Go vs Java 企业级分层架构全面对比

project/
├── cmd/
│   └── server/
│       └── main.go                  # 程序入口
├── internal/
│   ├── handler/                     # HTTP 处理器
│   │   ├── user_handler.go
│   │   ├── order_handler.go
│   │   └── middleware/              # 中间件
│   │       ├── auth.go              # 认证中间件
│   │       ├── permission.go        # 权限中间件
│   │       ├── logger.go            # 日志中间件
│   │       ├── ratelimit.go         # 限流中间件
│   │       └── recovery.go          # 异常恢复
│   ├── service/                     # 业务逻辑
│   │   ├── user_service.go
│   │   └── order_service.go
│   ├── repository/                  # 数据访问
│   │   ├── user_repository.go
│   │   ├── order_repository.go
│   │   └── cache/                   # 缓存实现
│   │       └── user_cache.go
│   ├── entity/                      # 实体定义
│   │   ├── user.go
│   │   └── order.go
│   ├── dto/                         # 传输对象
│   │   ├── request/
│   │   │   ├── user_request.go
│   │   │   └── order_request.go
│   │   └── response/
│   │       ├── user_response.go
│   │       └── common.go            # 统一响应结构
│   └── errors/                      # 错误定义
│       └── errors.go
├── pkg/                             # 可复用包
│   ├── auth/                        # JWT 工具
│   │   └── jwt.go
│   ├── cache/                       # 缓存抽象
│   │   └── redis.go
│   ├── logger/                      # 日志工具
│   │   └── logger.go
│   ├── validator/                   # 校验器
│   │   └── validator.go
│   └── utils/
│       └── crypto.go
├── config/                          # 配置
│   ├── config.go
│   └── config.yaml
├── migrations/                      # 数据库迁移
└── go.mod

project/
├── src/main/java/com/example/
│   ├── Application.java             # 程序入口
│   ├── controller/                  # 控制器
│   │   ├── UserController.java
│   │   └── OrderController.java
│   ├── service/                     # 服务接口
│   │   ├── UserService.java
│   │   └── OrderService.java
│   ├── service/impl/                # 服务实现
│   │   ├── UserServiceImpl.java
│   │   └── OrderServiceImpl.java
│   ├── mapper/                      # MyBatis Mapper
│   │   ├── UserMapper.java
│   │   └── OrderMapper.java
│   ├── entity/                      # 实体类
│   │   ├── User.java
│   │   └── Order.java
│   ├── dto/                         # 传输对象
│   │   ├── request/
│   │   │   ├── CreateUserRequest.java
│   │   │   └── UpdateUserRequest.java
│   │   └── response/
│   │       ├── UserResponse.java
│   │       └── CommonResponse.java
│   ├── config/                      # 配置类
│   │   ├── SecurityConfig.java      # 安全配置
│   │   ├── RedisConfig.java         # Redis 配置
│   │   └── WebMvcConfig.java        # MVC 配置
│   ├── filter/                      # 过滤器
│   │   └── JwtAuthenticationFilter.java
│   ├── interceptor/                 # 拦截器
│   │   ├── AuthInterceptor.java
│   │   └── PermissionInterceptor.java
│   ├── aspect/                      # 切面
│   │   ├── LogAspect.java
│   │   └── PermissionAspect.java
│   ├── exception/                   # 异常处理
│   │   ├── BusinessException.java
│   │   └── GlobalExceptionHandler.java
│   ├── enums/                       # 枚举
│   │   └── ErrorCode.java
│   └── util/                        # 工具类
│       ├── JwtUtil.java
│       └── RedisUtil.java
├── src/main/resources/
│   ├── mapper/                      # MyBatis XML
│   │   └── UserMapper.xml
│   ├── application.yml
│   └── application-dev.yml
└── pom.xml

// pkg/validator/validator.go
package validator

import (
    "regexp"
    "github.com/go-playground/validator/v10"
)

var validate *validator.Validate

func init() {
    validate = validator.New()
    // 注册自定义校验器
    validate.RegisterValidation("mobile", validateMobile)
    validate.RegisterValidation("idcard", validateIDCard)
}

func validateMobile(fl validator.FieldLevel) bool {
    mobile := fl.Field().String()
    matched, _ := regexp.MatchString(`^1[3-9]\d{9}$`, mobile)
    return matched
}

func validateIDCard(fl validator.FieldLevel) bool {
    idcard := fl.Field().String()
    matched, _ := regexp.MatchString(`^\d{17}[\dXx]$`, idcard)
    return matched
}

func Validate(s interface{}) error {
    return validate.Struct(s)
}

// 获取第一个校验错误的友好提示
func GetValidationError(err error) string {
    if errs, ok := err.(validator.ValidationErrors); ok {
        for _, e := range errs {
            return formatFieldError(e)
        }
    }
    return err.Error()
}

func formatFieldError(e validator.FieldError) string {
    fieldMessages := map[string]map[string]string{
        "Username": {
            "required": "用户名不能为空",
            "min":      "用户名长度不能少于3个字符",
            "max":      "用户名长度不能超过32个字符",
        },
        "Mobile": {
            "required": "手机号不能为空",
            "mobile":   "手机号格式不正确",
        },
        "Email": {
            "required": "邮箱不能为空",
            "email":    "邮箱格式不正确",
        },
    }
    
    if messages, ok := fieldMessages[e.Field()]; ok {
        if msg, ok := messages[e.Tag()]; ok {
            return msg
        }
    }
    return e.Error()
}

