表，因为其不是一个完整的实体类，但是它所拥有的属性能够隐射在其子类对用的数据库表中
  3. 使用这个注解标识得类不能再有@Entity或@Table注解

下面，为实体类定义公共接口Entity:

Entity.java

  1. package com.babyrabbit.demo.orm.jpa;
  2.  
  3. /**
  4.  * Interface for entity objects.
  5.  *
  6.  * @param <T> the type of {@link EntityId} that will be used in this entity
  7.  */
  8. public interface Entity<T extends EntityId> {
  9.     T getId();
  10. }

为实体类定义公共父类AbstractEntity,实现Entity接口：

AbstractEntity.java

  1. package com.babyrabbit.demo.orm.jpa;
  2.  
  3. import com.babyrabbit.demo.util.ArtifactForFramework;
  4. import lombok.Getter;
  5.  
  6. import javax.persistence.EmbeddedId;
  7. import javax.persistence.MappedSuperclass;
  8. import java.util.Objects;
  9.  
  10. import static com.google.common.base.MoreObjects.toStringHelper;
  11.  
  12. /**
  13.  * Abstract super class for entities. We are assuming that early primary key
  14.  * generation will be used.
  15.  *
  16.  * @param <T> the type of {@link EntityId} that will be used for this entity
  17.  */
  18. @Getter
  19. @MappedSuperclass
  20. public abstract class AbstractEntity<T extends EntityId> implements Entity<T> {
  21.  
  22.     @EmbeddedId
  23.     private T id;
  24.  
  25.     @ArtifactForFramework
  26.     protected AbstractEntity() {
  27.     }
  28.  
  29.     @Override
  30.     public boolean equals(Object obj) {
  31.         boolean result = false;
  32.         if (this == obj) {
  33.             result = true;
  34.         } else if (obj instanceof AbstractEntity) {
  35.             AbstractEntity other = (AbstractEntity) obj;
  36.             result = Objects.equals(id, other.id);
  37.         }
  38.         return result;
  39.     }
  40.  
  41.     @Override
  42.     public int hashCode() {
  43.         return Objects.hash(id);
  44.     }
  45.  
  46.     @Override
  47.     public String toString() {
  48.         return toStringHelper(this)
  49.                 .add("id", id)
  50.                 .toString();
  51.     }
  52. }

上面代码中，@EmbeddedId是jpa的注解，这个注解告诉jpa，这个主键类是不需要单独生成数据表存储的。

有个自定义注解@ArtifactForFramework，这个注解只是起标记说明的作用，标记这个只是因为框架需要这样一个构造方法，在代码中没有什么使用场景。

ArtifactForFramework.java

  1. package com.babyrabbit.demo.util;
  2.  
  3. import java.lang.annotation.Retention;
  4. import java.lang.annotation.RetentionPolicy;
  5.  
  6. @Retention(value = RetentionPolicy.SOURCE)
  7. public @interface ArtifactForFramework {
  8. }

创建和实体和主键的父类后，就可以重构User类。 创建UserId类：

UserId.java

  1. import com.babyrabbit.demo.orm.jpa.AbstractEntityId;
  2.  
  3. import java.util.UUID;
  4.  
  5. public class UserId extends AbstractEntityId<UUID> {
  6.     protected UserId(){
  7.  
  8.     }
  9.  
  10.     public UserId(UUID id){
  11.         super(id);
  12.     }
  13.  
  14.     @Override
  15.     public String asString() {
  16.         return super.getId().toString();
  17.     }
  18. }

重构后的User类如下：

User.java

  1. package com.babyrabbit.demo.user;
  2.  
  3. import com.babyrabbit.demo.orm.jpa.AbstractEntity;
  4. import lombok.Getter;
  5.  
  6. import javax.persistence.*;
  7. import javax.validation.constraints.NotNull;
  8. import java.util.HashSet;
  9. import java.util.Set;
  10.  
  11. /**
  12.  * Created by kevin on 2018/9/13.
  13.  */
  14. @Getter
  15. @Entity
  16. @Table(name="tb_user")
  17. public class User extends AbstractEntity<UserId>{
  18.     private String email;
  19.     private String password;
  20.  
  21.     @ElementCollection(fetch = FetchType.EAGER)
  22.     @Enumerated(EnumType.STRING)
  23.     @NotNull
  24.     private Set<UserRole> roles;
  25.  
  26.     protected User(){}
  27.  
  28.     public User(UserId id, String email, String password, Set<UserRole> roles) {
  29.         super(id);
  30.         this.email = email;
  31.         this.password = password;
  32.         this.roles = roles;
  33.     }
  34.  
  35.  
  36.     public static User createOfficer(UserId userId, String officerEmail, String encode) {
  37.         HashSet<UserRole> roles = new HashSet<>();
  38.         roles.add(UserRole.OFFICER);
  39.         return new User(userId,officerEmail,encode,roles);
  40.     }
  41.  
  42.     public static User createCaptain(UserId userId, String captainEmail, String encode) {
  43.         HashSet<UserRole> roles = new HashSet<>();
  44.         roles.add(UserRole.CAPTAIN);
  45.         return new User(userId,captainEmail,encode,roles);
  46.     }
  47. }
  48.

自定义主键生成逻辑

主键生成逻辑需要放在仓库中，因此需要在UserRepository中提供nextId()方法来生成UserId实例。由于UserRepository是接口，所以不能直接在UserRepository中提供nextId()的实现，因此需要做点额外工作，在一个额外实现类中实现这个功能.

自定义UserRepositoryCustom接口：

UserRepositoryCustom.java

  1. package com.babyrabbit.demo.user;
  2.  
  3. /**
  4.  * Created by kevin on 2018/9/13.
  5.  */
  6. public interface UserRepositoryCustom {
  7.     UserId nextId();
  8. }

然后将UserRepositoryCustom添加到UserRepository接口中：

UserRepository.java

  1. package com.babyrabbit.demo.user;
  2.  
  3. import org.springframework.data.repository.CrudRepository;
  4.  
  5. import java.util.UUID;
  6.  
  7. /**
  8.  * Created by kevin on 2018/9/13.
  9.  */
  10. public interface UserRepository extends CrudRepository<User,UUID>, UserRepositoryCustom{
  11. }

下面为UserRepositoryCustom接口创建实现类UserRepositoryImpl，实现nextId()的逻辑：

UserRepositoryImpl.java

  1. package com.babyrabbit.demo.user;
  2.  
  3.  
  4. import com.babyrabbit.demo.orm.jpa.UniqueIdGenerator;
  5.  
  6. import java.util.UUID;
  7.  
  8. public class UserRepositoryImpl implements UserRepositoryCustom {
  9.  
  10.     private final UniqueIdGenerator<UUID> generator;
  11. 	
  12.     public UserRepositoryImpl(UniqueIdGenerator<UUID> generator) {
  13.         this.generator = generator;
  14.     }
  15. 	
  16.     @Override
  17.     public UserId nextId() {
  18.         return new UserId(generator.getNextUniqueId());
  19.     }
  20. }

当程序运行时，spring data会将UserRepositoryImpl的代码与Spring data的CrudRepository的代码合并，在UserRepository中会看到UserRepositoryCustom和CrudRepository里的方法。

UserRepositoryImpl中注入了UniqueIdGenerator，因此需要创建UniqueIdGenerator，并注册为spring bean.

UniqueIdGenerator.java

  1. package com.babyrabbit.demo.orm.jpa;
  2.  
  3. /**
  4.  * Created by kevin on 2018/9/13.
  5.  */
  6. public interface UniqueIdGenerator<T> {
  7.     T getNextUniqueId();
  8. }

InMemoryUniqueIdGenerator.java

  1. package com.babyrabbit.demo.orm.jpa;
  2.  
  3. import java.util.UUID;
  4.  
  5. /**
  6.  * Created by kevin on 2018/9/13.
  7.  */
  8. public class InMemoryUniqueIdGenerator implements UniqueIdGenerator<UUID>{
  9.     @Override
  10.     public UUID getNextUniqueId() {
  11.         return UUID.randomUUID();
  12.     }
  13. }

在BabyRabbitConfiguration中，将UniqueIdGenerator注册到spring中：

BabyRabbitConfiguration.java

  1. package com.babyrabbit.demo.conf;
  2.  
  3. import com.babyrabbit.demo.orm.jpa.InMemoryUniqueIdGenerator;
  4. import com.babyrabbit.demo.orm.jpa.UniqueIdGenerator;
  5. import org.springframework.context.annotation.Bean;
  6. import org.springframework.context.annotation.Configuration;
  7.  
  8. import java.util.UUID;
  9.  
  10. /**
  11.  * Created by kevin on 2018/9/13.
  12.  */
  13. @Configuration
  14. public class BabyRabbitConfiguration {
  15.     @Bean
  16.     public UniqueIdGenerator<UUID> uniqueIdGenerator() {
  17.         return new InMemoryUniqueIdGenerator();
  18.     }
  19. }

重构了ID的定义后，UserRepositoryTest也需要做点调整才能通过测试：

UserRepositoryTest.java

  1. package com.babyrabbit.demo.user;
  2.  
  3. import com.babyrabbit.demo.orm.jpa.InMemoryUniqueIdGenerator;
  4. import com.babyrabbit.demo.orm.jpa.UniqueIdGenerator;
  5. import org.junit.Test;
  6. import org.junit.runner.RunWith;
  7. import org.springframework.beans.factory.annotation.Autowired;
  8. import org.springframework.boot.test.autoconfigure.orm.jpa.DataJpaTest;
  9. import org.springframework.boot.test.context.TestConfiguration;
  10. import org.springframework.context.annotation.Bean;
  11. import org.springframework.test.context.junit4.SpringRunner;
  12. import java.util.HashSet;
  13. import java.util.UUID;
  14.  
  15. import static org.assertj.core.api.Assertions.assertThat;
  16.  
  17. @RunWith(SpringRunner.class)
  18. @DataJpaTest
  19. public class UserRepositoryTest {
  20.     @Autowired
  21.     private UserRepository repository;
  22.  
  23.     @Test
  24.     public void testStoreUser() {
  25.         HashSet<UserRole> roles = new HashSet<>();
  26.         roles.add(UserRole.OFFICER);
  27.         User user = repository.save(new User(repository.nextId(),
  28.                 "alex.foley@beverly-hills.com",
  29.                 "my-secret-pwd",
  30.                 roles));
  31.         assertThat(user).isNotNull();
  32.         assertThat(repository.count()).isEqualTo(1L);
  33.     }
  34.  
  35.     @TestConfiguration
  36.     static class TestConfig {
  37.         @Bean
  38.         public UniqueIdGenerator<UUID> generator() {
  39.             return new InMemoryUniqueIdGenerator();
  40.         }
  41.     }
  42. }

REST API 的安全

Spring Security提供了全套的安全解决方案。对于移动应用，将使用Oauth2安全方案。Spring Security Oauth2提供了Oauth2实现。

注意： Oauth2需要使用HTTPS协议。

使用Oauth2安全方案后，可以通过client secret和client id 来验证client应用，使用username, password来验证用户。相应的，验证过的用户可以获取access token来访问API。

为了使用spring security oauth2，需要使用AutoConfigure来简化oauth2的配置，这需要在pom.xml中添加依赖：

  1. 		<dependency>
  2. 			<groupId>org.springframework.security.oauth.boot</groupId>
  3. 			<artifactId>spring-security-oauth2-autoconfigure</artifactId>
  4. 			<version>2.0.1.RELEASE</version>
  5. 		</dependency>

