delete from table where id=?

delete from table where id=? and user_id = userId

@Retention(RetentionPolicy.RUNTIME)
@Target({ElementType.TYPE, ElementType.METHOD})
@Documented
public @interface ApiSecurity {

    @Alias("isSign")
    boolean value() default true;

    /**
     * 是否加簽驗(yàn)證，默認(rèn)開(kāi)啟
     * @return
     */
    @Alias("value")
    boolean isSign() default true;

    /**
     * 接口請(qǐng)求參數(shù)是否需要解密
     * @return
     */
    boolean decryptRequest() default false;

    /**
     * 接口響應(yīng)參數(shù)是否需要加密
     * @return
     */
    boolean encryptResponse() default false;
}

@PostMapping("/security")
    @ApiSecurity(encryptResponse = true, decryptRequest = true)
    public User testApiSecurity(@RequestBody User user) {
        System.out.println(user);
        return user;
    }

@Data
public class ApiSecurityParam {

    /**
     * 應(yīng)用id
     */
    private String appId;

    /**
     * RSA加密后的aes秘鑰，需解密
     */
    private String key;

    /**
     * AES加密的json參數(shù)
     */
    private String data;

    /**
     * 簽名
     */
    private String sign;

    /**
     * 時(shí)間戳
     */
    private String timestamp;

    /**
     * 請(qǐng)求唯一標(biāo)識(shí)
     */
    private String nonce;

}

public class RequestBodyWrapper extends HttpServletRequestWrapper {

    //用于將流保存下來(lái)
    private String body;

    public RequestBodyWrapper(HttpServletRequest request) throws IOException {
        super(request);
        body = new String(StreamUtils.copyToByteArray(request.getInputStream()), StandardCharsets.UTF_8);
    }

    /**
     * 重寫(xiě)getInputStream， 從body中獲取請(qǐng)求參數(shù)
     * @return
     * @throws IOException
     */
    @Override
    public ServletInputStream getInputStream() throws IOException {
        final ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(body.getBytes("UTF-8"));
        ServletInputStream servletInputStream = new ServletInputStream() {
            @Override
            public boolean isFinished() {
                return false;
            }

            @Override
            public boolean isReady() {
                return false;
            }

            @Override
            public void setReadListener(ReadListener readListener) {

            }

            @Override
            public int read() throws IOException {
                return byteArrayInputStream.read();
            }
        };
        return servletInputStream;
    }

    @Override
    public BufferedReader getReader() throws IOException {
        return new BufferedReader(new InputStreamReader(getInputStream()));
    }

    public String getBody() {
        return this.body;
    }

    public void setBody(String body) {
        this.body = body;
    }
}

@Slf4j
public class BodyTransferFilter implements Filter {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        RequestBodyWrapper requestBodyWrapper = null;
        try {
            HttpServletRequest req = (HttpServletRequest)request;
            requestBodyWrapper = new RequestBodyWrapper(req);

        }catch (Exception e){
            log.warn("requestBodyWrapper Error:", e);
        }
        chain.doFilter((Objects.isNull(requestBodyWrapper) ? request : requestBodyWrapper), response);
    }
}

@Aspect
@Slf4j
@Order(value = OrderConstant.AOP_API_DECRYPT)
public class ApiSecurityAspect {
    @Resource
    private ApiSecurityProperties apiSecurityProperties;
    @Resource
    private StringRedisTemplate stringRedisTemplate;

    private static final String NONCE_KEY = "x-nonce-";

    @Pointcut("execution(* com.plasticene..controller..*(..)) && " +
            "(@annotation(com.plasticene.boot.web.core.anno.ApiSecurity) ||" +
            " @target(com.plasticene.boot.web.core.anno.ApiSecurity))")
    public void securityPointcut(){}

