java 与Spring Security整合用的关于审计日志记录的Filter

import com.fasterxml.jackson.annotation.JsonFormat;
import io.swagger.annotations.ApiModel;
import io.swagger.annotations.ApiModelProperty;
import java.util.Date;

@ApiModel("系统日志（一般用在列表中）")
public class LogEntity {
    /**
     *
     * This field was generated by MyBatis Generator.
     * This field corresponds to the database column audit_log.id
     *
     * @mbg.generated
     */
    @ApiModelProperty("主键 ID")
    private String id;

    /**
     *
     * This field was generated by MyBatis Generator.
     * This field corresponds to the database column audit_log.event_id
     *
     * @mbg.generated
     */
    @ApiModelProperty("事件唯一ID")
    private String eventId;

    /**
     *
     * This field was generated by MyBatis Generator.
     * This field corresponds to the database column audit_log.thread_id
     *
     * @mbg.generated
     */
    @ApiModelProperty("操作会话ID")
    private String threadId;

    /**
     *
     * This field was generated by MyBatis Generator.
     * This field corresponds to the database column audit_log.operation_time
     *
     * @mbg.generated
     */
    @ApiModelProperty("操作时间")
    @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss", timezone = "GMT+8")
    private Date operationTime;

    /**
     *
     * This field was generated by MyBatis Generator.
     * This field corresponds to the database column audit_log.operator_username
     *
     * @mbg.generated
     */
    @ApiModelProperty("操作账号")
    private String operatorUsername;

    /**
     *
     * This field was generated by MyBatis Generator.
     * This field corresponds to the database column audit_log.operator_real_name
     *
     * @mbg.generated
     */
    @ApiModelProperty("操作人")
    private String operatorRealName;

    /**
     *
     * This field was generated by MyBatis Generator.
     * This field corresponds to the database column audit_log.category
     *
     * @mbg.generated
     */
    @ApiModelProperty("操作类型")
    private String category;

    /**
     *
     * This field was generated by MyBatis Generator.
     * This field corresponds to the database column audit_log.target
     *
     * @mbg.generated
     */
    @ApiModelProperty("操作目标")
    private String target;

    /**
     *
     * This field was generated by MyBatis Generator.
     * This field corresponds to the database column audit_log.in_params
     *
     * @mbg.generated
     */
    @ApiModelProperty("操作入参")
    private String inParams;

    /**
     *
     * This field was generated by MyBatis Generator.
     * This field corresponds to the database column audit_log.out_params
     *
     * @mbg.generated
     */
    @ApiModelProperty("操作出参")
    private String outParams;

    /**
     *
     * This field was generated by MyBatis Generator.
     * This field corresponds to the database column audit_log.outcome
     *
     * @mbg.generated
     */
    private Integer outcome;

    /**
     *
     * This field was generated by MyBatis Generator.
     * This field corresponds to the database column audit_log.operator_perm
     *
     * @mbg.generated
     */
    private String operatorPerm;

    /**
     *
     * This field was generated by MyBatis Generator.
     * This field corresponds to the database column audit_log.description
     *
     * @mbg.generated
     */
    @ApiModelProperty("操作描述")
    private String description;

    /**
     *
     * This field was generated by MyBatis Generator.
     * This field corresponds to the database column audit_log.source_ip
     *
     * @mbg.generated
     */
    private String sourceIp;

