企业级Java项目金融应用领域——银行系统

银行系统

后端

• 核心框架: Spring Boot/Spring Cloud (微服务架构)

• 持久层: MyBatis/JPA, Hibernate

• 数据库: Oracle/MySQL (主从复制), Redis (缓存)

• 消息队列: RabbitMQ/Kafka (异步处理)

• API接口: RESTful API, Swagger文档

• 安全框架: Spring Security, OAuth2/JWT

• 分布式事务: Seata

• 搜索引擎: Elasticsearch (交易查询)

• 批处理: Spring Batch

前端

• Web框架: Vue.js/React + Element UI/Ant Design

• 移动端: 原生APP或React Native/Flutter

• 图表库: ECharts/D3.js (数据可视化)

**其他：**分布式锁: Redisson 分布式ID生成: Snowflake算法 文件处理: Apache POI (Excel), PDFBox 工作流引擎: Activiti/Camunda

• 容器化: Docker + Kubernetes

• 服务发现: Nacos/Eureka

• 配置中心: Apollo/Nacos

• 网关: Spring Cloud Gateway

• 监控: Prometheus + Grafana

• 日志: ELK Stack (Elasticsearch, Logstash, Kibana)

• CI/CD: Jenkins/

• GitLab CI

1. 账户管理

账户开户/销户

账户信息维护

账户状态管理(冻结/解冻)

账户余额查询

账户分级管理(个人/企业)

<dependencies>
    <!-- Spring Boot Starter -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-data-jpa</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-validation</artifactId>
    </dependency>
    
    <!-- Database -->
    <dependency>
        <groupId>mysql</groupId>
        <artifactId>mysql-connector-java</artifactId>
        <scope>runtime</scope>
    </dependency>
    <dependency>
        <groupId>com.h2database</groupId>
        <artifactId>h2</artifactId>
        <scope>test</scope>
    </dependency>
    
    <!-- Lombok -->
    <dependency>
        <groupId>org.projectlombok</groupId>
        <artifactId>lombok</artifactId>
        <optional>true</optional>
    </dependency>
    <!-- Spring Security -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    
    <!-- JWT支持 -->
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-api</artifactId>
        <version>0.11.5</version>
    </dependency>
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-impl</artifactId>
        <version>0.11.5</version>
        <scope>runtime</scope>
    </dependency>
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-jackson</artifactId>
        <version>0.11.5</version>
        <scope>runtime</scope>
    </dependency>
    
    <!-- 数据加密 -->
    <dependency>
        <groupId>org.bouncycastle</groupId>
        <artifactId>bcpkix-jdk15on</artifactId>
        <version>1.70</version>
    </dependency>
    
    <!-- 防XSS -->
    <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-text</artifactId>
        <version>1.10.0</version>
    </dependency>
    
    <!-- 限流 -->
    <dependency>
        <groupId>com.github.vladimir-bukhtoyarov</groupId>
        <artifactId>bucket4j-core</artifactId>
        <version>7.6.0</version>
    </dependency>
    <!-- Other -->
    <dependency>
        <groupId>org.springdoc</groupId>
        <artifactId>springdoc-openapi-ui</artifactId>
        <version>1.6.14</version>
    </dependency>
</dependencies>

spring:
  datasource:
    url: jdbc:mysql://localhost:3306/bank_account_db?useSSL=false&serverTimezone=UTC
    username: root
    password: password
    driver-class-name: com.mysql.cj.jdbc.Driver
  jpa:
    hibernate:
      ddl-auto: update
    show-sql: true
    properties:
      hibernate:
        format_sql: true
        dialect: org.hibernate.dialect.MySQL8Dialect

server:
  port: 8080

logging:
  level:
    com.bank.account: DEBUG
security:
  jwt:
    secret-key: your-256-bit-secret-key-change-this-to-something-secure
    expiration: 86400000 # 24 hours in milliseconds
    refresh-token.expiration: 604800000 # 7 days in milliseconds
  encryption:
    key: your-encryption-key-32bytes
    iv: your-initialization-vector-16bytes
  rate-limit:
    enabled: true
    capacity: 100
    refill-rate: 100
    refill-time: 1 # minutes

@Entity
@Table(name="bank_account")
@Data
public class Account{
	
	@Id
	@GeneratedValue(strategy=GenerationType.IDENTITY)
	private Long id;

	@Column(unique=true,nullable=false)
	private String accountNumber;

	@Column(nullable = false)
    private Long customerId;
    
    @Enumerated(EnumType.STRING)
    @Column(nullable = false)
    private AccountType accountType;//枚举类型：个人储蓄/活期,企业活期/贷款,信用卡
    
    @Enumerated(EnumType.STRING)
    @Column(nullable = false)
    private AccountStatus status;//枚举状态：活跃、不活跃、冻结、已关闭、休眠
    
    @Column(nullable = false, precision = 19, scale = 4)
    private BigDecimal balance = BigDecimal.ZERO;
    
    @Column(nullable = false, precision = 19, scale = 4)
    private BigDecimal availableBalance = BigDecimal.ZERO;
    
    @Column(nullable = false)
    private String currency = "CNY";
    
    @CreationTimestamp
    private Date createdAt;
    
    @UpdateTimestamp
    private Date updatedAt;
    
    @Version
    private Long version; // 乐观锁版本号
}

/**
	安全相关的实体
*/
@Data
@Builder
@NoArgsConstructor
@AllArgsConstructor
@Entity
@Table(name = "users")
public class User implements UserDetails {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    
    @Column(nullable = false, unique = true)
    private String username;
    
    @Column(nullable = false)
    private String password;
    
    @Enumerated(EnumType.STRING)
    private Role role;
    
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return List.of(new SimpleGrantedAuthority(role.name()));
    }
    
    @Override
    public boolean isAccountNonExpired() {
        return true;
    }
    
    @Override
    public boolean isAccountNonLocked() {
        return true;
    }
    
    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }
    
    @Override
    public boolean isEnabled() {
        return true;
    }
}

public enum Role {
    CUSTOMER,
    TELLER,
    MANAGER,
    ADMIN
}


@Data
@Builder
@AllArgsConstructor
@NoArgsConstructor
public class AuthenticationRequest {
    private String username;
    private String password;
}


@Data
@Builder
@AllArgsConstructor
@NoArgsConstructor
public class AuthenticationResponse {
    private String token;
    private String refreshToken;
}

public enum AccountType {
    PERSONAL_SAVINGS,    // 个人储蓄账户
    PERSONAL_CURRENT,    // 个人活期账户
    CORPORATE_CURRENT,   // 企业活期账户
    CORPORATE_LOAN,      // 企业贷款账户
    CREDIT_CARD          // 信用卡账户
}

public enum AccountStatus {
    ACTIVE,         // 活跃
    INACTIVE,       // 不活跃
    FROZEN,         // 冻结
    CLOSED,         // 已关闭
    DORMANT         // 休眠
}

@Data
public class AccountDTO {
    private Long id;
    private String accountNumber;
    private Long customerId;
    private AccountType accountType;
    private AccountStatus status;
    private BigDecimal balance;
    private BigDecimal availableBalance;
    private String currency;
    private Date createdAt;
    private Date updatedAt;
}

@Data
public class CreateAccountRequest {
    @NotNull
    private Long customerId;
    
    @NotNull
    private AccountType accountType;
    
    private String currency = "CNY";
}

@Data
public class AccountOperationResponse {
    private boolean success;
    private String message;
    private String accountNumber;
    private BigDecimal newBalance;
}

@Getter
public class AccountException extends RuntimeException {
    private final ErrorCode errorCode;
    
    public AccountException(ErrorCode errorCode) {
        super(errorCode.getMessage());
        this.errorCode = errorCode;
    }
}


@Getter
public enum ErrorCode {
    ACCOUNT_NOT_FOUND(404, "Account not found"),
    ACCOUNT_NOT_ACTIVE(400, "Account is not active"),
    ACCOUNT_ALREADY_FROZEN(400, "Account is already frozen"),
    ACCOUNT_NOT_FROZEN(400, "Account is not frozen"),
    ACCOUNT_ALREADY_CLOSED(400, "Account is already closed"),
    ACCOUNT_BALANCE_NOT_ZERO(400, "Account balance is not zero"),
    INSUFFICIENT_BALANCE(400, "Insufficient balance"),
    INVALID_AMOUNT(400, "Amount must be positive");
    
    private final int status;
    private final String message;
    