    @Around("securityPointcut()")
    public Object aroundApiSecurity(ProceedingJoinPoint joinPoint) throws Throwable {
        //=======AOP解密切面通知=======
        ApiSecurity apiSecurity = getApiSecurity(joinPoint);
        boolean isSign = apiSecurity.isSign();
        boolean decryptRequest = apiSecurity.decryptRequest();
        // 獲取request加密傳遞的參數(shù)
        HttpServletRequest request = getRequest();
        // 只能針對(duì)post接口的請(qǐng)求參數(shù)requestBody進(jìn)行統(tǒng)一加解密和加簽，這是規(guī)定
        if (!Objects.equals("POST", request.getMethod())) {
            throw new BizException("只能POST接口才能加密加簽操作");
        }
        // 獲取controller接口方法定義的參數(shù)
        Object[] args = joinPoint.getArgs();
        Object[] newArgs = args;
        ApiSecurityParam apiSecurityParam = new ApiSecurityParam();
        // 請(qǐng)求參數(shù)解密
        if (decryptRequest) {
            // 不支持多個(gè)請(qǐng)求，因?yàn)榻饷苷?qǐng)求參數(shù)之后會(huì)json字符串，再根據(jù)請(qǐng)求參數(shù)的類(lèi)型映射過(guò)去，如果有多個(gè)參數(shù)就不知道映射關(guān)系了
            if (args.length > 1) {
                throw new BizException("加密接口方法只支持一個(gè)參數(shù)，請(qǐng)修改");
            }
            // args.length=0沒(méi)有請(qǐng)求參數(shù)，就說(shuō)明沒(méi)必要解密，因?yàn)榻涌趬焊唤邮諈?shù)，即使使用者無(wú)腦開(kāi)啟的該接口的參數(shù)加密，這里不做任何邏輯即可
            if (args.length == 1) {
                RequestBodyWrapper requestBodyWrapper;
                if (request instanceof RequestBodyWrapper) {
                    requestBodyWrapper = (RequestBodyWrapper) request;
                } else {
                    requestBodyWrapper = new RequestBodyWrapper(request);
                }
                String body = requestBodyWrapper.getBody();
                apiSecurityParam = JSONObject.parseObject(body, ApiSecurityParam.class);
                // 通過(guò)RSA私鑰解密獲取到aes秘鑰
                String aesKey = RSAUtil.decryptByPrivateKey(apiSecurityParam.getKey(), apiSecurityProperties.getRsaPrivateKey());
                // 通過(guò)aes秘鑰解密data參數(shù)數(shù)據(jù)
                String data = AESUtil.decrypt(apiSecurityParam.getData(), aesKey);
                //獲取接口入?yún)⒌念?lèi)
                Class<?> c = args[0].getClass();
                //將獲取解密后的真實(shí)參數(shù)，封裝到接口入?yún)⒌念?lèi)中
                Object o = JSONObject.parseObject(data, c);
                newArgs = new Object[]{o};
            }
        }
        // 驗(yàn)簽
        if (isSign) {
            verifySign(request, newArgs.length == 0 ? null : newArgs[0], apiSecurityParam);
        }
        return joinPoint.proceed(newArgs);
    }

    void verifySign(HttpServletRequest request, Object o, ApiSecurityParam apiSecurityParam) {
        // 如果請(qǐng)求參數(shù)是加密傳輸?shù)模蔷拖葟腁piSecurityParam獲取簽名和時(shí)間戳等等。
        // 如果請(qǐng)求參數(shù)不是加密傳輸?shù)模敲碅piSecurityParam的字段取值都為null，這時(shí)候在請(qǐng)求的header里面獲取參數(shù)信息
        String sign = apiSecurityParam.getSign();
        if (StringUtils.isBlank(sign)) {
            sign = request.getHeader("X-Sign");
        }
        if (StringUtils.isBlank(sign)) {
            throw new BizException("簽名不能為空");
        }

        String nonce = apiSecurityParam.getNonce();
        if (StringUtils.isBlank(nonce)) {
            nonce = request.getHeader("X-Nonce");
        }
        if (StringUtils.isBlank(nonce)) {
            throw new BizException("唯一標(biāo)識(shí)不能為空");
        }

        String timestamp = apiSecurityParam.getTimestamp();
        Long t;
        if (StringUtils.isBlank(timestamp)) {
            timestamp = request.getHeader("X-Timestamp");
        }
        if (StringUtils.isBlank(timestamp)) {
            throw new BizException("時(shí)間戳不能為空");
        } else {
            try {
                t = Long.valueOf(timestamp);
            } catch (Exception e) {
                throw new BizException("非法的時(shí)間戳");
            }
        }

        // 判斷timestamp時(shí)間戳與當(dāng)前時(shí)間是否超過(guò)簽名有效時(shí)長(zhǎng)（過(guò)期時(shí)間根據(jù)業(yè)務(wù)情況進(jìn)行配置）,如果超過(guò)了就提示簽名過(guò)期
        long now = System.currentTimeMillis() / 1000;
        if (now - t > apiSecurityProperties.getValidTime()) {
            throw new BizException("簽名已過(guò)期");
        }

        // 判斷nonce
        boolean nonceExists = stringRedisTemplate.hasKey(NONCE_KEY + nonce);
        if (nonceExists) {
            //請(qǐng)求重復(fù)
            throw new BizException("唯一標(biāo)識(shí)nonce已存在");
        }

