太强了，一个注解实现接口返回数据脱敏

来源：juejin.cn/post/7110110794188062727

下午惬意时光，突然产品小姐姐走到我面前，打断我短暂的摸鱼time，企图与我进行深入交流，还好我早有防备没有闪，打开瑞star的点单页面，暗示没有一杯coffee解决不了的需求，需求是某些接口返回的信息，涉及到敏感数据的必须进行脱敏操作，我思考一反，表示某问题，马上安排。

思路

1.要做成可配置多策略的脱敏操作，要不然一个个接口进行脱敏操作，重复的工作量太多，很显然违背了“多写一行算我输”的程序员规范，思来想去，定义数据脱敏注解和数据脱敏逻辑的接口， 在返回类上，对需要进行脱敏的属性加上，并指定对应的脱敏策略操作。

2.接下来我只需要拦截控制器返回的数据，找到带有脱敏注解的属性操作即可，一开始打算用@ControllerAdvice去实现，但发现需要自己去反射类获取注解，当返回对象比较复杂，需要递归去反射，性能一下子就会降低，于是换种思路，我想到平时使用的@JsonFormat，跟我现在的场景很类似，通过自定义注解跟字段解析器，对字段进行自定义解析。

代码

1. 自定义数据注解，并可以配置数据脱敏策略

import java.lang.annotation.Documented;
import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

/**
 * @Description
 * @Author heiyu
 * @Date 2022-07-19 11:29
 */
@Target({ElementType.FIELD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface DataMasking {

    DataMaskingFunc maskFunc() default DataMaskingFunc.NO_MASK;
}

2. 自定义Serializer，参考jackson的StringSerializer，下面的示例只针对String类型进行脱敏

public interface DataMaskingOperation {

    String MASK_CHAR = "*";
    
    String mask(String content, String maskChar);

}

public enum DataMaskingFunc {

     /**
     *  脱敏转换器
     */
     NO_MASK((str, maskChar) -> {
        return str;
     }),
     ALL_MASK((str, maskChar) -> {
        if (StringUtils.hasLength(str)) {
            StringBuilder sb = new StringBuilder();
            for (int i = 0; i < str.length(); i++) {
                sb.append(StringUtils.hasLength(maskChar) ? maskChar : DataMaskingOperation.MASK_CHAR);
            }
            return sb.toString();
        } else {
            return str;
        }
    });

    private final DataMaskingOperation operation;

    private DataMaskingFunc(DataMaskingOperation operation) {
        this.operation = operation;
    }

    public DataMaskingOperation operation() {
        return this.operation;
    }

}

public final class DataMaskingSerializer extends StdScalarSerializer<Object> {
    private final DataMaskingOperation operation;

    public DataMaskingSerializer() {
        super(String.class, false);
        this.operation = null;
    }

    public DataMaskingSerializer(DataMaskingOperation operation) {
        super(String.class, false);
        this.operation = operation;
    }


    public boolean isEmpty(SerializerProvider prov, Object value) {
        String str = (String)value;
        return str.isEmpty();
    }

    public void serialize(Object value, JsonGenerator gen, SerializerProvider provider) throws IOException {
        if (Objects.isNull(operation)) {
            String content = DataMaskingFunc.ALL_MASK.operation().mask((String) value, null);
            gen.writeString(content);
        } else {
            String content = operation.mask((String) value, null);
            gen.writeString(content);
        }
    }

    public final void serializeWithType(Object value, JsonGenerator gen, SerializerProvider provider, TypeSerializer typeSer) throws IOException {
        this.serialize(value, gen, provider);
    }

    public JsonNode getSchema(SerializerProvider provider, Type typeHint) {
        return this.createSchemaNode("string", true);
    }

    public void acceptJsonFormatVisitor(JsonFormatVisitorWrapper visitor, JavaType typeHint) throws JsonMappingException {
        this.visitStringFormat(visitor, typeHint);
    }
}