// internal/dto/request/user_request.go
package request

type CreateUserRequest struct {
    Username string `json:"username" binding:"required,min=3,max=32"`
    Password string `json:"password" binding:"required,min=8,max=64"`
    Email    string `json:"email" binding:"required,email"`
    Mobile   string `json:"mobile" binding:"required,mobile"`
    IDCard   string `json:"id_card" binding:"omitempty,idcard"`
    Age      int    `json:"age" binding:"omitempty,gte=0,lte=150"`
    RoleID   int64  `json:"role_id" binding:"required,gt=0"`
}

type UpdateUserRequest struct {
    Username *string `json:"username" binding:"omitempty,min=3,max=32"`
    Email    *string `json:"email" binding:"omitempty,email"`
    Mobile   *string `json:"mobile" binding:"omitempty,mobile"`
    Status   *int    `json:"status" binding:"omitempty,oneof=0 1 2"`
}

type ListUserRequest struct {
    Page     int    `form:"page" binding:"omitempty,gte=1"`
    PageSize int    `form:"page_size" binding:"omitempty,gte=1,lte=100"`
    Keyword  string `form:"keyword" binding:"omitempty,max=64"`
    Status   *int   `form:"status" binding:"omitempty,oneof=0 1 2"`
    OrderBy  string `form:"order_by" binding:"omitempty,oneof=created_at updated_at"`
    Order    string `form:"order" binding:"omitempty,oneof=asc desc"`
}

func (r *ListUserRequest) SetDefaults() {
    if r.Page <= 0 {
        r.Page = 1
    }
    if r.PageSize <= 0 {
        r.PageSize = 20
    }
    if r.OrderBy == "" {
        r.OrderBy = "created_at"
    }
    if r.Order == "" {
        r.Order = "desc"
    }
}

// internal/handler/user_handler.go
func (h *UserHandler) Create(c *gin.Context) {
    var req request.CreateUserRequest
    
    if err := c.ShouldBindJSON(&req); err != nil {
        response.BadRequest(c, validator.GetValidationError(err))
        return
    }
    
    // 业务层额外校验（如唯一性）
    user, err := h.userService.Create(c.Request.Context(), &req)
    if err != nil {
        response.Error(c, err)
        return
    }
    
    response.Success(c, dto.ToUserResponse(user))
}

// 自定义校验注解
// validator/Mobile.java
@Target({ElementType.FIELD, ElementType.PARAMETER})
@Retention(RetentionPolicy.RUNTIME)
@Constraint(validatedBy = MobileValidator.class)
public @interface Mobile {
    String message() default "手机号格式不正确";
    Class<?>[] groups() default {};
    Class<? extends Payload>[] payload() default {};
}

// validator/MobileValidator.java
public class MobileValidator implements ConstraintValidator<Mobile, String> {
    private static final Pattern MOBILE_PATTERN = Pattern.compile("^1[3-9]\\d{9}$");
    
    @Override
    public boolean isValid(String value, ConstraintValidatorContext context) {
        if (value == null || value.isEmpty()) {
            return true; // 由 @NotBlank 处理空值
        }
        return MOBILE_PATTERN.matcher(value).matches();
    }
}

// dto/request/CreateUserRequest.java
@Data
public class CreateUserRequest {
    
    @NotBlank(message = "用户名不能为空")
    @Size(min = 3, max = 32, message = "用户名长度需在3-32个字符之间")
    private String username;
    
    @NotBlank(message = "密码不能为空")
    @Size(min = 8, max = 64, message = "密码长度需在8-64个字符之间")
    private String password;
    
    @NotBlank(message = "邮箱不能为空")
    @Email(message = "邮箱格式不正确")
    private String email;
    
    @NotBlank(message = "手机号不能为空")
    @Mobile
    private String mobile;
    
    @Pattern(regexp = "^\\d{17}[\\dXx]$", message = "身份证号格式不正确")
    private String idCard;
    
    @Min(value = 0, message = "年龄不能小于0")
    @Max(value = 150, message = "年龄不能大于150")
    private Integer age;
    
    @NotNull(message = "角色ID不能为空")
    @Positive(message = "角色ID必须为正数")
    private Long roleId;
}

// dto/request/UpdateUserRequest.java
@Data
public class UpdateUserRequest {
    
    @Size(min = 3, max = 32, message = "用户名长度需在3-32个字符之间")
    private String username;
    
    @Email(message = "邮箱格式不正确")
    private String email;
    
    @Mobile
    private String mobile;
    
    @ValidStatus  // 自定义校验：值必须在 0, 1, 2 中
    private Integer status;
}

// dto/request/ListUserRequest.java
@Data
public class ListUserRequest {
    
    @Min(value = 1, message = "页码最小为1")
    private Integer page = 1;
    
    @Min(value = 1, message = "每页条数最小为1")
    @Max(value = 100, message = "每页条数最大为100")
    private Integer pageSize = 20;
    
    @Size(max = 64, message = "关键词最大64个字符")
    private String keyword;
    
    private Integer status;
    
    @Pattern(regexp = "^(created_at|updated_at)$", message = "排序字段不合法")
    private String orderBy = "created_at";
    
    @Pattern(regexp = "^(asc|desc)$", message = "排序方向不合法")
    private String order = "desc";
}

// controller/UserController.java
@RestController
@RequestMapping("/api/v1/users")
@Validated
public class UserController {
    
    @Autowired
    private UserService userService;
    
    @PostMapping
    public CommonResponse<UserResponse> create(
            @Valid @RequestBody CreateUserRequest request) {
        User user = userService.create(request);
        return CommonResponse.success(UserResponse.from(user));
    }
    
    @GetMapping
    public CommonResponse<PageResult<UserResponse>> list(
            @Valid ListUserRequest request) {
        return CommonResponse.success(userService.list(request));
    }
}

// pkg/auth/jwt.go
package auth

import (
    "errors"
    "time"
    "github.com/golang-jwt/jwt/v5"
)

var (
    ErrTokenExpired     = errors.New("token已过期")
    ErrTokenInvalid     = errors.New("token无效")
    ErrTokenMalformed   = errors.New("token格式错误")
)

type Claims struct {
    UserID   int64  `json:"user_id"`
    Username string `json:"username"`
    RoleID   int64  `json:"role_id"`
    jwt.RegisteredClaims
}

type JWTManager struct {
    secretKey     []byte
    accessExpiry  time.Duration
    refreshExpiry time.Duration
    issuer        string
}

func NewJWTManager(secret string, accessExpiry, refreshExpiry time.Duration) *JWTManager {
    return &JWTManager{
        secretKey:     []byte(secret),
        accessExpiry:  accessExpiry,
        refreshExpiry: refreshExpiry,
        issuer:        "myapp",
    }
}

type TokenPair struct {
    AccessToken  string `json:"access_token"`
    RefreshToken string `json:"refresh_token"`
    ExpiresIn    int64  `json:"expires_in"`
}

func (m *JWTManager) GenerateTokenPair(userID int64, username string, roleID int64) (*TokenPair, error) {
    now := time.Now()
    