        // 驗(yàn)簽
        SortedMap sortedMap = SignUtil.beanToMap(o);
        String content = SignUtil.getContent(sortedMap, nonce, timestamp);
        boolean flag = RSAUtil.verifySignByPublicKey(content, sign, apiSecurityProperties.getRsaPublicKey());
        if (!flag) {
            throw new BizException("簽名驗(yàn)證不通過(guò)");
        }

        stringRedisTemplate.opsForValue().set(NONCE_KEY+ nonce, "1", apiSecurityProperties.getValidTime(),
                TimeUnit.SECONDS);
    }


    private HttpServletRequest getRequest() {
        ServletRequestAttributes requestAttributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
        HttpServletRequest request = requestAttributes.getRequest();
        return request;
    }


    private ApiSecurity getApiSecurity(JoinPoint joinPoint) {
        MethodSignature methodSignature = (MethodSignature) joinPoint.getSignature();
        Method method = methodSignature.getMethod();
        ApiSecurity apiSecurity = method.getAnnotation(ApiSecurity.class);
        if (Objects.isNull(apiSecurity)) {
            apiSecurity = method.getDeclaringClass().getAnnotation(ApiSecurity.class);
        }
        return apiSecurity;
    }
}

@RestControllerAdvice
@Slf4j
public class ResponseResultBodyAdvice implements ResponseBodyAdvice<Object> {
    @Resource
    private ObjectMapper objectMapper;
    @Resource
    private ApiSecurityProperties apiSecurityProperties;


    /**
     * 判斷類(lèi)或者方法是否使用了 @ResponseResultBody
     */
    @Override
    public boolean supports(MethodParameter returnType, Class<? extends HttpMessageConverter<?>> converterType) {
        return AnnotatedElementUtils.hasAnnotation(returnType.getContainingClass(), ResponseResultBody.class)
                || returnType.hasMethodAnnotation(ResponseResultBody.class)
                || AnnotatedElementUtils.hasAnnotation(returnType.getContainingClass(), ApiSecurity.class)
                || returnType.hasMethodAnnotation(ApiSecurity.class);
    }

    /**
     * 當(dāng)類(lèi)或者方法使用了 @ResponseResultBody 就會(huì)調(diào)用這個(gè)方法
     * 如果返回類(lèi)型是string，那么springmvc是直接返回的，此時(shí)需要手動(dòng)轉(zhuǎn)化為json
     * 因?yàn)楫?dāng)body都為null時(shí)，下面的非加密下的if判斷參數(shù)類(lèi)型的條件都不滿足，如果接口返回類(lèi)似為String，
     * 會(huì)報(bào)錯(cuò)com.shepherd.fast.global.ResponseVO cannot be cast to java.lang.String
     */
    @SneakyThrows
    @Override
    public Object beforeBodyWrite(Object body, MethodParameter returnType, MediaType selectedContentType, Class<? extends HttpMessageConverter<?>> selectedConverterType, ServerHttpRequest request, ServerHttpResponse response) {
        Method method = returnType.getMethod();
        Class<?> returnClass = method.getReturnType();
        Boolean enable = apiSecurityProperties.getEnable();
        ApiSecurity apiSecurity = method.getAnnotation(ApiSecurity.class);
        if (Objects.isNull(apiSecurity)) {
            apiSecurity = method.getDeclaringClass().getAnnotation(ApiSecurity.class);
        }
        if (enable && Objects.nonNull(apiSecurity) && apiSecurity.encryptResponse() && Objects.nonNull(body)) {
            // 只需要加密返回data數(shù)據(jù)內(nèi)容
            if (body instanceof ResponseVO) {
                body = ((ResponseVO) body).getData();
            }
            JSONObject jsonObject = encryptResponse(body);
            body = jsonObject;
        } else {
            if (body instanceof String || Objects.equals(returnClass, String.class)) {
                String value = objectMapper.writeValueAsString(ResponseVO.success(body));
                return value;
            }
            // 防止重復(fù)包裹的問(wèn)題出現(xiàn)
            if (body instanceof ResponseVO) {
                return body;
            }
        }
        return ResponseVO.success(body);
    }

    JSONObject encryptResponse(Object result) {
        String aseKey = AESUtil.generateAESKey();
        String content = JSONObject.toJSONString(result);
        String data = AESUtil.encrypt(content, aseKey);
        String key = RSAUtil.encryptByPublicKey(aseKey, apiSecurityProperties.getRsaPublicKey());
        JSONObject jsonObject = new JSONObject();
        jsonObject.put("key", key);
        jsonObject.put("data", data);
        return jsonObject;
    }

}