Oauth协议中，提供了两部分组件：

  • 授权服务：负责给客户端和用户授权
  • 资源服务：负责定义认证用户和未认证用户可以访问应用的哪些部分

创建OAuth2ServerConfiguration来配置授权和资源服务：

OAuth2ServerConfiguration.java

  1. package com.babyrabbit.demo.conf;
  2.  
  3. import org.springframework.beans.factory.annotation.Autowired;
  4. import org.springframework.beans.factory.annotation.Value;
  5. import org.springframework.context.annotation.Configuration;
  6. import org.springframework.http.HttpMethod;
  7. import org.springframework.security.authentication.AuthenticationManager;
  8. import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
  9. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  10. import org.springframework.security.core.userdetails.UserDetailsService;
  11. import org.springframework.security.crypto.password.PasswordEncoder;
  12. import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
  13. import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
  14. import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
  15. import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
  16. import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
  17. import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
  18. import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;
  19. import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;
  20. import org.springframework.security.oauth2.provider.token.TokenStore;
  21.  
  22. /**
  23.  * Created by kevin on 2018/9/14.
  24.  */
  25. public class OAuth2ServerConfiguration {
  26.  
  27.     @Value("${resource_id}")
  28.     private String resourceId;
  29. 		
  30.     @Configuration
  31.     @EnableAuthorizationServer
  32.     protected class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
  33.  
  34.         @Autowired
  35.         private AuthenticationManager authenticationManager;
  36.  
  37.         @Autowired
  38.         private UserDetailsService userDetailsService;
  39.  
  40.         @Autowired
  41.         private PasswordEncoder passwordEncoder;
  42.  
  43.         @Autowired
  44.         private TokenStore tokenStore;
  45.        
  46.         @Override
  47.         public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
  48.             security.passwordEncoder(passwordEncoder);
  49.         }
  50.  
  51.         @Override
  52.         public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
  53.             clients.inMemory()
  54.                     .withClient("baby-mobile-client")
  55.                     .authorizedGrantTypes("password", "refresh_token")
  56.                     .scopes("mobile_app")
  57.                     .resourceIds(resourceId)
  58.                     .secret(passwordEncoder.encode("ccUyb6vS4S8nxfbKPCrN"));
  59.         }
  60.  
  61.         @Override
  62.         public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
  63.             endpoints.tokenStore(tokenStore)
  64.                     .authenticationManager(authenticationManager)
  65.                     .userDetailsService(userDetailsService);
  66.         }
  67.     }
  68.  
  69.     @Configuration
  70.     @EnableResourceServer
  71.     @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
  72.     protected class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
  73.  
  74.         @Override
  75.         public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
  76.             resources.resourceId(resourceId);
  77.         }
  78.  
  79.         @Override
  80.         public void configure(HttpSecurity http) throws Exception {
  81.             http.authorizeRequests()
  82.                     .antMatchers(HttpMethod.OPTIONS, "/api/**").permitAll()
  83.                     .and()
  84.                     .antMatcher("/api/**").authorizeRequests()
  85.                     .anyRequest().authenticated();
  86.         }
  87.     }
  88. }

上面AuthorizationServerConfiguration代码中：

  • 只对ID是baby-mobile-client的客户端做认证
  • 支持password和refresh_token两种认证模式
  • scopes定义了可以通过access token访问的程序部分

上面ResourceServerConfiguration代码中：

  • 允许所有对于 '/api/**' 的Options操作
  • 其他访问 '/api/**' 的操作，需要授权
  • 所有对 '/api/**' 的非OPTIONS访问都需要认证

上面的代码中需要注入PasswordEncoder和 TokenStore， 因此，需要在Spring中注册这两个bean：

  1. package com.babyrabbit.demo.conf;
  2.  
  3. import com.babyrabbit.demo.orm.jpa.InMemoryUniqueIdGenerator;
  4. import com.babyrabbit.demo.orm.jpa.UniqueIdGenerator;
  5. import org.springframework.context.annotation.Bean;
  6. import org.springframework.context.annotation.Configuration;
  7. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  8. import org.springframework.security.crypto.password.PasswordEncoder;
  9. import org.springframework.security.oauth2.provider.token.TokenStore;
  10. import org.springframework.security.oauth2.provider.token.store.InMemoryTokenStore;
  11.  
  12. import java.util.UUID;
  13.  
  14. /**
  15.  * Created by kevin on 2018/9/13.
  16.  */
  17. @Configuration
  18. public class BabyRabbitConfiguration {
  19.     @Bean
  20.     public UniqueIdGenerator<UUID> uniqueIdGenerator() {
  21.         return new InMemoryUniqueIdGenerator();
  22.     }
  23.  
  24.     @Bean
  25.     public PasswordEncoder passwordEncoder() {
  26.         return new BCryptPasswordEncoder();
  27.     }
  28.     @Bean
  29.     public TokenStore tokenStore() {
  30.         return new InMemoryTokenStore();
  31.     }
  32. }

UserDetailsService

为了实现认证功能，需要实现UserDetailsService。这个接口只有一个方法 UserDetails loadUserByUsername(String username) throws UsernameNotFoundException;

UserDetails

这里，先要构建一个UserDetails实现。

ApplicationUserDetails.java

  1. package com.babyrabbit.demo.security;
  2.  
  3. import com.babyrabbit.demo.user.User;
  4. import com.babyrabbit.demo.user.UserId;
  5. import com.babyrabbit.demo.user.UserRole;
  6. import org.springframework.security.core.authority.SimpleGrantedAuthority;
  7. import java.util.Collection;
  8. import java.util.Set;
  9. import java.util.stream.Collectors;
  10.  
  11. public class ApplicationUserDetails extends org.springframework.security.core.userdetails.User {
  12.     private static final String ROLE_PREFIX = "ROLE_";
  13.  
  14.     private final UserId userId;
  15.  
  16.     public ApplicationUserDetails(User user) {
  17.         super(user.getEmail(), user.getPassword(), createAuthorities(user.getRoles()));
  18.         this.userId = user.getId();
  19.     }
  20.  
  21.     public UserId getUserId() {
  22.         return userId;
  23.     }
  24.  
  25.     private static Collection<SimpleGrantedAuthority> createAuthorities(Set<UserRole> roles) {
  26.         return roles.stream()
  27.                 .map(userRole -> new SimpleGrantedAuthority(ROLE_PREFIX + userRole.name()))
  28.                 .collect(Collectors.toSet());
  29.     }
  30. }

自定义的UserDetails继承了 org.springframework.security.core.userdetails.User.

当然，也可以直接在User对象里实现UserDetails：

public class User extends AbstractEntity<UserId> implements UserDetails {

如果要这么做，需要注意三点：

  1. getAuthorities()方法返回这个用户的授权列表。可以参照org.springframework.security.core.userdetails.User 里的实现
  2. User需要实现序列化
  3. Spring Security 会缓存UserDetails，因此在控制器中，使用@AuthenticationPrincipal User user 注入已认证用户对象

UserRepository

要实现能读取用户信息的能力，需要在用户仓库里增加一个方法：

UserRepository.java

  1. package com.babyrabbit.demo.user;
  2.  
  3. import org.springframework.data.repository.CrudRepository;
  4.  
  5. import java.util.Optional;
  6. import java.util.UUID;
  7.  
  8. /**
  9.  * Created by kevin on 2018/9/13.
  10.  */
  11. public interface UserRepository extends CrudRepository<User,UUID>, UserRepositoryCustom{
  12.     Optional<User> findByEmailIgnoreCase(String email);
  13. }

这里用了Optional作为返回类型，无论findByEmailIgnoreCase方法是否找到user的信息，都不会直接返回null给调用者，这样防止了空指针例外。

相应的，修改UserRepositoryTest.java，测试这个新方法：

UserRepositoryTest.java

  1. package com.babyrabbit.demo.user;
  2.  
  3. import com.babyrabbit.demo.orm.jpa.InMemoryUniqueIdGenerator;
  4. import com.babyrabbit.demo.orm.jpa.UniqueIdGenerator;
  5. import org.junit.Test;
  6. import org.junit.runner.RunWith;
  7. import org.springframework.beans.factory.annotation.Autowired;
  8. import org.springframework.boot.test.autoconfigure.orm.jpa.DataJpaTest;
  9. import org.springframework.boot.test.context.TestConfiguration;
  10. import org.springframework.context.annotation.Bean;
  11. import org.springframework.test.context.junit4.SpringRunner;
  12. import java.util.HashSet;
  13. import java.util.Locale;
  14. import java.util.Optional;
  15. import java.util.UUID;
  16.  
  17. import static org.assertj.core.api.Assertions.assertThat;
  18.  
  19. @RunWith(SpringRunner.class)
  20. @DataJpaTest
  21. public class UserRepositoryTest {
  22.     @Autowired
  23.     private UserRepository repository;
  24.  
  25.     @Test
  26.     public void testStoreUser() {
  27.         HashSet<UserRole> roles = new HashSet<>();
  28.         roles.add(UserRole.OFFICER);
  29.         User user = repository.save(new User(repository.nextId(),
  30.                 "alex.foley@beverly-hills.com",
  31.                 "my-secret-pwd",
  32.                 roles));
  33.         assertThat(user).isNotNull();
  34.         assertThat(repository.count()).isEqualTo(1L);
  35.     }
  36.  
  37.     @Test
  38.     public void testFindByEmail() {
  39.         User user = Users.newRandomOfficer();
  40.         repository.save(user);
  41.         Optional<User> optional = repository.findByEmailIgnoreCase(user.getEmail());
  42.         assertThat(optional).isNotEmpty()
  43.                 .contains(user);
  44.     }
  45.     @Test
  46.     public void testFindByEmailIgnoringCase() {
  47.         User user = Users.newRandomOfficer();
  48.         repository.save(user);
  49.         Optional<User> optional = repository.findByEmailIgnoreCase(user.getEmail()
  50.                 .toUpperCase
  51.                         (Locale.US));
  52.         assertThat(optional).isNotEmpty()
  53.                 .contains(user);
  54.     }
  55.     @Test
  56.     public void testFindByEmail_unknownEmail() {
  57.         User user = Users.newRandomOfficer();
  58.         repository.save(user);
  59.         Optional<User> optional = repository.findByEmailIgnoreCase("will.not@find.me");
  60.         assertThat(optional).isEmpty();
  61.     }
  62.  
  63.     @TestConfiguration
  64.     static class TestConfig {
  65.         @Bean
  66.         public UniqueIdGenerator<UUID> generator() {
  67.             return new InMemoryUniqueIdGenerator();
  68.         }
  69.     }
  70. }

上面的测试代码中，新增了三个测试： testFindByEmail, testFindByEmailIgnoringCase, testFindByEmail_unknownEmail . 在新增的测试中，使用了Users这个类，这是一个工厂类，用来构造User。 我喜欢为每个实体对象都准备一个工厂类，这样就可以把构造实体对象的逻辑集中化。

ApplicationUserDetailsService

下面创建ApplicationUserDetailsService.java， 实现UserDetailsService， 提供加载user信息的服务。

ApplicationUserDetailsService.java

  1. package com.babyrabbit.demo.security;
  2.  
  3. import com.babyrabbit.demo.user.User;
  4. import com.babyrabbit.demo.user.UserRepository;
  5. import org.springframework.beans.factory.annotation.Autowired;
  6. import org.springframework.security.core.userdetails.UserDetails;
  7. import org.springframework.security.core.userdetails.UserDetailsService;
  8. import org.springframework.security.core.userdetails.UsernameNotFoundException;
  9. import org.springframework.stereotype.Service;
  10. import static java.lang.String.format;
  11. @Service 
  12. public class ApplicationUserDetailsService implements UserDetailsService {
  13.     private final UserRepository userRepository;
  14.     @Autowired
  15.     public ApplicationUserDetailsService(UserRepository userRepository) { 
  16.         this.userRepository = userRepository;
  17.     }
  18.     @Override
  19.     public UserDetails loadUserByUsername(String username) {
  20.         User user = userRepository.findByEmailIgnoreCase(username)
  21.                 .orElseThrow(() -> new UsernameNotFoundException( 
  22.                     String.format("User with email %s could not be found",
  23.                         username)));
  24.         return new ApplicationUserDetails(user); 
  25.     }
  26. }

