核心开发框架层

project-name/
├── project-name-api/            # 对外暴露的DTO/接口
│   └── src/main/java/.../dto/   # 数据传输对象
├── project-name-common/         # 通用工具类与常量
│   └── src/main/java/.../util/  # 工具类
├── project-name-dao/            # 数据访问层
│   └── src/main/java/.../mapper/  # MyBatis Mapper
│   └── src/main/resources/mapper/ # XML映射文件
├── project-name-service/        # 业务逻辑层
│   └── src/main/java/.../service/
│   └── src/main/java/.../service/impl/
├── project-name-web/            # 控制层(启动入口)
│   └── src/main/java/.../controller/
│   └── src/main/java/.../config/   # 配置类
│   └── src/main/resources/
│       ├── application.yml
│       ├── application-dev.yml
│       ├── application-prod.yml
│       └── bootstrap.yml        # Nacos配置
└── pom.xml

// Spring Boot 自动配置的核心注解
@SpringBootApplication
public class Application {
    public static void main(String[] args) {
        SpringApplication.run(Application.class, args);
    }
}

@SpringBootApplication
├── @EnableAutoConfiguration         ← 开启自动配置
│   └── @Import(AutoConfigurationImportSelector.class)
│       └── SpringFactoriesLoader.loadFactoryNames()
│           └── META-INF/spring.factories
│               └── (读取所有xxxAutoConfiguration类)
├── @ComponentScan                   ← 组件扫描
└── @SpringBootConfiguration         ← 标记配置类

# application.yml — 公共配置
spring:
  profiles:
    active: @profile.active@      # Maven打包时动态替换
  application:
    name: order-service

server:
  tomcat:
    max-threads: 200              # 公共默认值
    min-spare-threads: 20

---
# application-dev.yml (开发环境)
spring:
  config:
    activate:
      on-profile: dev
  datasource:
    url: jdbc:mysql://localhost:3306/order?useSSL=false
  redis:
    host: localhost

---
# application-prod.yml (生产环境)
spring:
  config:
    activate:
      on-profile: prod
  datasource:
    url: jdbc:mysql://prod-master:3306/order?useSSL=true
    hikari:
      maximum-pool-size: 20       # 生产环境连接池调大
  redis:
    host: redis-prod-cluster
    timeout: 3000ms

# bootstrap.yml — 优先于application.yml加载
spring:
  cloud:
    nacos:
      config:
        server-addr: 192.168.1.100:8848
        namespace: prod           # 命名空间隔离环境
        group: DEFAULT_GROUP
        file-extension: yaml
        refresh-enabled: true     # 配置热更新
      discovery:
        server-addr: 192.168.1.100:8848

// 配置热更新：两种方式
@RefreshScope  // 方式一：注解标记，配置变化时Bean刷新
public class DynamicConfig {
    @Value("${order.timeout:5000}")
    private Integer orderTimeout;
}

// 方式二：@ConfigurationProperties 自动刷新（推荐）
@ConfigurationProperties(prefix = "order")
public class OrderProperties {
    private Integer timeout;
    private Integer retryCount;
}

# application.yml — Tomcat调优配置
server:
  tomcat:
    # 连接器线程池 —— 处理请求的工作线程
    max-threads: 200              # 默认200，按CPU核心数*2~4调整
    min-spare-threads: 20         # 最小空闲线程数
    max-connections: 10000        # 最大连接数，默认10000
    accept-count: 1000            # 等待队列长度
    connection-timeout: 5000      # 连接超时ms

    # HTTP压缩
    compression: on
    compression-min-response-size: 1024  # 超过1KB启用压缩

  # 优雅关闭 —— 生产环境必配
  shutdown: graceful

spring:
  lifecycle:
    timeout-per-shutdown-phase: 30s

// 代码方式配置
@Bean
public WebServerFactoryCustomizer<TomcatServletWebServerFactory> tomcatCustomizer() {
    return factory -> {
        factory.addConnectorCustomizers(connector -> {
            connector.setProperty("maxSwallowSize", "-1");      // 不限制吞数据大小
            connector.setProperty("relaxedQueryChars", "[]{}"); // URL特殊字符
        });
        factory.addContextCustomizers(context -> {
            context.setSessionTimeout(30, TimeUnit.MINUTES);
        });
    };
}