    /**
     * This method was generated by MyBatis Generator.
     * This method returns the value of the database column audit_log.id
     *
     * @return the value of audit_log.id
     *
     * @mbg.generated
     */
    public String getId() {
        return id;
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method sets the value of the database column audit_log.id
     *
     * @param id the value for audit_log.id
     *
     * @mbg.generated
     */
    public void setId(String id) {
        this.id = id;
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method returns the value of the database column audit_log.event_id
     *
     * @return the value of audit_log.event_id
     *
     * @mbg.generated
     */
    public String getEventId() {
        return eventId;
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method sets the value of the database column audit_log.event_id
     *
     * @param eventId the value for audit_log.event_id
     *
     * @mbg.generated
     */
    public void setEventId(String eventId) {
        this.eventId = eventId == null ? null : eventId.trim();
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method returns the value of the database column audit_log.thread_id
     *
     * @return the value of audit_log.thread_id
     *
     * @mbg.generated
     */
    public String getThreadId() {
        return threadId;
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method sets the value of the database column audit_log.thread_id
     *
     * @param threadId the value for audit_log.thread_id
     *
     * @mbg.generated
     */
    public void setThreadId(String threadId) {
        this.threadId = threadId == null ? null : threadId.trim();
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method returns the value of the database column audit_log.operation_time
     *
     * @return the value of audit_log.operation_time
     *
     * @mbg.generated
     */
    public Date getOperationTime() {
        return operationTime;
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method sets the value of the database column audit_log.operation_time
     *
     * @param operationTime the value for audit_log.operation_time
     *
     * @mbg.generated
     */
    public void setOperationTime(Date operationTime) {
        this.operationTime = operationTime;
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method returns the value of the database column audit_log.operator_username
     *
     * @return the value of audit_log.operator_username
     *
     * @mbg.generated
     */
    public String getOperatorUsername() {
        return operatorUsername;
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method sets the value of the database column audit_log.operator_username
     *
     * @param operatorUsername the value for audit_log.operator_username
     *
     * @mbg.generated
     */
    public void setOperatorUsername(String operatorUsername) {
        this.operatorUsername = operatorUsername == null ? null : operatorUsername.trim();
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method returns the value of the database column audit_log.operator_real_name
     *
     * @return the value of audit_log.operator_real_name
     *
     * @mbg.generated
     */
    public String getOperatorRealName() {
        return operatorRealName;
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method sets the value of the database column audit_log.operator_real_name
     *
     * @param operatorRealName the value for audit_log.operator_real_name
     *
     * @mbg.generated
     */
    public void setOperatorRealName(String operatorRealName) {
        this.operatorRealName = operatorRealName == null ? null : operatorRealName.trim();
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method returns the value of the database column audit_log.category
     *
     * @return the value of audit_log.category
     *
     * @mbg.generated
     */
    public String getCategory() {
        return category;
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method sets the value of the database column audit_log.category
     *
     * @param category the value for audit_log.category
     *
     * @mbg.generated
     */
    public void setCategory(String category) {
        this.category = category == null ? null : category.trim();
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method returns the value of the database column audit_log.target
     *
     * @return the value of audit_log.target
     *
     * @mbg.generated
     */
    public String getTarget() {
        return target;
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method sets the value of the database column audit_log.target
     *
     * @param target the value for audit_log.target
     *
     * @mbg.generated
     */
    public void setTarget(String target) {
        this.target = target == null ? null : target.trim();
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method returns the value of the database column audit_log.in_params
     *
     * @return the value of audit_log.in_params
     *
     * @mbg.generated
     */
    public String getInParams() {
        return inParams;
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method sets the value of the database column audit_log.in_params
     *
     * @param inParams the value for audit_log.in_params
     *
     * @mbg.generated
     */
    public void setInParams(String inParams) {
        this.inParams = inParams == null ? null : inParams.trim();
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method returns the value of the database column audit_log.out_params
     *
     * @return the value of audit_log.out_params
     *
     * @mbg.generated
     */
    public String getOutParams() {
        return outParams;
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method sets the value of the database column audit_log.out_params
     *
     * @param outParams the value for audit_log.out_params
     *
     * @mbg.generated
     */
    public void setOutParams(String outParams) {
        this.outParams = outParams == null ? null : outParams.trim();
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method returns the value of the database column audit_log.outcome
     *
     * @return the value of audit_log.outcome
     *
     * @mbg.generated
     */
    public Integer getOutcome() {
        return outcome;
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method sets the value of the database column audit_log.outcome
     *
     * @param outcome the value for audit_log.outcome
     *
     * @mbg.generated
     */
    public void setOutcome(Integer outcome) {
        this.outcome = outcome;
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method returns the value of the database column audit_log.operator_perm
     *
     * @return the value of audit_log.operator_perm
     *
     * @mbg.generated
     */
    public String getOperatorPerm() {
        return operatorPerm;
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method sets the value of the database column audit_log.operator_perm
     *
     * @param operatorPerm the value for audit_log.operator_perm
     *
     * @mbg.generated
     */
    public void setOperatorPerm(String operatorPerm) {
        this.operatorPerm = operatorPerm == null ? null : operatorPerm.trim();
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method returns the value of the database column audit_log.description
     *
     * @return the value of audit_log.description
     *
     * @mbg.generated
     */
    public String getDescription() {
        return description;
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method sets the value of the database column audit_log.description
     *
     * @param description the value for audit_log.description
     *
     * @mbg.generated
     */
    public void setDescription(String description) {
        this.description = description == null ? null : description.trim();
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method returns the value of the database column audit_log.source_ip
     *
     * @return the value of audit_log.source_ip
     *
     * @mbg.generated
     */
    public String getSourceIp() {
        return sourceIp;
    }

    /**
     * This method was generated by MyBatis Generator.
     * This method sets the value of the database column audit_log.source_ip
     *
     * @param sourceIp the value for audit_log.source_ip
     *
     * @mbg.generated
     */
    public void setSourceIp(String sourceIp) {
        this.sourceIp = sourceIp == null ? null : sourceIp.trim();
    }
}

import com.dimpt.common.log.command.SearchLogCommand;
import com.dimpt.common.log.entity.LogEntity;
import org.apache.ibatis.annotations.Param;
import org.springframework.stereotype.Repository;
import java.util.List;

@Repository
public interface LogRepository {
    /**
     * This method was generated by MyBatis Generator.
     * This method corresponds to the database table audit_log
     *
     * @mbg.generated
     */
    int deleteByPrimaryKey(Long id);

    /**
     * This method was generated by MyBatis Generator.
     * This method corresponds to the database table audit_log
     *
     * @mbg.generated
     */
    int insert(LogEntity record);

    /**
     * This method was generated by MyBatis Generator.
     * This method corresponds to the database table audit_log
     *
     * @mbg.generated
     */
    LogEntity selectByPrimaryKey(Long id);