由于User仓库的findByEmailIgnoreCase 方法返回的是Optional类型的返回值，因此当Optional中没有期望的值时，可以使用orElseThrow 来抛出例外终止代码执行流程。

已经创建了ApplicationUserDetailsService，下面就可以为其创建测试了。

ApplicationUserDetailsServiceTest.java

  1. package com.babyrabbit.demo.security;
  2.  
  3. import com.babyrabbit.demo.user.UserRepository;
  4. import com.babyrabbit.demo.user.Users;
  5. import org.junit.Test;
  6. import org.springframework.security.core.GrantedAuthority;
  7. import org.springframework.security.core.userdetails.UserDetails;
  8. import org.springframework.security.core.userdetails.UsernameNotFoundException;
  9. import java.util.Optional;
  10. import static org.assertj.core.api.Assertions.assertThat;
  11. import static org.mockito.Matchers.anyString;
  12. import static org.mockito.Mockito.mock;
  13. import static org.mockito.Mockito.when;
  14.  
  15. public class ApplicationUserDetailsServiceTest {
  16.     @Test
  17.     public void givenExistingUsername_whenLoadingUser_userIsReturned() {
  18.         UserRepository repository = mock(UserRepository.class);
  19.         ApplicationUserDetailsService service = new ApplicationUserDetailsService(repository);
  20.         
  21.         when(repository.findByEmailIgnoreCase(Users.OFFICER_EMAIL))
  22.                 .thenReturn(Optional
  23.                         .of(Users.officer()));
  24.         
  25.         UserDetails userDetails = service.loadUserByUsername(Users.OFFICER_EMAIL);
  26.         
  27.         assertThat(userDetails).isNotNull();
  28.         assertThat(userDetails.getUsername()).isEqualTo(Users.OFFICER_EMAIL);
  29.         assertThat(userDetails.getAuthorities()).extracting(GrantedAuthority::getAuthority).contains("ROLE_OFFICER");
  30.         assertThat(userDetails).isInstanceOfSatisfying(ApplicationUserDetails.class,
  31.                 applicationUserDetails -> {
  32.                     assertThat(applicationUserDetails.getUserId()).isEqualTo(Users.officer().getId());
  33.                 });
  34.     }
  35.  
  36.     @Test(expected = UsernameNotFoundException.class)
  37.     public void givenNotExistingUsername_whenLoadingUser_exceptionThrown() {
  38.         UserRepository repository = mock(UserRepository.class);
  39.         ApplicationUserDetailsService service = new ApplicationUserDetailsService(repository);
  40.         
  41.         when(repository.findByEmailIgnoreCase(anyString())).thenReturn(Optional.empty());
  42.         
  43.         service.loadUserByUsername("i@donotexist.com");
  44.     }
  45. }

测试获取access token

前面已经把Spring Security OAuth2集成到工程里了，下面就可以尝试获取access token. 在执行测试前，需要先在库里创建几个User。

DevelopmentDbInitializer

DevelopmentDbInitializer类实现了ApplicationRunner接口，spring boot在启动时，会执行所有这个接口的实现类。

DevelopmentDbInitializer.java

  1. package com.babyrabbit.demo;
  2.  
  3.  
  4. import com.babyrabbit.demo.user.UserService;
  5. import com.babyrabbit.demo.util.SpringProfiles;
  6. import org.springframework.beans.factory.annotation.Autowired;
  7. import org.springframework.boot.ApplicationArguments;
  8. import org.springframework.boot.ApplicationRunner;
  9. import org.springframework.context.annotation.Profile;
  10. import org.springframework.stereotype.Component;
  11.  
  12. @Component
  13. @Profile(SpringProfiles.DEV)
  14. public class DevelopmentDbInitializer implements ApplicationRunner {
  15.  
  16.     private final UserService userService;
  17.  
  18.     @Autowired
  19.     public DevelopmentDbInitializer(UserService userService) {
  20.         this.userService = userService;
  21.     }
  22.  
  23.     @Override
  24.     public void run(ApplicationArguments applicationArguments) {
  25.         createTestUsers();
  26.     }
  27.  
  28.     private void createTestUsers() {
  29.         userService.createOfficer("officer@example.com", "officer");
  30.     }
  31. }

UserService

UserService完成与User有关业务逻辑的服务接口。

UserService.java

  1. package com.babyrabbit.demo.user;
  2.  
  3. public interface UserService {
  4.     User createOfficer(String email, String password);
  5. }
  6.

UserServiceImpl.java

  1. package com.babyrabbit.demo.user;
  2.  
  3. import org.springframework.beans.factory.annotation.Autowired;
  4. import org.springframework.security.crypto.password.PasswordEncoder;
  5. import org.springframework.stereotype.Service;
  6.  
  7. @Service
  8. public class UserServiceImpl implements UserService {
  9.     private final UserRepository repository;
  10.     private final PasswordEncoder passwordEncoder;
  11.  
  12.     @Autowired
  13.     public UserServiceImpl(UserRepository repository, PasswordEncoder passwordEncoder) {
  14.         this.repository = repository;
  15.         this.passwordEncoder = passwordEncoder;
  16.     }
  17.  
  18.     @Override
  19.     public User createOfficer(String email, String password) {
  20.         User user = User.createOfficer(repository.nextId(), email,
  21.                 passwordEncoder.encode(password));
  22.         return repository.save(user);
  23.     }
  24. }

下面使用maven 启动spring boot 服务： mvn spring-boot:run --spring.profiles.active=dev

使用POSTMAN工具来测试服务：

  • 选择POST请求
  • 地址为： http://localhost:8080/oauth/token
  • 在Basic Auth选项页中，username: baby-mobile-client, password: ccUyb6vS4S8nxfbKPCrN
  • Priview Request, 在Body选项页，选择x-www-form-urlencoded，填入下面的值：
keyvalue
usernameofficer@example.com
passwordofficer
grant_typepassword
client_idbaby-mobile-client
client_secretccUyb6vS4S8nxfbKPCrN

测试成，服务返回数据：

  1. {
  2. 	"access_token": "4329339a-ea9b-4781-86d1-1f49193fa5b3",
  3. 	"token_type": "bearer",
  4. 	"refresh_token": "90d46c41-9aa0-4c23-88e3-8d4ca4e77b30",
  5. 	"expires_in": 43199,
  6. 	"scope": "mobile_app"
  7. }

在返回结果中，包含了access_token和refresh_token。access_token是我们在访问服务的时候需要用的。当access_token过期后，可以使用refresh_token获取一个新的access_token，而不需要重新提供用户名密码进行验证。 当然，refresh_token也会过期，这时候就需要用户重新认证，获取新的access_token和refresh_token。

为了能自动测试 /oauth/token 接口，需要准备点单元测试，这样在每次修改代码后，都会执行单元测试验证接口的正确性。

OAuth2ServerConfigurationTest.java

  1. package com.babyrabbit.demo.security;
  2.  
  3. import com.babyrabbit.demo.user.UserService;
  4. import com.babyrabbit.demo.user.Users;
  5. import com.babyrabbit.demo.util.SpringProfiles;
  6. import org.junit.Test;
  7. import org.junit.runner.RunWith;
  8. import org.springframework.beans.factory.annotation.Autowired;
  9. import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
  10. import org.springframework.boot.test.context.SpringBootTest;
  11. import org.springframework.test.context.ActiveProfiles;
  12. import org.springframework.test.context.junit4.SpringRunner;
  13. import org.springframework.test.web.servlet.MockMvc;
  14. import org.springframework.util.LinkedMultiValueMap;
  15. import org.springframework.util.MultiValueMap;
  16.  
  17. import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.httpBasic;
  18. import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
  19. import static org.springframework.test.web.servlet.result.MockMvcResultHandlers.print;
  20. import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
  21.  
  22. @RunWith(SpringRunner.class)
  23. @SpringBootTest
  24. @AutoConfigureMockMvc
  25. @ActiveProfiles(SpringProfiles.TEST)
  26. public class OAuth2ServerConfigurationTest {
  27.  
  28.     @Autowired
  29.     private MockMvc mvc;
  30.  
  31.     @Autowired
  32.     private UserService userService;
  33.  
  34.     @Test
  35.     public void testGetAccessTokenAsOfficer() throws Exception {
  36.         userService.createOfficer(Users.OFFICER_EMAIL, Users.OFFICER_PASSWORD);
  37.         String clientId = "baby-mobile-client";
  38.         String clientSecret = "ccUyb6vS4S8nxfbKPCrN";
  39.         MultiValueMap<String, String> params = new LinkedMultiValueMap<>();
  40.         params.add("grant_type", "password");
  41.         params.add("client_id", clientId);
  42.         params.add("client_secret", clientSecret);
  43.         params.add("username", Users.OFFICER_EMAIL);
  44.         params.add("password", Users.OFFICER_PASSWORD);
  45.         mvc.perform(post("/oauth/token")
  46.                     .params(params)
  47.                     .with(httpBasic(clientId, clientSecret))
  48.                     .accept("application/json;charset=UTF-8"))
  49.             .andExpect(status().isOk())
  50.             .andExpect(content().contentType("application/json;charset=UTF-8"))
  51.             .andDo(print())
  52.             .andExpect(jsonPath("access_token").isString())
  53.             .andExpect(jsonPath("token_type").value("bearer"))
  54.             .andExpect(jsonPath("refresh_token").isString())
  55.             .andExpect(jsonPath("expires_in").isNumber())
  56.             .andExpect(jsonPath("scope").value("mobile_app"));
  57.     }
  58. }

上面的代码中：

  • @SpringBootTest 要求测试需要一个mock servlet 环境
  • @AutoConfigureMockMvc 标记这个mock servlet环境会被自动配置，不需要为了这个测试做特殊配置
  • 自动注入MockMvc， 可以用来测试API接口

把自定义的配置分离出来

在这个工程中，有一些自定义的属性，例如，client_id, client_secret等，这些配置是与安全相关的，这些信息最好放在配置文件了，而不是硬编码在代码中。spring boot对这样的需求提供了支持。

首先，需要在工程pom.xml中增减依赖：

  1. <dependency>
  2. 			<groupId>org.springframework.boot</groupId>
  3. 			<artifactId>spring-boot-configuration-processor</artifactId>
  4. 			<optional>true</optional>
  5. 		</dependency>

然后，创建一个POJO来存储这两个属性：

SecurityConfiguration.java

  1. package com.babyrabbit.demo.conf;
  2.  
  3. import lombok.Data;
  4. import org.springframework.boot.context.properties.ConfigurationProperties;
  5. import org.springframework.stereotype.Component;
  6.  
  7. @Data
  8. @Component
  9. @ConfigurationProperties(prefix = "babyrabbit-security")
  10. public class SecurityConfiguration {
  11.     private String mobileAppClientId;
  12.     private String mobileAppClientSecret;
  13. }