    // Access Token
    accessClaims := Claims{
        UserID:   userID,
        Username: username,
        RoleID:   roleID,
        RegisteredClaims: jwt.RegisteredClaims{
            ExpiresAt: jwt.NewNumericDate(now.Add(m.accessExpiry)),
            IssuedAt:  jwt.NewNumericDate(now),
            NotBefore: jwt.NewNumericDate(now),
            Issuer:    m.issuer,
            Subject:   "access",
        },
    }
    accessToken := jwt.NewWithClaims(jwt.SigningMethodHS256, accessClaims)
    accessTokenString, err := accessToken.SignedString(m.secretKey)
    if err != nil {
        return nil, err
    }
    
    // Refresh Token
    refreshClaims := Claims{
        UserID: userID,
        RegisteredClaims: jwt.RegisteredClaims{
            ExpiresAt: jwt.NewNumericDate(now.Add(m.refreshExpiry)),
            IssuedAt:  jwt.NewNumericDate(now),
            Subject:   "refresh",
        },
    }
    refreshToken := jwt.NewWithClaims(jwt.SigningMethodHS256, refreshClaims)
    refreshTokenString, err := refreshToken.SignedString(m.secretKey)
    if err != nil {
        return nil, err
    }
    
    return &TokenPair{
        AccessToken:  accessTokenString,
        RefreshToken: refreshTokenString,
        ExpiresIn:    int64(m.accessExpiry.Seconds()),
    }, nil
}

func (m *JWTManager) ParseToken(tokenString string) (*Claims, error) {
    token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) {
        return m.secretKey, nil
    })
    
    if err != nil {
        if errors.Is(err, jwt.ErrTokenExpired) {
            return nil, ErrTokenExpired
        }
        if errors.Is(err, jwt.ErrTokenMalformed) {
            return nil, ErrTokenMalformed
        }
        return nil, ErrTokenInvalid
    }
    
    if claims, ok := token.Claims.(*Claims); ok && token.Valid {
        return claims, nil
    }
    
    return nil, ErrTokenInvalid
}

// internal/handler/middleware/auth.go
package middleware

import (
    "strings"
    "github.com/gin-gonic/gin"
)

type contextKey string

const (
    UserIDKey   contextKey = "user_id"
    UsernameKey contextKey = "username"
    RoleIDKey   contextKey = "role_id"
)

func AuthMiddleware(jwtManager *auth.JWTManager, cache cache.TokenCache) gin.HandlerFunc {
    return func(c *gin.Context) {
        authHeader := c.GetHeader("Authorization")
        if authHeader == "" {
            response.Unauthorized(c, "缺少认证信息")
            c.Abort()
            return
        }
        
        parts := strings.SplitN(authHeader, " ", 2)
        if len(parts) != 2 || parts[0] != "Bearer" {
            response.Unauthorized(c, "认证格式错误")
            c.Abort()
            return
        }
        
        tokenString := parts[1]
        
        // 检查 Token 是否在黑名单中（用于登出）
        if cache.IsBlacklisted(c.Request.Context(), tokenString) {
            response.Unauthorized(c, "Token已失效")
            c.Abort()
            return
        }
        
        claims, err := jwtManager.ParseToken(tokenString)
        if err != nil {
            switch err {
            case auth.ErrTokenExpired:
                response.Unauthorized(c, "Token已过期")
            default:
                response.Unauthorized(c, "Token无效")
            }
            c.Abort()
            return
        }
        
        // 存入上下文
        c.Set(string(UserIDKey), claims.UserID)
        c.Set(string(UsernameKey), claims.Username)
        c.Set(string(RoleIDKey), claims.RoleID)
        
        c.Next()
    }
}

// 获取当前用户ID
func GetCurrentUserID(c *gin.Context) int64 {
    if v, exists := c.Get(string(UserIDKey)); exists {
        return v.(int64)
    }
    return 0
}

// 获取当前用户角色
func GetCurrentRoleID(c *gin.Context) int64 {
    if v, exists := c.Get(string(RoleIDKey)); exists {
        return v.(int64)
    }
    return 0
}

// util/JwtUtil.java
@Component
public class JwtUtil {
    
    @Value("${jwt.secret}")
    private String secret;
    
    @Value("${jwt.access-expiry:7200}")
    private long accessExpiry; // 秒
    
    @Value("${jwt.refresh-expiry:604800}")
    private long refreshExpiry; // 秒
    
    @Data
    @AllArgsConstructor
    public static class TokenPair {
        private String accessToken;
        private String refreshToken;
        private Long expiresIn;
    }
    
    public TokenPair generateTokenPair(Long userId, String username, Long roleId) {
        Date now = new Date();
        
        String accessToken = Jwts.builder()
                .setSubject(userId.toString())
                .claim("username", username)
                .claim("role_id", roleId)
                .claim("type", "access")
                .setIssuedAt(now)
                .setExpiration(new Date(now.getTime() + accessExpiry * 1000))
                .signWith(Keys.hmacShaKeyFor(secret.getBytes()), SignatureAlgorithm.HS256)
                .compact();
        
        String refreshToken = Jwts.builder()
                .setSubject(userId.toString())
                .claim("type", "refresh")
                .setIssuedAt(now)
                .setExpiration(new Date(now.getTime() + refreshExpiry * 1000))
                .signWith(Keys.hmacShaKeyFor(secret.getBytes()), SignatureAlgorithm.HS256)
                .compact();
        
        return new TokenPair(accessToken, refreshToken, accessExpiry);
    }
    
    public Claims parseToken(String token) {
        return Jwts.parserBuilder()
                .setSigningKey(Keys.hmacShaKeyFor(secret.getBytes()))
                .build()
                .parseClaimsJws(token)
                .getBody();
    }
    
    public Long getUserIdFromToken(String token) {
        return Long.parseLong(parseToken(token).getSubject());
    }
    
    public boolean isTokenExpired(String token) {
        try {
            return parseToken(token).getExpiration().before(new Date());
        } catch (ExpiredJwtException e) {
            return true;
        }
    }
}