                           ┌─────────────────────┐
                           │      Nacos           │
                           │  注册中心+配置中心    │
                           └──────────┬──────────┘
                                      │
              ┌───────────────────────┼───────────────────────┐
              │  注册/发现             │  配置管理             │
              ▼                       ▼                       ▼
┌──────────────────────────────────────────────────────────────────────┐
│                        Spring Cloud Gateway                          │
│   路由转发  │  鉴权(Sentinel)  │  限流  │  跨域  │  请求日志         │
└──────┬───────────────────────────────────────────────────────────────┘
       │
       │  OpenFeign 调用
       ▼
┌──────────────────────────────────────────────────────────────────────┐
│                     微服务集群 (Service Cluster)                      │
│                                                                      │
│  ┌─────────┐  ┌─────────┐  ┌─────────┐  ┌─────────┐ ┌─────────┐   │
│  │ 用户服务│◄─┤ 订单服务│◄─┤ 库存服务│◄─┤ 支付服务│ │ 通知服务│   │
│  └────┬────┘  └────┬────┘  └────┬────┘  └────┬────┘ └────┬────┘   │
│       │            │            │            │          │          │
│       │            │  Seata AT  │            │          │          │
│       │            │ (分布式事务)│            │          │          │
│       └────────────┴────────────┴────────────┴──────────┘          │
│                                                                      │
│  同步调用: OpenFeign + Sentinel 熔断降级                              │
│  异步通信: RocketMQ (事务消息)                                       │
└──────────────────────────────────────────────────────────────────────┘

# application.yml 服务注册配置
spring:
  cloud:
    nacos:
      discovery:
        server-addr: 192.168.1.100:8848
        namespace: prod              # 环境隔离
        group: ORDER_GROUP           # 服务分组
        cluster-name: HZ             # 集群名（同城机房）
        weight: 1.0                  # 负载均衡权重
        ephemeral: true              # 临时实例（默认true）
        heart-beat-interval: 5000    # 心跳间隔ms

# Nacos中推送的配置 Data ID: order-service-prod.yaml
order:
  timeout: 3000
  auto-cancel-minutes: 30
  max-retry-count: 3

spring:
  datasource:
    url: jdbc:mysql://prod-db:3306/order?rewriteBatchedStatements=true

// 动态刷新配置
@Component
@RefreshScope
@ConfigurationProperties(prefix = "order")
public class OrderConfig {
    private Integer timeout;
    private Integer autoCancelMinutes;
    private Integer maxRetryCount;

    // getter/setter... 配置变更时自动注入新值
}

// 企业中最常用的Sentinel配置方式：注解 + Nacos持久化

// 1. 资源定义与流控
@Service
public class OrderService {

    @SentinelResource(
        value = "createOrder",
        blockHandler = "createOrderBlockHandler",    // 触发了流控 -> 走这里
        fallback = "createOrderFallback"              // 触发了熔断 -> 走这里
    )
    public OrderVO createOrder(OrderDTO orderDTO) {
        // 业务逻辑
        if (someCondition) {
            throw new RuntimeException("业务异常");
        }
        return doCreate(orderDTO);
    }

    // 流控降级 —— 返回友好的提示信息
    public OrderVO createOrderBlockHandler(OrderDTO orderDTO, BlockException ex) {
        log.warn("createOrder 被限流: {}", ex.getMessage());
        return OrderVO.failed("系统繁忙，请稍后重试");
    }

    // 熔断降级 —— 返回兜底数据
    public OrderVO createOrderFallback(OrderDTO orderDTO, Throwable t) {
        log.error("createOrder 熔断降级: {}", t.getMessage());
        return OrderVO.failed("服务异常，请稍后重试");
    }
}