@ConfigurationProperties注解告诉配置处理器这个类的属性字段对于外部配置是可见的。

有了这个配置后，就可以修改AuthorizationServerConfiguration, 自动注入SecurityConfiguration了：

OAuth2ServerConfiguration.java

  1. package com.babyrabbit.demo.conf;
  2.  
  3. import org.springframework.beans.factory.annotation.Autowired;
  4. import org.springframework.beans.factory.annotation.Value;
  5. import org.springframework.context.annotation.Configuration;
  6. import org.springframework.http.HttpMethod;
  7. import org.springframework.security.authentication.AuthenticationManager;
  8. import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
  9. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  10. import org.springframework.security.core.userdetails.UserDetailsService;
  11. import org.springframework.security.crypto.password.PasswordEncoder;
  12. import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
  13. import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
  14. import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
  15. import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
  16. import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
  17. import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
  18. import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;
  19. import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;
  20. import org.springframework.security.oauth2.provider.token.TokenStore;
  21.  
  22. /**
  23.  * Created by kevin on 2018/9/14.
  24.  */
  25. @Configuration
  26. public class OAuth2ServerConfiguration {
  27.     @Value("${resource_id}")
  28.     private String resourceId;
  29.  
  30.     @Configuration
  31.     @EnableAuthorizationServer
  32.     protected class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
  33.  
  34.         @Autowired
  35.         private AuthenticationManager authenticationManager;
  36.  
  37.         @Autowired
  38.         private UserDetailsService userDetailsService;
  39.  
  40.         @Autowired
  41.         private PasswordEncoder passwordEncoder;
  42.  
  43.         @Autowired
  44.         private TokenStore tokenStore;
  45.  
  46.         @Autowired
  47.         private  SecurityConfiguration securityConfiguration;
  48.  
  49.         @Override
  50.         public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
  51.             security.passwordEncoder(passwordEncoder);
  52.         }
  53.  
  54.         @Override
  55.         public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
  56.             clients.inMemory()
  57.                     .withClient(securityConfiguration.getMobileAppClientId())
  58.                     .authorizedGrantTypes("password", "refresh_token")
  59.                     .scopes("mobile_app")
  60.                     .resourceIds(resourceId)
  61.                     .secret(passwordEncoder.encode(securityConfiguration.getMobileAppClientSecret()));
  62.         }
  63.  
  64.         @Override
  65.         public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
  66.             endpoints.tokenStore(tokenStore)
  67.                     .authenticationManager(authenticationManager)
  68.                     .userDetailsService(userDetailsService);
  69.         }
  70.     }
  71.  
  72.     @Configuration
  73.     @EnableResourceServer
  74.     @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
  75.     protected class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
  76.  
  77.         @Override
  78.         public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
  79.             resources.resourceId(resourceId);
  80.         }
  81.  
  82.         @Override
  83.         public void configure(HttpSecurity http) throws Exception {
  84.             http.authorizeRequests()
  85.                     .antMatchers(HttpMethod.OPTIONS, "/api/**").permitAll()
  86.                     .and()
  87.                     .antMatcher("/api/**").authorizeRequests()
  88.                     .anyRequest().authenticated();
  89.         }
  90.     }
  91. }

之后，就可以在application-dev.properties,application-staging.properties,application-prod.properties,application-test.properties中配置相应的值:

例如，在application-dev.properties中的配置如下：

  1. baby-security.mobile-app-client-id=baby-mobile-client
  2. baby-security.mobile-app-client-secret=ccUyb6vS4S8nxfbKPCrN

在application-test.properties中配置如下：

  1. baby-security.mobile-app-client-id=test-client-id
  2. baby-security.mobile-app-client-secret=test-client-secret

REST 控制器

要实现API业务服务，需要通过REST提供API 接口。

GET 接口

首先提供一个查看用户自己信息的接口，这个接口是一个GET接口。

UserRestController.java

  1. package com.babyrabbit.demo.web;
  2.  
  3. import com.babyrabbit.demo.security.ApplicationUserDetails;
  4. import com.babyrabbit.demo.user.User;
  5. import com.babyrabbit.demo.user.UserNotFoundException;
  6. import com.babyrabbit.demo.user.UserService;
  7. import org.springframework.beans.factory.annotation.Autowired;
  8. import org.springframework.security.core.annotation.AuthenticationPrincipal;
  9. import org.springframework.web.bind.annotation.GetMapping;
  10. import org.springframework.web.bind.annotation.RequestMapping;
  11. import org.springframework.web.bind.annotation.RestController;
  12.  
  13. @RestController
  14. @RequestMapping("/api/users")
  15. public class UserRestController {
  16.     private final UserService service;
  17.  
  18.     @Autowired
  19.     public UserRestController(UserService service) {
  20.         this.service = service;
  21.     }
  22.  
  23.     @GetMapping("/me")
  24.     public UserDto currentUser(@AuthenticationPrincipal ApplicationUserDetails userDetails) {
  25.         User user = service.getUser(userDetails.getUserId())
  26.                 .orElseThrow(() -> new UserNotFoundException(userDetails.getUserId()));
  27.         return UserDto.fromUser(user);
  28.     }
  29. }

客户端可以通过 get /api/users/me 来查看登录用户的信息。

UserNotFoundException.java

  1. package com.babyrabbit.demo.user;
  2.  
  3. import org.springframework.http.HttpStatus;
  4. import org.springframework.web.bind.annotation.ResponseStatus;
  5.  
  6. @ResponseStatus(HttpStatus.NOT_FOUND)
  7. public class UserNotFoundException extends RuntimeException {
  8.     public UserNotFoundException(UserId userId) {
  9.         super(String.format("Could not find user with id %s", userId.asString()));
  10.     }
  11. }

这个自定义例外用来在未找到用户时，打断程序的执行流程。使用@ResponseStatus注解，当这个例外从controller抛出时，spring框架会捕捉并处理，生成默认的响应，这时候，这个响应使用的状态码就是这个注解里的值。

UserDto.java

  1. package com.babyrabbit.demo.web;
  2.  
  3. import com.babyrabbit.demo.user.User;
  4. import com.babyrabbit.demo.user.UserId;
  5. import com.babyrabbit.demo.user.UserRole;
  6. import lombok.Value;
  7. import java.util.Set;
  8.  
  9. @Value
  10. public class UserDto {
  11.  
  12.     private final UserId id;
  13.     private final String email;
  14.     private final Set<UserRole> roles;
  15.  
  16.     public static UserDto fromUser(User user) {
  17.         return new UserDto(user.getId(),
  18.                 user.getEmail(),
  19.                 user.getRoles());
  20.     }
  21. }

不能直接使用实体对象作为返回数据的载体，使用专用的传输对象。

UserRestController的测试

为这个接口创建测试用例。

UserRestControllerTest.java

  1. package com.babyrabbit.demo.web;
  2.  
  3. import com.babyrabbit.demo.conf.OAuth2ServerConfiguration;
  4. import com.babyrabbit.demo.conf.SecurityConfiguration;
  5. import com.babyrabbit.demo.user.UserService;
  6. import com.babyrabbit.demo.user.Users;
  7. import com.babyrabbit.demo.util.SpringProfiles;
  8. import org.junit.Test;
  9. import org.junit.runner.RunWith;
  10. import org.springframework.beans.factory.annotation.Autowired;
  11. import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
  12. import org.springframework.boot.test.context.TestConfiguration;
  13. import org.springframework.boot.test.mock.mockito.MockBean;
  14. import org.springframework.context.annotation.Bean;
  15. import org.springframework.context.annotation.Import;
  16. import org.springframework.security.core.userdetails.UserDetailsService;
  17. import org.springframework.security.oauth2.provider.token.TokenStore;
  18. import org.springframework.security.oauth2.provider.token.store.InMemoryTokenStore;
  19. import org.springframework.test.context.ActiveProfiles;
  20. import org.springframework.test.context.junit4.SpringRunner;
  21. import org.springframework.test.web.servlet.MockMvc;
  22.  
  23. import java.util.Optional;
  24.  
  25. import static com.babyrabbit.demo.security.SecurityHelperForMockMvc.HEADER_AUTHORIZATION;
  26. import static com.babyrabbit.demo.security.SecurityHelperForMockMvc.bearer;
  27. import static com.babyrabbit.demo.security.SecurityHelperForMockMvc.obtainAccessToken;
  28. import static org.mockito.Mockito.when;
  29. import static org.springframework.restdocs.mockmvc.RestDocumentationRequestBuilders.get;
  30. import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
  31. import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
  32.  
  33. @RunWith(SpringRunner.class)
  34. @WebMvcTest(UserRestController.class)
  35. @ActiveProfiles(SpringProfiles.TEST)
  36. public class UserRestControllerTest {
  37.     @Autowired
  38.     private MockMvc mvc;
  39.     @MockBean
  40.     private UserService service;
  41.  
  42.     @Test
  43.     public void givenNotAuthenticated_whenAskingMyDetails_forbidden() throws Exception {
  44.         mvc.perform(get("/api/users/me")).andExpect(status().isUnauthorized());
  45.     }
  46.  
  47.     @Test
  48.     public void givenAuthenticatedAsOfficer_whenAskingMyDetails_detailsReturned() throws Exception {
  49.         String accessToken = obtainAccessToken(mvc, Users.OFFICER_EMAIL, Users.OFFICER_PASSWORD);
  50.  
  51.         when(service.getUser(Users.officer().getId())).thenReturn(Optional.of(Users.officer()));
  52.  
  53.         mvc.perform(get("/api/users/me")
  54.                 .header(HEADER_AUTHORIZATION, bearer(accessToken)))
  55.                 .andExpect(status().isOk())
  56.                 .andExpect(jsonPath("id").exists())
  57.                 .andExpect(jsonPath("email").value(Users.OFFICER_EMAIL))
  58.                 .andExpect(jsonPath("roles").isArray())
  59.                 .andExpect(jsonPath("roles[0]").value("OFFICER"))
  60.         ;
  61.     }
  62.  
  63.     @TestConfiguration
  64.     @Import(OAuth2ServerConfiguration.class)
  65.     static class TestConfig {
  66.         @Bean
  67.         public UserDetailsService userDetailsService() {
  68.             return new StubUserDetailsService();
  69.         }
  70.  
  71.         @Bean
  72.         public TokenStore tokenStore() {
  73.             return new InMemoryTokenStore();
  74.         }
  75.  
  76.         @Bean
  77.         public SecurityConfiguration securityConfiguration() {
  78.             return new SecurityConfiguration();
  79.         }
  80.     }
  81. }

上面的测试代码中，用到了下面几个类：

StubUserDetailsService.java

  1. package com.babyrabbit.demo.web;
  2.  
  3. import com.babyrabbit.demo.security.ApplicationUserDetails;
  4. import com.babyrabbit.demo.user.Users;
  5. import org.springframework.security.core.userdetails.UserDetailsService;
  6.  
  7. import org.springframework.security.core.userdetails.UserDetails;
  8. import org.springframework.security.core.userdetails.UsernameNotFoundException;
  9.  
  10. public class StubUserDetailsService implements UserDetailsService {
  11.     @Override
  12.     public UserDetails loadUserByUsername(String username) throws
  13.             UsernameNotFoundException {
  14.         switch (username) {
  15.             case Users.OFFICER_EMAIL:
  16.                 return new ApplicationUserDetails(Users.officer());
  17.             case Users.CAPTAIN_EMAIL:
  18.                 return new ApplicationUserDetails(Users.captain());
  19.             default:
  20.                 throw new UsernameNotFoundException(username);
  21.         }
  22.     }
  23. }
  24.

