Spring Security+Hibernate按需加载用户懒加载关联的最佳实践

针对你遇到的按需加载用户关联的场景，以下几种方案可以满足需求，无需将关联设为EAGER：

1. 基于请求上下文动态调整UserDetailsService的加载逻辑 #

你可以在自定义的UserDetailsService中注入HttpServletRequest，根据当前请求的路径或方法，动态选择是否通过JOIN FETCH加载指定关联。

示例代码：

@Service
public class CustomUserDetailsService implements UserDetailsService {

    private final UserRepository userRepository;
    private final HttpServletRequest request;

    public CustomUserDetailsService(UserRepository userRepository, HttpServletRequest request) {
        this.userRepository = userRepository;
        this.request = request;
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        String requestPath = request.getRequestURI();
        String requestMethod = request.getMethod();

        User user;
        // 针对POST /todo请求，加载用户的todos关联
        if ("POST".equals(requestMethod) && "/todo".equals(requestPath)) {
            user = userRepository.findByUsernameWithTodos(username)
                    .orElseThrow(() -> new UsernameNotFoundException("User not found"));
        } else {
            // 其他请求仅加载用户本身
            user = userRepository.findByUsername(username)
                    .orElseThrow(() -> new UsernameNotFoundException("User not found"));
        }
        // 转换为UserDetails返回
        return new UserPrincipal(user);
    }
}

// UserRepository中定义对应的查询方法
public interface UserRepository extends JpaRepository<User, Long> {
    Optional<User> findByUsername(String username);

    @Query("SELECT u FROM User u JOIN FETCH u.todos WHERE u.username = :username")
    Optional<User> findByUsernameWithTodos(@Param("username") String username);
}

2. 服务层显式初始化懒加载关联 #

在处理POST /todo的业务逻辑中，拿到SecurityContext中的用户后，通过Spring Data JPA的专用查询方法重新加载用户并获取关联，或者使用JPA的API初始化懒加载集合。

示例代码：

@Service
public class TodoService {

    private final UserRepository userRepository;
    private final TodoRepository todoRepository;

    public TodoService(UserRepository userRepository, TodoRepository todoRepository) {
        this.userRepository = userRepository;
        this.todoRepository = todoRepository;
    }

    public Todo createTodo(String content, Authentication authentication) {
        UserPrincipal principal = (UserPrincipal) authentication.getPrincipal();
        // 重新查询用户并加载todos关联
        User user = userRepository.findByIdWithTodos(principal.getId())
                .orElseThrow(() -> new RuntimeException("User not found"));
        
        Todo todo = new Todo();
        todo.setContent(content);
        todo.setUser(user);
        user.getTodos().add(todo);
        
        userRepository.save(user);
        return todo;
    }
}

// UserRepository中添加方法
@Query("SELECT u FROM User u JOIN FETCH u.todos WHERE u.id = :id")
Optional<User> findByIdWithTodos(@Param("id") Long id);

如果你不想重新查询，也可以用EntityManager初始化懒加载集合：

@PersistenceContext
private EntityManager entityManager;

// 在服务方法中
entityManager.refresh(user); // 或者直接初始化集合
Hibernate.initialize(user.getTodos());

3. 使用@EntityGraph简化关联加载 #

结合Spring Data JPA的@EntityGraph注解，可以更简洁地定义需要加载的关联，无需手写JPQL。

示例代码：

public interface UserRepository extends JpaRepository<User, Long> {
    Optional<User> findByUsername(String username);

    @EntityGraph(attributePaths = "todos", type = EntityGraph.EntityGraphType.FETCH)
    Optional<User> findByUsername(String username);
}

可以定义两个同名方法，通过不同的参数或@EntityGraph区分，或者直接在需要的场景调用带注解的方法。

4. 自定义延迟加载的UserPrincipal包装类 #

如果希望实现真正的按需加载（即只有当访问关联集合时才去加载），可以自定义一个UserPrincipal类，延迟获取关联数据。

示例代码：

public class UserPrincipal implements UserDetails {

    private final Long userId;
    private final String username;
    private final String password;
    private final UserRepository userRepository;
    // 缓存已加载的todos，避免重复查询
    private List<Todo> todos;

    public UserPrincipal(User user, UserRepository userRepository) {
        this.userId = user.getId();
        this.username = user.getUsername();
        this.password = user.getPassword();
        this.userRepository = userRepository;
    }

    // 按需加载todos
    public List<Todo> getTodos() {
        if (todos == null) {
            User user = userRepository.findByIdWithTodos(userId)
                    .orElseThrow(() -> new RuntimeException("User not found"));
            this.todos = user.getTodos();
        }
        return todos;
    }

    // 实现UserDetails的其他方法...
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        // 返回权限集合
        return Collections.emptyList();
    }

    @Override
    public String getPassword() {
        return password;
    }

    @Override
    public String getUsername() {
        return username;
    }

    // 其他方法如isAccountNonExpired等按需实现
}

在业务逻辑中调用principal.getTodos()时，才会触发关联数据的加载。

内容的提问来源于stack exchange，提问作者Lorenzo Valente