    ErrorCode(int status, String message) {
        this.status = status;
        this.message = message;
    }
}

@RestControllerAdvice
public class GlobalExceptionHandler {
    @ExceptionHandler(AccountException.class)
    public ResponseEntity<ErrorResponse> handleAccountException(AccountException e) {
        ErrorCode errorCode = e.getErrorCode();
        return ResponseEntity
                .status(errorCode.getStatus())
                .body(new ErrorResponse(errorCode.getStatus(), errorCode.getMessage()));
    }
}

安全配置类和限流配置类

@Configuration
@EnableWebSecurity
@EnableMethodSecurity(prePostEnabled = true)
@RequiredArgsConstructor
public class SecurityConfig {
    private final JwtAuthenticationFilter jwtAuthFilter;
    private final AuthenticationProvider authenticationProvider;
    
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .cors(cors -> cors.configurationSource(corsConfigurationSource()))
            .csrf(AbstractHttpConfigurer::disable)
            .authorizeHttpRequests(auth -> auth
                .requestMatchers(
                    "/api/auth/**",
                    "/v3/api-docs/**",
                    "/swagger-ui/**",
                    "/swagger-ui.html"
                ).permitAll()
                .anyRequest().authenticated()
            )
            .sessionManagement(sess -> sess.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authenticationProvider(authenticationProvider)
            .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class);
        
        return http.build();
    }
    
    @Bean
    CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(List.of("https://bank.com", "https://admin.bank.com"));
        configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE"));
        configuration.setAllowedHeaders(List.of("*"));
        configuration.setExposedHeaders(List.of("X-Rate-Limit-Remaining"));
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }
}

@Configuration
@EnableCaching
public class RateLimitConfig {
    @Bean
    public CacheManager cacheManager() {
        CacheManager cacheManager = Caching.getCachingProvider().getCacheManager();
        MutableConfiguration<String, byte[]> config = new MutableConfiguration<>();
        cacheManager.createCache("rate-limit-buckets", config);
        return cacheManager;
    }

    @Bean
    ProxyManager<String> proxyManager(CacheManager cacheManager) {
        return new JCacheProxyManager<>(cacheManager.getCache("rate-limit-buckets"));
    }

    @Bean
    public BucketConfiguration bucketConfiguration() {
        return BucketConfiguration.builder()
                .addLimit(Bandwidth.classic(100, Refill.intervally(100, Duration.ofMinutes(1))))
                .build();
    }

    @Bean
    public Bucket bucket(ProxyManager<String> proxyManager, BucketConfiguration bucketConfiguration) {
        return proxyManager.builder().build("global-limit", bucketConfiguration);
    }
}

JWT认证实现

@Service
public class JwtService {
    @Value("${security.jwt.secret-key}")
    private String secretKey;
    
    @Value("${security.jwt.expiration}")
    private long jwtExpiration;
    
    @Value("${security.jwt.refresh-token.expiration}")
    private long refreshExpiration;

    public String extractUsername(String token) {
        return extractClaim(token, Claims::getSubject);
    }

    public <T> T extractClaim(String token, Function<Claims, T> claimsResolver) {
        final Claims claims = extractAllClaims(token);
        return claimsResolver.apply(claims);
    }

    public String generateToken(UserDetails userDetails) {
        return generateToken(new HashMap<>(), userDetails);
    }

    public String generateToken(
            Map<String, Object> extraClaims,
            UserDetails userDetails
    ) {
        return buildToken(extraClaims, userDetails, jwtExpiration);
    }

    public String generateRefreshToken(
            UserDetails userDetails
    ) {
        return buildToken(new HashMap<>(), userDetails, refreshExpiration);
    }

    private String buildToken(
            Map<String, Object> extraClaims,
            UserDetails userDetails,
            long expiration
    ) {
        return Jwts
                .builder()
                .setClaims(extraClaims)
                .setSubject(userDetails.getUsername())
                .setIssuedAt(new Date(System.currentTimeMillis()))
                .setExpiration(new Date(System.currentTimeMillis() + expiration))
                .signWith(getSignInKey(), SignatureAlgorithm.HS256)
                .compact();
    }

    public boolean isTokenValid(String token, UserDetails userDetails) {
        final String username = extractUsername(token);
        return (username.equals(userDetails.getUsername())) && !isTokenExpired(token);
    }

    private boolean isTokenExpired(String token) {
        return extractExpiration(token).before(new Date());
    }

    private Date extractExpiration(String token) {
        return extractClaim(token, Claims::getExpiration);
    }

    private Claims extractAllClaims(String token) {
        return Jwts
                .parserBuilder()
                .setSigningKey(getSignInKey())
                .build()
                .parseClaimsJws(token)
                .getBody();
    }

    private Key getSignInKey() {
        byte[] keyBytes = Decoders.BASE64.decode(secretKey);
        return Keys.hmacShaKeyFor(keyBytes);
    }
}

工具类

/**
	账号生成工具
*/
@Component
public class AccountNumberGenerator {
    private static final String BANK_CODE = "888";
    private final AtomicLong sequence = new AtomicLong(1);
    
    public String generate(AccountType accountType) {
        long seq = sequence.getAndIncrement();
        String prefix = getAccountPrefix(accountType);
        String seqStr = String.format("%010d", seq);
        
        // 简单校验码计算
        String rawNumber = BANK_CODE + prefix + seqStr;
        int checkDigit = calculateCheckDigit(rawNumber);
        
        return rawNumber + checkDigit;
    }
    
    private String getAccountPrefix(AccountType accountType) {
        return switch (accountType) {
            case PERSONAL_SAVINGS -> "10";
            case PERSONAL_CURRENT -> "11";
            case CORPORATE_CURRENT -> "20";
            case CORPORATE_LOAN -> "21";
            case CREDIT_CARD -> "30";
        };
    }
    
    private int calculateCheckDigit(String number) {
        int sum = 0;
        for (int i = 0; i < number.length(); i++) {
            int digit = Character.getNumericValue(number.charAt(i));
            sum += (i % 2 == 0) ? digit * 1 : digit * 3;
        }
        return (10 - (sum % 10)) % 10;
    }
}

/**
	数据加密工具
*/
@Component
public class EncryptionUtil {
    @Value("${security.encryption.key}")
    private String encryptionKey;
    
    @Value("${security.encryption.iv}")
    private String iv;
    
    static {
        Security.addProvider(new BouncyCastleProvider());
    }

    public String encrypt(String data) {
        try {
            IvParameterSpec ivSpec = new IvParameterSpec(iv.getBytes(StandardCharsets.UTF_8));
            SecretKeySpec keySpec = new SecretKeySpec(encryptionKey.getBytes(StandardCharsets.UTF_8), "AES");
            
            Cipher cipher = Cipher.getInstance("AES/CBC/PKCS7Padding", "BC");
            cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec);
            
            byte[] encrypted = cipher.doFinal(data.getBytes(StandardCharsets.UTF_8));
            return Base64.getEncoder().encodeToString(encrypted);
        } catch (Exception e) {
            throw new RuntimeException("Encryption failed", e);
        }
    }

    public String decrypt(String encryptedData) {
        try {
            IvParameterSpec ivSpec = new IvParameterSpec(iv.getBytes(StandardCharsets.UTF_8));
            SecretKeySpec keySpec = new SecretKeySpec(encryptionKey.getBytes(StandardCharsets.UTF_8), "AES");
            
            Cipher cipher = Cipher.getInstance("AES/CBC/PKCS7Padding", "BC");
            cipher.init(Cipher.DECRYPT_MODE, keySpec, ivSpec);
            
            byte[] decoded = Base64.getDecoder().decode(encryptedData);
            byte[] decrypted = cipher.doFinal(decoded);
            return new String(decrypted, StandardCharsets.UTF_8);
        } catch (Exception e) {
            throw new RuntimeException("Decryption failed", e);
        }
    }
}

防XSS过滤器

@Component
public class XSSFilter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, 
            FilterChain filterChain) throws ServletException, IOException {
        filterChain.doFilter(new XSSRequestWrapper(request), response);
    }

    private static class XSSRequestWrapper extends HttpServletRequestWrapper {
        private final Map<String, String[]> escapedParameterValuesMap = new ConcurrentHashMap<>();

        public XSSRequestWrapper(HttpServletRequest request) {
            super(request);
        }