// 2. 规则持久化到Nacos（避免重启丢失规则）
@Configuration
public class SentinelConfig {

    @PostConstruct
    public void initSentinelRules() {
        // 流控规则持久化
        ReadableDataSource<String, List<FlowRule>> flowRuleDataSource =
            new NacosDataSource<>(
                Arrays.asList("192.168.1.100:8848"),
                "DEFAULT_GROUP",
                "sentinel-flow-rules",
                source -> JSON.parseObject(source, new TypeReference<List<FlowRule>>() {})
            );
        FlowRuleManager.register2Property(flowRuleDataSource.getProperty());

        // 熔断规则持久化
        ReadableDataSource<String, List<DegradeRule>> degradeRuleDataSource =
            new NacosDataSource<>(
                Arrays.asList("192.168.1.100:8848"),
                "DEFAULT_GROUP",
                "sentinel-degrade-rules",
                source -> JSON.parseObject(source, new TypeReference<List<DegradeRule>>() {})
            );
        DegradeRuleManager.register2Property(degradeRuleDataSource.getProperty());
    }
}

# application.yml — 企业级Gateway配置
spring:
  cloud:
    gateway:
      routes:
        - id: order-service
          uri: lb://order-service           # 负载均衡
          predicates:
            - Path=/api/order/**            # 路径匹配
            - Header=X-Request-Source, mobile  # Header匹配
          filters:
            - StripPrefix=1                 # 去掉/api前缀
            - name: RequestRateLimiter      # 限流
              args:
                key-resolver: "#{@userKeyResolver}"
                redis-rate-limiter:
                  replenishRate: 100        # 每秒令牌数
                  burstCapacity: 200        # 令牌桶容量
            - name: Retry                   # 重试
              args:
                retries: 3
                statuses: BAD_GATEWAY
                methods: GET

        - id: user-service
          uri: lb://user-service
          predicates:
            - Path=/api/user/**

      # 全局过滤器配置
      default-filters:
        - AddResponseHeader=X-Response-Time, localtime
        - DedupeResponseHeader=Access-Control-Allow-Origin

// 全局鉴权过滤器 —— 企业必配
@Component
public class AuthGlobalFilter implements GlobalFilter, Ordered {

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        ServerHttpRequest request = exchange.getRequest();
        String path = request.getURI().getPath();

        // 白名单路径跳过鉴权
        List<String> whitelist = Arrays.asList("/api/user/login", "/api/user/register");
        if (whitelist.contains(path)) {
            return chain.filter(exchange);
        }

        // 从Header中提取Token
        String token = request.getHeaders().getFirst("Authorization");
        if (StringUtils.isBlank(token) || !token.startsWith("Bearer ")) {
            return unauthorized(exchange, "Missing token");
        }

        // 校验JWT（缓存校验结果减少重复解析）
        try {
            Claims claims = JwtUtil.parseToken(token.substring(7));
            // 将用户信息放入请求头，传递给下游服务
            ServerHttpRequest mutatedRequest = request.mutate()
                .header("X-User-Id", claims.get("userId").toString())
                .header("X-User-Name", URLEncoder.encode(claims.get("userName").toString(), "UTF-8"))
                .build();
            return chain.filter(exchange.mutate().request(mutatedRequest).build());
        } catch (Exception e) {
            return unauthorized(exchange, "Invalid token");
        }
    }

    @Override
    public int getOrder() {
        return -100;  // 高优先级
    }

    private Mono<Void> unauthorized(ServerWebExchange exchange, String msg) {
        exchange.getResponse().setStatusCode(HttpStatus.UNAUTHORIZED);
        return exchange.getResponse().writeWith(
            Mono.just(exchange.getResponse().bufferFactory()
                .wrap(("{\"code\":401,\"msg\":\"" + msg + "\"}").getBytes()))
        );
    }
}

