Author: 江南白衣

1.业务异常类

      1.所以业务异常类派生于BusinessException基类。

      2.原则上，要进行相同处理的异常分为一类，用ERROR_CODE标识不同。

      3.出错信息统一写在errors.properties，以ERROR_CODE为主键，支持i18N，由基类提供默认的getMessage()函数。

      参考BussinessException.java和OrderException.java。

2.Servlet规范里的异常控制

 2.1按error-code统一定义错误页面

<error-page>
  <error-code>404</error-code>
  <location>/404.jsp</location>
</error-page>

<error-page>
  <error-code>500</error-code>
  <location>/error.jsp</location>
</error-page>

2.2按异常类型定义单独错误页面

<error-page>
  <exception-type>org.sprngside.bookstore.UserNotFound</exception-type>
  <location>/userNotFound.jsp</location>
</error-page>

2.3 在JSP里单独定义错误页面

<@ errorPage="error.jsp">

3.Spring MVC里的异常控制

   spring-mvc可在xxx-serverlet.xml里定义default和 按Excepiton类型影射的错误页面, 和Servlet规范比,主要作了Spring特色的JSP路径转向和日志记录.参见bookstore-servlet.xml

  <bean id="exceptionResolver" class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">
        <property name="defaultErrorView" value="/error.jsp"/>
        <property name="exceptionMappings">
            <props>
                <prop key="org.springside.framework.base.BusinessException">/businessError.jsp</prop>
            </props>
        </property>
    </bean>

4. error.jsp的处理

         error.jsp会同时处理jsp,servlet,和spring抛过来的异常

         其中jsp的异常在exception 变量中.

         servlet的异常在(Exception)request.getAttribute("javax.servlet.error.exception")

         spring的异常在(Exception) request.getAttribute("exception")

         使用 (String) request.getAttribute("javax.servlet.error.request_uri")获得 request_uri
         使用 logger.error(exception.getMessage(), exception); 记录整个异常栈

java.lang.Objectorg.acegisecurity.util.FilterChainProxy

All Implemented Interfaces:

Filter, InitializingBean, ApplicationContextAware

public class FilterChainProxy
extends Object
implements Filter, InitializingBean, ApplicationContextAware

Delegates Filter requests to a list of Spring-managed beans.

通过一系列的由spring托管的beans ，代理过滤请求。
FilterChainProxy 通过在web.xml中定义的FilterToBeanProxy 被加载，FilterChainProxy 将会通过init(FilterConfig), destroy() and doFilter(ServletRequest, ServletResponse, FilterChain)调用，调用每一个在其中定义的过滤器。

The FilterChainProxy is loaded via a standard FilterToBeanProxy declaration in web.xml. FilterChainProxy will then pass init(FilterConfig), destroy() and doFilter(ServletRequest, ServletResponse, FilterChain) invocations through to each Filter defined against FilterChainProxy.

 
    FilterChainProxy  是通过一个标准的FilterInvocationDefinitionSource 来实现配置的，每个可能的FilterChainProxy应该服务的URI模式都必须进入
            第一个搭配的URI模式将会被用来定义处理请求的所有的过滤器，就是说只适配第一组过滤器，后面的其他过滤器将无效。
FilterChainProxy is configured using a standard FilterInvocationDefinitionSource. Each possible URI pattern that FilterChainProxy should service must be entered. The first matching URI pattern located by FilterInvocationDefinitionSource for a given request will be used to define all of the Filters that apply to that request. NB: This means you must put most specific URI patterns at the top of the list, and ensure all Filters that should apply for a given URI pattern are entered against the respective entry. The FilterChainProxy will not iterate the remainder of the URI patterns to locate additional Filters. The FilterInvocationDefinitionSource described the applicable URI pattern to fire the filter chain, followed by a list of configuration attributes. Each configuration attribute's ConfigAttribute.getAttribute() corresponds to a bean name that is available from the application context.

