Spring Boot 3.5 + Java 25 + Cloud Native 系列（二）：API Gateway 架构

spring:
  cloud:
    gateway:
      server:
        webmvc:
          routes:
            # 灰度路由需要放在稳定路由之前
            - id: buyer-api-canary
              uri: ${BUYER_BFF_V2_URI:http://buyer-bff-v2:8080}
              predicates:
                - Path=/api/buyer/**
                - name: Canary
                  args:
                    routeId: buyer-api
              filters:
                - StripPrefix=1

- id: api-docs-buyer-bff
  uri: ${BUYER_BFF_URI:http://buyer-bff:8080}
  predicates:
    - Path=/v3/api-docs/buyer
  filters:
    - RewritePath=/v3/api-docs/buyer, /v3/api-docs

@Bean
SecurityFilterChain securityFilterChain(HttpSecurity http, JwtDecoder jwtDecoder) throws Exception {
    return http.cors(Customizer.withDefaults())
            .csrf(AbstractHttpConfigurer::disable)
            .httpBasic(AbstractHttpConfigurer::disable)
            .formLogin(AbstractHttpConfigurer::disable)
            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authorizeHttpRequests(auth -> auth
                    .requestMatchers(
                            "/actuator/**", "/auth/**", "/buyer/**",
                            "/seller/**", "/public/**",
                            "/swagger-ui.html", "/swagger-ui/**",
                            "/v3/api-docs/**").permitAll()
                    .requestMatchers("/api/**").authenticated()
                    .anyRequest().permitAll())
            .oauth2ResourceServer(oauth2 -> oauth2.jwt(jwt -> jwt.decoder(jwtDecoder)))
            .build();
}

@Bean
JwtDecoder jwtDecoder(GatewayProperties properties) {
    return NimbusJwtDecoder.withJwkSetUri(properties.jwksUri()).build();
}

public class TrustedHeadersRequestWrapper extends HttpServletRequestWrapper {

    private static final Set<String> STRIPPED_HEADERS = Set.of(
            "x-buyer-id", "x-player-id", "x-user-id",
            "x-username", "x-roles", "x-portal");

    private final Map<String, String> injectedHeadersByLowercase;

    public TrustedHeadersRequestWrapper(HttpServletRequest request,
                                        String requestId,
                                        String buyerId,
                                        String username,
                                        String roles,
                                        String portal) {
        super(request);
        // 注入信任 Header
    }

    @Override
    public String getHeader(String name) {
        String key = normalize(name);
        // 客户端伪造的 Header 被剥离，只返回 Gateway 注入的值
        if (injectedHeadersByLowercase.containsKey(key) || STRIPPED_HEADERS.contains(key)) {
            return injectedHeadersByLowercase.get(key);
        }
        return super.getHeader(name);
    }
}

// TrustedHeadersFilter.doFilterInternal()
if (principalId != null) {
    MDC.put("principalId", principalId);
    if ("BUYER".equalsIgnoreCase(portal)) {
        MDC.put("buyerId", principalId);
    } else if ("SELLER".equalsIgnoreCase(portal)) {
        MDC.put("sellerId", principalId);
    }
}
MDC.put("username", username);
MDC.put("portal", portal);
MDC.put("requestId", requestId);

@Component
@Order(SecurityProperties.DEFAULT_FILTER_ORDER + 20)
public class RateLimitingFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain chain) throws ServletException, IOException {
        try {
            String baseKey = resolveRateLimitKey(request);
            Long allowed = redissonClient.getScript(StringCodec.INSTANCE).eval(
                    RScript.Mode.READ_WRITE,
                    TOKEN_BUCKET_SCRIPT,
                    RScript.ReturnType.INTEGER,
                    List.<Object>of(baseKey + ":tokens", baseKey + ":ts"),
                    String.valueOf(ratePerSec),
                    String.valueOf(capacity),
                    String.valueOf(nowMs));
            if (allowed == null || allowed == 0L) {
                response.setStatus(429);
                response.setHeader("Retry-After", "60");
                return;
            }
        } catch (RedisException exception) {
            log.warn("Rate limit check failed, allowing request through: {}", exception.getMessage());
        }
        chain.doFilter(request, response);
    }
}

@Component
public class CanaryRequestPredicates implements PredicateSupplier {

    private static final String KEY_PREFIX = "gateway:canary:";

    public static RequestPredicate canary(String routeId) {
        return request -> {
            String buyerId = request.servletRequest().getHeader(BUYER_ID);
            if (buyerId == null || buyerId.isBlank() || redisTemplate == null) {
                return false;
            }
            try {
                return Boolean.TRUE.equals(
                    redisTemplate.opsForSet()
                        .isMember(KEY_PREFIX + routeId, buyerId));
            } catch (DataAccessException exception) {
                log.warn("Canary lookup failed for route {}, routing to stable: {}",
                        routeId, exception.getMessage());
                return false;
            }
        };
    }
}

# 将 buyer-123 加入灰度名单
SADD gateway:canary:buyer-api buyer-123

# 查看当前灰度用户
SMEMBERS gateway:canary:buyer-api

# 移除灰度用户
SREM gateway:canary:buyer-api buyer-123

spring:
  threads:
    virtual:
      enabled: true