SecurityHelperForMockMvc.java

  1. package com.babyrabbit.demo.security;
  2.  
  3. import org.springframework.boot.json.JacksonJsonParser;
  4. import org.springframework.test.web.servlet.MockMvc;
  5. import org.springframework.test.web.servlet.ResultActions;
  6. import org.springframework.util.LinkedMultiValueMap;
  7. import org.springframework.util.MultiValueMap;
  8.  
  9. import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.httpBasic;
  10. import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
  11. import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
  12. import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
  13.  
  14. public class SecurityHelperForMockMvc {
  15.  
  16.     private static final String UNIT_TEST_CLIENT_ID = "test-client-id";
  17.     private static final String UNIT_TEST_CLIENT_SECRET = "test-client-secret";
  18.     public static final String HEADER_AUTHORIZATION = "Authorization";
  19.  
  20.     /**
  21.      * Allows to get an access token for the given user in the context of a spring (unit)
  22.      test
  23.      * using MockMVC.
  24.      *
  25.      * @param mvc the MockMvc instance
  26.      * @param username the username
  27.      * @param password the password
  28.      * @return the <code>access_token</code> to be used in the <code>Authorization</code>
  29.     header
  30.      * @throws Exception if no token could be obtained.
  31.      */
  32.     public static String obtainAccessToken(MockMvc mvc, String username, String password)
  33.             throws Exception {
  34.         MultiValueMap<String, String> params = new LinkedMultiValueMap<>();
  35.         params.add("grant_type", "password");
  36.         params.add("client_id", UNIT_TEST_CLIENT_ID);
  37.         params.add("client_secret", UNIT_TEST_CLIENT_SECRET);
  38.         params.add("username", username);
  39.         params.add("password", password);
  40.         ResultActions result = mvc.perform(post("/oauth/token")
  41.                         .params(params)
  42.                         .with(httpBasic(UNIT_TEST_CLIENT_ID,UNIT_TEST_CLIENT_SECRET))
  43.                         .accept("application/json;charset=UTF-8"))
  44.                 .andExpect(status().isOk())
  45.                 .andExpect(content().contentType("application/json;charset=UTF-8"));
  46.         String resultString = result.andReturn().getResponse().getContentAsString();
  47.  
  48.         JacksonJsonParser jsonParser = new JacksonJsonParser();
  49.         return jsonParser.parseMap(resultString).get("access_token").toString();
  50.     }
  51.  
  52.     public static String bearer(String accessToken) {
  53.         return "Bearer " + accessToken;
  54.     }
  55. }

UNIT_TEST_CLIENT_ID 和 UNIT_TEST_CLIENT_SECRET的值要与application-test.properties里的client id, client secret一致。

POST 接口

为了能让mobile-app 用户创建账号，需要提供一个/api/users/ POST 接口。这个接口接收JSON类型的数据，来创建账号。

首先，为这个接口创建入参：

CreateOfficerParameters.java

  1. package com.babyrabbit.demo.web;
  2.  
  3. import lombok.Data;
  4. import org.hibernate.validator.constraints.Email;
  5. import javax.validation.constraints.NotNull;
  6. import javax.validation.constraints.Size;
  7. @Data
  8. public class CreateOfficerParameters {
  9.     @NotNull
  10.     @Email
  11.     private String email;
  12.  
  13.     @NotNull
  14.     @Size(min = 6, max = 1000)
  15.     private String password;
  16. }

在UserRestController里创建接口方法：

  1. package com.babyrabbit.demo.web;
  2.  
  3. import com.babyrabbit.demo.security.ApplicationUserDetails;
  4. import com.babyrabbit.demo.user.User;
  5. import com.babyrabbit.demo.user.UserNotFoundException;
  6. import com.babyrabbit.demo.user.UserService;
  7. import org.springframework.beans.factory.annotation.Autowired;
  8. import org.springframework.http.HttpStatus;
  9. import org.springframework.security.core.annotation.AuthenticationPrincipal;
  10. import org.springframework.web.bind.annotation.*;
  11.  
  12. import javax.validation.Valid;
  13.  
  14. @RestController
  15. @RequestMapping("/api/users")
  16. public class UserRestController {
  17.     private final UserService service;
  18.  
  19.     @Autowired
  20.     public UserRestController(UserService service) {
  21.         this.service = service;
  22.     }
  23.  
  24.     @GetMapping("/me")
  25.     public UserDto currentUser(@AuthenticationPrincipal ApplicationUserDetails userDetails) {
  26.         User user = service.getUser(userDetails.getUserId())
  27.                 .orElseThrow(() -> new UserNotFoundException(userDetails.getUserId()));
  28.         return UserDto.fromUser(user);
  29.     }
  30.  
  31.     @PostMapping 
  32.     @ResponseStatus(HttpStatus.CREATED) 
  33.     public UserDto createOfficer(@Valid @RequestBody CreateOfficerParameters parameters)
  34.     { 
  35.         User officer = service.createOfficer(parameters.getEmail(), parameters.getPassword());
  36.         return UserDto.fromUser(officer); 
  37.     }
  38. }
  39.

下面就为这个接口构建测试代码：

  1. package com.babyrabbit.demo.web;
  2.  
  3. import com.babyrabbit.demo.conf.OAuth2ServerConfiguration;
  4. import com.babyrabbit.demo.conf.SecurityConfiguration;
  5. import com.babyrabbit.demo.user.UserService;
  6. import com.babyrabbit.demo.user.Users;
  7. import com.babyrabbit.demo.util.SpringProfiles;
  8. import com.fasterxml.jackson.databind.ObjectMapper;
  9. import org.junit.Test;
  10. import org.junit.runner.RunWith;
  11. import org.springframework.beans.factory.annotation.Autowired;
  12. import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
  13. import org.springframework.boot.test.context.TestConfiguration;
  14. import org.springframework.boot.test.mock.mockito.MockBean;
  15. import org.springframework.context.annotation.Bean;
  16. import org.springframework.context.annotation.Import;
  17. import org.springframework.http.MediaType;
  18. import org.springframework.security.core.userdetails.UserDetailsService;
  19. import org.springframework.security.oauth2.provider.token.TokenStore;
  20. import org.springframework.security.oauth2.provider.token.store.InMemoryTokenStore;
  21. import org.springframework.test.context.ActiveProfiles;
  22. import org.springframework.test.context.junit4.SpringRunner;
  23. import org.springframework.test.web.servlet.MockMvc;
  24.  
  25. import java.util.Optional;
  26.  
  27. import static com.babyrabbit.demo.security.SecurityHelperForMockMvc.HEADER_AUTHORIZATION;
  28. import static com.babyrabbit.demo.security.SecurityHelperForMockMvc.bearer;
  29. import static com.babyrabbit.demo.security.SecurityHelperForMockMvc.obtainAccessToken;
  30. import static org.mockito.Mockito.verify;
  31. import static org.mockito.Mockito.when;
  32. import static org.springframework.restdocs.mockmvc.RestDocumentationRequestBuilders.get;
  33. import static org.springframework.restdocs.mockmvc.RestDocumentationRequestBuilders.post;
  34. import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
  35. import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
  36.  
  37. @RunWith(SpringRunner.class)
  38. @WebMvcTest(UserRestController.class)
  39. @ActiveProfiles(SpringProfiles.TEST)
  40. public class UserRestControllerTest {
  41.     @Autowired
  42.     private MockMvc mvc;
  43.     @MockBean
  44.     private UserService service;
  45.  
  46.     @Autowired
  47.     private ObjectMapper objectMapper;
  48.  
  49.     @Test
  50.     public void givenNotAuthenticated_whenAskingMyDetails_forbidden() throws Exception {
  51.         mvc.perform(get("/api/users/me")).andExpect(status().isUnauthorized());
  52.     }
  53.  
  54.     @Test
  55.     public void givenAuthenticatedAsOfficer_whenAskingMyDetails_detailsReturned() throws Exception {
  56.         String accessToken = obtainAccessToken(mvc, Users.OFFICER_EMAIL, Users.OFFICER_PASSWORD);
  57.  
  58.         when(service.getUser(Users.officer().getId())).thenReturn(Optional.of(Users.officer()));
  59.  
  60.         mvc.perform(get("/api/users/me")
  61.                 .header(HEADER_AUTHORIZATION, bearer(accessToken)))
  62.                 .andExpect(status().isOk())
  63.                 .andExpect(jsonPath("id").exists())
  64.                 .andExpect(jsonPath("email").value(Users.OFFICER_EMAIL))
  65.                 .andExpect(jsonPath("roles").isArray())
  66.                 .andExpect(jsonPath("roles[0]").value("OFFICER"))
  67.         ;
  68.     }
  69.  
  70.     @Test
  71.     public void testCreateOfficer() throws Exception {
  72.         String email = "wim.deblauwe@example.com";
  73.         String password = "my-super-secret-pwd";
  74.  
  75.         CreateOfficerParameters parameters = new CreateOfficerParameters();
  76.         parameters.setEmail(email);
  77.         parameters.setPassword(password);
  78.  
  79.         when(service.createOfficer(email, password)).thenReturn(Users.newOfficer(email,password));
  80.  
  81.         mvc.perform(post("/api/users")
  82.                     .contentType(MediaType.APPLICATION_JSON_UTF8)
  83.                     .content(objectMapper.writeValueAsString(parameters)))
  84.             .andExpect(status().isCreated())
  85.             .andExpect(jsonPath("id").exists())
  86.             .andExpect(jsonPath("email").value(email))
  87.             .andExpect(jsonPath("roles").isArray())
  88.             .andExpect(jsonPath("roles[0]").value("OFFICER"));
  89.  
  90.         verify(service).createOfficer(email, password);
  91.     }
  92.  
  93.     @TestConfiguration
  94.     @Import(OAuth2ServerConfiguration.class)
  95.     static class TestConfig {
  96.         @Bean
  97.         public UserDetailsService userDetailsService() {
  98.             return new StubUserDetailsService();
  99.         }
  100.  
  101.         @Bean
  102.         public TokenStore tokenStore() {
  103.             return new InMemoryTokenStore();
  104.         }
  105.  
  106.         @Bean
  107.         public SecurityConfiguration securityConfiguration() {
  108.             return new SecurityConfiguration();
  109.         }
  110.     }
  111. }

需要在Users中增加一个createOfficer方法：

  1. package com.babyrabbit.demo.user;
  2.  
  3. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  4. import org.springframework.security.crypto.password.PasswordEncoder;
  5.  
  6. import java.util.HashSet;
  7. import java.util.UUID;
  8.  
  9. public class Users {
  10.     private static final PasswordEncoder PASSWORD_ENCODER = new BCryptPasswordEncoder();
  11.  
  12.     public static final String OFFICER_EMAIL = "officer@example.com";
  13.     public static final String OFFICER_PASSWORD = "officer";
  14.     public static final String CAPTAIN_EMAIL = "captain@example.com";
  15.     public static final String CAPTAIN_PASSWORD = "captain";
  16.  
  17.     private static User OFFICER = User.createOfficer(newRandomId(),
  18.             OFFICER_EMAIL,
  19.             PASSWORD_ENCODER.encode(OFFICER_PASSWORD));
  20.  
  21.     private static User CAPTAIN = User.createCaptain(newRandomId(),
  22.             CAPTAIN_EMAIL,
  23.             PASSWORD_ENCODER.encode(CAPTAIN_PASSWORD));
  24.  
  25.     public static UserId newRandomId() {
  26.         return new UserId(UUID.randomUUID());
  27.     }
  28.  
  29.     public static User newRandomOfficer() {
  30.         return newRandomOfficer(newRandomId());
  31.     }
  32.  
  33.     public static User newRandomOfficer(UserId userId) {
  34.         String uniqueId = userId.asString().substring(0, 5);
  35.         return User.createOfficer(userId,
  36.                 "user-" + uniqueId + "@example.com",
  37.                 PASSWORD_ENCODER.encode("user"));
  38.     }
  39.  
  40.     public static User officer() {
  41.         return OFFICER;
  42.     }
  43.  
  44.     public static User captain() {
  45.         return CAPTAIN;
  46.     }
  47.  
  48.     private Users() {
  49.     }
  50.  
  51.     public static User newOfficer(String email, String password) {
  52.         HashSet<UserRole> roles = new HashSet<>();
  53.         roles.add(UserRole.OFFICER);
  54.         return new User(new UserId(UUID.randomUUID()),email,PASSWORD_ENCODER.encode(password),roles);
  55.     }
  56. }

执行这个测试用例会返回"401 Unauthorized"错误，这是因为Spring Security Oauth 资源服务中配置的队所有/api接口访问都需要认证，而创建账号时是无法认证的，因此，需要修改资源服务的配置，允许/api/users的post请求访问：