FilterChainProxy respects normal handling of Filters that elect not to call Filter.doFilter(javax.servlet.ServletRequest, javax.servlet.ServletResponse, javax.servlet.FilterChain), in that the remainder of the origial or FilterChainProxy-declared filter chain will not be called.

It is particularly noted the Filter lifecycle mismatch between the servlet container and IoC container. As per FilterToBeanProxy JavaDocs, we recommend you allow the IoC container to manage lifecycle instead of the servlet container. By default the FilterToBeanProxy will never call this class' init(FilterConfig) and destroy() methods, meaning each of the filters defined against FilterInvocationDefinitionSource will not be called. If you do need your filters to be initialized and destroyed, please set the lifecycle initialization parameter against the FilterToBeanProxy to specify servlet container lifecycle management.

If a filter name of TOKEN_NONE is used, this allows specification of a filter pattern which should never cause any filters to fire.

    Author: cac 差沙

    Acegi是Spring Framework 下最成熟的安全系统，它提供了强大灵活的企业级安全服务，如完善的认证和授权机制，Http资源访问控制，Method 调用访问控制，Access Control List (ACL) 基于对象实例的访问控制，Yale Central Authentication Service (CAS) 耶鲁单点登陆，X509 认证，当前所有流行容器的认证适配器，Channel Security频道安全管理等功能。

1.1 网站资源

官方网站      http://acegisecurity.sourceforge.net
论坛            http://forum.springframework.org/forumdisplay.php?f=33
Jira              http://opensource.atlassian.com/projects/spring/browse/SEC

1.2 多方面的安全控制粒度

1. URL 资源访问控制
    http://apps:8080/index.htm -> for public
    http://apps:8080/user.htm -> for authorized user
2. 方法调用访问控制
   public void getData() -> all user
   public void modifyData() -> supervisor only
3. 对象实例保护
   order.getValue() < $100 -> all user
   order.getValue() > $100 -> supervisor only

1.3 非入侵式安全架构

1. 基于Servlet Filter和Spring aop,  使商业逻辑和安全逻辑分开，结构更清晰
2. 使用Spring 来代理对象，能方便地保护方法调用

1.4 其它安全架构

    Acegi只是安全框架之一，其实还存在其它优秀的安全框架可供选择：

•  JAAS ：http://java.sun.com/products/jaas/
•  Seraph: http://opensource.atlassian.com/seraph/
•  jSai - Servlet Security : http://oss.ipov.org/jsai/
•  Gabriel : http://gabriel.codehaus.org/
•  JOSSO : http://www.josso.org/
•  Kasai: http://www.manentiasoftware.com/kasai/goToHome.action
•  jPAM : http://jpam.sourceforge.net/
•  OpenSAML : http://www.opensaml.org/

import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.ArrayList;
import java.util.Iterator;
import java.util.List;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.beans.factory.ListableBeanFactory;
import org.springframework.beans.factory.generic.GenericBeanFactoryAccessor;
import org.springframework.context.support.ClassPathXmlApplicationContext;
import org.springframework.dao.DataAccessException;
import org.springframework.jdbc.core.ColumnMapRowMapper;
import org.springframework.jdbc.core.ConnectionCallback;
import org.springframework.jdbc.core.JdbcTemplate;
import org.springframework.jdbc.core.PreparedStatementCallback;
import org.springframework.jdbc.core.PreparedStatementCreator;
import org.springframework.jdbc.core.PreparedStatementSetter;
import org.springframework.jdbc.core.ResultSetExtractor;
import org.springframework.jdbc.core.RowCallbackHandler;
import org.springframework.jdbc.core.RowCountCallbackHandler;
import org.springframework.jdbc.core.RowMapper;
import org.springframework.jdbc.core.StatementCallback;
import org.springframework.jdbc.support.JdbcUtils;
import org.springframework.samples.petclinic.Person;