    /**
     * This method was generated by MyBatis Generator.
     * This method corresponds to the database table audit_log
     *
     * @mbg.generated
     */
    List<LogEntity> selectAll();

    /**
     * This method was generated by MyBatis Generator.
     * This method corresponds to the database table audit_log
     *
     * @mbg.generated
     */
    int updateByPrimaryKey(LogEntity record);

    List<LogEntity> selectIf(@Param("query") SearchLogCommand query);

    LogEntity selectByEventId(String eventId);
}

import com.dimpt.common.log.application.OperationOutcome;
import com.dimpt.common.log.command.SearchLogCommand;
import com.dimpt.common.log.entity.LogEntity;
import com.dimpt.common.log.repository.LogRepository;
import com.github.pagehelper.PageHelper;
import com.github.pagehelper.PageInfo;
import org.apache.commons.lang3.EnumUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;

@Service
public class LogService {

    @Autowired
    private LogRepository auditLogRepository;

    public boolean insertAuditLog(LogEntity auditLog)
    {
        return auditLogRepository.insert(auditLog)>0;
    }

    public PageInfo<LogEntity> listAuditLogs(SearchLogCommand command, int page, int limit)
    {
        PageHelper.startPage(page,limit);
        List<LogEntity> list= auditLogRepository.selectIf(command);
        return new PageInfo<>(list);
    }

    /**
     * 通过事件id查询
     * @param eventId 事件id
     * @return
     */
    public LogEntity selectByEventId(String eventId)
    {
        return auditLogRepository.selectByEventId(eventId);
    }

    /**
     *  查询所有操作结果List
     * @return
     */
    public List<Map<String, Object>> getOutcomeList()
    {
        List<OperationOutcome> enumList = EnumUtils.getEnumList(OperationOutcome.class);
        List<Map<String,Object>> data = new ArrayList<>();
        enumList.forEach(item->{
            Map<String,Object> map = new HashMap<>();
            map.put("value",item.value());
            map.put("description",item.description());
            data.add(map);
        });
        return   data;
    }
}

import com.dimpt.common.util.IdUtils;
import java.io.Serializable;
import java.time.ZonedDateTime;

/**
 * 审计事件类
 *
 * <p>创建人：</p>
 * <p>创建时间：2018年11月8日 14:31</p>
 */
public class LogEvent implements Serializable {

    private static final long serialVersionUID = -2147518420420074858L;

    /**
     * 事件ID。默认会使用UUID自动生成
     */
    private String id = IdUtils.nextId(IdUtils.PREFIX_EVENT_ID);

    /**
     * 操作会话ID。必填。所有相关的操作应共享同一个操作会话ID。若不提供将会自动生成AuditEventHandler
     */
    private String threadId = IdUtils.nextId(IdUtils.PREFIX_EVENT_THREAD_ID);

    /**
     * 事件发生时间。默认会使用当前事件
     */
    private ZonedDateTime time = ZonedDateTime.now();

    /**
     * 事件关联操作者。选填。对于系统在处理流程上拆分的操作，请填写“SYSTEM”
     */
    private String username;

    /**
     * 事件关联操作者真实姓名。选填。对于系统在处理流程上拆分的操作，请填写“SYSTEM”
     */
    private String realName;

    /**
     * 操作分类。必填。请根据操作所在的模块填写
     */
    private String category;

    /**
     * 操作对象。必填，对于一般请求，可选取值为LOGIN/LOGOUT/接口调用的目标URL。对于系统在处理流程上拆分的操作，请根据业务逻辑取值
     */
    private String target;

    /**
     * 操作对象描述。必填，对于一般请求，可选的取值为登录/登出/接口调用目标的描述。对于系统在处理流程上拆分的操作，请根据业务逻辑填写具体的描述
     */
    private String description;

    /**
     * 操作结果，必填
     */
    private OperationOutcome outcome;

    /**
     * 操作者权限列表（逗号分隔）。选填，仅对一般请求日志有效
     */
    private String ownedPermissions;

    /**
     * 操作入参。选填
     */
    private String inParams;

    /**
     * 操作出参。选填
     */
    private String outParams;

    /**
     * 来源IP。选填。在登录/登出/一般请求时应填写发起请求的IP地址。其余情况应留空
     */
    private String sourceIp;

    public String getId() {
        return id;
    }

    protected void setId(String id) {
        this.id = id;
    }

    public ZonedDateTime getTime() {
        return time;
    }

    public void setTime(ZonedDateTime time) {
        this.time = time;
    }

    public String getUsername() {
        return username;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    public String getRealName() {
        return realName;
    }

    public void setRealName(String realName) {
        this.realName = realName;
    }

    public String getTarget() {
        return target;
    }

    public void setTarget(String target) {
        this.target = target;
    }

    public String getDescription() {
        return description;
    }

    public void setDescription(String description) {
        this.description = description;
    }

    public OperationOutcome getOutcome() {
        return outcome;
    }

    public void setOutcome(OperationOutcome outcome) {
        this.outcome = outcome;
    }

    public String getOwnedPermissions() {
        return ownedPermissions;
    }

    public void setOwnedPermissions(String ownedPermissions) {
        this.ownedPermissions = ownedPermissions;
    }

    public void setSourceIp(String sourceIp) {
        this.sourceIp = sourceIp;
    }

    public String getSourceIp() {
        return sourceIp;
    }

    public String getCategory() {
        return category;
    }

    public void setCategory(String category) {
        this.category = category;
    }

    public String getInParams() {
        return inParams;
    }

    public void setInParams(String inParams) {
        this.inParams = inParams;
    }

    public String getOutParams() {
        return outParams;
    }

    public void setOutParams(String outParams) {
        this.outParams = outParams;
    }

    public String getThreadId() {
        return threadId;
    }

    public void setThreadId(String threadId) {
        this.threadId = threadId;
    }

