@Bean
public GlobalTransactionScanner globalTransactionScanner() {
    String txServiceGroup = String.format("%s-%s-tx-group",
        System.getenv("SPRING_APPLICATION_NAME"),
        System.getenv("ENV"));
    return new GlobalTransactionScanner("forum-seata-group", txServiceGroup);
}

package com.forum.gateway.filter;

import com.forum.common.utils.JwtUtil;
import io.jsonwebtoken.Claims;
import io.jsonwebtoken.ExpiredJwtException;
import io.jsonwebtoken.SignatureException;
import lombok.Data;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang3.StringUtils;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.cloud.gateway.filter.GatewayFilter;
import org.springframework.cloud.gateway.filter.factory.AbstractGatewayFilterFactory;
import org.springframework.core.io.buffer.DataBuffer;
import org.springframework.http.HttpStatus;
import org.springframework.http.server.reactive.ServerHttpRequest;
import org.springframework.http.server.reactive.ServerHttpResponse;
import org.springframework.stereotype.Component;
import org.springframework.util.AntPathMatcher;
import org.springframework.web.server.ServerWebExchange;
import reactor.core.publisher.Mono;

import java.nio.charset.StandardCharsets;
import java.util.*;
import java.util.concurrent.ConcurrentHashMap;

@Slf4j
@Component
public class AuthGatewayFilterFactory extends AbstractGatewayFilterFactory<AuthGatewayFilterFactory.Config> {

    private final JwtUtil jwtUtil;
    private final AntPathMatcher pathMatcher = new AntPathMatcher();

    // 解析缓存（避免每次都重复解析 JWT）
    private final Map<String, Claims> tokenCache = new ConcurrentHashMap<>(256);

    @Value("${gateway.auth.tokenHeader:Authorization}")
    private String tokenHeader;

    public AuthGatewayFilterFactory(JwtUtil jwtUtil) {
        super(Config.class);
        this.jwtUtil = jwtUtil;
    }

    @Override
    public GatewayFilter apply(Config config) {
        return (exchange, chain) -> {
            ServerHttpRequest request = exchange.getRequest();
            String path = request.getURI().getPath();

            // 白名单放行
            if (isWhiteListed(path, config.getWhiteList())) {
                return chain.filter(exchange);
            }

            // 获取 Token
            String token = getToken(request);
            if (StringUtils.isBlank(token)) {
                return unauthorizedResponse(exchange, "缺少认证信息");
            }

            try {
                Claims claims = tokenCache.computeIfAbsent(token, t -> jwtUtil.getClaimsFromToken(t));

                // 校验 Token 是否过期
                if (jwtUtil.isTokenExpired(token)) {
                    tokenCache.remove(token);
                    return unauthorizedResponse(exchange, "Token 已过期");
                }

                // 提取用户信息并添加到请求头
                Long userId = claims.get("userId", Long.class);
                String username = StringUtils.defaultString(claims.getSubject(), "unknown");

                ServerHttpRequest mutatedRequest = request.mutate()
                        .header("X-User-Id", String.valueOf(userId))
                        .header("X-Username", username)
                        .header("X-Trace-Id", UUID.randomUUID().toString())
                        .build();

                return chain.filter(exchange.mutate().request(mutatedRequest).build());

            } catch (ExpiredJwtException e) {
                log.warn("Token 已过期: {}", token);
                return unauthorizedResponse(exchange, "Token 已过期");
            } catch (SignatureException e) {
                log.warn("Token 签名无效: {}", token);
                return unauthorizedResponse(exchange, "无效的认证信息");
            } catch (Exception e) {
                log.error("Token 验证失败", e);
                return unauthorizedResponse(exchange, "认证失败");
            }
        };
    }

    private boolean isWhiteListed(String path, List<String> whiteList) {
        return whiteList.stream().anyMatch(pattern ->
                path.equals(pattern) || path.startsWith(pattern) || pathMatcher.match(pattern, path)
        );
    }

    private String getToken(ServerHttpRequest request) {
        String authorization = request.getHeaders().getFirst(tokenHeader);
        if (StringUtils.isNotBlank(authorization) && authorization.startsWith("Bearer ")) {
            return authorization.substring(7).trim();
        }
        return null;
    }

    private Mono<Void> unauthorizedResponse(ServerWebExchange exchange, String message) {
        ServerHttpResponse response = exchange.getResponse();
        response.setStatusCode(HttpStatus.UNAUTHORIZED);
        response.getHeaders().set("Content-Type", "application/json;charset=UTF-8");

        String body = String.format("{\"code\":401,\"message\":\"%s\",\"timestamp\":%d}",
                message, System.currentTimeMillis());

        DataBuffer buffer = response.bufferFactory().wrap(body.getBytes(StandardCharsets.UTF_8));
        return response.writeWith(Mono.just(buffer));
    }

    @Data
    public static class Config {
        private List<String> whiteList = Arrays.asList(
                "/auth/login",
                "/auth/register",
                "/auth/captcha",
                "/doc.html",
                "/swagger-ui/**",
                "/v3/api-docs/**"
        );
    }
}