OAuth2ServerConfiguration.java

  1. package com.babyrabbit.demo.conf;
  2.  
  3. import org.springframework.beans.factory.annotation.Autowired;
  4. import org.springframework.beans.factory.annotation.Value;
  5. import org.springframework.context.annotation.Configuration;
  6. import org.springframework.http.HttpMethod;
  7. import org.springframework.security.authentication.AuthenticationManager;
  8. import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
  9. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  10. import org.springframework.security.core.userdetails.UserDetailsService;
  11. import org.springframework.security.crypto.password.PasswordEncoder;
  12. import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
  13. import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
  14. import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
  15. import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
  16. import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
  17. import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
  18. import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;
  19. import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;
  20. import org.springframework.security.oauth2.provider.token.TokenStore;
  21.  
  22. /**
  23.  * Created by kevin on 2018/9/14.
  24.  */
  25. @Configuration
  26. public class OAuth2ServerConfiguration {
  27.     @Value("${resource_id}")
  28.     private String resourceId;
  29.  
  30.     @Configuration
  31.     @EnableAuthorizationServer
  32.     protected class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
  33.  
  34.         @Autowired
  35.         private AuthenticationManager authenticationManager;
  36.  
  37.         @Autowired
  38.         private UserDetailsService userDetailsService;
  39.  
  40.         @Autowired
  41.         private PasswordEncoder passwordEncoder;
  42.  
  43.         @Autowired
  44.         private TokenStore tokenStore;
  45.  
  46.         @Autowired
  47.         private  SecurityConfiguration securityConfiguration;
  48.  
  49.         @Override
  50.         public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
  51.             security.passwordEncoder(passwordEncoder);
  52.         }
  53.  
  54.         @Override
  55.         public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
  56.             clients.inMemory()
  57.                     .withClient(securityConfiguration.getMobileAppClientId())
  58.                     .authorizedGrantTypes("password", "refresh_token")
  59.                     .scopes("mobile_app")
  60.                     .resourceIds(resourceId)
  61.                     .secret(passwordEncoder.encode(securityConfiguration.getMobileAppClientSecret()));
  62.         }
  63.  
  64.         @Override
  65.         public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
  66.             endpoints.tokenStore(tokenStore)
  67.                     .authenticationManager(authenticationManager)
  68.                     .userDetailsService(userDetailsService);
  69.         }
  70.     }
  71.  
  72.     @Configuration
  73.     @EnableResourceServer
  74.     @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
  75.     protected class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
  76.  
  77.         @Override
  78.         public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
  79.             resources.resourceId(resourceId);
  80.         }
  81.  
  82.         @Override
  83.         public void configure(HttpSecurity http) throws Exception {
  84.             http.authorizeRequests()
  85.                     .antMatchers(HttpMethod.OPTIONS, "/api/**").permitAll()
  86.                     .and()
  87.                     .antMatcher("/api/**").authorizeRequests()
  88.                     .antMatchers(HttpMethod.POST, "/api/users").permitAll()
  89.                     .anyRequest().authenticated();
  90.         }
  91.     }
  92. }

对测试代码重构

现在只有一个Controller，对应也只创建了一个Controller的测试代码，如果后面再有新的controller，也要创建新的controller测试代码，就会有一些重复代码。为了减少重复代码，下面对controller的测试代码做一点重构工作。

创建自己的注解

在控制器测试代码上有一组注解：

  1. @WebMvcTest(UserRestController.class)
  2. @ActiveProfiles(SpringProfiles.TEST)

这两行注解基本上所有的控制器测试类都要有。可以合并成自定义注解，用一行代码实现两行代码的效果。

BabyControllerTest .java

  1. package com.babyrabbit.demo.util;
  2.  
  3. import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
  4. import org.springframework.core.annotation.AliasFor;
  5. import org.springframework.test.context.ActiveProfiles;
  6. import org.springframework.test.context.ContextConfiguration;
  7.  
  8. import java.lang.annotation.Retention;
  9. import java.lang.annotation.RetentionPolicy;
  10.  
  11. @Retention(RetentionPolicy.RUNTIME)
  12. @WebMvcTest
  13. @ContextConfiguration(classes = BabyControllerTestConfiguration.class)
  14. @ActiveProfiles(SpringProfiles.TEST)
  15. public @interface BabyControllerTest {
  16.     @AliasFor(annotation = WebMvcTest.class, attribute = "value")
  17.     Class<?>[] value() default {};
  18.     
  19.     @AliasFor(annotation = WebMvcTest.class, attribute = "controllers")
  20.     Class<?>[] controllers() default {};
  21. }

这个注解是利用spring的meta-annotations特性，将多个注解组合成一个注解。

BabyControllerTestConfiguration.java

  1. package com.babyrabbit.demo.util;
  2.  
  3. import com.babyrabbit.demo.conf.OAuth2ServerConfiguration;
  4. import com.babyrabbit.demo.conf.SecurityConfiguration;
  5. import com.babyrabbit.demo.web.StubUserDetailsService;
  6. import org.springframework.boot.test.context.TestConfiguration;
  7. import org.springframework.context.annotation.Bean;
  8. import org.springframework.context.annotation.Import;
  9. import org.springframework.security.core.userdetails.UserDetailsService;
  10. import org.springframework.security.oauth2.provider.token.TokenStore;
  11. import org.springframework.security.oauth2.provider.token.store.InMemoryTokenStore;
  12.  
  13. @TestConfiguration
  14. @Import(OAuth2ServerConfiguration.class)
  15. public class BabyControllerTestConfiguration {
  16.     @Bean
  17.     public UserDetailsService userDetailsService() {
  18.         return new StubUserDetailsService();
  19.     }
  20.     @Bean
  21.     public TokenStore tokenStore() {
  22.         return new InMemoryTokenStore();
  23.     }
  24.     @Bean
  25.     public SecurityConfiguration securityConfiguration() {
  26.         return new SecurityConfiguration();
  27.     }
  28. }
  29.

这个类就是前面在UserRestControllerTest.java中的那个静态类TestConfig，把这个类拿出来放到单独的文件里，以便在多个ControllerTest中重用。

这样，UserRestControllerTest中就需要把TestConfig静态类移除：

UserRestControllerTest.java

  1. package com.babyrabbit.demo.web;
  2.  
  3. import com.babyrabbit.demo.conf.OAuth2ServerConfiguration;
  4. import com.babyrabbit.demo.conf.SecurityConfiguration;
  5. import com.babyrabbit.demo.user.UserService;
  6. import com.babyrabbit.demo.user.Users;
  7. import com.babyrabbit.demo.util.BabyControllerTest;
  8. import com.babyrabbit.demo.util.SpringProfiles;
  9. import com.fasterxml.jackson.databind.ObjectMapper;
  10. import org.junit.Test;
  11. import org.junit.runner.RunWith;
  12. import org.springframework.beans.factory.annotation.Autowired;
  13. import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
  14. import org.springframework.boot.test.mock.mockito.MockBean;
  15. import org.springframework.http.MediaType;
  16. import org.springframework.test.context.ActiveProfiles;
  17. import org.springframework.test.context.junit4.SpringRunner;
  18. import org.springframework.test.web.servlet.MockMvc;
  19.  
  20. import java.util.Optional;
  21.  
  22. import static com.babyrabbit.demo.security.SecurityHelperForMockMvc.HEADER_AUTHORIZATION;
  23. import static com.babyrabbit.demo.security.SecurityHelperForMockMvc.bearer;
  24. import static com.babyrabbit.demo.security.SecurityHelperForMockMvc.obtainAccessToken;
  25. import static org.mockito.Mockito.verify;
  26. import static org.mockito.Mockito.when;
  27. import static org.springframework.restdocs.mockmvc.RestDocumentationRequestBuilders.get;
  28. import static org.springframework.restdocs.mockmvc.RestDocumentationRequestBuilders.post;
  29. import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
  30. import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
  31.  
  32. @RunWith(SpringRunner.class)
  33. @BabyControllerTest(UserRestController.class)
  34. public class UserRestControllerTest {
  35.     @Autowired
  36.     private MockMvc mvc;
  37.     @MockBean
  38.     private UserService service;
  39.  
  40.     @Autowired
  41.     private ObjectMapper objectMapper;
  42.  
  43.     @Test
  44.     public void givenNotAuthenticated_whenAskingMyDetails_forbidden() throws Exception {
  45.         mvc.perform(get("/api/users/me")).andExpect(status().isUnauthorized());
  46.     }
  47.  
  48.     @Test
  49.     public void givenAuthenticatedAsOfficer_whenAskingMyDetails_detailsReturned() throws Exception {
  50.         String accessToken = obtainAccessToken(mvc, Users.OFFICER_EMAIL, Users.OFFICER_PASSWORD);
  51.  
  52.         when(service.getUser(Users.officer().getId())).thenReturn(Optional.of(Users.officer()));
  53.  
  54.         mvc.perform(get("/api/users/me")
  55.                 .header(HEADER_AUTHORIZATION, bearer(accessToken)))
  56.                 .andExpect(status().isOk())
  57.                 .andExpect(jsonPath("id").exists())
  58.                 .andExpect(jsonPath("email").value(Users.OFFICER_EMAIL))
  59.                 .andExpect(jsonPath("roles").isArray())
  60.                 .andExpect(jsonPath("roles[0]").value("OFFICER"))
  61.         ;
  62.     }
  63.  
  64.     @Test
  65.     public void testCreateOfficer() throws Exception {
  66.         String email = "wim.deblauwe@example.com";
  67.         String password = "my-super-secret-pwd";
  68.  
  69.         CreateOfficerParameters parameters = new CreateOfficerParameters();
  70.         parameters.setEmail(email);
  71.         parameters.setPassword(password);
  72.  
  73.         when(service.createOfficer(email, password)).thenReturn(Users.newOfficer(email,password));
  74.  
  75.         mvc.perform(post("/api/users")
  76.                     .contentType(MediaType.APPLICATION_JSON_UTF8)
  77.                     .content(objectMapper.writeValueAsString(parameters)))
  78.             .andExpect(status().isCreated())
  79.             .andExpect(jsonPath("id").exists())
  80.             .andExpect(jsonPath("email").value(email))
  81.             .andExpect(jsonPath("roles").isArray())
  82.             .andExpect(jsonPath("roles[0]").value("OFFICER"));
  83.  
  84.         verify(service).createOfficer(email, password);
  85.     }
  86. }

使用MySQL数据库

前面的代码，都是在内存里模拟用户数据，实际项目里，还是会需要用到数据库的。这里就用MySQL数据库来继续开发这个工程。

配置数据库信息

由于我打算将数据库和API服务放在一个服务器上，将使用spring profile配合来配置数据库连接信息。

设定访问localhost 数据库的profile为 local，首先需要创建application-local.properties，配置数据库访问信息：

  1. copsboot-security.mobile-app-client-id=baby-mobile-client
  2. copsboot-security.mobile-app-client-secret=ccUyb6vS4S8nxfbKPCrN
  3.  
  4. spring.datasource.url=jdbc:mysql://localhost/babydb 
  5. spring.datasource.driverClassName=com.mysql.jdbc.Driver
  6. spring.datasource.username=dbadmin 
  7. spring.datasource.password=dbadmin
  8. spring.jpa.database-platform=org.hibernate.dialect.MySQLDialect 
  9. spring.jpa.hibernate.ddl-auto=none

这个文件中包含了敏感信息，所以不要把这个文件提交到git上。推荐个好的实践，提交application-local.properties.template作为样例文件，当然，要把其中的敏感信息隐藏掉

创建数据库

为了对数据库变更也能做版本管理，spring boot 支持两个库： Flyway 和 Liquibase，在spring boot启动时，自动执行SQL 脚本确保数据库是最新的。

这两个库最大的区别是：Flyway 使用的是SQL脚本，而Liquibase使用的是XML语法。这里我使用的是Flyway。首先需要在工程的pom.xml中添加依赖：

  1. 	<dependency>
  2. 		<groupId>org.flywaydb</groupId>
  3. 		<artifactId>flyway-core</artifactId>
  4. 	</dependency>

在src/main/resources下创建db/migration目录作为Flyway的工作目录。在migration目录里，再创建一个h2目录，一个mysql目录，分别用来放数据库脚本。