// filter/JwtAuthenticationFilter.java
@Component
@RequiredArgsConstructor
public class JwtAuthenticationFilter extends OncePerRequestFilter {
    
    private final JwtUtil jwtUtil;
    private final UserDetailsService userDetailsService;
    private final RedisTemplate<String, Object> redisTemplate;
    
    private static final String TOKEN_BLACKLIST_PREFIX = "token:blacklist:";
    
    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain filterChain) throws ServletException, IOException {
        
        String authHeader = request.getHeader("Authorization");
        
        if (authHeader == null || !authHeader.startsWith("Bearer ")) {
            filterChain.doFilter(request, response);
            return;
        }
        
        String token = authHeader.substring(7);
        
        try {
            // 检查黑名单
            if (Boolean.TRUE.equals(redisTemplate.hasKey(TOKEN_BLACKLIST_PREFIX + token))) {
                sendErrorResponse(response, HttpStatus.UNAUTHORIZED, "Token已失效");
                return;
            }
            
            Long userId = jwtUtil.getUserIdFromToken(token);
            
            if (userId != null && SecurityContextHolder.getContext().getAuthentication() == null) {
                UserDetails userDetails = userDetailsService.loadUserByUsername(userId.toString());
                
                if (!jwtUtil.isTokenExpired(token)) {
                    UsernamePasswordAuthenticationToken authentication =
                            new UsernamePasswordAuthenticationToken(
                                    userDetails, null, userDetails.getAuthorities());
                    authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                    SecurityContextHolder.getContext().setAuthentication(authentication);
                }
            }
        } catch (ExpiredJwtException e) {
            sendErrorResponse(response, HttpStatus.UNAUTHORIZED, "Token已过期");
            return;
        } catch (JwtException e) {
            sendErrorResponse(response, HttpStatus.UNAUTHORIZED, "Token无效");
            return;
        }
        
        filterChain.doFilter(request, response);
    }
    
    private void sendErrorResponse(HttpServletResponse response, HttpStatus status, String message)
            throws IOException {
        response.setStatus(status.value());
        response.setContentType("application/json;charset=UTF-8");
        response.getWriter().write(
                String.format("{\"code\":%d,\"message\":\"%s\"}", status.value(), message));
    }
}

// config/SecurityConfig.java
@Configuration
@EnableWebSecurity
@RequiredArgsConstructor
public class SecurityConfig {
    
    private final JwtAuthenticationFilter jwtAuthenticationFilter;
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .csrf(AbstractHttpConfigurer::disable)
            .sessionManagement(session -> 
                session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/v1/auth/**").permitAll()
                .requestMatchers("/api/v1/public/**").permitAll()
                .requestMatchers("/actuator/health").permitAll()
                .anyRequest().authenticated())
            .addFilterBefore(jwtAuthenticationFilter, 
                UsernamePasswordAuthenticationFilter.class);
        
        return http.build();
    }
    
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

// internal/service/permission_service.go
package service

type PermissionService interface {
    GetRolePermissions(ctx context.Context, roleID int64) ([]string, error)
    HasPermission(ctx context.Context, roleID int64, permCode string) (bool, error)
    CheckPermissions(ctx context.Context, roleID int64, permCodes ...string) (bool, error)
}

type permissionService struct {
    roleRepo       repository.RoleRepository
    permissionRepo repository.PermissionRepository
    cache          cache.Cache
}

func NewPermissionService(
    roleRepo repository.RoleRepository,
    permRepo repository.PermissionRepository,
    cache cache.Cache,
) PermissionService {
    return &permissionService{
        roleRepo:       roleRepo,
        permissionRepo: permRepo,
        cache:          cache,
    }
}

func (s *permissionService) GetRolePermissions(ctx context.Context, roleID int64) ([]string, error) {
    // 先查缓存
    cacheKey := fmt.Sprintf("role:permissions:%d", roleID)
    var permissions []string
    
    if err := s.cache.Get(ctx, cacheKey, &permissions); err == nil {
        return permissions, nil
    }
    
    // 查数据库
    permissions, err := s.permissionRepo.FindCodesByRoleID(ctx, roleID)
    if err != nil {
        return nil, err
    }
    
    // 写入缓存，过期时间 30 分钟
    _ = s.cache.Set(ctx, cacheKey, permissions, 30*time.Minute)
    
    return permissions, nil
}

func (s *permissionService) HasPermission(ctx context.Context, roleID int64, permCode string) (bool, error) {
    permissions, err := s.GetRolePermissions(ctx, roleID)
    if err != nil {
        return false, err
    }
    
    for _, p := range permissions {
        if p == permCode || p == "*" { // * 表示超级权限
            return true, nil
        }
        // 支持通配符匹配：user:* 匹配 user:create, user:read 等
        if strings.HasSuffix(p, ":*") {
            prefix := strings.TrimSuffix(p, "*")
            if strings.HasPrefix(permCode, prefix) {
                return true, nil
            }
        }
    }
    
    return false, nil
}

func (s *permissionService) CheckPermissions(ctx context.Context, roleID int64, permCodes ...string) (bool, error) {
    for _, code := range permCodes {
        has, err := s.HasPermission(ctx, roleID, code)
        if err != nil {
            return false, err
        }
        if !has {
            return false, nil
        }
    }
    return true, nil
}

// internal/handler/middleware/permission.go
package middleware

import (
    "github.com/gin-gonic/gin"
)

// RequirePermission 创建权限校验中间件
func RequirePermission(permService service.PermissionService, permissions ...string) gin.HandlerFunc {
    return func(c *gin.Context) {
        roleID := GetCurrentRoleID(c)
        if roleID == 0 {
            response.Forbidden(c, "未获取到角色信息")
            c.Abort()
            return
        }
        
        has, err := permService.CheckPermissions(c.Request.Context(), roleID, permissions...)
        if err != nil {
            response.InternalError(c, "权限校验失败")
            c.Abort()
            return
        }
        
        if !has {
            response.Forbidden(c, "权限不足")
            c.Abort()
            return
        }
        
        c.Next()
    }
}

// RequireAnyPermission 满足任一权限即可
func RequireAnyPermission(permService service.PermissionService, permissions ...string) gin.HandlerFunc {
    return func(c *gin.Context) {
        roleID := GetCurrentRoleID(c)
        if roleID == 0 {
            response.Forbidden(c, "未获取到角色信息")
            c.Abort()
            return
        }
        
        for _, perm := range permissions {
            has, err := permService.HasPermission(c.Request.Context(), roleID, perm)
            if err != nil {
                continue
            }
            if has {
                c.Next()
                return
            }
        }
        
        response.Forbidden(c, "权限不足")
        c.Abort()
    }
}

// RequireRole 角色校验
func RequireRole(roles ...string) gin.HandlerFunc {
    roleSet := make(map[string]struct{})
    for _, r := range roles {
        roleSet[r] = struct{}{}
    }
    
    return func(c *gin.Context) {
        roleCode := GetCurrentRoleCode(c)
        if _, ok := roleSet[roleCode]; !ok {
            response.Forbidden(c, "角色权限不足")
            c.Abort()
            return
        }
        c.Next()
    }
}

