如何修改Java代码提取Security Context中subjects内的auth_claims？

给定如下JSON格式的Security Context字符串：

{
  "version": "1.2",
  "actor": {
    "id": "4381991279",
    "auth_claims": [
      "USERNAME",
      "PASSWORD"
    ],
    "auth_state": "LOGGEDIN",
    "account_number": "4796109829347323858",
    "encrypted_account_number": "",
    "party_id": "4796109829347323858",
    "user_type": "API_CALLER"
  },
  "auth_token": "****",
  "auth_token_type": "SESSION_TOKEN",
  "global_session_id": "****",
  "last_validated": 1608492054.561,
  "scopes": [
    "*"
  ],
  "claims": {
    "subject_payer_id": "",
    "application_name": "",
    "actor_payer_id": "",
    "consent_id": null
  },
  "edge_authorization": {
    "policy_decision": "PERMIT",
    "obligations": []
  },
  "subjects": [
    {
      "subject": {
        "id": "4381991279",
        "auth_claims": [
          "USERNAME",
          "PASSWORD"
        ],
        "auth_state": "LOGGEDIN",
        "account_number": "4796109829347323858",
        "encrypted_account_number": "",
        "party_id": "4796109829347323858",
        "authenticating_user": true,
        "user_type": "CONSUMER"
      },
      "features": []
    }
  ],
  "signature": ""
}

需求是捕获subjects数组内的auth_claims数组，并将其值存储为字符串列表。原Java代码如下：

private static List<String> getAuthClaims(String securityContext) {
        List<String> securityContextClaims = new ArrayList<>();
        if(StringUtils.isNotBlank(securityContext) && securityContext.contains("auth_claims")) {
            JSONObject securityContextJson = new JSONObject(securityContext);
            JSONArray auth_claims = securityContextJson.getJSONArray("subjects");
            auth_claims.forEach(claim -> securityContextClaims.add(claim.toString()));
            return securityContextClaims;
        }
        logger.warn("Security Context Is Empty or Missing Auth Claims");
        return null;
    }

但这段代码会获取subjects内的所有对象，无法仅提取目标auth_claims值，需要修改代码。

private static List<String> getAuthClaims(String securityContext) {
    List<String> securityContextClaims = new ArrayList<>();
    if (StringUtils.isNotBlank(securityContext)) {
        try {
            JSONObject securityContextJson = new JSONObject(securityContext);
            // 先获取subjects数组
            JSONArray subjects = securityContextJson.getJSONArray("subjects");
            
            // 遍历subjects中的每个元素
            for (int i = 0; i < subjects.length(); i++) {
                JSONObject subjectItem = subjects.getJSONObject(i);
                // 获取嵌套的subject对象
                JSONObject subject = subjectItem.getJSONObject("subject");
                // 获取auth_claims数组
                JSONArray authClaimsArray = subject.getJSONArray("auth_claims");
                
                // 将数组中的每个字符串添加到结果列表
                for (int j = 0; j < authClaimsArray.length(); j++) {
                    securityContextClaims.add(authClaimsArray.getString(j));
                }
            }
            
            // 如果没有提取到任何claims，打印警告
            if (securityContextClaims.isEmpty()) {
                logger.warn("Security Context Missing Auth Claims");
            }
        } catch (JSONException e) {
            logger.error("Failed to parse Security Context JSON", e);
        }
    } else {
        logger.warn("Security Context Is Empty");
    }
    // 返回空列表而非null，避免空指针风险
    return securityContextClaims;
}

• 修正层级遍历：原代码直接把subjects数组当成auth_claims数组处理，现在需要逐层解析：先取subjects数组，再遍历每个元素取出subject对象，最后从subject里提取auth_claims数组。
• 增加异常处理：添加JSONException捕获，避免JSON结构异常导致程序崩溃。
• 优化空值判断：原代码用字符串包含判断auth_claims不可靠（可能存在于其他字段），改为实际解析后判断结果列表是否为空。
• 返回空列表而非null：减少调用方空指针的风险，符合Java集合返回的最佳实践。

内容的提问来源于stack exchange，提问作者Sahil__