    @Override
    public String toString() {
        return "AuditEvent{" +
                "id=‘" + id + ‘\‘‘ +
                ", threadId=‘" + threadId + ‘\‘‘ +
                ", time=" + time +
                ‘}‘;
    }
}

import com.dimpt.common.util.IpUtils;
import io.swagger.annotations.Api;
import io.swagger.annotations.ApiOperation;
import org.apache.commons.lang3.StringUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.ApplicationEventPublisher;
import org.springframework.context.ApplicationEventPublisherAware;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.security.web.util.matcher.AnyRequestMatcher;
import org.springframework.security.web.util.matcher.RequestMatcher;
import org.springframework.web.filter.OncePerRequestFilter;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.HandlerExecutionChain;
import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping;
import org.springframework.web.util.NestedServletException;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.lang.reflect.Method;
import java.time.ZonedDateTime;
import java.util.*;

/**
 * 与Spring Security整合用的关于审计日志记录的Filter
 * <br>
 * 此Filter的注册位置位于登录Filter（{@link org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter}）之前，
 * 用于对所有进入系统的请求进行预处理和后处理
 * <br>
 * 预处理部分包括根据请求URL构建对应的 {@link LogEvent} 实例
 * 后处理部分包括根据请求的处理结果发布实际的审计事件。审计事件会进一步被其余处理器进一步处理
 * <br>
 * 预处理和后处理之间会有额外的处理工作。该工作将交由其它协同类进行处理
 *
 * <p>创建人：</p>
 * <p>创建时间：2018年11月8日 14:31</p>
 */
public class LogFilter extends OncePerRequestFilter implements ApplicationEventPublisherAware {

    private ApplicationEventPublisher applicationEventPublisher;

    /**
     * 获取全部的接口信息
     */
    private List<RequestMappingHandlerMapping> handlerMappings;

    /**
     * Spring Security用于处理登录的请求地址
     */
    private RequestMatcher loginRequestMatcher = new AntPathRequestMatcher("/login");

    /**
     * Spring Security用于处理登出的请求地址
     */
    private RequestMatcher logoutRequestMatcher = new AntPathRequestMatcher("/logout");

    /**
     * 普通请求的URL匹配器。默认为所有请求拦截
     */
    private RequestMatcher genericRequestMatcher = AnyRequestMatcher.INSTANCE;

    /**
     * 设置用于处理登录的URL地址（仅用作检测）。默认为/login
     *
     * @param loginProcessingUrl 登录处理URL
     *
     * <p>创建人：陈柱辉</p>
     * <p>创建时间：2018年11月8日 14:31</p>
     */
    public void setLoginProcessingUrl(String loginProcessingUrl) {
        this.loginRequestMatcher = new AntPathRequestMatcher(loginProcessingUrl);
    }

    /**
     * 设置用于处理登出的URL地址（仅用作检测）。默认为/logout
     *
     * @param logoutProcessingUrl 登出处理URL
     *
     * <p>创建人：陈柱辉</p>
     * <p>创建时间：2018年11月8日 14:31</p>
     */
    public void setLogoutProcessingUrl(String logoutProcessingUrl) {
        this.logoutRequestMatcher = new AntPathRequestMatcher(logoutProcessingUrl);
    }

    /**
     * 设置常规接口请求的请求匹配器。默认为匹配所有请求
     *
     * @param genericRequestMatcher 常规接口的请求匹配器
     * <p>创建人：陈柱辉</p>
     * <p>创建时间：2018年11月8日 14:31</p>
     */
    public void setGenericRequestMatcher(RequestMatcher genericRequestMatcher) {
        this.genericRequestMatcher = genericRequestMatcher;
    }

    @Autowired(required = false)
    public void setHandlerMappings(List<RequestMappingHandlerMapping> handlerMappings) {
        this.handlerMappings = handlerMappings;
    }