实际的目录结构如下：

  1. pom.xml
  2. mvnw
  3. mvnw.cmd
  4. src
  5.    |-- main
  6.        |-- java
  7.            |-- com.babyrabbit.demo
  8.                |-- DemoApplication
  9.        |-- resources
  10.            |-- application.properties
  11.            |-- db
  12.                |-- migration
  13.                    |-- h2
  14.                        |-- V1.0.0.1__authentication.sql
  15.                    |-- mysql
  16.                        |-- V1.0.0.1__authentication.sql
  17.                        |-- V1.0.0.2__users.sql
  18.    |-- test
  19.        |-- java
  20.            |-- com.babyrabbit.demo
  21.                |-- ApplicationTests

sql文件的名字非常重要，Flyway将使用这个名字来决定这些脚本的执行顺序。

创建数据表的脚本可以自己手写，可以让jpa自动生成创建脚本：

application-local.properties

  1. spring.jpa.properties.javax.persistence.schema-generation.create-source=metadata
  2. spring.jpa.properties.javax.persistence.schema-generation.scripts.action=create
  3. spring.jpa.properties.javax.persistence.schema-generation.scripts.create-target=create.sql

当选用local作为激活的profile，启动程序，spring boot会自动创建create.sql文件，包含所有的创建脚本。

把create.sql 脚本复制到mysql目录下，命名为V1.0.0.2_users.sql , 在application-local.properties添加配置，告诉Flpyway 脚本的相对位置：

spring.flyway.locations=classpath:db/migration/mysql

对于dev 这个profile，需要配置的是application-dev.properties:

  1. spring.flyway.locations=classpath:db/migration/h2
  2. spring.jpa.hibernate.ddl-auto=create-drop

初始化数据库

当使用dev这个profile 启动服务时， 会触发spring boot执行DevelopmentDbInitializer， 创建测试用户。如果想同时在MySQL中创建默认用户，可以在启动时候，同时使用 dev, local作为激活的profile。 激活的profile的顺序很重要，dev在前， local在后，这样local可以重写数据库连接属性。

Flyway将在库里创建一个schema_version表，用来记录那些更新已经执行，那些还没有执行。

注意： 一旦发布了一个数据库更新脚本，并让flyway执行了，就不要更改这个文件了，否则会导致flyway拒绝执行任何脚本，最终导致程序启动失败。如果要修改数据库，就新创建一个脚本，不要在已有脚本中修改。

校验

spring中可以使用javax.validation.constrants包里的校验注解，也可以使用org.hibernate.validation.constrants包里校验注解。

这些校验注解都是用来校验对象里的字段的。在controller中，启用一个校验，使用@Valid 注解，则框架会根据数据对象里的校验注解对数据进行校验。

使用exception handler处理校验错误

例外处理如果跟正常业务逻辑混在一起，不但让代码乱，有很多重复代码，还可能引入bug。spring提供一个@ExceptionHandler注解，来单独创建例外处理，这样就可以把例外处理的代码集中放置。

要处理Controller中抛出的例外，需要使用@ControllerAdvice注解，捕捉Controller中的例外：

RestControllerExceptionHandler.java

  1. package com.babyrabbit.demo.web;
  2.  
  3. import org.springframework.http.HttpStatus;
  4. import org.springframework.web.bind.MethodArgumentNotValidException;
  5. import org.springframework.web.bind.annotation.ControllerAdvice;
  6. import org.springframework.web.bind.annotation.ExceptionHandler;
  7. import org.springframework.web.bind.annotation.ResponseBody;
  8. import org.springframework.web.bind.annotation.ResponseStatus;
  9.  
  10. import java.util.Collections;
  11. import java.util.List;
  12. import java.util.Map;
  13. import java.util.stream.Collectors;
  14.  
  15. @ControllerAdvice
  16. public class RestControllerExceptionHandler {
  17.     @ExceptionHandler
  18.     @ResponseBody
  19.     @ResponseStatus(HttpStatus.BAD_REQUEST)
  20.     public Map<String, List<FieldErrorResponse>> handle(MethodArgumentNotValidException exception) {
  21.         return error(exception.getBindingResult()
  22.                 .getFieldErrors()
  23.                 .stream()
  24.                 .map(fieldError -> new FieldErrorResponse(fieldError.getField(),
  25.                         fieldError.getDefaultMessage()))
  26.                 .collect(Collectors.toList()));
  27.     }
  28.     private Map<String, List<FieldErrorResponse>> error(List<FieldErrorResponse> errors)
  29.     {
  30.         return Collections.singletonMap("errors", errors);
  31.     }
  32. }

对上面代码的一点解释：

  • @ControllerAdvice注解标注这个类的代码是应用到这个工程的所有controller上。
  • @ExceptionHandler注解标注当controller抛出例外时，调用这个方法

上面代码中，用到了一个数据容器，当校验失败时，用其保持校验失败的字段名及校验失败的错误信息：

FieldErrorResponse.java

  1. package com.babyrabbit.demo.web;
  2.  
  3. import lombok.Value;
  4.  
  5. @Value
  6. public class FieldErrorResponse {
  7.     private String fieldName;
  8.     private String errorMessage;
  9. }

自定义字段校验器

为了演示如何使用自定义字段校验器，下面创建了Report模块。

ReportRestController.java

  1. package com.babyrabbit.demo.web;
  2.  
  3. import com.babyrabbit.demo.report.ReportService;
  4. import com.babyrabbit.demo.security.ApplicationUserDetails;
  5. import org.springframework.http.HttpStatus;
  6. import org.springframework.security.core.annotation.AuthenticationPrincipal;
  7. import org.springframework.web.bind.annotation.*;
  8.  
  9. import javax.validation.Valid;
  10.  
  11. @RestController
  12. @RequestMapping("/api/reports")
  13. public class ReportRestController {
  14.  
  15.     private final ReportService service;
  16.  
  17.     public ReportRestController(ReportService service) {
  18.         this.service = service;
  19.     }
  20.  
  21.     @PostMapping
  22.     @ResponseStatus(HttpStatus.CREATED)
  23.     public ReportDto createReport(@AuthenticationPrincipal ApplicationUserDetails userDetails,
  24.                                   @Valid @RequestBody CreateReportParameters parameters) {
  25.         return ReportDto.fromReport(service.createReport(userDetails.getUserId(),
  26.                 parameters.getDateTime(),
  27.                 parameters.getDescription()));
  28.     }
  29. }

Report.java

  1. package com.babyrabbit.demo.report;
  2.  
  3. import com.babyrabbit.demo.orm.jpa.AbstractEntity;
  4. import com.babyrabbit.demo.user.User;
  5. import com.babyrabbit.demo.util.ArtifactForFramework;
  6. import lombok.Getter;
  7.  
  8. import javax.persistence.Entity;
  9. import javax.persistence.ManyToOne;
  10. import java.time.ZonedDateTime;
  11.  
  12. @Getter
  13. @Entity
  14. public class Report extends AbstractEntity<ReportId> {
  15.     @ManyToOne
  16.     private User reporter;
  17.     private ZonedDateTime dateTime;
  18.     private String description;
  19.  
  20.     @ArtifactForFramework
  21.     protected Report() {
  22.     }
  23.  
  24.     public Report(ReportId id, User reporter, ZonedDateTime dateTime, String description)
  25.     {
  26.         super(id);
  27.         this.reporter = reporter;
  28.         this.dateTime = dateTime;
  29.         this.description = description;
  30.     }
  31. }

ReportId.java

  1. package com.babyrabbit.demo.report;
  2.  
  3. import com.babyrabbit.demo.orm.jpa.AbstractEntityId;
  4.  
  5. import java.util.UUID;
  6.  
  7. /**
  8.  * Created by kevin on 2018/9/14.
  9.  */
  10. public class ReportId extends AbstractEntityId<UUID> {
  11.     protected ReportId(){
  12.  
  13.     }
  14.  
  15.     public ReportId(UUID id){
  16.         super(id);
  17.     }
  18.  
  19.     @Override
  20.     public String asString() {
  21.         return super.getId().toString();
  22.     }
  23. }

ReportRepository.java

  1. package com.babyrabbit.demo.report;
  2.  
  3. import org.springframework.data.repository.CrudRepository;
  4.  
  5. import java.util.UUID;
  6.  
  7. /**
  8.  * Created by kevin on 2018/9/14.
  9.  */
  10. public interface ReportRepository extends CrudRepository<Report, UUID>,ReportRepositoryCustom{
  11. }
  12.

ReportRepositoryCustomer.java

  1. package com.babyrabbit.demo.report;
  2.  
  3. import com.babyrabbit.demo.user.UserId;
  4.  
  5. /**
  6.  * Created by kevin on 2018/9/14.
  7.  */
  8. public interface ReportRepositoryCustom {
  9.     ReportId nextId();
  10. }
  11.

ReportRepositoryImpl.java

  1. package com.babyrabbit.demo.report;
  2.  
  3. import com.babyrabbit.demo.orm.jpa.UniqueIdGenerator;
  4.  
  5. import java.util.UUID;
  6.  
  7. /**
  8.  * Created by kevin on 2018/9/14.
  9.  */
  10. public class ReportRepositoryImpl implements ReportRepositoryCustom{
  11.     private final UniqueIdGenerator<UUID> generator;
  12.     public ReportRepositoryImpl(UniqueIdGenerator<UUID> generator) {
  13.         this.generator = generator;
  14.     }
  15.     @Override
  16.     public ReportId nextId() {
  17.         return new ReportId(generator.getNextUniqueId());
  18.     }
  19. }
  20.

ReportService.java

  1. package com.babyrabbit.demo.report;
  2.  
  3. import com.babyrabbit.demo.user.UserId;
  4.  
  5. import java.time.ZonedDateTime;
  6.  
  7. /**
  8.  * Created by kevin on 2018/9/14.
  9.  */
  10. public interface ReportService {
  11.     Report createReport(UserId userId, ZonedDateTime dateTime, String description);
  12. }
  13.

ReportServiceImpl.java

  1. package com.babyrabbit.demo.report;
  2.  
  3. import com.babyrabbit.demo.user.User;
  4. import com.babyrabbit.demo.user.UserId;
  5. import com.babyrabbit.demo.user.UserNotFoundException;
  6. import com.babyrabbit.demo.user.UserRepository;
  7. import org.springframework.beans.factory.annotation.Autowired;
  8.  
  9. import java.time.ZonedDateTime;
  10.  
  11. /**
  12.  * Created by kevin on 2018/9/14.
  13.  */
  14. public class ReportServiceImpl implements ReportService{
  15.  
  16.     private final ReportRepository reportRepository;
  17.     private final UserRepository userRepository;
  18.     @Autowired
  19.     public ReportServiceImpl(ReportRepository reportRepository, UserRepository userRepository){
  20.         this.reportRepository = reportRepository;
  21.         this.userRepository = userRepository;
  22.     }
  23.  
  24.     @Override
  25.     public Report createReport(UserId userId, ZonedDateTime dateTime, String description) {
  26.         User user = userRepository.findById(userId.getId()).orElseThrow(() -> new UserNotFoundException(userId));
  27.         Report report = Reports.createReport(reportRepository.nextId(), user,dateTime,description);
  28.         return reportRepository.save(report);
  29.     }
  30. }
  31.