// 企业级OpenFeign配置

// 1. FeignClient声明
@FeignClient(
    name = "inventory-service",
    path = "/api/inventory",
    configuration = InventoryFeignConfig.class,
    fallbackFactory = InventoryFallbackFactory.class   // 降级工厂
)
public interface InventoryFeignClient {

    @PostMapping("/deduct")
    Result<Void> deductStock(@Valid @RequestBody StockDeductDTO dto);

    @GetMapping("/query/{skuId}")
    Result<StockVO> queryStock(@PathVariable("skuId") Long skuId);
}

// 2. 统一降级处理 —— 返回兜底数据 + 记录日志
@Component
public class InventoryFallbackFactory implements FallbackFactory<InventoryFeignClient> {

    @Override
    public InventoryFeignClient create(Throwable cause) {
        log.error("inventory-service 调用失败: {}", cause.getMessage());
        return new InventoryFeignClient() {
            @Override
            public Result<Void> deductStock(StockDeductDTO dto) {
                return Result.error("库存服务不可用");
            }

            @Override
            public Result<StockVO> queryStock(Long skuId) {
                return Result.success(new StockVO(skuId, 0));  // 返回安全值
            }
        };
    }
}

// 3. 配置类 —— 超时/拦截器/重试
@Configuration
public class InventoryFeignConfig {

    @Bean
    public RequestInterceptor requestInterceptor() {
        return requestTemplate -> {
            // 传递TraceId用于链路追踪
            requestTemplate.header("X-Trace-Id", MDC.get("traceId"));
            // 传递认证信息
            requestTemplate.header("X-User-Id", UserContext.getUserId());
        };
    }

    @Bean
    public Retryer retryer() {
        return new Retryer.Default(100, 1000, 3);  // 100ms间隔, 最多3次
    }
}

# application.yml — Feign全局配置
spring:
  cloud:
    openfeign:
      client:
        config:
          default:
            connect-timeout: 5000       # 连接超时
            read-timeout: 10000         # 读取超时
            logger-level: BASIC         # BASIC/HEADERS/FULL
      compression:
        request:
          enabled: true
          mime-types: application/json
          min-request-size: 2048
        response:
          enabled: true

// AT模式 —— 最常用，对业务侵入最小
@GlobalTransactional(name = "create-order-tx", rollbackFor = Exception.class)
public OrderVO createOrder(OrderDTO orderDTO) {
    // 1. 创建订单（本地事务）
    orderMapper.insert(order);

    // 2. 扣减库存（远程调用：inventory-service）
    inventoryFeign.deductStock(new StockDeductDTO(order.getSkuId(), order.getCount()));

    // 3. 扣减账户余额（远程调用：account-service）
    accountFeign.deductBalance(new BalanceDeductDTO(order.getUserId(), order.getAmount()));

    // 任意一步失败，Seata自动回滚所有参与者
    return OrderVO.success(order);
}

AT模式执行流程
┌─────────┐     ┌─────────┐     ┌─────────┐
│  TM     │     │  TC     │     │  RM     │
│ (事务发起)│────▶│ (协调器)│────▶│ (资源管理)│
└────┬────┘     └─────────┘     └────┬────┘
     │                                │
     │ 1. 开启全局事务                  │
     │ 2. 注册分支事务                  │
     │ 3. 执行业务SQL                  │
     │    + 解析SQL生成UNDO_LOG        │
     │ 4. 提交/回滚                    │
     └────────────────────────────────┘

关键机制:
- 前置镜像: 在执行业务SQL前，记录修改前的数据快照
- UNDO_LOG表: 保存前后镜像，用于失败回滚
- 全局锁: 防止脏读脏写，事务结束后释放

// 1. 定义Mapper —— 继承BaseMapper即获得基础CRUD
@Mapper
public interface OrderMapper extends BaseMapper<Order> {
    // 无需写任何代码，自动拥有 insert/deleteById/updateById/selectById 等方法
}