    @SuppressWarnings("ConstantConditions")
    @Override
    protected void doFilterInternal(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain) throws ServletException, IOException {
        LogEvent event;
        if (loginRequestMatcher.matches(httpServletRequest)) {
            event = new LogEvent();
            event.setCategory("登录/登出");
            event.setTarget("LOGIN");
            event.setDescription("登录");
            event.setTime(ZonedDateTime.now());
        } else if (logoutRequestMatcher.matches(httpServletRequest)) {
            event = new LogEvent();
            event.setCategory("登录/登出");
            event.setTarget("LOGOUT");
            event.setDescription("登出");
            event.setTime(ZonedDateTime.now());
        } else if (genericRequestMatcher.matches(httpServletRequest)) {
            event = new LogEvent();
            event.setTarget(httpServletRequest.getMethod() + " " + httpServletRequest.getRequestURI());
            event.setTime(ZonedDateTime.now());
        } else {
            filterChain.doFilter(httpServletRequest, httpServletResponse);
            return;
        }
        event.setSourceIp(IpUtils.getIpAddress(httpServletRequest));
        // 由于审计日志需要记录入参和出参的情况，所以这里需要对请求和响应对象做响应的封装
        // 对请求的封装是因为提取入参时会消耗输入流，为了让输入流能被重复读取，需要进行封装
        // 对响应的封装也是类似的
        CachedHttpServletRequestWrapper req = new CachedHttpServletRequestWrapper(httpServletRequest);
        CachedHttpServletResponseWrapper resp = new CachedHttpServletResponseWrapper(httpServletResponse);

        // 将当前登录的用户信息写入到AuditEvent中
        Object principal =
                Optional.ofNullable(SecurityContextHolder.getContext())
                .map(SecurityContext::getAuthentication)
                .map(Authentication::getPrincipal)
                .orElse(null);
        if (principal != null) {
            if (principal instanceof User) {
                User user = (User) principal;
                event.setUsername(user.getUsername());
//                if (principal instanceof AdminUserSecurityPrincipal) {
//                    event.setRealName(
//                            Optional.of((AdminUserSecurityPrincipal) principal)
//                                    .map(AdminUserSecurityPrincipal::getDetails).map(AdminUserDto::getRealName).orElse(null));
//                }
            } else {
                event.setUsername(principal.toString());
            }
            event.setOwnedPermissions(StringUtils.join(AuthorityUtils.authorityListToSet(SecurityContextHolder.getContext().getAuthentication().getAuthorities()), ‘,‘));
        }

        httpServletRequest.setAttribute(Constant.AUDIT_EVENT_OBJECT_NAME, event);

        // 捕获后续处理过程中出现的异常。对于后续处理中outcome未进行设置的情况下，根据捕获到的异常信息对outcome进行默认的设置
        Throwable thrownTh = null;
        try {
            filterChain.doFilter(req, resp);
        } catch (Throwable ex) {
            thrownTh = ex;
        }

        event = (LogEvent) req.getAttribute(Constant.AUDIT_EVENT_OBJECT_NAME);

        auditingPostHandling(event, req, resp, thrownTh);

        applicationEventPublisher.publishEvent(event);

        // 重新抛出异常
        if (thrownTh != null) {
            if (thrownTh instanceof ServletException) {
                throw (ServletException) thrownTh;
            } else if (thrownTh instanceof IOException) {
                throw (IOException) thrownTh;
            } else {
                // 由于doFilter只能抛出已声明的checked exception或者unchecked exception，
                // 因此此处只可能是RuntimeException或其子类
                throw (RuntimeException) thrownTh;
            }
        }
    }

    private void auditingPostHandling(LogEvent event, CachedHttpServletRequestWrapper req, CachedHttpServletResponseWrapper resp, Throwable thrownTh) {
        // 对于接口的分类及目标描述的部分而言，由于它们高度依赖于SpringMVC的拦截器来从swagger的注解中提取信息，
        // 所以对于因为未登录或者权限不足等情况导致请求在filter层面就已经被拒绝处理的情况，会没有办法拿到接口的分类
        // 及目标描述
        // ApiAuditingInfoHolder类在这个事情上获取了全部 request handler的信息。从这个信息中可以再次尝试找到接口的
        // 相关描述
        if (StringUtils.isEmpty(event.getDescription())) {
            Object handler = lookupHandler(req);
            if (handler instanceof HandlerMethod) {
                // 能找到接口定义。从接口定义中再次尝试抽取描述
                HandlerMethod handlerMethod = (HandlerMethod) handler;
                Method method = handlerMethod.getMethod();
                Class<?> declaringClass = method.getDeclaringClass();
                Api apiAnnotation = declaringClass.getAnnotation(Api.class);
                ApiOperation operationAnnotation = method.getAnnotation(ApiOperation.class);
                if (apiAnnotation != null && apiAnnotation.tags().length > 0) {
                    event.setCategory(apiAnnotation.tags()[0]);
                }
                if (operationAnnotation != null) {
                    event.setDescription(operationAnnotation.value());
                }
            } else {
                // 其余情况，作为未知接口显示
                event.setCategory("未知");
                event.setDescription("接口未定义");
            }
        }
        // 关于结果部分的处理。当事件的结果未设置时，会根据是否捕获到异常、异常的类型来确定事件的结果
        if (event.getOutcome() == null) {
            if (thrownTh == null) {
                event.setOutcome(OperationOutcome.NORMAL);
            } else {
                event.setOutcome(OperationOutcome.INVOCATION_ERROR);
            }
        }
        // 入参出参部分
        // 入参有点小特殊，除了post body以外，query param也是很重要的一部分
        StringBuilder sb = new StringBuilder("Query:\n");
        reconstructQueryParam(req, sb);
        sb.append("\n\nBody:\n");
        byte[] body = req.getReadData();
        if (body.length == 0) {
            sb.append("<无>");
        } else {
            sb.append(new String(body));
        }
        event.setInParams(sb.toString());
        // 当出参数据太庞大的时候，为了避免写入过长数据（从而影响数据库写入），出参部分以“出参数据量过大未作记录”标识
        // 当前的阈值暂时写死65K（2^16次方）

