Java中MongoDB CRUD操作审计拦截器选型咨询（基于GMongo）

Hey there! Since you're new to Spring and MongoDB, and you're looking for Java-level interceptors/hooks (similar to Hibernate's EmptyInterceptor) to handle CRUD auditing while using GMongo, here are some practical, tailored solutions for you:

GMongo wraps the standard MongoDB Java driver, so you can override its key CRUD methods to inject audit logic directly. This is a straightforward approach that ties closely to your GMongo setup:

• Create a custom subclass of GMongo and override methods like save(), insert(), update(), and remove(). Before delegating to the original method, add your audit steps (populating timestamps, capturing the current user, logging operation details, etc.).
• Example code snippet:

public class AuditableGMongo extends GMongo {
    @Override
    public WriteResult save(String collectionName, Object object) {
        // Apply audit fields to entities that implement an Auditable interface
        if (object instanceof Auditable) {
            Auditable auditable = (Auditable) object;
            String currentUser = getCurrentAuthenticatedUser();
            Date now = new Date();
            
            if (auditable.getCreatedAt() == null) {
                auditable.setCreatedAt(now);
                auditable.setCreatedBy(currentUser);
            }
            auditable.setUpdatedAt(now);
            auditable.setUpdatedBy(currentUser);
        }
        return super.save(collectionName, object);
    }

    // Override other CRUD methods (insert, update, remove) following the same pattern

    private String getCurrentAuthenticatedUser() {
        // Integrate with your auth system (e.g., Spring Security)
        return SecurityContextHolder.getContext().getAuthentication().getName();
    }
}

• Replace your default GMongo bean with this custom class in your Spring configuration to activate the auditing.

Spring AOP is perfect for cross-cutting concerns like auditing, as it keeps your audit logic separate from your data access code:

• Define an aspect that intercepts calls to GMongo's CRUD methods. You can target specific methods or even your own repository classes if you've wrapped GMongo in repositories.
• Example aspect implementation:

@Aspect
@Component
public class MongoCrudAuditAspect {

    @Before("execution(* com.gmongo.GMongo.save(..)) || " +
            "execution(* com.gmongo.GMongo.insert(..)) || " +
            "execution(* com.gmongo.GMongo.update(..)) || " +
            "execution(* com.gmongo.GMongo.remove(..))")
    public void interceptCrudOperations(JoinPoint joinPoint) {
        Object[] methodArgs = joinPoint.getArgs();
        String operationType = joinPoint.getSignature().getName();
        String collectionName = (String) methodArgs[0];
        Object targetEntity = methodArgs[1];

        // Update audit fields for auditable entities
        if (targetEntity instanceof Auditable) {
            Auditable auditable = (Auditable) targetEntity;
            String currentUser = getCurrentAuthenticatedUser();
            Date now = new Date();

            if (operationType.equals("save") || operationType.equals("insert")) {
                if (auditable.getCreatedAt() == null) {
                    auditable.setCreatedAt(now);
                    auditable.setCreatedBy(currentUser);
                }
                auditable.setUpdatedAt(now);
                auditable.setUpdatedBy(currentUser);
            } else if (operationType.equals("update")) {
                auditable.setUpdatedAt(now);
                auditable.setUpdatedBy(currentUser);
            }
        }

        // Optional: Save a dedicated audit log entry to MongoDB
        logAuditEvent(operationType, collectionName, targetEntity);
    }

    private void logAuditEvent(String operation, String collection, Object entity) {
        AuditLog auditLog = new AuditLog();
        auditLog.setOperation(operation);
        auditLog.setCollectionName(collection);
        auditLog.setEntityId(extractEntityId(entity)); // Add logic to get your entity's ID
        auditLog.setTimestamp(new Date());
        auditLog.setUser(getCurrentAuthenticatedUser());
        
        // Use GMongo to save this audit log to a dedicated collection
        new GMongo().save("audit_logs", auditLog);
    }

    private String getCurrentAuthenticatedUser() {
        // Adjust based on your authentication mechanism
        return SecurityContextHolder.getContext().getAuthentication().getName();
    }
}

If you're combining GMongo with Spring Data MongoDB, creating a custom base repository class lets you standardize auditing across all your repositories:

• Extend SimpleMongoRepository and override its save/delete methods to add audit logic.
• Example implementation:

public class AuditableMongoRepository<T, ID extends Serializable> extends SimpleMongoRepository<T, ID> {

    private final MongoOperations mongoOperations;

    public AuditableMongoRepository(MongoEntityInformation<T, ID> metadata, MongoOperations mongoOperations) {
        super(metadata, mongoOperations);
        this.mongoOperations = mongoOperations;
    }

    @Override
    public <S extends T> S save(S entity) {
        if (entity instanceof Auditable) {
            Auditable auditable = (Auditable) entity;
            String currentUser = getCurrentAuthenticatedUser();
            Date now = new Date();
            
            if (auditable.getCreatedAt() == null) {
                auditable.setCreatedAt(now);
                auditable.setCreatedBy(currentUser);
            }
            auditable.setUpdatedAt(now);
            auditable.setUpdatedBy(currentUser);
        }
        return super.save(entity);
    }
}

• Configure Spring Data to use this base class with the @EnableMongoRepositories annotation:

@EnableMongoRepositories(repositoryBaseClass = AuditableMongoRepository.class)

• Define a common Auditable interface with fields like createdAt, createdBy, updatedAt, updatedBy to standardize audit logic across your entities.
• For change-tracking (e.g., logging before/after state for updates), fetch the existing entity from MongoDB before the update operation and compare it with the modified version in your audit logic.
• Adjust the getCurrentAuthenticatedUser() method to match your application's authentication setup (e.g., session-based auth, API keys).

内容的提问来源于stack exchange，提问作者Nimesh Nischal