// 2. 使用示例
@Service
public class OrderServiceImpl implements OrderService {

    @Autowired
    private OrderMapper orderMapper;

    public Order getById(Long id) {
        return orderMapper.selectById(id);   // 单表查询
    }

    public Page<Order> pageQuery(int page, int size) {
        Page<Order> pageObj = new Page<>(page, size);
        return orderMapper.selectPage(pageObj, null);
    }

    public boolean save(Order order) {
        // 自动填充 createTime, updateTime (配合 @TableField)
        return orderMapper.insert(order) > 0;
    }
}

// QueryWrapper —— 最常用，支持链式条件构建
public List<Order> queryOrders(Long userId, Integer status, String keyword) {
    LambdaQueryWrapper<Order> wrapper = Wrappers.<Order>lambdaQuery()
        .eq(Order::getUserId, userId)
        .eq(status != null, Order::getStatus, status)        // 条件判断
        .like(StringUtils.isNotBlank(keyword), Order::getOrderNo, keyword)  // 模糊查询
        .orderByDesc(Order::getCreateTime)
        .last("limit 10");

    return orderMapper.selectList(wrapper);
}

// UpdateWrapper —— 更新特定字段（避免全字段更新）
public void updateStatus(String orderNo, Integer status) {
    LambdaUpdateWrapper<Order> wrapper = Wrappers.<Order>lambdaUpdate()
        .set(Order::getStatus, status)
        .set(Order::getUpdateTime, new Date())
        .eq(Order::getOrderNo, orderNo);

    orderMapper.update(null, wrapper);
}

@Configuration
@MapperScan("com.company.*.mapper")
public class MyBatisPlusConfig {

    @Bean
    public MybatisPlusInterceptor mybatisPlusInterceptor() {
        MybatisPlusInterceptor interceptor = new MybatisPlusInterceptor();

        // 分页插件（必配）
        PaginationInnerInterceptor pagination = new PaginationInnerInterceptor(DbType.MYSQL);
        pagination.setMaxLimit(1000L);            // 单页最大条数保护
        pagination.setOverflow(true);             // 溢出后自动回到第一页
        interceptor.addInnerInterceptor(pagination);

        // 乐观锁插件（写操作需要用）
        interceptor.addInnerInterceptor(new OptimisticLockerInnerInterceptor());

        return interceptor;
    }
}

// 1. 逻辑删除 —— 企业标配，避免物理删除
@TableName("order")
public class Order {
    @TableId(type = IdType.ASSIGN_ID)          // 分布式ID
    private Long id;

    @TableLogic(value = "0", delval = "1")     // 逻辑删除
    private Integer deleted;

    @TableField(fill = FieldFill.INSERT)       // 自动填充
    private Date createTime;

    @TableField(fill = FieldFill.INSERT_UPDATE)
    private Date updateTime;
}

// 2. 自动填充处理器
@Component
public class MyMetaObjectHandler implements MetaObjectHandler {

    @Override
    public void insertFill(MetaObject metaObject) {
        this.strictInsertFill(metaObject, "createTime", Date.class, new Date());
        this.strictInsertFill(metaObject, "updateTime", Date.class, new Date());
        this.strictInsertFill(metaObject, "deleted", Integer.class, 0);
    }

    @Override
    public void updateFill(MetaObject metaObject) {
        this.strictUpdateFill(metaObject, "updateTime", Date.class, new Date());
    }
}

// XML映射文件 —— 复杂SQL建议写在XML中而非注解
@Mapper
public interface OrderExtMapper {
    // 统计某时间段内的销售排行
    List<SalesRankVO> getSalesRanking(@Param("startDate") String startDate,
                                       @Param("endDate") String endDate,
                                       @Param("limit") Integer limit);
}

<!-- OrderExtMapper.xml —— 企业级复杂SQL示例 -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
    "http://mybatis.org/dtd/mybatis-3-mapper.dtd">