// 路由注册示例
// cmd/server/router.go
func SetupRouter(
    userHandler *handler.UserHandler,
    orderHandler *handler.OrderHandler,
    permService service.PermissionService,
    jwtManager *auth.JWTManager,
    tokenCache cache.TokenCache,
) *gin.Engine {
    r := gin.New()
    
    // 全局中间件
    r.Use(middleware.Recovery())
    r.Use(middleware.Logger())
    r.Use(middleware.RateLimit(100, time.Minute))
    r.Use(middleware.CORS())
    
    // 公开路由
    public := r.Group("/api/v1")
    {
        public.POST("/auth/login", userHandler.Login)
        public.POST("/auth/register", userHandler.Register)
        public.POST("/auth/refresh", userHandler.RefreshToken)
    }
    
    // 需要认证的路由
    authorized := r.Group("/api/v1")
    authorized.Use(middleware.AuthMiddleware(jwtManager, tokenCache))
    {
        // 用户模块
        users := authorized.Group("/users")
        {
            users.GET("", 
                middleware.RequirePermission(permService, "user:list"),
                userHandler.List)
            users.GET("/:id", 
                middleware.RequirePermission(permService, "user:read"),
                userHandler.GetByID)
            users.POST("", 
                middleware.RequirePermission(permService, "user:create"),
                userHandler.Create)
            users.PUT("/:id", 
                middleware.RequirePermission(permService, "user:update"),
                userHandler.Update)
            users.DELETE("/:id", 
                middleware.RequirePermission(permService, "user:delete"),
                userHandler.Delete)
        }
        
        // 订单模块
        orders := authorized.Group("/orders")
        {
            orders.GET("", 
                middleware.RequireAnyPermission(permService, "order:list", "order:*"),
                orderHandler.List)
            orders.POST("/:id/cancel",
                middleware.RequirePermission(permService, "order:cancel"),
                orderHandler.Cancel)
        }
        
        // 管理员专用
        admin := authorized.Group("/admin")
        admin.Use(middleware.RequireRole("admin", "super_admin"))
        {
            admin.GET("/dashboard", userHandler.Dashboard)
            admin.POST("/users/:id/ban", userHandler.BanUser)
        }
    }
    
    return r
}

// annotation/RequirePermission.java
@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
public @interface RequirePermission {
    String[] value();           // 所需权限码
    Logical logical() default Logical.AND;  // 权限间逻辑关系
}

// annotation/RequireRole.java
@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
public @interface RequireRole {
    String[] value();
}

// enums/Logical.java
public enum Logical {
    AND,  // 所有权限都需要
    OR    // 满足任一即可
}

// service/PermissionService.java
public interface PermissionService {
    List<String> getRolePermissions(Long roleId);
    boolean hasPermission(Long roleId, String permCode);
    boolean checkPermissions(Long roleId, List<String> permCodes, Logical logical);
}

// service/impl/PermissionServiceImpl.java
@Service
@RequiredArgsConstructor
public class PermissionServiceImpl implements PermissionService {
    
    private final RoleMapper roleMapper;
    private final PermissionMapper permissionMapper;
    private final RedisTemplate<String, Object> redisTemplate;
    
    private static final String ROLE_PERM_KEY = "role:permissions:";
    private static final long CACHE_EXPIRE = 30; // 分钟
    
    @Override
    @SuppressWarnings("unchecked")
    public List<String> getRolePermissions(Long roleId) {
        String cacheKey = ROLE_PERM_KEY + roleId;
        
        // 查缓存
        Object cached = redisTemplate.opsForValue().get(cacheKey);
        if (cached != null) {
            return (List<String>) cached;
        }
        
        // 查数据库
        List<String> permissions = permissionMapper.selectCodesByRoleId(roleId);
        
        // 写缓存
        redisTemplate.opsForValue().set(cacheKey, permissions, CACHE_EXPIRE, TimeUnit.MINUTES);
        
        return permissions;
    }
    
    @Override
    public boolean hasPermission(Long roleId, String permCode) {
        List<String> permissions = getRolePermissions(roleId);
        
        for (String p : permissions) {
            if (p.equals(permCode) || p.equals("*")) {
                return true;
            }
            // 通配符支持
            if (p.endsWith(":*")) {
                String prefix = p.substring(0, p.length() - 1);
                if (permCode.startsWith(prefix)) {
                    return true;
                }
            }
        }
        return false;
    }
    
    @Override
    public boolean checkPermissions(Long roleId, List<String> permCodes, Logical logical) {
        if (logical == Logical.AND) {
            return permCodes.stream().allMatch(code -> hasPermission(roleId, code));
        } else {
            return permCodes.stream().anyMatch(code -> hasPermission(roleId, code));
        }
    }
}

// aspect/PermissionAspect.java
@Aspect
@Component
@RequiredArgsConstructor
@Order(2) // 在认证之后执行
public class PermissionAspect {
    
    private final PermissionService permissionService;
    
    @Before("@annotation(requirePermission)")
    public void checkPermission(JoinPoint joinPoint, RequirePermission requirePermission) {
        Long roleId = getCurrentRoleId();
        if (roleId == null) {
            throw new ForbiddenException("未获取到角色信息");
        }
        
        List<String> required = Arrays.asList(requirePermission.value());
        boolean hasPermission = permissionService.checkPermissions(
                roleId, required, requirePermission.logical());
        
        if (!hasPermission) {
            throw new ForbiddenException("权限不足");
        }
    }
    