        @Override
        public String getParameter(String name) {
            String parameter = super.getParameter(name);
            return parameter != null ? StringEscapeUtils.escapeHtml4(parameter) : null;
        }

        @Override
        public String[] getParameterValues(String name) {
            String[] parameterValues = super.getParameterValues(name);
            if (parameterValues == null) {
                return null;
            }
            
            return escapedParameterValuesMap.computeIfAbsent(name, k -> {
                String[] escapedValues = new String[parameterValues.length];
                for (int i = 0; i < parameterValues.length; i++) {
                    escapedValues[i] = StringEscapeUtils.escapeHtml4(parameterValues[i]);
                }
                return escapedValues;
            });
        }

        @Override
        public Map<String, String[]> getParameterMap() {
            Map<String, String[]> parameterMap = super.getParameterMap();
            Map<String, String[]> escapedParameterMap = new ConcurrentHashMap<>();
            
            for (Map.Entry<String, String[]> entry : parameterMap.entrySet()) {
                escapedParameterMap.put(entry.getKey(), getParameterValues(entry.getKey()));
            }
            
            return escapedParameterMap;
        }

        @Override
        public Enumeration<String> getParameterNames() {
            return Collections.enumeration(getParameterMap().keySet());
        }
    }
}

Controller层

@RestController
@RequestMapping("/api/accounts")
@RequiredArgsConstructor
public class AccountController {
    private final AccountService accountService;
	
	@PostMapping
	public ResponseEntity<AccountDTO> createAccount(@Valid @RequestBody CreateAccountRequest request){
		AccountDTO account = accountService.createAccount(request);
        return ResponseEntity.ok(account);
	}

	@GetMapping("/{accountNumber}")
    public ResponseEntity<AccountDTO> getAccount(@PathVariable String accountNumber) {
        AccountDTO account = accountService.getAccount(accountNumber);
        return ResponseEntity.ok(account);
    }
    
    @PostMapping("/{accountNumber}/deposit")
    public ResponseEntity<AccountOperationResponse> deposit(
            @PathVariable String accountNumber,
            @RequestParam BigDecimal amount) {
        AccountOperationResponse response = accountService.deposit(accountNumber, amount);
        return ResponseEntity.ok(response);
    }
    
    @PostMapping("/{accountNumber}/withdraw")
    public ResponseEntity<AccountOperationResponse> withdraw(
            @PathVariable String accountNumber,
            @RequestParam BigDecimal amount) {
        AccountOperationResponse response = accountService.withdraw(accountNumber, amount);
        return ResponseEntity.ok(response);
    }
    
    @PostMapping("/{accountNumber}/freeze")
    public ResponseEntity<AccountOperationResponse> freezeAccount(@PathVariable String accountNumber) {
        AccountOperationResponse response = accountService.freezeAccount(accountNumber);
        return ResponseEntity.ok(response);
    }
    
    @PostMapping("/{accountNumber}/unfreeze")
    public ResponseEntity<AccountOperationResponse> unfreezeAccount(@PathVariable String accountNumber) {
        AccountOperationResponse response = accountService.unfreezeAccount(accountNumber);
        return ResponseEntity.ok(response);
    }
    
    @PostMapping("/{accountNumber}/close")
    public ResponseEntity<AccountOperationResponse> closeAccount(@PathVariable String accountNumber) {
        AccountOperationResponse response = accountService.closeAccount(accountNumber);
        return ResponseEntity.ok(response);
    }
}

@RestController
@RequestMapping("/api/auth")
@RequiredArgsConstructor
public class AuthenticationController {
    private final AuthenticationService authenticationService;
    
    @PostMapping("/register/customer")
    public ResponseEntity<AuthenticationResponse> registerCustomer(
            @RequestBody AuthenticationRequest request
    ) {
        return ResponseEntity.ok(authenticationService.register(request, Role.CUSTOMER));
    }
    
    @PostMapping("/register/teller")
    public ResponseEntity<AuthenticationResponse> registerTeller(
            @RequestBody AuthenticationRequest request
    ) {
        return ResponseEntity.ok(authenticationService.register(request, Role.TELLER));
    }
    
    @PostMapping("/authenticate")
    public ResponseEntity<AuthenticationResponse> authenticate(
            @RequestBody AuthenticationRequest request
    ) {
        return ResponseEntity.ok(authenticationService.authenticate(request));
    }
}

Service层

@Service
@RequiredArgsConstructor
@Slf4j
public class AccountService{
	
	private final AccountRepository accountRepository;
    private final AccountNumberGenerator accountNumberGenerator;
	
	private final EncryptionUtil encryptionUtil;
    private final RateLimitConfig rateLimitConfig;
	
	@Transactional
	public AccountDTO createAccount(CreateAccountRequest request){
		
		String accountNumber = accountNumberGenerator.generate(request.getAccountType());
		Account account = new Account();
        account.setAccountNumber(accountNumber);
        account.setCustomerId(request.getCustomerId());
        account.setAccountType(request.getAccountType());
        account.setStatus(AccountStatus.ACTIVE);
        account.setCurrency(request.getCurrency());
        
        Account savedAccount = accountRepository.save(account);
        log.info("Account created: {}", accountNumber);
        
        return convertToDTO(savedAccount);
	}

	@Transactional(readOnly = true)
	@PreAuthorize("hasAnyRole('TELLER', 'MANAGER', 'ADMIN') || "
            + "(hasRole('CUSTOMER') && @accountSecurityService.isAccountOwner(authentication, #accountNumber))")
    public AccountDTO getAccount(String accountNumber) {
		
		// 限流检查
        Bucket bucket = rateLimitConfig.bucket();
        if (!bucket.tryConsume(1)) {
            throw new AccountException(ErrorCode.TOO_MANY_REQUESTS);
        }
        Account account = accountRepository.findByAccountNumber(accountNumber)
                .orElseThrow(() -> new AccountException(ErrorCode.ACCOUNT_NOT_FOUND));
        
        //敏感数据加密
        AccountDTO dto = convertToDto(account);
        dto.setAccountNumber(encryptionUtil.encrypt(dto.getAccountNumber()));
        return dto;
    }
    
    @Transactional
    @PreAuthorize("hasAnyRole('TELLER', 'MANAGER', 'ADMIN')")
    public AccountOperationResponse deposit(String accountNumber, BigDecimal amount) {
        
        //解密账号
        String decryptedAccountNumber = encryptionUtil.decrypt(accountNumber);
        if (amount.compareTo(BigDecimal.ZERO) <= 0) {
            throw new AccountException(ErrorCode.INVALID_AMOUNT);
        }
        
        Account account = accountRepository.findByAccountNumberForUpdate(accountNumber)
                .orElseThrow(() -> new AccountException(ErrorCode.ACCOUNT_NOT_FOUND));
        
        if (account.getStatus() != AccountStatus.ACTIVE) {
            throw new AccountException(ErrorCode.ACCOUNT_NOT_ACTIVE);
        }
        
        BigDecimal newBalance = account.getBalance().add(amount);
        account.setBalance(newBalance);
        account.setAvailableBalance(newBalance);
        
        accountRepository.save(account);
        log.info("Deposit {} to account {}", amount, accountNumber);
        
        // 审计日志
        logSecurityEvent("DEPOSIT", decryptedAccountNumber, amount);
        
        return buildSuccessResponse(accountNumber, newBalance, "Deposit successful");
    }
    
    @Transactional
    public AccountOperationResponse withdraw(String accountNumber, BigDecimal amount) {
        if (amount.compareTo(BigDecimal.ZERO) <= 0) {
            throw new AccountException(ErrorCode.INVALID_AMOUNT);
        }
        
        Account account = accountRepository.findByAccountNumberForUpdate(accountNumber)
                .orElseThrow(() -> new AccountException(ErrorCode.ACCOUNT_NOT_FOUND));
        
        if (account.getStatus() != AccountStatus.ACTIVE) {
            throw new AccountException(ErrorCode.ACCOUNT_NOT_ACTIVE);
        }
        
        if (account.getAvailableBalance().compareTo(amount) < 0) {
            throw new AccountException(ErrorCode.INSUFFICIENT_BALANCE);
        }
        
        BigDecimal newBalance = account.getBalance().subtract(amount);
        account.setBalance(newBalance);
        account.setAvailableBalance(newBalance);
        
        accountRepository.save(account);
        log.info("Withdraw {} from account {}", amount, accountNumber);
        
        return buildSuccessResponse(accountNumber, newBalance, "Withdrawal successful");
    }
    