        // TODO: 后期如果要解决，解决方案应考虑以非关系数据库的形式保存数据，例如以文件的形式保存出入参，并提供出下载链接。
        //       但需要注意如果网关以集群的形式进行部署，那么文件的保存也得支持这种分布式才行
       /* if (resp.getWrittenData().length >= (1<<16)) {
            logger.warn(String.format("注意：由于出参数据量过于庞大（合计 %.2fKB），本次日志未记录出参", resp.getWrittenData().length / 1024.0f));
            event.setOutParams("出参数据量过大未作记录");
        }*/
       //输出参数大于20k做特殊处理
        if (resp.getWrittenData().length >= 10<<11) {
            logger.warn(String.format("注意：由于出参数据量过于庞大（合计 %.2fKB），本次日志未记录出参", resp.getWrittenData().length / 1024.0f));
            event.setOutParams("出参数据量过大未作记录");
        }
        else {
            event.setOutParams(new String(resp.getWrittenData()));
        }
    }

    private void reconstructQueryParam(HttpServletRequest httpServletRequest, StringBuilder sb) {
        Map<String, String[]> params = httpServletRequest.getParameterMap();
        if (params.size() == 0) {
            sb.append("<无>");
        }
        Iterator<Map.Entry<String, String[]>> iter = params.entrySet().iterator();
        while (iter.hasNext()) {
            Map.Entry<String, String[]> entry = iter.next();
            String key = entry.getKey();
            String[] values = entry.getValue();
            for (int i = 0; i < values.length; ++i) {
                if (i != 0) {
                    sb.append(‘&‘);
                }
                sb.append(key).append(‘=‘).append(values[i]);
            }
            if (iter.hasNext()) {
                sb.append(‘&‘);
            }
        }
    }

    @Override
    public void setApplicationEventPublisher(ApplicationEventPublisher publisher) {
        this.applicationEventPublisher = publisher;
    }

    /**
     * 对传入的 {@link Throwable} 进行分析，找出导致异常的真正原因
     * <br>
     * 当前的分析原则：
     * 1. 对于 {@link NestedServletException}，取它的cause进行进一步分析
     * 2. 对于 {@link RuntimeException}，如果它的cause非空，去它的cause进行进一步分析
     * 3. 重复上述步骤。如果最后导致无法找到实际的目标异常（例如一直上溯到了异常链的顶部，最终的
     * cause为空），那么返回传入的异常
     */
    private Throwable getRealRootCause(Throwable th) {
        Throwable realTh = th;
        while (realTh != null) {
            if (realTh instanceof NestedServletException) {
                realTh = realTh.getCause();
            } else if (realTh instanceof RuntimeException) {
                if (realTh.getCause() != null) {
                    realTh = realTh.getCause();
                } else {
                    break;
                }
            } else {
                break;
            }
        }
        if (realTh == null) {
            realTh = th;
        }
        return realTh;
    }

    private Object lookupHandler(HttpServletRequest request) {
        if (this.handlerMappings == null) {
            return null;
        }
        return handlerMappings.stream()
                .map(hm -> {
                    try {
                        HandlerExecutionChain chain = hm.getHandler(request);
                        return chain == null ? null : chain.getHandler();
                    } catch (Exception e) {
                        // 不用管，返回null即可
                        return null;
                    }
                })
                .filter(Objects::nonNull)
                .findFirst().orElse(null);
    }
}

import com.dimpt.common.log.entity.LogEntity;
import com.dimpt.common.log.service.LogService;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.context.event.EventListener;
import org.springframework.scheduling.annotation.Async;
import org.springframework.stereotype.Component;
import javax.annotation.Resource;
import java.sql.Date;
import java.time.ZonedDateTime;
import java.time.format.DateTimeFormatter;

/**
 * 审计事件处理器
 *
 * <p>创建人：陈柱辉</p>
 * <p>创建时间：2018年11月8日 14:31</p>
 */
@Component
public class LogEventHandler {

    private static final Logger auditLog = LoggerFactory.getLogger("audit");

    @Resource
    private LogService auditLogService;

    /**
     * 将审计事件写入到日志文件
     *
     * @param event 审计事件
     * <p>创建人：</p>
     * <p>创建时间：2018年11月8日 14:31</p>
     */
    @EventListener(LogEvent.class)
    public void writeAuditEventToLog(LogEvent event) {
        // 写审计日志文件。这部分应该和整个请求的处理流程串行处理，保证审计日志在整体日志中的连续性
        // 由于是串行，同时需要保证万一日志出现问题，不应该影响整个系统的运行，但出现此种错误时应
        // 尽快排查原因
        try {
            if (event.getOutcome() == null) {
                if (auditLog.isWarnEnabled()) {
                    auditLog.warn(constructAuditLogFromEvent(event));
                }
            } else {
                if (auditLog.isInfoEnabled()) {
                    auditLog.info(constructAuditLogFromEvent(event));
                }
            }
        } catch (Exception e) {
            auditLog.warn("写入审计日志时发生错误。请联系开发人员尽快排查出错原因并修复，以免影响审计记录", e);
        }
    }