    @Before("@annotation(requireRole)")
    public void checkRole(JoinPoint joinPoint, RequireRole requireRole) {
        String currentRole = getCurrentRoleCode();
        if (currentRole == null) {
            throw new ForbiddenException("未获取到角色信息");
        }
        
        Set<String> allowedRoles = Set.of(requireRole.value());
        if (!allowedRoles.contains(currentRole)) {
            throw new ForbiddenException("角色权限不足");
        }
    }
    
    private Long getCurrentRoleId() {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth != null && auth.getPrincipal() instanceof CustomUserDetails) {
            return ((CustomUserDetails) auth.getPrincipal()).getRoleId();
        }
        return null;
    }
    
    private String getCurrentRoleCode() {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth != null && auth.getPrincipal() instanceof CustomUserDetails) {
            return ((CustomUserDetails) auth.getPrincipal()).getRoleCode();
        }
        return null;
    }
}

// controller/UserController.java
@RestController
@RequestMapping("/api/v1/users")
@RequiredArgsConstructor
public class UserController {
    
    private final UserService userService;
    
    @GetMapping
    @RequirePermission("user:list")
    public CommonResponse<PageResult<UserResponse>> list(@Valid ListUserRequest request) {
        return CommonResponse.success(userService.list(request));
    }
    
    @GetMapping("/{id}")
    @RequirePermission("user:read")
    public CommonResponse<UserResponse> getById(@PathVariable Long id) {
        return CommonResponse.success(userService.getById(id));
    }
    
    @PostMapping
    @RequirePermission("user:create")
    public CommonResponse<UserResponse> create(@Valid @RequestBody CreateUserRequest request) {
        return CommonResponse.success(userService.create(request));
    }
    
    @PutMapping("/{id}")
    @RequirePermission("user:update")
    public CommonResponse<Void> update(
            @PathVariable Long id,
            @Valid @RequestBody UpdateUserRequest request) {
        userService.update(id, request);
        return CommonResponse.success();
    }
    
    @DeleteMapping("/{id}")
    @RequirePermission("user:delete")
    public CommonResponse<Void> delete(@PathVariable Long id) {
        userService.delete(id);
        return CommonResponse.success();
    }
    
    // 需要多个权限（AND 逻辑）
    @PostMapping("/{id}/reset-password")
    @RequirePermission(value = {"user:update", "user:sensitive"}, logical = Logical.AND)
    public CommonResponse<Void> resetPassword(@PathVariable Long id) {
        userService.resetPassword(id);
        return CommonResponse.success();
    }
    
    // 满足任一权限即可（OR 逻辑）
    @GetMapping("/{id}/detail")
    @RequirePermission(value = {"user:read", "user:admin"}, logical = Logical.OR)
    public CommonResponse<UserDetailResponse> getDetail(@PathVariable Long id) {
        return CommonResponse.success(userService.getDetail(id));
    }
}

// controller/AdminController.java
@RestController
@RequestMapping("/api/v1/admin")
@RequireRole({"admin", "super_admin"})  // 类级别角色限制
public class AdminController {
    
    @GetMapping("/dashboard")
    public CommonResponse<DashboardVO> dashboard() {
        // ...
    }
    
    @PostMapping("/users/{id}/ban")
    @RequirePermission("user:ban")  // 方法级别额外权限
    public CommonResponse<Void> banUser(@PathVariable Long id) {
        // ...
    }
}

// pkg/cache/cache.go
package cache

import (
    "context"
    "encoding/json"
    "time"
    "github.com/redis/go-redis/v9"
)

type Cache interface {
    Get(ctx context.Context, key string, dest interface{}) error
    Set(ctx context.Context, key string, value interface{}, expiration time.Duration) error
    Delete(ctx context.Context, keys ...string) error
    Exists(ctx context.Context, key string) (bool, error)
    SetNX(ctx context.Context, key string, value interface{}, expiration time.Duration) (bool, error)
    Incr(ctx context.Context, key string) (int64, error)
    Expire(ctx context.Context, key string, expiration time.Duration) error
}

type redisCache struct {
    client *redis.Client
}

func NewRedisCache(client *redis.Client) Cache {
    return &redisCache{client: client}
}

func (c *redisCache) Get(ctx context.Context, key string, dest interface{}) error {
    data, err := c.client.Get(ctx, key).Bytes()
    if err != nil {
        if err == redis.Nil {
            return ErrCacheMiss
        }
        return err
    }
    return json.Unmarshal(data, dest)
}

func (c *redisCache) Set(ctx context.Context, key string, value interface{}, expiration time.Duration) error {
    data, err := json.Marshal(value)
    if err != nil {
        return err
    }
    return c.client.Set(ctx, key, data, expiration).Err()
}

func (c *redisCache) Delete(ctx context.Context, keys ...string) error {
    return c.client.Del(ctx, keys...).Err()
}

var ErrCacheMiss = errors.New("cache miss")

// internal/repository/cache/user_cache.go
package cache

import (
    "context"
    "fmt"
    "time"
)

type UserCache interface {
    GetUser(ctx context.Context, id int64) (*entity.User, error)
    SetUser(ctx context.Context, user *entity.User) error
    DeleteUser(ctx context.Context, id int64) error
    GetUserByEmail(ctx context.Context, email string) (*entity.User, error)
    SetUserByEmail(ctx context.Context, user *entity.User) error
}

type userCache struct {
    cache      cache.Cache
    expiration time.Duration
}

func NewUserCache(c cache.Cache) UserCache {
    return &userCache{
        cache:      c,
        expiration: 30 * time.Minute,
    }
}

func (c *userCache) userKey(id int64) string {
    return fmt.Sprintf("user:id:%d", id)
}

func (c *userCache) userEmailKey(email string) string {
    return fmt.Sprintf("user:email:%s", email)
}

func (c *userCache) GetUser(ctx context.Context, id int64) (*entity.User, error) {
    var user entity.User
    err := c.cache.Get(ctx, c.userKey(id), &user)
    if err != nil {
        return nil, err
    }
    return &user, nil
}

func (c *userCache) SetUser(ctx context.Context, user *entity.User) error {
    return c.cache.Set(ctx, c.userKey(user.ID), user, c.expiration)
}

func (c *userCache) DeleteUser(ctx context.Context, id int64) error {
    return c.cache.Delete(ctx, c.userKey(id))
}