    @Transactional
    public AccountOperationResponse freezeAccount(String accountNumber) {
        Account account = accountRepository.findByAccountNumberForUpdate(accountNumber)
                .orElseThrow(() -> new AccountException(ErrorCode.ACCOUNT_NOT_FOUND));
        
        if (account.getStatus() == AccountStatus.FROZEN) {
            throw new AccountException(ErrorCode.ACCOUNT_ALREADY_FROZEN);
        }
        
        account.setStatus(AccountStatus.FROZEN);
        accountRepository.save(account);
        log.info("Account {} frozen", accountNumber);
        
        return buildSuccessResponse(accountNumber, account.getBalance(), "Account frozen successfully");
    }
    
    @Transactional
    public AccountOperationResponse unfreezeAccount(String accountNumber) {
        Account account = accountRepository.findByAccountNumberForUpdate(accountNumber)
                .orElseThrow(() -> new AccountException(ErrorCode.ACCOUNT_NOT_FOUND));
        
        if (account.getStatus() != AccountStatus.FROZEN) {
            throw new AccountException(ErrorCode.ACCOUNT_NOT_FROZEN);
        }
        
        account.setStatus(AccountStatus.ACTIVE);
        accountRepository.save(account);
        log.info("Account {} unfrozen", accountNumber);
        
        return buildSuccessResponse(accountNumber, account.getBalance(), "Account unfrozen successfully");
    }
    
    @Transactional
    public AccountOperationResponse closeAccount(String accountNumber) {
        Account account = accountRepository.findByAccountNumberForUpdate(accountNumber)
                .orElseThrow(() -> new AccountException(ErrorCode.ACCOUNT_NOT_FOUND));
        
        if (account.getStatus() == AccountStatus.CLOSED) {
            throw new AccountException(ErrorCode.ACCOUNT_ALREADY_CLOSED);
        }
        
        if (account.getBalance().compareTo(BigDecimal.ZERO) != 0) {
            throw new AccountException(ErrorCode.ACCOUNT_BALANCE_NOT_ZERO);
        }
        
        account.setStatus(AccountStatus.CLOSED);
        accountRepository.save(account);
        log.info("Account {} closed", accountNumber);
        
        return buildSuccessResponse(accountNumber, account.getBalance(), "Account closed successfully");
    }
    
    private AccountDTO convertToDTO(Account account) {
        AccountDTO dto = new AccountDTO();
        dto.setId(account.getId());
        dto.setAccountNumber(account.getAccountNumber());
        dto.setCustomerId(account.getCustomerId());
        dto.setAccountType(account.getAccountType());
        dto.setStatus(account.getStatus());
        dto.setBalance(account.getBalance());
        dto.setAvailableBalance(account.getAvailableBalance());
        dto.setCurrency(account.getCurrency());
        dto.setCreatedAt(account.getCreatedAt());
        dto.setUpdatedAt(account.getUpdatedAt());
        return dto;
    }
    
    private AccountOperationResponse buildSuccessResponse(String accountNumber, BigDecimal newBalance, String message) {
        AccountOperationResponse response = new AccountOperationResponse();
        response.setSuccess(true);
        response.setMessage(message);
        response.setAccountNumber(accountNumber);
        response.setNewBalance(newBalance);
        return response;
    }
}

/**
	安全服务
*/
@Service
@RequiredArgsConstructor
public class AuthenticationService {
    private final UserRepository userRepository;
    private final PasswordEncoder passwordEncoder;
    private final JwtService jwtService;
    private final AuthenticationManager authenticationManager;
    
    public AuthenticationResponse register(AuthenticationRequest request, Role role) {
        var user = User.builder()
                .username(request.getUsername())
                .password(passwordEncoder.encode(request.getPassword()))
                .role(role)
                .build();
        userRepository.save(user);
        
        var jwtToken = jwtService.generateToken(user);
        var refreshToken = jwtService.generateRefreshToken(user);
        
        return AuthenticationResponse.builder()
                .token(jwtToken)
                .refreshToken(refreshToken)
                .build();
    }
    
    public AuthenticationResponse authenticate(AuthenticationRequest request) {
        authenticationManager.authenticate(
                new UsernamePasswordAuthenticationToken(
                        request.getUsername(),
                        request.getPassword()
                )
        );
        
        var user = userRepository.findByUsername(request.getUsername())
                .orElseThrow();
        
        var jwtToken = jwtService.generateToken(user);
        var refreshToken = jwtService.generateRefreshToken(user);
        
        return AuthenticationResponse.builder()
                .token(jwtToken)
                .refreshToken(refreshToken)
                .build();
    }
}

Repository层

public interface AccountRepository extends JpaRepository<Account,Long>{
	
	Optional<Account> findByAccountNumber(String accountNumber);
	
	@Lock(LockModeType.PESSIMISTIC_WRITE)
	@Query("SELECT a FROM Account a WHERE a.accountNumber = :accountNumber")
    Optional<Account> findByAccountNumberForUpdate(@Param("accountNumber") String accountNumber);

	boolean existsByAccountNumber(String accountNumber);	
}

2. 交易处理

存款/取款

转账(同行/跨行)

批量交易处理

交易流水记录

交易限额管理

# 在原有配置基础上添加
service:
  account:
    url: http://account-service:8080

security:
  transaction:
    max-retry-attempts: 3
    retry-delay: 1000 # ms

@Entity
@Table(name = "transaction")
@Data
public class Transaction {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    
    @Column(nullable = false, unique = true)
    private String transactionId;
    
    @Column(nullable = false)
    private String accountNumber;
    
    @Column
    private String counterpartyAccountNumber;
    
    @Enumerated(EnumType.STRING)
    @Column(nullable = false)
    private TransactionType transactionType;
    
    @Enumerated(EnumType.STRING)
    @Column(nullable = false)
    private TransactionStatus status;//处理中、已完成、失败、已冲正、已取消
    
    @Column(nullable = false, precision = 19, scale = 4)
    private BigDecimal amount;
    
    @Column(precision = 19, scale = 4)
    private BigDecimal fee;
    
    @Column(nullable = false)
    private String currency = "CNY";
    
    @Column
    private String description;
    
    @Column(nullable = false)
    private String reference;
    
    @CreationTimestamp
    private LocalDateTime createdAt;
    
    @UpdateTimestamp
    private LocalDateTime updatedAt;
    
    @Version
    private Long version;
}

@Entity
@Table(name = "transaction_limit")
@Data
public class TransactionLimit {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    
    @Enumerated(EnumType.STRING)
    @Column(nullable = false)
    private TransactionType transactionType;//存款、取款、转账、账单支付、贷款还款、费用收取
    
    @Column(nullable = false)
    private String accountType;
    
    @Column(nullable = false, precision = 19, scale = 4)
    private BigDecimal dailyLimit;
    
    @Column(nullable = false, precision = 19, scale = 4)
    private BigDecimal perTransactionLimit;
    
    @Column(nullable = false)
    private Integer dailyCountLimit;
}

@Data
public class TransactionDTO {
    private String transactionId;
    private String accountNumber;
    private String counterpartyAccountNumber;
    private TransactionType transactionType;
    private TransactionStatus status;
    private BigDecimal amount;
    private BigDecimal fee;
    private String currency;
    private String description;
    private String reference;
    private LocalDateTime createdAt;
    private LocalDateTime updatedAt;
}

@Data
public class DepositRequest {
    @NotNull
    private String accountNumber;
    
    @NotNull
    @Positive
    private BigDecimal amount;
    
    private String description;
}

@Data
public class WithdrawalRequest {
    @NotNull
    private String accountNumber;
    
    @NotNull
    @Positive
    private BigDecimal amount;
    
    private String description;
}

@Data
public class TransferRequest {
    @NotNull
    private String fromAccountNumber;
    
    @NotNull
    private String toAccountNumber;
    
    @NotNull
    @Positive
    private BigDecimal amount;
    
    private String description;
}

@Data
public class BatchTransactionRequest {
    @NotEmpty
    @Valid
    private List<TransferRequest> transactions;
}