    /**
     * 审计事件写入数据库的处理器。写入的处理是异步进行的
     *
     * @param event 审计事件
     * <p>创建人：陈柱辉</p>
     * <p>创建时间：2018年11月8日 14:31</p>
     */
    @Async
    @EventListener(LogEvent.class)
    public void writeAuditEventToDb(LogEvent event) {
        // 将审计日志保存至数据库中。这部分脱离请求处理流程，异步处理，以提高系统对请求的处理能力
        LogEntity log = new LogEntity();
        log.setEventId(event.getId());
        log.setThreadId(event.getThreadId());
        log.setDescription(event.getDescription());
        log.setOperationTime(Date.from(event.getTime().toInstant()));
        log.setOperatorPerm(event.getOwnedPermissions());
        log.setOperatorUsername(event.getUsername());
        log.setOperatorRealName(event.getRealName());
        log.setCategory(event.getCategory());
        log.setTarget(event.getTarget());
        log.setSourceIp(event.getSourceIp());
        log.setOutcome(event.getOutcome().ordinal());
        log.setInParams(event.getInParams());
        log.setOutParams(event.getOutParams());
        auditLogService.insertAuditLog(log);
    }

    private String constructAuditLogFromEvent(LogEvent event) {
        return String.format("" +
                        "审计事件：%s\n" +
                        "会话ID：%s\n" +
                        "时间：%s\n" +
                        "来源IP：%s\n"+
                        "操作人：%s（%s）\n" +
                        "操作人权限：%s\n" +
                        "操作：%s\n" +
                        "操作描述：%s\n" +
                        "操作结果：%s",
                event.getId(),
                event.getThreadId(),
                zonedDateTimeString(event.getTime()),
                getStringOrDefault(event.getSourceIp(), "-"),
                nameString(event.getUsername()), nameString(event.getRealName()),
                getStringOrDefault(event.getOwnedPermissions()),
                getStringOrDefault(event.getTarget()),
                getStringOrDefault(event.getDescription(), "-"),
                outcomeString(event.getOutcome()));
    }

    private static String zonedDateTimeString(ZonedDateTime value) {
        return DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss").format(value);
    }

    private static String nameString(String value) {
        return getStringOrDefault(value, "-");
    }

    private static String getStringOrDefault(String value) {
        return getStringOrDefault(value, "无");
    }

    private static String getStringOrDefault(String value, String nullValue) {
        return value != null ? value : nullValue;
    }

    private static String outcomeString(OperationOutcome value) {
        if (value == null) {
            return "未知";
        }
        switch (value) {
            case NORMAL:
                return "正常";
            case LOGIN_REQUIRED:
                return "需要登录";
            case ACCESS_DENIED:
                return "拒绝访问";
            case INVOCATION_ERROR:
                return "处理异常";
        }
        return "未知";
    }
}

import com.dimpt.common.handler.ExceptionTranslationControllerAdvice;
import org.springframework.stereotype.Component;
import org.springframework.web.context.request.ServletWebRequest;
import org.springframework.web.context.request.WebRequest;
import javax.servlet.http.HttpServletRequest;

/**
 * 用于处理审计的异常回调。详见 {@link ExceptionTranslationControllerAdvice.ExceptionCallback}
 * <br>
 * <p>创建人：</p>
 * <p>创建时间：2018年11月09日 16:56</p>
 */
@Component
public class LogExceptionCallback implements ExceptionTranslationControllerAdvice.ExceptionCallback {

    @Override
    public void onException(Exception ex, WebRequest request) {
        if (!(request instanceof ServletWebRequest)) {
            return;
        }
        HttpServletRequest req = ((ServletWebRequest) request).getRequest();

        LogEvent event = (LogEvent) req.getAttribute(Constant.AUDIT_EVENT_OBJECT_NAME);
        if (event != null) {
            event.setOutcome(OperationOutcome.INVOCATION_ERROR);
        }
    }
}

/**
 * 常量定义
 *
 * <p>创建人：</p>
 * <p>创建时间：2018年11月8日 14:31</p>
 */
public interface Constant {

    /**
     * 审计模块用于保存请求中审计事件对象的名称
     */
    String AUDIT_EVENT_OBJECT_NAME = "_ORCHESTRATOR_AUDIT_EVENT_OBJECT";

}

import javax.servlet.ServletOutputStream;
import javax.servlet.WriteListener;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpServletResponseWrapper;
import java.io.ByteArrayOutputStream;
import java.io.IOException;