<mapper namespace="com.company.order.mapper.OrderExtMapper">

    <!-- 基础结果映射 -->
    <resultMap id="OrderDetailMap" type="com.company.order.entity.OrderDetail">
        <id property="id" column="id"/>
        <result property="orderNo" column="order_no"/>
        <result property="totalAmount" column="total_amount"/>
        <association property="user" javaType="com.company.user.entity.User"
                     select="com.company.user.mapper.UserMapper.selectById"
                     column="user_id"/>
        <collection property="items" ofType="com.company.order.entity.OrderItem"
                    select="com.company.order.mapper.OrderItemMapper.selectByOrderId"
                    column="id"/>
    </resultMap>

    <!-- 动态SQL + 时间窗口统计 -->
    <select id="getSalesRanking" resultType="com.company.order.vo.SalesRankVO">
        SELECT
            oi.sku_id,
            sku_name,
            SUM(oi.quantity) AS total_sales,
            SUM(oi.amount) AS total_amount
        FROM order_item oi
        INNER JOIN `order` o ON oi.order_id = o.id
        <where>
            o.`status` = 2  <!-- 已支付状态 -->
            <if test="startDate != null and startDate != ''">
                AND o.pay_time >= #{startDate}
            </if>
            <if test="endDate != null and endDate != ''">
                AND o.pay_time <![CDATA[ <= ]]> #{endDate}
            </if>
            AND o.deleted = 0
        </where>
        GROUP BY oi.sku_id, sku_name
        ORDER BY total_sales DESC
        <if test="limit != null">
            LIMIT #{limit}
        </if>
    </select>

</mapper>

# application.yml —— ShardingSphere + MyBatis-Plus 分库分表配置
spring:
  shardingsphere:
    datasource:
      names: ds0, ds1
      ds0:
        type: com.zaxxer.hikari.HikariDataSource
        driver-class-name: com.mysql.cj.jdbc.Driver
        jdbc-url: jdbc:mysql://192.168.1.10:3306/order_0?useSSL=false
        username: root
        password: ${DB_PASSWORD}
      ds1:
        type: com.zaxxer.hikari.HikariDataSource
        driver-class-name: com.mysql.cj.jdbc.Driver
        jdbc-url: jdbc:mysql://192.168.1.11:3306/order_1?useSSL=false
        username: root
        password: ${DB_PASSWORD}

    rules:
      sharding:
        tables:
          order:
            actual-data-nodes: ds$->{0..1}.order_$->{0..3}
            database-strategy:
              standard:
                sharding-column: user_id
                sharding-algorithm-name: db_hash  # 按user_id分库
            table-strategy:
              standard:
                sharding-column: id
                sharding-algorithm-name: table_mod  # 按id取模分表
            key-generate-strategy:
              column: id
              key-generator-name: snowflake  # 雪花算法分布式ID

        sharding-algorithms:
          db_hash:
            type: HASH_MOD
            props:
              sharding-count: 2   # 2个库
          table_mod:
            type: MOD
            props:
              sharding-count: 4   # 每库4张表

        key-generators:
          snowflake:
            type: SNOWFLAKE  # 雪花算法


    props:
      sql-show: true           # 打印SQL（开发环境启用）
      check-table-metadata-enabled: true  # 检查表元数据一致性

# Gateway核心路由配置（已在2.4节展示基础配置）
# 这里补充企业常用的高级特性

spring:
  cloud:
    gateway:
      routes:
        - id: user-service
          uri: lb://user-service
          predicates:
            - Path=/api/user/**
            - Method=GET,POST,PUT,DELETE  # 允许的HTTP方法
            - Header=X-Request-ID, \d+    # Header匹配正则
            - Query=source, app.          # 查询参数匹配
            - RemoteAddr=192.168.1.0/24   # IP白名单
            - Weight=group1, 80           # 灰度权重
          filters:
            - name: CircuitBreaker        # 断路器
              args:
                name: userServiceCB
                fallbackUri: forward:/fallback/user
            - AddRequestHeader=X-Api-Version, v2
            - PrefixPath=/api/v2
            - name: SecureHeaders         # 安全头
              args:
                disable: x-frame-options

