自定义参数解析器

public interface HandlerMethodArgumentResolver {

    // 判断本解析器是否支持该参数
    boolean supportsParameter(MethodParameter parameter);

    // 从请求中解析并返回参数值
    Object resolveArgument(MethodParameter parameter, 
                           ModelAndViewContainer mavContainer,
                           NativeWebRequest webRequest, 
                           WebDataBinderFactory binderFactory) throws Exception;
}

@Target(ElementType.PARAMETER)
@Retention(RetentionPolicy.RUNTIME)
public @interface LoginUser {
    // 标记该参数需要从 JWT 解析当前登录用户
}

public class CurrentUser {
    private Long userId;
    private String username;
    private String email;
    private List<String> roles;
    private Long tenantId;  // 租户ID，用于多租户隔离
    
    // constructors, getters, setters...
    
    public boolean hasRole(String role) {
        return roles != null && roles.contains(role);
    }
}

@Component
public class CurrentUserArgumentResolver implements HandlerMethodArgumentResolver {

    @Autowired
    private JwtTokenProvider jwtTokenProvider;
    
    @Autowired
    private UserCacheService userCacheService;

    /**
     * 判断本解析器是否支持该参数：
     * 1. 参数类型是 CurrentUser
     * 2. 且带有 @LoginUser 注解
     */
    @Override
    public boolean supportsParameter(MethodParameter parameter) {
        return parameter.getParameterType().equals(CurrentUser.class)
            && parameter.hasParameterAnnotation(LoginUser.class);
    }

    /**
     * 从请求中解析 JWT，组装 CurrentUser 对象
     */
    @Override
    public Object resolveArgument(MethodParameter parameter,
                                  ModelAndViewContainer mavContainer,
                                  NativeWebRequest webRequest,
                                  WebDataBinderFactory binderFactory) throws Exception {
        
        // 1. 从请求头获取 Authorization
        String authHeader = webRequest.getHeader("Authorization");
        if (authHeader == null || !authHeader.startsWith("Bearer ")) {
            throw new UnauthorizedException("缺少有效的认证信息");
        }
        
        String token = authHeader.substring(7);
        
        // 2. 解析 JWT（验证签名、检查过期时间）
        Claims claims;
        try {
            claims = jwtTokenProvider.parseToken(token);
        } catch (ExpiredJwtException e) {
            throw new UnauthorizedException("登录已过期，请重新登录");
        } catch (JwtException e) {
            throw new UnauthorizedException("无效的认证令牌");
        }
        
        Long userId = claims.get("userId", Long.class);
        
        // 3. 从缓存获取用户详细信息（避免每次请求都查数据库）
        CurrentUser user = userCacheService.getCurrentUser(userId);
        if (user == null) {
            throw new UnauthorizedException("用户不存在或已被禁用");
        }
        
        // 4. 可选：从其他请求头补充租户信息
        String tenantHeader = webRequest.getHeader("X-Tenant-Id");
        if (tenantHeader != null) {
            try {
                user.setTenantId(Long.valueOf(tenantHeader));
            } catch (NumberFormatException e) {
                // 租户ID格式错误，使用JWT中的默认租户
            }
        }
        
        return user;
    }
}

@Configuration
public class WebConfig implements WebMvcConfigurer {

    @Autowired
    private CurrentUserArgumentResolver currentUserArgumentResolver;

    @Override
    public void addArgumentResolvers(List<HandlerMethodArgumentResolver> resolvers) {
        // 添加到自定义解析器列表，排在内置解析器之前
        resolvers.add(currentUserArgumentResolver);
    }
}

@RestController
@RequestMapping("/api/projects")
public class ProjectController {

    @Autowired
    private ProjectService projectService;

    // 无需手动解析 JWT，直接声明 @LoginUser CurrentUser
    @GetMapping
    public List<Project> listProjects(@LoginUser CurrentUser user) {
        // user 已经包含 userId、username、roles、tenantId
        // 自动完成 JWT 解析、用户查询、租户隔离
        return projectService.findByTenantId(user.getTenantId());
    }

    @PostMapping
    public Project createProject(@LoginUser CurrentUser user,
                                 @RequestBody ProjectCreateRequest request) {
        // 自动校验权限
        if (!user.hasRole("PROJECT_MANAGER")) {
            throw new ForbiddenException("需要项目经理权限");
        }
        return projectService.create(user.getTenantId(), request);
    }

    @DeleteMapping("/{id}")
    public void deleteProject(@LoginUser CurrentUser user,
                              @PathVariable Long id) {
        // 自动注入当前用户，无需重复写解析逻辑
        projectService.delete(user.getTenantId(), id, user.getUserId());
    }
}

@Component
public class ResultWrapperReturnValueHandler implements HandlerMethodReturnValueHandler {

    // 判断本处理器是否支持该返回值类型
    @Override
    public boolean supportsReturnType(MethodParameter returnType) {
        // 只处理非 Result 类型的返回值（避免重复包装）
        return !Result.class.isAssignableFrom(returnType.getParameterType());
    }

    @Override
    public void handleReturnValue(Object returnValue,
                                  MethodParameter returnType,
                                  ModelAndViewContainer mavContainer,
                                  NativeWebRequest webRequest) throws Exception {
        
        // 将返回值包装为 Result
        Result<Object> result;
        if (returnValue == null) {
            result = Result.success(null);
        } else {
            result = Result.success(returnValue);
        }
        
        // 使用内置的消息转换器写出
        mavContainer.setRequestHandled(true);
        HttpServletResponse response = webRequest.getNativeResponse(HttpServletResponse.class);
        response.setContentType(MediaType.APPLICATION_JSON_VALUE);
        
        // 实际项目中应注入 ObjectMapper
        // new ObjectMapper().writeValue(response.getOutputStream(), result);
    }
}

@Configuration
public class WebConfig implements WebMvcConfigurer {

    @Autowired
    private ResultWrapperReturnValueHandler resultWrapperHandler;

    @Override
    public void addReturnValueHandlers(List<HandlerMethodReturnValueHandler> handlers) {
        // 返回值处理器也有优先级，添加到列表中
        handlers.add(resultWrapperHandler);
    }
}

@Override
public boolean supportsParameter(MethodParameter parameter) {
    // 危险：所有名为 "user" 的参数都被拦截
    return "user".equals(parameter.getParameterName());
}

@Override
public boolean supportsParameter(MethodParameter parameter) {
    return parameter.getParameterType().equals(CurrentUser.class)
        && parameter.hasParameterAnnotation(LoginUser.class);
}

@Override
public Object resolveArgument(...) {
    // 先检查请求属性中是否已解析
    CurrentUser cached = (CurrentUser) webRequest.getAttribute(
        "CURRENT_USER", RequestAttributes.SCOPE_REQUEST);
    if (cached != null) {
        return cached;
    }
    
    // 解析并缓存到请求属性
    CurrentUser user = doResolve(webRequest);
    webRequest.setAttribute("CURRENT_USER", user, RequestAttributes.SCOPE_REQUEST);
    return user;
}