异常

@Getter
public enum ErrorCode {
    // 原有错误码...
    TRANSACTION_LIMIT_NOT_FOUND(400, "Transaction limit not found"),
    EXCEED_PER_TRANSACTION_LIMIT(400, "Exceed per transaction limit"),
    EXCEED_DAILY_LIMIT(400, "Exceed daily limit"),
    EXCEED_DAILY_COUNT_LIMIT(400, "Exceed daily count limit"),
    DEPOSIT_FAILED(400, "Deposit failed"),
    WITHDRAWAL_FAILED(400, "Withdrawal failed"),
    TRANSFER_FAILED(400, "Transfer failed"),
    ACCOUNT_SERVICE_UNAVAILABLE(503, "Account service unavailable"),
    TRANSACTION_SERVICE_UNAVAILABLE(503, "Transaction service unavailable");
    
    private final int status;
    private final String message;
    
    ErrorCode(int status, String message) {
        this.status = status;
        this.message = message;
    }
}

工具类

@Component
public class TransactionIdGenerator {
    private static final String BANK_CODE = "888";
    private final AtomicLong sequence = new AtomicLong(1);
    
    public String generate() {
        long timestamp = Instant.now().toEpochMilli();
        long seq = sequence.getAndIncrement();
        return String.format("%s-TRX-%d-%06d", BANK_CODE, timestamp, seq);
    }
}

Controller层

@Controller
@RequestMapping("/api/transactions")
@RequiredArgsConstructor
public class TransactionController{
	
	private final TransactionService transactionService;

	@PostMapping("/deposit")
	@PreAuthorize("hasAnyRole('TELLER', 'MANAGER', 'ADMIN')")
	public ResponseEntity<TransactionDTO> deposit(@Valid @RequestBody DepositRequest request) {
        return ResponseEntity.ok(transactionService.deposit(request));
    }

	@PostMapping("/withdraw")
    public ResponseEntity<TransactionDTO> withdraw(@Valid @RequestBody WithdrawalRequest request) {
        return ResponseEntity.ok(transactionService.withdraw(request));
    }
    
    @PostMapping("/transfer")
    public ResponseEntity<TransactionDTO> transfer(@Valid @RequestBody TransferRequest request) {
        return ResponseEntity.ok(transactionService.transfer(request));
    }
    
    @PostMapping("/batch-transfer")
    @PreAuthorize("hasAnyRole('TELLER', 'MANAGER', 'ADMIN')")
    public ResponseEntity<List<TransactionDTO>> batchTransfer(@Valid @RequestBody BatchTransactionRequest request) {
        return ResponseEntity.ok(transactionService.batchTransfer(request));
    }
    
    @GetMapping("/history")
    public ResponseEntity<List<TransactionDTO>> getTransactionHistory(
            @RequestParam String accountNumber,
            @RequestParam @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate startDate,
            @RequestParam @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate endDate) {
        return ResponseEntity.ok(transactionService.getTransactionHistory(accountNumber, startDate, endDate));
    }
	
}

Service层

@Service
@RequiredArgsConstructor
@Slf4j
public class TransactionService {
    private final TransactionRepository transactionRepository;
    private final TransactionLimitRepository limitRepository;
    private final AccountClientService accountClientService;
    private final TransactionIdGenerator idGenerator;
    private final EncryptionUtil encryptionUtil;
    
    @Transactional
    @PreAuthorize("hasAnyRole('TELLER', 'MANAGER', 'ADMIN')")
    public TransactionDTO deposit(DepositRequest request) {
        // 解密账号
        String decryptedAccountNumber = encryptionUtil.decrypt(request.getAccountNumber());
        
        // 验证金额
        validateAmount(request.getAmount());
        
        // 检查账户状态
        checkAccountStatus(decryptedAccountNumber);
        
        // 执行存款
        BigDecimal newBalance = accountClientService.deposit(decryptedAccountNumber, request.getAmount());
        
        // 记录交易
        Transaction transaction = new Transaction();
        transaction.setTransactionId(idGenerator.generate());
        transaction.setAccountNumber(decryptedAccountNumber);
        transaction.setTransactionType(TransactionType.DEPOSIT);
        transaction.setStatus(TransactionStatus.COMPLETED);
        transaction.setAmount(request.getAmount());
        transaction.setCurrency("CNY");
        transaction.setDescription(request.getDescription());
        transaction.setReference("DEP-" + System.currentTimeMillis());
        
        Transaction saved = transactionRepository.save(transaction);
        log.info("Deposit completed: {}", saved.getTransactionId());
        
        return convertToDTO(saved);
    }
    
    @Transactional
    @PreAuthorize("hasAnyRole('TELLER', 'MANAGER', 'ADMIN') || "
            + "(hasRole('CUSTOMER') && @accountSecurityService.isAccountOwner(authentication, #request.accountNumber))")
    public TransactionDTO withdraw(WithdrawalRequest request) {
        // 解密账号
        String decryptedAccountNumber = encryptionUtil.decrypt(request.getAccountNumber());
        
        // 验证金额
        validateAmount(request.getAmount());
        
        // 检查账户状态
        checkAccountStatus(decryptedAccountNumber);
        
        // 检查交易限额
        checkWithdrawalLimit(decryptedAccountNumber, request.getAmount());
        
        // 执行取款
        BigDecimal newBalance = accountClientService.withdraw(decryptedAccountNumber, request.getAmount());
        
        // 记录交易
        Transaction transaction = new Transaction();
        transaction.setTransactionId(idGenerator.generate());
        transaction.setAccountNumber(decryptedAccountNumber);
        transaction.setTransactionType(TransactionType.WITHDRAWAL);
        transaction.setStatus(TransactionStatus.COMPLETED);
        transaction.setAmount(request.getAmount().negate());
        transaction.setCurrency("CNY");
        transaction.setDescription(request.getDescription());
        transaction.setReference("WTH-" + System.currentTimeMillis());
        
        Transaction saved = transactionRepository.save(transaction);
        log.info("Withdrawal completed: {}", saved.getTransactionId());
        
        return convertToDTO(saved);
    }
    
    @Transactional
    @PreAuthorize("hasAnyRole('TELLER', 'MANAGER', 'ADMIN') || "
            + "(hasRole('CUSTOMER') && @accountSecurityService.isAccountOwner(authentication, #request.fromAccountNumber))")
    public TransactionDTO transfer(TransferRequest request) {
        // 解密账号
        String decryptedFromAccount = encryptionUtil.decrypt(request.getFromAccountNumber());
        String decryptedToAccount = encryptionUtil.decrypt(request.getToAccountNumber());
        
        // 验证金额
        validateAmount(request.getAmount());
        
        // 检查账户状态
        checkAccountStatus(decryptedFromAccount);
        checkAccountStatus(decryptedToAccount);
        
        // 检查转账限额
        checkTransferLimit(decryptedFromAccount, request.getAmount());
        
        // 执行转账
        BigDecimal fromNewBalance = accountClientService.withdraw(decryptedFromAccount, request.getAmount());
        BigDecimal toNewBalance = accountClientService.deposit(decryptedToAccount, request.getAmount());
        
        // 记录交易(借方)
        Transaction debitTransaction = new Transaction();
        debitTransaction.setTransactionId(idGenerator.generate());
        debitTransaction.setAccountNumber(decryptedFromAccount);
        debitTransaction.setCounterpartyAccountNumber(decryptedToAccount);
        debitTransaction.setTransactionType(TransactionType.TRANSFER);
        debitTransaction.setStatus(TransactionStatus.COMPLETED);
        debitTransaction.setAmount(request.getAmount().negate());
        debitTransaction.setCurrency("CNY");
        debitTransaction.setDescription(request.getDescription());
        debitTransaction.setReference("TFR-DEBIT-" + System.currentTimeMillis());
        
        // 记录交易(贷方)
        Transaction creditTransaction = new Transaction();
        creditTransaction.setTransactionId(idGenerator.generate());
        creditTransaction.setAccountNumber(decryptedToAccount);
        creditTransaction.setCounterpartyAccountNumber(decryptedFromAccount);
        creditTransaction.setTransactionType(TransactionType.TRANSFER);
        creditTransaction.setStatus(TransactionStatus.COMPLETED);
        creditTransaction.setAmount(request.getAmount());
        creditTransaction.setCurrency("CNY");
        creditTransaction.setDescription(request.getDescription());
        creditTransaction.setReference("TFR-CREDIT-" + System.currentTimeMillis());
        
        transactionRepository.save(debitTransaction);
        transactionRepository.save(creditTransaction);
        log.info("Transfer completed: {} -> {}", debitTransaction.getTransactionId(), creditTransaction.getTransactionId());
        
        return convertToDTO(debitTransaction);
    }
    
    @Transactional
    @PreAuthorize("hasAnyRole('TELLER', 'MANAGER', 'ADMIN')")
    public List<TransactionDTO> batchTransfer(BatchTransactionRequest request) {
        return request.getTransactions().stream()
                .map(this::transfer)
                .collect(Collectors.toList());
    }
    