三层权限模型
┌─────────────────────────────────────────────────────┐
│                    用户 (User)                        │
│   ┌──────┴──────┐                                    │
│   │  admin      │  user1    user2    user3           │
│   └──────┬──────┘                                    │
│          │  多对多                                     │
│   ┌──────▼──────┐                                    │
│   │   角色 (Role)│                                    │
│   │  管理员 │ 运营 │ 客服 │ 财务                       │
│   └──────┬──────┘                                    │
│          │  多对多                                     │
│   ┌──────▼──────┐                                    │
│   │  权限 (Permission)                               │
│   │ 订单:查询 │ 订单:创建 │ 订单:退款 │ 用户:管理       │
│   └─────────────┘                                    │
└─────────────────────────────────────────────────────┘

# JWT = Header.Payload.Signature

# Header
{
  "alg": "RS256",           // 非对称加密
  "typ": "JWT"
}

# Payload
{
  "sub": "user123",         // 用户ID
  "userName": "张三",
  "roles": ["admin", "operator"],
  "permissions": ["order:create", "order:query", "order:refund"],
  "exp": 1750000000,        // 过期时间
  "iat": 1700000000,        // 签发时间
  "jti": "<uuid>"        // Token唯一ID（用于黑名单）
}

# Signature
RSASHA256(base64UrlEncode(header) + "." + base64UrlEncode(payload), privateKey)

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)   // 开启方法级别权限控制
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            // 1. 关闭CSRF（前后端分离）
            .csrf().disable()

            // 2. 无状态Session
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)

            // 3. 请求鉴权
            .authorizeRequests()
                .antMatchers("/api/user/login", "/api/user/register").permitAll()
                .antMatchers("/api/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()

            // 4. 异常处理
            .exceptionHandling()
                .authenticationEntryPoint((request, response, authException) -> {
                    response.setContentType("application/json;charset=UTF-8");
                    response.getWriter().write("{\"code\":401,\"msg\":\"未登录\"}");
                })
                .accessDeniedHandler((request, response, accessDeniedException) -> {
                    response.setContentType("application/json;charset=UTF-8");
                    response.getWriter().write("{\"code\":403,\"msg\":\"无权限\"}");
                })

            // 5. JWT过滤器
            .addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }

    @Bean
    public JwtAuthenticationFilter jwtAuthenticationFilter() {
        return new JwtAuthenticationFilter();
    }
}

// Sa-Token 极简API
@RestController
@RequestMapping("/api")
public class UserController {

    // 登录 —— 一行代码
    @PostMapping("/login")
    public Result<String> login(@RequestBody LoginDTO dto) {
        User user = userService.login(dto.getUsername(), dto.getPassword());
        StpUtil.login(user.getId());                // 登录，生成Token
        StpUtil.getSession().set("userInfo", user);  // Session中存用户信息
        return Result.success(StpUtil.getTokenValue());  // 返回Token
    }

    // 鉴权 —— 注解方式
    @SaCheckLogin                          // 必须登录
    @SaCheckRole("admin")                  // 必须admin角色
    @SaCheckPermission("order:delete")     // 必须有指定权限
    @PostMapping("/order/delete")
    public Result<Void> deleteOrder(Long orderId) {
        orderService.delete(orderId);
        return Result.success();
    }
}

// XXL-JOB 任务示例 —— 分片广播处理海量数据
@Component
public class BatchOrderHandler extends IJobHandler {

    @Override
    public ReturnT<String> execute(String param) throws Exception {
        // 获取分片信息
        int shardIndex = XxlJobHelper.getShardIndex();    // 当前分片序号 (0,1,2...)
        int shardTotal = XxlJobHelper.getShardTotal();    // 总分片数

        // 按分片查询待处理订单：当前节点只处理自己分片的数据
        List<Order> orders = orderMapper.selectPendingOrders(
            shardIndex, shardTotal, 1000
        );