// internal/service/user_service.go - 带缓存的服务层
package service

type userService struct {
    userRepo  repository.UserRepository
    userCache cache.UserCache
    logger    *zap.Logger
}

func (s *userService) GetByID(ctx context.Context, id int64) (*entity.User, error) {
    // 1. 查缓存
    user, err := s.userCache.GetUser(ctx, id)
    if err == nil {
        s.logger.Debug("cache hit", zap.Int64("user_id", id))
        return user, nil
    }
    
    if err != cache.ErrCacheMiss {
        s.logger.Warn("cache error", zap.Error(err))
    }
    
    // 2. 查数据库
    user, err = s.userRepo.FindByID(ctx, id)
    if err != nil {
        return nil, err
    }
    if user == nil {
        return nil, ErrUserNotFound
    }
    
    // 3. 写入缓存（异步）
    go func() {
        if err := s.userCache.SetUser(context.Background(), user); err != nil {
            s.logger.Warn("failed to set cache", zap.Error(err))
        }
    }()
    
    return user, nil
}

func (s *userService) Update(ctx context.Context, id int64, req *dto.UpdateUserRequest) error {
    // 1. 更新数据库
    if err := s.userRepo.Update(ctx, id, req); err != nil {
        return err
    }
    
    // 2. 删除缓存（保证一致性）
    if err := s.userCache.DeleteUser(ctx, id); err != nil {
        s.logger.Warn("failed to delete cache", zap.Error(err))
    }
    
    return nil
}

func (s *userService) Delete(ctx context.Context, id int64) error {
    // 1. 删除数据库
    if err := s.userRepo.Delete(ctx, id); err != nil {
        return err
    }
    
    // 2. 删除缓存
    if err := s.userCache.DeleteUser(ctx, id); err != nil {
        s.logger.Warn("failed to delete cache", zap.Error(err))
    }
    
    return nil
}

// 防缓存穿透 - 布隆过滤器 + 空值缓存
// internal/service/user_service.go

func (s *userService) GetByIDWithProtection(ctx context.Context, id int64) (*entity.User, error) {
    // 1. 布隆过滤器检查（可选）
    if s.bloomFilter != nil && !s.bloomFilter.Test([]byte(fmt.Sprintf("user:%d", id))) {
        return nil, ErrUserNotFound
    }
    
    // 2. 查缓存
    user, err := s.userCache.GetUser(ctx, id)
    if err == nil {
        // 检查是否为空值缓存
        if user.ID == 0 {
            return nil, ErrUserNotFound
        }
        return user, nil
    }
    
    // 3. 分布式锁防止缓存击穿
    lockKey := fmt.Sprintf("lock:user:%d", id)
    locked, err := s.cache.SetNX(ctx, lockKey, "1", 5*time.Second)
    if err != nil {
        return nil, err
    }
    
    if !locked {
        // 未获取到锁，等待后重试
        time.Sleep(100 * time.Millisecond)
        return s.GetByIDWithProtection(ctx, id)
    }
    defer s.cache.Delete(ctx, lockKey)
    
    // 4. 再次检查缓存（双重检查）
    user, err = s.userCache.GetUser(ctx, id)
    if err == nil {
        return user, nil
    }
    
    // 5. 查数据库
    user, err = s.userRepo.FindByID(ctx, id)
    if err != nil {
        return nil, err
    }
    
    if user == nil {
        // 缓存空值，防止缓存穿透
        _ = s.userCache.SetUser(ctx, &entity.User{})
        return nil, ErrUserNotFound
    }
    
    // 6. 写入缓存
    _ = s.userCache.SetUser(ctx, user)
    
    return user, nil
}

// config/RedisConfig.java
@Configuration
@EnableCaching
public class RedisConfig {
    
    @Bean
    public RedisTemplate<String, Object> redisTemplate(RedisConnectionFactory factory) {
        RedisTemplate<String, Object> template = new RedisTemplate<>();
        template.setConnectionFactory(factory);
        
        // Key 序列化
        template.setKeySerializer(new StringRedisSerializer());
        template.setHashKeySerializer(new StringRedisSerializer());
        
        // Value 序列化
        Jackson2JsonRedisSerializer<Object> jsonSerializer = 
                new Jackson2JsonRedisSerializer<>(Object.class);
        ObjectMapper om = new ObjectMapper();
        om.setVisibility(PropertyAccessor.ALL, JsonAutoDetect.Visibility.ANY);
        om.activateDefaultTyping(
                LaissezFaireSubTypeValidator.instance,
                ObjectMapper.DefaultTyping.NON_FINAL);
        jsonSerializer.setObjectMapper(om);
        
        template.setValueSerializer(jsonSerializer);
        template.setHashValueSerializer(jsonSerializer);
        
        template.afterPropertiesSet();
        return template;
    }
    
    @Bean
    public CacheManager cacheManager(RedisConnectionFactory factory) {
        RedisCacheConfiguration config = RedisCacheConfiguration.defaultCacheConfig()
                .entryTtl(Duration.ofMinutes(30))
                .serializeKeysWith(
                    RedisSerializationContext.SerializationPair.fromSerializer(
                        new StringRedisSerializer()))
                .serializeValuesWith(
                    RedisSerializationContext.SerializationPair.fromSerializer(
                        new GenericJackson2JsonRedisSerializer()))
                .disableCachingNullValues();
        
        // 不同缓存空间配置不同过期时间
        Map<String, RedisCacheConfiguration> configMap = new HashMap<>();
        configMap.put("user", config.entryTtl(Duration.ofMinutes(30)));
        configMap.put("order", config.entryTtl(Duration.ofMinutes(10)));
        configMap.put("permission", config.entryTtl(Duration.ofHours(1)));
        
        return RedisCacheManager.builder(factory)
                .cacheDefaults(config)
                .withInitialCacheConfigurations(configMap)
                .build();
    }
}

// service/impl/UserServiceImpl.java
@Service
@RequiredArgsConstructor
@Slf4j
public class UserServiceImpl implements UserService {
    
    private final UserMapper userMapper;
    private final RedisTemplate<String, Object> redisTemplate;
    
    private static final String USER_CACHE_KEY = "user:id:";
    private static final long CACHE_EXPIRE = 30; // 分钟
    