    @Transactional(readOnly = true)
    @PreAuthorize("hasAnyRole('TELLER', 'MANAGER', 'ADMIN') || "
            + "(hasRole('CUSTOMER') && @accountSecurityService.isAccountOwner(authentication, #accountNumber))")
    public List<TransactionDTO> getTransactionHistory(String accountNumber, LocalDate startDate, LocalDate endDate) {
        String decryptedAccountNumber = encryptionUtil.decrypt(accountNumber);
        
        LocalDateTime start = startDate.atStartOfDay();
        LocalDateTime end = endDate.atTime(LocalTime.MAX);
        
        return transactionRepository
                .findByAccountNumberAndCreatedAtBetween(decryptedAccountNumber, start, end)
                .stream()
                .map(this::convertToDTO)
                .peek(dto -> dto.setAccountNumber(encryptionUtil.encrypt(dto.getAccountNumber())))
                .peek(dto -> {
                    if (dto.getCounterpartyAccountNumber() != null) {
                        dto.setCounterpartyAccountNumber(encryptionUtil.encrypt(dto.getCounterpartyAccountNumber()));
                    }
                })
                .collect(Collectors.toList());
    }
    
    private void validateAmount(BigDecimal amount) {
        if (amount.compareTo(BigDecimal.ZERO) <= 0) {
            throw new AccountException(ErrorCode.INVALID_AMOUNT);
        }
    }
    
    private void checkAccountStatus(String accountNumber) {
        AccountDTO account = accountClientService.getAccount(accountNumber);
        if (account.getStatus() != AccountStatus.ACTIVE) {
            throw new AccountException(ErrorCode.ACCOUNT_NOT_ACTIVE);
        }
    }
    
    private void checkWithdrawalLimit(String accountNumber, BigDecimal amount) {
        AccountDTO account = accountClientService.getAccount(accountNumber);
        TransactionLimit limit = limitRepository.findByTransactionTypeAndAccountType(
                TransactionType.WITHDRAWAL, account.getAccountType().name())
                .orElseThrow(() -> new AccountException(ErrorCode.TRANSACTION_LIMIT_NOT_FOUND));
        
        // 检查单笔限额
        if (amount.compareTo(limit.getPerTransactionLimit()) > 0) {
            throw new AccountException(ErrorCode.EXCEED_PER_TRANSACTION_LIMIT);
        }
        
        // 检查当日累计限额
        LocalDateTime todayStart = LocalDate.now().atStartOfDay();
        LocalDateTime todayEnd = LocalDate.now().atTime(LocalTime.MAX);
        
        BigDecimal todayTotal = transactionRepository
                .findByAccountNumberAndCreatedAtBetween(accountNumber, todayStart, todayEnd)
                .stream()
                .filter(t -> t.getTransactionType() == TransactionType.WITHDRAWAL)
                .map(Transaction::getAmount)
                .reduce(BigDecimal.ZERO, BigDecimal::add)
                .abs();
        
        if (todayTotal.add(amount).compareTo(limit.getDailyLimit()) > 0) {
            throw new AccountException(ErrorCode.EXCEED_DAILY_LIMIT);
        }
        
        // 检查当日交易次数
        long todayCount = transactionRepository
                .findByAccountNumberAndCreatedAtBetween(accountNumber, todayStart, todayEnd)
                .stream()
                .filter(t -> t.getTransactionType() == TransactionType.WITHDRAWAL)
                .count();
        
        if (todayCount >= limit.getDailyCountLimit()) {
            throw new AccountException(ErrorCode.EXCEED_DAILY_COUNT_LIMIT);
        }
    }
    
    private void checkTransferLimit(String accountNumber, BigDecimal amount) {
        AccountDTO account = accountClientService.getAccount(accountNumber);
        TransactionLimit limit = limitRepository.findByTransactionTypeAndAccountType(
                TransactionType.TRANSFER, account.getAccountType().name())
                .orElseThrow(() -> new AccountException(ErrorCode.TRANSACTION_LIMIT_NOT_FOUND));
        
        // 检查单笔限额
        if (amount.compareTo(limit.getPerTransactionLimit()) > 0) {
            throw new AccountException(ErrorCode.EXCEED_PER_TRANSACTION_LIMIT);
        }
        
        // 检查当日累计限额
        LocalDateTime todayStart = LocalDate.now().atStartOfDay();
        LocalDateTime todayEnd = LocalDate.now().atTime(LocalTime.MAX);
        
        BigDecimal todayTotal = transactionRepository
                .findByAccountNumberAndCreatedAtBetween(accountNumber, todayStart, todayEnd)
                .stream()
                .filter(t -> t.getTransactionType() == TransactionType.TRANSFER)
                .map(Transaction::getAmount)
                .reduce(BigDecimal.ZERO, BigDecimal::add)
                .abs();
        
        if (todayTotal.add(amount).compareTo(limit.getDailyLimit()) > 0) {
            throw new AccountException(ErrorCode.EXCEED_DAILY_LIMIT);
        }
    }
    
    private TransactionDTO convertToDTO(Transaction transaction) {
        TransactionDTO dto = new TransactionDTO();
        dto.setTransactionId(transaction.getTransactionId());
        dto.setAccountNumber(transaction.getAccountNumber());
        dto.setCounterpartyAccountNumber(transaction.getCounterpartyAccountNumber());
        dto.setTransactionType(transaction.getTransactionType());
        dto.setStatus(transaction.getStatus());
        dto.setAmount(transaction.getAmount());
        dto.setFee(transaction.getFee());
        dto.setCurrency(transaction.getCurrency());
        dto.setDescription(transaction.getDescription());
        dto.setReference(transaction.getReference());
        dto.setCreatedAt(transaction.getCreatedAt());
        dto.setUpdatedAt(transaction.getUpdatedAt());
        return dto;
    }
}

@Service
@RequiredArgsConstructor
public class AccountClientService {
    private final RestTemplate restTemplate;
    private final EncryptionUtil encryptionUtil;
    
    @Value("${service.account.url}")
    private String accountServiceUrl;
    
    public AccountDTO getAccount(String accountNumber) {
        try {
            String encryptedAccountNumber = encryptionUtil.encrypt(accountNumber);
            
            HttpHeaders headers = new HttpHeaders();
            headers.set("X-Internal-Service", "transaction-service");
            
            ResponseEntity<AccountDTO> response = restTemplate.exchange(
                    accountServiceUrl + "/api/accounts/" + encryptedAccountNumber,
                    HttpMethod.GET,
                    new HttpEntity<>(headers),
                    AccountDTO.class);
            
            AccountDTO account = response.getBody();
            if (account != null) {
                account.setAccountNumber(accountNumber); // 返回解密后的账号
            }
            return account;
        } catch (HttpClientErrorException.NotFound e) {
            throw new AccountException(ErrorCode.ACCOUNT_NOT_FOUND);
        } catch (Exception e) {
            throw new AccountException(ErrorCode.ACCOUNT_SERVICE_UNAVAILABLE);
        }
    }
    
    public BigDecimal deposit(String accountNumber, BigDecimal amount) {
        try {
            String encryptedAccountNumber = encryptionUtil.encrypt(accountNumber);
            
            HttpHeaders headers = new HttpHeaders();
            headers.set("X-Internal-Service", "transaction-service");
            
            ResponseEntity<AccountOperationResponse> response = restTemplate.exchange(
                    accountServiceUrl + "/api/accounts/" + encryptedAccountNumber + "/deposit?amount=" + amount,
                    HttpMethod.POST,
                    new HttpEntity<>(headers),
                    AccountOperationResponse.class);
            
            AccountOperationResponse result = response.getBody();
            if (result == null || !result.isSuccess()) {
                throw new AccountException(ErrorCode.DEPOSIT_FAILED);
            }
            return result.getNewBalance();
        } catch (Exception e) {
            throw new AccountException(ErrorCode.ACCOUNT_SERVICE_UNAVAILABLE);
        }
    }
    
    public BigDecimal withdraw(String accountNumber, BigDecimal amount) {
        try {
            String encryptedAccountNumber = encryptionUtil.encrypt(accountNumber);
            