3. 自定义AnnotationIntrospector，适配我们自定义注解返回相应的Serializer

import com.fasterxml.jackson.databind.introspect.Annotated;
import com.fasterxml.jackson.databind.introspect.NopAnnotationIntrospector;
import lombok.extern.slf4j.Slf4j;

/**
 * @Description
 * @Author heiyu
 * @Date 2022-07-19 11:33
 */
@Slf4j
public class DataMaskingAnnotationIntrospector extends NopAnnotationIntrospector {
    @Override
    public Object findSerializer(Annotated am) {
        DataMasking annotation = am.getAnnotation(DataMasking.class);
        if (annotation != null) {
            return new DataMaskingSerializer(annotation.maskFunc().operation());
        }
        return null;
    }
}

4. 覆盖ObjectMapper

import com.fasterxml.jackson.databind.AnnotationIntrospector;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.introspect.AnnotationIntrospectorPair;
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Primary;
import org.springframework.http.converter.json.Jackson2ObjectMapperBuilder;

/**
 * @Description
 * @Author heiyu
 * @Date 2022-07-19 11:33
 */
@Configuration(
        proxyBeanMethods = false
)
public class DataMaskConfiguration {

    @Configuration(
            proxyBeanMethods = false
    )
    @ConditionalOnClass({Jackson2ObjectMapperBuilder.class})
    static class JacksonObjectMapperConfiguration {
        JacksonObjectMapperConfiguration() {
        }

        @Bean
        @Primary
        ObjectMapper jacksonObjectMapper(Jackson2ObjectMapperBuilder builder) {
            ObjectMapper objectMapper = builder.createXmlMapper(false).build();
            AnnotationIntrospector ai = objectMapper.getSerializationConfig().getAnnotationIntrospector();
            AnnotationIntrospector newAi = AnnotationIntrospectorPair.pair(ai, new DataMaskingAnnotationIntrospector());
            objectMapper.setAnnotationIntrospector(newAi);
            return objectMapper;
        }
    }
}

5. 返回对象加上注解

/**
 * @Description
 * @Author heiyu
 * @Date 2022-07-019 11:16
 */
@Data
@Schema(title = "用户DTO")
public class UserDTO {


    @Schema(title = "用户id")
    @JsonSerialize(using = ToStringSerializer.class)
    private Long userId;

    @Schema(title = "用户名称")
    @NotNull(message = "用户名称不能为空")
    private String userName;

    @Schema(title = "密码")
    @NotNull(message = "密码不能为空")
    @DataMasking(maskFunc = DataMaskingFunc.ALL_MASK)
    private String password;

    @TableField(value = "phone")
    @Schema(title = "电话")
    private String phone;

    @Schema(title = "电子邮箱")
     @DataMasking(maskFunc = DataMaskingFunc.ALL_MASK)
    private String email;

}

这里面涉及到了java8的新特性，函数式接口，DataMaskingOperation是一个函数式接口。

函数式接口是指一个接口内只有一个抽象方法，若干个 default 方法的接口，一般函数式接口都会使用 @FunctionalInterface 注解进行标注，但是并不是说没有该注解就不是一个函数式接口了，该注解只是用于编译期检查，如果有多个抽象方法，那么编译将不通过。

DataMaskingFunc 既是枚举类，也是函数式接口的实现类。这里采用了 java8 的 lambda 表达式来实现的。

public enum DataMaskingFunc {

    /**
     *  脱敏转换器
     */
    NO_MASK((str, maskChar) -> {
        return str;
    }),
    ALL_MASK((str, maskChar) -> {
        if (StringUtils.hasLength(str)) {
            StringBuilder sb = new StringBuilder();
            for (int i = 0; i < str.length(); i++) {
                sb.append(StringUtils.hasLength(maskChar) ? maskChar : DataMaskingOperation.MASK_CHAR);
            }
            return sb.toString();
        } else {
            return str;
        }
    });

    private final DataMaskingOperation operation;
    
    private DataMaskingFunc(DataMaskingOperation operation) {
        this.operation = operation;
    }
    public DataMaskingOperation operation() {
        return this.operation;
    }
}