    @Override
    @Cacheable(value = "user", key = "#id", unless = "#result == null")
    public User getById(Long id) {
        log.debug("Cache miss, querying database for user: {}", id);
        return userMapper.selectById(id);
    }
    
    @Override
    @CachePut(value = "user", key = "#result.id")
    @Transactional
    public User create(CreateUserRequest request) {
        User user = new User();
        BeanUtils.copyProperties(request, user);
        user.setPassword(passwordEncoder.encode(request.getPassword()));
        user.setCreatedAt(LocalDateTime.now());
        userMapper.insert(user);
        return user;
    }
    
    @Override
    @CacheEvict(value = "user", key = "#id")
    @Transactional
    public void update(Long id, UpdateUserRequest request) {
        User user = userMapper.selectById(id);
        if (user == null) {
            throw new NotFoundException("用户不存在");
        }
        
        if (request.getUsername() != null) {
            user.setUsername(request.getUsername());
        }
        if (request.getEmail() != null) {
            user.setEmail(request.getEmail());
        }
        user.setUpdatedAt(LocalDateTime.now());
        
        userMapper.updateById(user);
    }
    
    @Override
    @CacheEvict(value = "user", key = "#id")
    @Transactional
    public void delete(Long id) {
        userMapper.deleteById(id);
    }
    
    // 批量删除缓存
    @Override
    @CacheEvict(value = "user", allEntries = true)
    @Transactional
    public void batchDelete(List<Long> ids) {
        userMapper.deleteBatchIds(ids);
    }
    
    // 手动缓存控制 - 带穿透保护
    @Override
    public User getByIdWithProtection(Long id) {
        String cacheKey = USER_CACHE_KEY + id;
        
        // 1. 查缓存
        Object cached = redisTemplate.opsForValue().get(cacheKey);
        if (cached != null) {
            if (cached instanceof NullValue) {
                return null; // 空值缓存
            }
            return (User) cached;
        }
        
        // 2. 分布式锁
        String lockKey = "lock:user:" + id;
        Boolean locked = redisTemplate.opsForValue()
                .setIfAbsent(lockKey, "1", Duration.ofSeconds(5));
        
        if (Boolean.FALSE.equals(locked)) {
            try {
                Thread.sleep(100);
            } catch (InterruptedException e) {
                Thread.currentThread().interrupt();
            }
            return getByIdWithProtection(id);
        }
        
        try {
            // 3. 双重检查
            cached = redisTemplate.opsForValue().get(cacheKey);
            if (cached != null) {
                return cached instanceof NullValue ? null : (User) cached;
            }
            
            // 4. 查数据库
            User user = userMapper.selectById(id);
            
            // 5. 写缓存
            if (user != null) {
                redisTemplate.opsForValue().set(cacheKey, user, 
                        CACHE_EXPIRE, TimeUnit.MINUTES);
            } else {
                // 缓存空值，防止穿透
                redisTemplate.opsForValue().set(cacheKey, NullValue.INSTANCE, 
                        5, TimeUnit.MINUTES);
            }
            
            return user;
        } finally {
            redisTemplate.delete(lockKey);
        }
    }
    
    // 空值标记
    private static class NullValue implements Serializable {
        static final NullValue INSTANCE = new NullValue();
        private static final long serialVersionUID = 1L;
    }
}

// 自定义缓存注解 - 支持更复杂的缓存策略
// annotation/CacheableWithLock.java
@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface CacheableWithLock {
    String cacheName();
    String key();
    long expire() default 30;  // 分钟
    long lockTimeout() default 5;  // 秒
    boolean cacheNull() default true;
}

// aspect/CacheAspect.java
@Aspect
@Component
@RequiredArgsConstructor
@Slf4j
public class CacheAspect {
    
    private final RedisTemplate<String, Object> redisTemplate;
    private final SpelExpressionParser parser = new SpelExpressionParser();
    
    @Around("@annotation(cacheableWithLock)")
    public Object around(ProceedingJoinPoint pjp, CacheableWithLock cacheableWithLock) 
            throws Throwable {
        
        String cacheKey = buildCacheKey(pjp, cacheableWithLock);
        
        // 1. 查缓存
        Object cached = redisTemplate.opsForValue().get(cacheKey);
        if (cached != null) {
            if (cached instanceof NullValue) {
                return null;
            }
            log.debug("Cache hit: {}", cacheKey);
            return cached;
        }
        
        // 2. 加锁
        String lockKey = "lock:" + cacheKey;
        Boolean locked = redisTemplate.opsForValue()
                .setIfAbsent(lockKey, "1", 
                    Duration.ofSeconds(cacheableWithLock.lockTimeout()));
        
        if (Boolean.FALSE.equals(locked)) {
            Thread.sleep(100);
            return around(pjp, cacheableWithLock); // 重试
        }
        
        try {
            // 3. 双重检查
            cached = redisTemplate.opsForValue().get(cacheKey);
            if (cached != null) {
                return cached instanceof NullValue ? null : cached;
            }
            
            // 4. 执行方法
            Object result = pjp.proceed();
            
            // 5. 写缓存
            if (result != null) {
                redisTemplate.opsForValue().set(cacheKey, result,
                        Duration.ofMinutes(cacheableWithLock.expire()));
            } else if (cacheableWithLock.cacheNull()) {
                redisTemplate.opsForValue().set(cacheKey, NullValue.INSTANCE,
                        Duration.ofMinutes(5));
            }
            
            return result;
        } finally {
            redisTemplate.delete(lockKey);
        }
    }
    
    private String buildCacheKey(ProceedingJoinPoint pjp, CacheableWithLock annotation) {
        MethodSignature signature = (MethodSignature) pjp.getSignature();
        EvaluationContext context = new StandardEvaluationContext();
        
        String[] paramNames = signature.getParameterNames();
        Object[] args = pjp.getArgs();
        for (int i = 0; i < paramNames.length; i++) {
            context.setVariable(paramNames[i], args[i]);
        }
        
        String keyExpression = annotation.key();
        String key = parser.parseExpression(keyExpression)
                .getValue(context, String.class);
        
        return annotation.cacheName() + ":" + key;
    }
    
    private static class NullValue implements Serializable {
        static final NullValue INSTANCE = new NullValue();
    }
}