            HttpHeaders headers = new HttpHeaders();
            headers.set("X-Internal-Service", "transaction-service");
            
            ResponseEntity<AccountOperationResponse> response = restTemplate.exchange(
                    accountServiceUrl + "/api/accounts/" + encryptedAccountNumber + "/withdraw?amount=" + amount,
                    HttpMethod.POST,
                    new HttpEntity<>(headers),
                    AccountOperationResponse.class);
            
            AccountOperationResponse result = response.getBody();
            if (result == null || !result.isSuccess()) {
                throw new AccountException(ErrorCode.WITHDRAWAL_FAILED);
            }
            return result.getNewBalance();
        } catch (Exception e) {
            throw new AccountException(ErrorCode.ACCOUNT_SERVICE_UNAVAILABLE);
        }
    }
}

Repository层

public interface TransactionRepository extends JpaRepository<Transaction, Long> {
    Optional<Transaction> findByTransactionId(String transactionId);
    
    List<Transaction> findByAccountNumberAndCreatedAtBetween(
            String accountNumber, LocalDateTime startDate, LocalDateTime endDate);
    
    @Lock(LockModeType.PESSIMISTIC_WRITE)
    @Query("SELECT t FROM Transaction t WHERE t.transactionId = :transactionId")
    Optional<Transaction> findByTransactionIdForUpdate(@Param("transactionId") String transactionId);
}

public interface TransactionLimitRepository extends JpaRepository<TransactionLimit, Long> {
    Optional<TransactionLimit> findByTransactionTypeAndAccountType(
            TransactionType transactionType, String accountType);
}

3. 支付结算

支付订单处理

清算对账

手续费计算

第三方支付对接

# 在原有配置基础上添加
payment:
  settlement:
    auto-enabled: true
    time: "02:00" # 自动结算时间
  third-party:
    timeout: 5000 # 第三方支付超时时间(ms)
    retry-times: 3 # 重试次数

@Entity
@Table(name = "payment_order")
@Data
public class PaymentOrder {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    
    @Column(nullable = false, unique = true)
    private String orderNo;
    
    @Column(nullable = false)
    private String accountNumber;
    
    @Column(nullable = false)
    private String merchantCode;
    
    @Column(nullable = false)
    private String merchantOrderNo;
    
    @Enumerated(EnumType.STRING)
    @Column(nullable = false)
    private PaymentOrderType orderType;
    
    @Enumerated(EnumType.STRING)
    @Column(nullable = false)
    private PaymentOrderStatus status;
    
    @Column(nullable = false, precision = 19, scale = 4)
    private BigDecimal amount;
    
    @Column(precision = 19, scale = 4)
    private BigDecimal fee;
    
    @Column(precision = 19, scale = 4)
    private BigDecimal settlementAmount;
    
    @Column(nullable = false)
    private String currency = "CNY";
    
    @Column
    private String description;
    
    @Column
    private String callbackUrl;
    
    @Column
    private String notifyUrl;
    
    @Column
    private String thirdPartyTransactionNo;
    
    @Column
    private LocalDateTime paymentTime;
    
    @Column
    private LocalDateTime settlementTime;
    
    @CreationTimestamp
    private LocalDateTime createdAt;
    
    @UpdateTimestamp
    private LocalDateTime updatedAt;
    
    @Version
    private Long version;
}

@Entity
@Table(name = "settlement_record")
@Data
public class SettlementRecord {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    
    @Column(nullable = false, unique = true)
    private String settlementNo;
    
    @Column(nullable = false)
    private String merchantCode;
    
    @Column(nullable = false)
    private LocalDate settlementDate;
    
    @Column(nullable = false, precision = 19, scale = 4)
    private BigDecimal totalAmount;
    
    @Column(nullable = false, precision = 19, scale = 4)
    private BigDecimal totalFee;
    
    @Column(nullable = false, precision = 19, scale = 4)
    private BigDecimal netAmount;
    
    @Column(nullable = false)
    private Integer totalCount;
    
    @Enumerated(EnumType.STRING)
    @Column(nullable = false)
    private SettlementStatus status;
    
    @Column
    private String bankTransactionNo;
    
    @Column
    private LocalDateTime completedTime;
    
    @CreationTimestamp
    private LocalDateTime createdAt;
    
    @UpdateTimestamp
    private LocalDateTime updatedAt;
}

@Entity
@Table(name = "fee_config")
@Data
public class FeeConfig {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    
    @Column(nullable = false)
    private String merchantCode;
    
    @Column(nullable = false)
    private String paymentType;
    
    @Enumerated(EnumType.STRING)
    @Column(nullable = false)
    private FeeCalculateMethod calculateMethod;
    
    @Column(precision = 19, scale = 4)
    private BigDecimal fixedFee;
    
    @Column(precision = 5, scale = 4)
    private BigDecimal rate;
    
    @Column(precision = 19, scale = 4)
    private BigDecimal minFee;
    
    @Column(precision = 19, scale = 4)
    private BigDecimal maxFee;
    
    @Column(nullable = false)
    private Boolean active = true;
}

public enum PaymentOrderType {
    WECHAT_PAY,     // 微信支付
    ALI_PAY,        // 支付宝
    UNION_PAY,      // 银联
    QUICK_PAY,      // 快捷支付
    BANK_TRANSFER   // 银行转账
}

public enum PaymentOrderStatus {
    CREATED,        // 已创建
    PROCESSING,     // 处理中
    SUCCESS,        // 支付成功
    FAILED,         // 支付失败
    REFUNDED,       // 已退款
    CLOSED          // 已关闭
}

public enum SettlementStatus {
    PENDING,        // 待结算
    PROCESSING,     // 结算中
    COMPLETED,      // 结算完成
    FAILED          // 结算失败
}

public enum FeeCalculateMethod {
    FIXED,          // 固定费用
    PERCENTAGE,     // 百分比
    TIERED          // 阶梯费率
}

@Data
public class PaymentRequestDTO {
    @NotBlank
    private String accountNumber;
    
    @NotBlank
    private String merchantCode;
    
    @NotBlank
    private String merchantOrderNo;
    
    @NotNull
    private PaymentOrderType orderType;
    
    @NotNull
    @Positive
    private BigDecimal amount;
    
    @NotBlank
    private String currency;
    
    private String description;
    
    private String callbackUrl;
    
    private String notifyUrl;
}

@Data
public class PaymentResponseDTO {
    private String orderNo;
    private String merchantOrderNo;
    private PaymentOrderStatus status;
    private BigDecimal amount;
    private BigDecimal fee;
    private BigDecimal settlementAmount;
    private String currency;
    private String paymentUrl; // 用于前端跳转支付
    private LocalDateTime createdAt;
}

@Data
public class SettlementRequestDTO {
    @NotBlank
    private String merchantCode;
    
    private LocalDate settlementDate;
}



@Data
public class SettlementResponseDTO {
    private String settlementNo;
    private String merchantCode;
    private LocalDate settlementDate;
    private BigDecimal totalAmount;
    private BigDecimal totalFee;
    private BigDecimal netAmount;
    private Integer totalCount;
    private SettlementStatus status;
    private LocalDateTime completedTime;
}

@Data
public class ThirdPartyPaymentRequest {
    private String orderNo;
    private BigDecimal amount;
    private String currency;
    private String accountNumber;
    private String merchantCode;
    private String paymentType;
}

@Data
public class ThirdPartyPaymentResponse {
    private boolean success;
    private String transactionNo;
    private String paymentUrl;
    private String errorCode;
    private String errorMessage;
}

工具类

@Component
public class OrderNoGenerator {
    private static final String BANK_CODE = "888";
    private final AtomicLong sequence = new AtomicLong(1);
    
    public String generate() {
        long timestamp = Instant.now().toEpochMilli();
        long seq = sequence.getAndIncrement();
        return String.format("%s-PAY-%d-%06d", BANK_CODE, timestamp, seq);
    }
}

@Component
public class SettlementNoGenerator {
    private static final String BANK_CODE = "888";
    private final AtomicLong sequence = new AtomicLong(1);
    
    public String generate() {
        String dateStr = LocalDate.now().format(DateTimeFormatter.BASIC_ISO_DATE);
        long seq = sequence.getAndIncrement();
        return String.format("%s-STL-%s-%06d", BANK_CODE, dateStr, seq);
    }
}