        XxlJobHelper.log("当前节点: {}/{}，待处理订单: {}", shardIndex, shardTotal, orders.size());

        for (Order order : orders) {
            try {
                processOrder(order);
            } catch (Exception e) {
                XxlJobHelper.log("处理订单 {} 失败: {}", order.getOrderNo(), e.getMessage());
                // 记录失败，后续通过补偿任务处理
                orderMapper.insertFailedLog(order.getId(), e.getMessage());
            }
        }

        return ReturnT.SUCCESS;
    }
}

# xxl-job 执行器配置
xxl:
  job:
    admin:
      addresses: http://192.168.1.100:8080/xxl-job-admin
    executor:
      appname: order-job-executor
      ip:
      port: 9999
      logpath: /data/applogs/xxl-job/jobhandler
      logretentiondays: 30
    accessToken: ${ACCESS_TOKEN}

@Configuration
@EnableAsync    // 开启异步支持
public class AsyncConfig implements AsyncConfigurer {

    @Override
    @Bean("taskExecutor")
    public Executor getAsyncExecutor() {
        ThreadPoolTaskExecutor executor = new ThreadPoolTaskExecutor();

        // 核心参数 —— 需根据业务类型调整
        executor.setCorePoolSize(10);                // 核心线程数
        executor.setMaxPoolSize(50);                 // 最大线程数
        executor.setQueueCapacity(200);              // 等待队列
        executor.setKeepAliveSeconds(60);            // 空闲线程存活时间
        executor.setThreadNamePrefix("async-biz-");  // 线程名前缀

        // 拒绝策略 —— 企业推荐CallerRunsPolicy（由调用线程执行）
        executor.setRejectedExecutionHandler(new ThreadPoolExecutor.CallerRunsPolicy());

        // 优雅关闭
        executor.setWaitForTasksToCompleteOnShutdown(true);
        executor.setAwaitTerminationSeconds(30);

        executor.initialize();
        return executor;
    }

    @Override
    public AsyncUncaughtExceptionHandler getAsyncUncaughtExceptionHandler() {
        return (ex, method, params) -> {
            log.error("异步任务执行异常: {}#{}", method.getDeclaringClass().getSimpleName(),
                      method.getName(), ex);
            // 发送告警通知
            alertService.sendAlert("异步任务失败", method.getName(), ex.getMessage());
        };
    }
}

// 使用示例
@Service
public class OrderServiceImpl implements OrderService {

    @Async("taskExecutor")  // 指定线程池
    @Override
    public CompletableFuture<Void> asyncProcessAfterPay(Order order) {
        // 异步执行：发送短信、更新统计、推送消息......失败不影响主流程
        smsService.sendPaySuccessSms(order.getPhone(), order.getOrderNo());
        statisticsService.updateSalesStatistic(order);
        pushService.sendPaySuccessPush(order.getUserId(), order.getOrderNo());
        return CompletableFuture.completedFuture(null);
    }
}

读流程：
1. 查询缓存 -> 命中直接返回
2. 未命中 -> 查询数据库 -> 写入缓存 -> 返回

写流程（延迟双删）：
1. 删除缓存
2. 更新数据库
3. 延迟500ms再次删除缓存（应对并发读写）

最终一致性（Canal方案）：
1. Canal监听MySQL binlog变更
2. 解析变更数据
3. 发送MQ消息
4. 消费者更新Redis缓存

XXL-JOB通信模型 (调度中心 => 执行器)

调度中心 (xxl-job-admin)
    │
    │  触发调度 ├── 注册回调接口 (Post请求)
    │
    ▼
执行器 (xxl-job-executor)
    │
    │  接收调度 ├── 启动任务线程
    │  执行日志 ├── 写入日志文件
    │  回调结果 ├── Post请求通知调度中心
    │
    ▼
调度中心更新任务状态

核心机制:
- 调度中心和执行器解耦，调度中心不持有执行器连接
- 回调机制是推模式（执行器主动回调），避免调度中心轮询
- 内置分布式锁防止同一任务被多次调度
- 调度失败会触发故障转移，选择另一台执行器重试