ReportDto.java

  1. package com.babyrabbit.demo.web;
  2.  
  3. import com.babyrabbit.demo.report.Report;
  4. import com.babyrabbit.demo.report.ReportId;
  5. import lombok.Value;
  6.  
  7. import java.time.ZonedDateTime;
  8.  
  9. @Value
  10. public class ReportDto {
  11.     private ReportId id;
  12.     private String reporter;
  13.     private ZonedDateTime dateTime;
  14.     private String description;
  15.  
  16.     public static ReportDto fromReport(Report report) {
  17.         return new ReportDto(report.getId(),
  18.                 report.getReporter().getEmail(),
  19.                 report.getDateTime(),
  20.                 report.getDescription());
  21.     }
  22. }

最后为上面的代码创建测试代码：

ReportRestControllerTest.java

  1. package com.babyrabbit.demo.web;
  2.  
  3. import com.babyrabbit.demo.report.Report;
  4. import com.babyrabbit.demo.report.ReportId;
  5. import com.babyrabbit.demo.report.ReportService;
  6. import com.babyrabbit.demo.user.Users;
  7. import com.babyrabbit.demo.util.BabyControllerTest;
  8. import com.fasterxml.jackson.databind.ObjectMapper;
  9. import org.junit.Test;
  10. import org.junit.runner.RunWith;
  11. import org.springframework.beans.factory.annotation.Autowired;
  12. import org.springframework.boot.test.mock.mockito.MockBean;
  13. import org.springframework.http.MediaType;
  14. import org.springframework.test.context.junit4.SpringRunner;
  15. import org.springframework.test.web.servlet.MockMvc;
  16.  
  17. import java.time.ZonedDateTime;
  18. import java.util.UUID;
  19.  
  20. import static com.babyrabbit.demo.security.SecurityHelperForMockMvc.HEADER_AUTHORIZATION;
  21. import static com.babyrabbit.demo.security.SecurityHelperForMockMvc.bearer;
  22. import static com.babyrabbit.demo.security.SecurityHelperForMockMvc.obtainAccessToken;
  23. import static org.mockito.ArgumentMatchers.any;
  24. import static org.mockito.ArgumentMatchers.eq;
  25. import static org.mockito.Mockito.when;
  26. import static org.springframework.restdocs.mockmvc.RestDocumentationRequestBuilders.post;
  27. import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
  28. import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
  29.  
  30. @RunWith(SpringRunner.class)
  31. @BabyControllerTest(ReportRestController.class)
  32. public class ReportRestControllerTest {
  33.     @Autowired
  34.     private MockMvc mvc;
  35.     @Autowired
  36.     private ObjectMapper objectMapper;
  37.     @MockBean
  38.     private ReportService service;
  39.     @Test
  40.     public void officerIsAbleToPostAReport() throws Exception {
  41.         String accessToken = obtainAccessToken(mvc, Users.OFFICER_EMAIL, Users
  42.                 .OFFICER_PASSWORD);
  43.         ZonedDateTime dateTime = ZonedDateTime.parse("2018-04-11T22:59:03.189+02:00");
  44.         String description = "This is a test report description.";
  45.         CreateReportParameters parameters = new CreateReportParameters(dateTime,
  46.                 description);
  47.         when(service.createReport(eq(Users.officer().getId()), any(ZonedDateTime.class),
  48.                 eq(description)))
  49.                 .thenReturn(new Report(new ReportId(UUID.randomUUID()), Users.officer(),
  50.                         dateTime, description));
  51.         mvc.perform(post("/api/reports")
  52.                 .header(HEADER_AUTHORIZATION, bearer(accessToken))
  53.                 .contentType(MediaType.APPLICATION_JSON_UTF8)
  54.                 .content(objectMapper.writeValueAsString(parameters)))
  55.                 .andExpect(status().isCreated())
  56.                 .andExpect(jsonPath("id").exists())
  57.                 .andExpect(jsonPath("reporter").value(Users.OFFICER_EMAIL))
  58.                 .andExpect(jsonPath("dateTime").value("2018-04-11T22:59:03.189+02:00"))
  59.                 .andExpect(jsonPath("description").value(description));
  60.     }
  61. }
  62.

下面进入正题， 针对description字段，校验内容中是否有敏感词。这个校验需要自定义一个校验器ValidReportDescription:

ValidReportDescription.java

  1. package com.babyrabbit.demo.web;
  2.  
  3. import javax.validation.Constraint;
  4. import javax.validation.Payload;
  5. import java.lang.annotation.ElementType;
  6. import java.lang.annotation.Retention;
  7. import java.lang.annotation.RetentionPolicy;
  8. import java.lang.annotation.Target;
  9.  
  10. @Target(ElementType.FIELD)
  11. @Retention(RetentionPolicy.RUNTIME)
  12. @Constraint(validatedBy = {ReportDescriptionValidator.class})
  13. public @interface ValidReportDescription {
  14.     String message() default "Invalid report description";
  15.     Class<?>[] groups() default {};
  16.     Class<? extends Payload>[] payload() default {};
  17. }

这个注解用来在description字段上添加校验标记。

ReportDescriptionValidator.java

  1. package com.babyrabbit.demo.web;
  2.  
  3. import javax.validation.ConstraintValidator;
  4. import javax.validation.ConstraintValidatorContext;
  5.  
  6. public class ReportDescriptionValidator implements ConstraintValidator<ValidReportDescription, String> {
  7.     @Override
  8.     public void initialize(ValidReportDescription constraintAnnotation) {
  9.     }
  10.  
  11.     @Override
  12.     public boolean isValid(String value, ConstraintValidatorContext context) {
  13.         boolean result = true;
  14.         if (!value.toLowerCase().contains("suspect")) {
  15.             result = false;
  16.         }
  17.         return result;
  18.     }
  19. }

这个类实现了真正的校验逻辑。

下面，就可以将这个自定义的字段校验器应用到代码中：

CreateReportParameters.java

  1. package com.babyrabbit.demo.web;
  2.  
  3. import lombok.AllArgsConstructor;
  4. import lombok.Data;
  5. import lombok.NoArgsConstructor;
  6.  
  7. import java.time.ZonedDateTime;
  8.  
  9. @Data
  10. @AllArgsConstructor
  11. @NoArgsConstructor
  12. public class CreateReportParameters {
  13.     private ZonedDateTime dateTime;
  14.  
  15.     @ValidReportDescription
  16.     private String description;
  17. }

将自定义对象校验器注册玮Spring服务

普通的校验注解只是做前端校验，并没有深入到后端数据库或业务层面上的校验。如果创建一个User的时候，需要深入到数据库查重，这时候需要调用UserService来访问数据，执行业务逻辑。UserService是Spring管理的Service，因此要求校验器也要被Spring管理，才能实现注入。

下面先创建校验器注解类：

ValidCreateUserParameters.java

  1. package com.babyrabbit.demo.web;
  2.  
  3. import javax.validation.Constraint;
  4. import javax.validation.Payload;
  5. import java.lang.annotation.ElementType;
  6. import java.lang.annotation.Retention;
  7. import java.lang.annotation.RetentionPolicy;
  8. import java.lang.annotation.Target;
  9.  
  10. @Target(ElementType.TYPE)
  11. @Retention(RetentionPolicy.RUNTIME)
  12. @Constraint(validatedBy = {CreateUserParametersValidator.class})
  13. public @interface ValidCreateUserParameters {
  14.     String message() default "Invalid user";
  15.     Class<?>[] groups() default {};
  16.     Class<? extends Payload>[] payload() default {};
  17. }

CreateUserParametersValidator 是校验逻辑实现类。

CreateUserParametersValidator.java

  1. package com.babyrabbit.demo.web;
  2.  
  3. import com.babyrabbit.demo.user.UserService;
  4. import org.springframework.beans.factory.annotation.Autowired;
  5.  
  6. import javax.validation.ConstraintValidator;
  7. import javax.validation.ConstraintValidatorContext;
  8.  
  9. public class CreateUserParametersValidator implements ConstraintValidator<ValidCreateUserParameters, CreateOfficerParameters> {
  10.     private final UserService userService;
  11.  
  12.     @Autowired
  13.     public CreateUserParametersValidator(UserService userService) {
  14.         this.userService = userService;
  15.     }
  16.  
  17.     @Override
  18.     public void initialize(ValidCreateUserParameters constraintAnnotation) {
  19.     }
  20.  
  21.     @Override
  22.     public boolean isValid(CreateOfficerParameters userParameters,ConstraintValidatorContext context) {
  23.         boolean result = true;
  24.         if (userService.findUserByEmail(userParameters.getEmail()).isPresent()) {
  25.             context.buildConstraintViolationWithTemplate(
  26.                     "There is already a user with the given email address.")
  27.                     .addPropertyNode("email").addConstraintViolation();
  28.             result = false;
  29.         }
  30.         return result;
  31.     }
  32. }

在上面的代码中，注入了UserService。

这样就实现了调用Spring Service做逻辑校验。

OAuth Database Schema

MySQL

  1. CREATE TABLE oauth_client_details (
  2. 	client_id                  VARCHAR(255) PRIMARY KEY,
  3. 	resource_ids               VARCHAR(255),
  4. 	client_secret              VARCHAR(255),
  5. 	scope                      VARCHAR(255),
  6. 	authorized_grant_types     VARCHAR(255),
  7. 	web_server_redirect_uri    VARCHAR(255),
  8. 	authorities                VARCHAR(255),
  9. 	access_token_validity      INTEGER,
  10. 	refresh_token_validity     INTEGER,
  11. 	additional_information     VARCHAR(4096),
  12. 	autoapprove                TINYINT
  13. );
  14.  
  15. CREATE TABLE oauth_client_token (
  16. 	token_id                   VARCHAR(255),
  17. 	token                      BLOB,
  18. 	authentication_id          VARCHAR(255) PRIMARY KEY,
  19. 	user_name                  VARCHAR(255),
  20. 	client_id                  VARCHAR(255)
  21. );
  22.  
  23. CREATE TABLE oauth_access_token (
  24. 	token_id                   VARCHAR(255),
  25. 	token                      BLOB,
  26. 	authentication_id          VARCHAR(255) PRIMARY KEY,
  27. 	user_name                  VARCHAR(255),
  28. 	client_id                  VARCHAR(255),
  29. 	authentication             BLOB,
  30. 	refresh_token              VARCHAR(255)
  31. );
  32.  
  33. CREATE TABLE oauth_refresh_token (
  34. 	token_id                   VARCHAR(255),
  35. 	token                      BLOB,
  36. 	authentication             BLOB
  37. );
  38.  
  39. CREATE TABLE oauth_code (
  40. 	activationCode             VARCHAR(255),
  41. 	authentication             BLOB
  42. );

H2

  1. CREATE TABLE oauth_client_details (
  2. 	client_id                     VARCHAR(255) PRIMARY KEY,
  3. 	resource_ids                  VARCHAR(255),
  4. 	client_secret                 VARCHAR(255),
  5. 	scope                         VARCHAR(255),
  6. 	authorized_grant_types        VARCHAR(255),
  7. 	web_server_redirect_uri       VARCHAR(255),
  8. 	authorities                   VARCHAR(255),
  9. 	access_token_validity         INTEGER,
  10. 	refresh_token_validity        INTEGER,
  11. 	additional_information        VARCHAR(4096),
  12. 	autoapprove                   VARCHAR(255)
  13. );
  14.  
  15. CREATE TABLE oauth_client_token (
  16. 	token_id                      VARCHAR(255),
  17. 	token                         BLOB,
  18. 	authentication_id             VARCHAR(255) PRIMARY KEY,
  19. 	user_name                     VARCHAR(255),
  20. 	client_id                     VARCHAR(255)
  21. );
  22.  
  23. CREATE TABLE oauth_access_token (
  24. 	token_id                      VARCHAR(255),
  25. 	token                         BLOB,
  26. 	authentication_id             VARCHAR(255) PRIMARY KEY,
  27. 	user_name                     VARCHAR(255),
  28. 	client_id                     VARCHAR(255),
  29. 	authentication                BLOB,
  30. 	refresh_token                 VARCHAR(255)
  31. );
  32.  
  33. CREATE TABLE oauth_refresh_token (
  34. 	token_id                      VARCHAR(255),
  35. 	token                         BLOB,
  36. 	authentication                BLOB
  37. );
  38.  
  39. CREATE TABLE oauth_code (
  40. 	activationCode                VARCHAR(255),
  41. 	authentication                BLOB
  42. );

转载于:https://my.oschina.net/ez8life/blog/2051291

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/Cpp五条/article/detail/68967
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号