/**
 * 对 {@link HttpServletResponse} 进行封装，对输出流的写入进行记录然后委派，并且允许获取写入到输入流的内容
 * <p>创建人：</p>
 * <p>创建时间：2018年11月19日 11:07</p>
 */
public class CachedHttpServletResponseWrapper extends HttpServletResponseWrapper {

    private final CachedOutputStream caughtOuput;

    public CachedHttpServletResponseWrapper(HttpServletResponse response) throws IOException {
        super(response);
        caughtOuput = new CachedOutputStream(response.getOutputStream());
    }

    @Override
    public ServletOutputStream getOutputStream() throws IOException {
        return caughtOuput;
    }

    public byte[] getWrittenData() {
        return caughtOuput.getWritten().toByteArray();
    }

    private class CachedOutputStream extends ServletOutputStream {

        private final ServletOutputStream delegatingOutputStream;
        private final ByteArrayOutputStream written;

        public CachedOutputStream(ServletOutputStream outputStream) {
            this.delegatingOutputStream = outputStream;
            this.written = new ByteArrayOutputStream();
        }

        @Override
        public boolean isReady() {
            return true;
        }

        @Override
        public void setWriteListener(WriteListener listener) {
            this.delegatingOutputStream.setWriteListener(listener);
        }

        @Override
        public void write(int b) throws IOException {
            this.written.write(b);
            delegatingOutputStream.write(b);
        }

        public ByteArrayOutputStream getWritten() {
            return written;
        }
    }


}

import javax.servlet.ReadListener;
import javax.servlet.ServletInputStream;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import java.io.ByteArrayOutputStream;
import java.io.IOException;

/**
 * 对 {@link HttpServletRequest} 进行封装，记录输入流中的数据，并允许在后续过程中重新读出
 * <p>创建人：</p>
 * <p>创建时间：2018年11月19日 10:42</p>
 */
public class CachedHttpServletRequestWrapper extends HttpServletRequestWrapper {

   private final CachedInputStream cachedInputStream;

    public CachedHttpServletRequestWrapper(HttpServletRequest request) throws IOException {
        super(request);
        this.cachedInputStream = new CachedInputStream(request.getInputStream());
    }

    @Override
    public ServletInputStream getInputStream() throws IOException {
        return cachedInputStream;
    }

    public byte[] getReadData() {
        return this.cachedInputStream.getCachedInput().toByteArray();
    }

    /**
     * 将输入流缓存的辅助类
     * <p>创建人：陈柱辉</p>
     * <p>创建时间：2018年11月19日 10:57</p>
     */
    public static class CachedInputStream extends ServletInputStream {

        private final ServletInputStream delegatingInputStream;
        private final ByteArrayOutputStream cachedInput;

        public CachedInputStream(ServletInputStream delegatingInputStream) {
            this.delegatingInputStream = delegatingInputStream;
            this.cachedInput = new ByteArrayOutputStream();
        }

        @Override
        public boolean isFinished() {
            return this.delegatingInputStream.isFinished();
        }

        @Override
        public boolean isReady() {
            return this.delegatingInputStream.isReady();
        }

        @Override
        public void setReadListener(ReadListener listener) {
            this.delegatingInputStream.setReadListener(listener);
        }

        @Override
        public int read() throws IOException {
            int read = this.delegatingInputStream.read();
            if (read != -1) {
                this.cachedInput.write(read);
            }
            return read;
        }

        public ByteArrayOutputStream getCachedInput() {
            return cachedInput;
        }
    }
}

import com.dimpt.common.log.application.LogFilter;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;

/**
 * @Description
 * @Author 胡俊敏
 * @Date 2019/10/25 14:33
 */
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)//注解开启在方法上的保护功能
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean
    public LogFilter auditLoggingFilter() {
        LogFilter filter = new LogFilter();
        filter.setLoginProcessingUrl("/api/login");
        filter.setLogoutProcessingUrl("/api/logout");
        filter.setGenericRequestMatcher(new AntPathRequestMatcher("/api/**"));
        return filter;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //配置哪些请求需要验证
        http.csrf().disable()
                .authorizeRequests()
                .antMatchers("/**").permitAll()
                .anyRequest().authenticated()
                .and()
                .addFilterBefore(auditLoggingFilter(), UsernamePasswordAuthenticationFilter.class);

    }
}

import com.dimpt.common.filter.OperaterFilter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class FilterConfig {
    @Autowired
    private OperaterFilter operatorFilter;

    @Bean
    public FilterRegistrationBean registerOperatorFilter() {
        FilterRegistrationBean registration = new FilterRegistrationBean();
        registration.setFilter(operatorFilter);
        registration.addUrlPatterns("/*");
        registration.setName("operatorFilter");
        registration.setOrder(1);  //值越小，Filter越靠前。
        return registration;
    }
}

import com.dimpt.common.log.application.HandlerMethodAuditingInterceptor;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.CorsRegistry;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
public class SpringMvcConfigurer implements WebMvcConfigurer {
    @Bean
    public HandlerMethodAuditingInterceptor requestHandlerAuditingInterceptor() {
        return new HandlerMethodAuditingInterceptor();
    }

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(requestHandlerAuditingInterceptor());
    }

    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**")
                .allowedHeaders("*")
                .allowedMethods("*")
                .allowedOrigins("*");
    }
}