Controller层

@RestController
@RequestMapping("/api/payments")
@RequiredArgsConstructor
public class PaymentController {
    private final PaymentService paymentService;
    private final SettlementService settlementService;
    
    @PostMapping
    public PaymentResponseDTO createPayment(@Valid @RequestBody PaymentRequestDTO request) {
        return paymentService.createPayment(request);
    }
    
    @GetMapping("/{orderNo}")
    public PaymentResponseDTO queryPayment(@PathVariable String orderNo) {
        return paymentService.queryPayment(orderNo);
    }
    
    @GetMapping
    public PaymentResponseDTO queryPaymentByMerchant(
            @RequestParam String merchantCode,
            @RequestParam String merchantOrderNo) {
        return paymentService.queryPaymentByMerchant(merchantCode, merchantOrderNo);
    }
    
    @PostMapping("/settlements")
    public SettlementResponseDTO createSettlement(@Valid @RequestBody SettlementRequestDTO request) {
        return settlementService.createSettlement(request);
    }
    
    @GetMapping("/settlements/{settlementNo}")
    public SettlementResponseDTO querySettlement(@PathVariable String settlementNo) {
        return settlementService.querySettlement(settlementNo);
    }
}

Service层

@Service
@RequiredArgsConstructor
@Slf4j
public class PaymentService {
    private final PaymentOrderRepository paymentOrderRepository;
    private final FeeConfigRepository feeConfigRepository;
    private final TransactionService transactionService;
    private final ThirdPartyPaymentGateway paymentGateway;
    private final OrderNoGenerator orderNoGenerator;
    private final EncryptionUtil encryptionUtil;

	@Transactional
    public PaymentResponseDTO createPayment(PaymentRequestDTO request) {
        // 解密账号
        String decryptedAccountNumber = encryptionUtil.decrypt(request.getAccountNumber());
        
        // 检查是否已存在相同商户订单
        Optional<PaymentOrder> existingOrder = paymentOrderRepository
                .findByMerchantCodeAndMerchantOrderNo(request.getMerchantCode(), request.getMerchantOrderNo());
        if (existingOrder.isPresent()) {
            throw new AccountException(ErrorCode.DUPLICATE_MERCHANT_ORDER);
        }
        
        // 计算手续费
        BigDecimal fee = calculateFee(request.getMerchantCode(), request.getOrderType().name(), request.getAmount());
        BigDecimal settlementAmount = request.getAmount().subtract(fee);
        
        // 创建支付订单
        PaymentOrder order = new PaymentOrder();
        order.setOrderNo(orderNoGenerator.generate());
        order.setAccountNumber(decryptedAccountNumber);
        order.setMerchantCode(request.getMerchantCode());
        order.setMerchantOrderNo(request.getMerchantOrderNo());
        order.setOrderType(request.getOrderType());
        order.setStatus(PaymentOrderStatus.CREATED);
        order.setAmount(request.getAmount());
        order.setFee(fee);
        order.setSettlementAmount(settlementAmount);
        order.setCurrency(request.getCurrency());
        order.setDescription(request.getDescription());
        order.setCallbackUrl(request.getCallbackUrl());
        order.setNotifyUrl(request.getNotifyUrl());
        
        PaymentOrder savedOrder = paymentOrderRepository.save(order);
        log.info("Payment order created: {}", savedOrder.getOrderNo());
        
        // 异步处理支付
        processPaymentAsync(savedOrder.getOrderNo());
        
        return convertToPaymentResponse(savedOrder);
    }
    
    @Async
    public void processPaymentAsync(String orderNo) {
        try {
            PaymentOrder order = paymentOrderRepository.findByOrderNoForUpdate(orderNo)
                    .orElseThrow(() -> new AccountException(ErrorCode.ORDER_NOT_FOUND));
            
            if (order.getStatus() != PaymentOrderStatus.CREATED) {
                return;
            }
            
            order.setStatus(PaymentOrderStatus.PROCESSING);
            paymentOrderRepository.save(order);
            
            // 调用第三方支付
            ThirdPartyPaymentRequest paymentRequest = new ThirdPartyPaymentRequest();
            paymentRequest.setOrderNo(order.getOrderNo());
            paymentRequest.setAmount(order.getAmount());
            paymentRequest.setCurrency(order.getCurrency());
            paymentRequest.setAccountNumber(order.getAccountNumber());
            paymentRequest.setMerchantCode(order.getMerchantCode());
            paymentRequest.setPaymentType(order.getOrderType().name());
            
            ThirdPartyPaymentResponse paymentResponse = paymentGateway.processPayment(paymentRequest);
            
            if (paymentResponse.isSuccess()) {
                order.setStatus(PaymentOrderStatus.SUCCESS);
                order.setThirdPartyTransactionNo(paymentResponse.getTransactionNo());
                order.setPaymentTime(LocalDateTime.now());
                
                // 记录交易
                transactionService.withdraw(
                        order.getAccountNumber(),
                        order.getAmount(),
                        "Payment for order: " + order.getOrderNo());
            } else {
                order.setStatus(PaymentOrderStatus.FAILED);
                log.error("Payment failed for order {}: {}", orderNo, paymentResponse.getErrorMessage());
            }
            
            paymentOrderRepository.save(order);
            
            // 回调商户
            if (order.getCallbackUrl() != null) {
                notifyMerchant(order);
            }
            
        } catch (Exception e) {
            log.error("Error processing payment for order: " + orderNo, e);
            paymentOrderRepository.findByOrderNo(orderNo).ifPresent(order -> {
                order.setStatus(PaymentOrderStatus.FAILED);
                paymentOrderRepository.save(order);
            });
        }
    }
    
    @Transactional(readOnly = true)
    public PaymentResponseDTO queryPayment(String orderNo) {
        PaymentOrder order = paymentOrderRepository.findByOrderNo(orderNo)
                .orElseThrow(() -> new AccountException(ErrorCode.ORDER_NOT_FOUND));
        
        return convertToPaymentResponse(order);
    }
    
    @Transactional(readOnly = true)
    public PaymentResponseDTO queryPaymentByMerchant(String merchantCode, String merchantOrderNo) {
        PaymentOrder order = paymentOrderRepository.findByMerchantCodeAndMerchantOrderNo(merchantCode, merchantOrderNo)
                .orElseThrow(() -> new AccountException(ErrorCode.ORDER_NOT_FOUND));
        
        return convertToPaymentResponse(order);
    }
    
    private BigDecimal calculateFee(String merchantCode, String paymentType, BigDecimal amount) {
        FeeConfig feeConfig = feeConfigRepository.findByMerchantCodeAndPaymentType(merchantCode, paymentType)
                .orElseThrow(() -> new AccountException(ErrorCode.FEE_CONFIG_NOT_FOUND));
        
        switch (feeConfig.getCalculateMethod()) {
            case FIXED:
                return feeConfig.getFixedFee();
            case PERCENTAGE:
                BigDecimal fee = amount.multiply(feeConfig.getRate());
                if (feeConfig.getMinFee() != null && fee.compareTo(feeConfig.getMinFee()) < 0) {
                    return feeConfig.getMinFee();
                }
                if (feeConfig.getMaxFee() != null && fee.compareTo(feeConfig.getMaxFee()) > 0) {
                    return feeConfig.getMaxFee();
                }
                return fee;
            case TIERED:
                // 实现阶梯费率计算逻辑
                return feeConfig.getFixedFee(); // 简化处理
            default:
                return BigDecimal.ZERO;
        }
    }
    
    private void notifyMerchant(PaymentOrder order) {
        // 实现回调商户逻辑
        // 通常使用HTTP调用商户的callbackUrl或notifyUrl
        log.info("Notifying merchant for order: {}", order.getOrderNo());
    }
    
    private PaymentResponseDTO convertToPaymentResponse(PaymentOrder order) {
        PaymentResponseDTO response = new PaymentResponseDTO();
        response.setOrderNo(order.getOrderNo());
        response.setMerchantOrderNo(order.getMerchantOrderNo());
        response.setStatus(order.getStatus());
        response.setAmount(order.getAmount());
        response.setFee(order.getFee());
        response.setSettlementAmount(order.getSettlementAmount());
        response.setCurrency(order.getCurrency());
        response.setCreatedAt(order.getCreatedAt());
        
        // 加密账号
        response.setAccountNumber(encryptionUtil.encrypt(order.getAccountNumber()));
        
        return response;
    }
}