/**
 *
 * @author worldheart
 *
 */
public class MainTestForJdbcTemplate {

 private static final Log log = LogFactory.getLog(MainTestForJdbcTemplate.class);
 
 public static void main(String[] args) {  
  ListableBeanFactory cbf = new ClassPathXmlApplicationContext("ac1.xml");  
  GenericBeanFactoryAccessor gbfa = new GenericBeanFactoryAccessor(cbf);
  
  JdbcTemplate jt = gbfa.getBean("jdbcTemplate");
  
  jt.execute(new ConnectionCallback(){
   public Object doInConnection(Connection con) throws SQLException, DataAccessException {
    System.out.println(con.getMetaData().getDriverName());
    return null;
   }
  });
  
  List nameList = (List)jt.execute(new StatementCallback(){
   public Object doInStatement(Statement stmt) throws SQLException, DataAccessException {
    System.out.println(stmt.getConnection().getMetaData().getDatabaseProductVersion());
    List<String> nameList = new ArrayList<String>();
    ResultSet rs = null;
    try{
     rs = stmt.executeQuery("select name from types");
     while(rs.next()){
      nameList.add(rs.getString("name"));
     }
    }finally{
     JdbcUtils.closeResultSet(rs);
    }
    return nameList;
   }
  });
  System.out.println(nameList);
  
  List perList = (List)jt.query("select * from vets",
    new ResultSetExtractor(){
      public Object extractData(ResultSet rs) throws SQLException, DataAccessException {
       List<Person> personList = new ArrayList<Person>();
       while(rs.next()){
        Person per = new Person();
        per.setId(rs.getInt("id"));
        per.setFirstName(rs.getString("first_name"));
        per.setLastName(rs.getString("last_name"));
        personList.add(per);
       }
       return personList;
    }
  });
  for(Iterator iterator = perList.iterator(); iterator.hasNext();){
   Person person = (Person)iterator.next();
   System.out.println(person.getId() + "," + person.getFirstName() + "," + person.getLastName());
  }

  final List<Person> pSonList = new ArrayList<Person>();
  jt.query("select * from vets", new RowCallbackHandler(){
   public void processRow(ResultSet rs) throws SQLException {
    Person per = new Person();
    per.setId(rs.getInt("id"));
    per.setFirstName(rs.getString("first_name"));
    per.setLastName(rs.getString("last_name"));
    pSonList.add(per);
   }
  });
  for(Person pSon: pSonList){
   System.out.println(pSon.getId() + "," + pSon.getFirstName() + "," + pSon.getLastName());
  }
  
  RowCountCallbackHandler rcch = new RowCountCallbackHandler();
  jt.query("select * from vets", rcch);
  for(String colName: rcch.getColumnNames())
   System.out.println(colName);
  for(int colType: rcch.getColumnTypes())
   System.out.println(colType);
  System.out.println(rcch.getColumnCount());
  System.out.println(rcch.getRowCount());
  
  List vetsList = (List)jt.query("select * from vets",
    new RowMapper(){
     public Object mapRow(ResultSet rs, int rowNum) throws SQLException {
      Person pers = new Person();
      pers.setId(rs.getInt("id"));
      pers.setFirstName(rs.getString("first_name"));
      pers.setLastName(rs.getString("last_name"));
      return pers;
     }
  });
  System.out.println(vetsList);
  
  ColumnMapRowMapper cmrw = new ColumnMapRowMapper();
  List vList = (List)jt.query("select * from vets", cmrw);
  System.out.println(vList);
  
  System.out.println(jt.queryForInt("select count(*) from vets where id = ?",
    new Object[]{3}));
      
  jt.execute("update owners set address = 'GuangZhou' where telephone = ?",
    new PreparedStatementCallback(){
     public Object doInPreparedStatement(PreparedStatement ps) throws SQLException, DataAccessException {
      ps.setString(1, "16068008");
      ps.addBatch();
      ps.setString(1, "6085555487");
      ps.addBatch();
      return ps.executeBatch();
     }
  });
  
  System.out.println(jt.query("select address from owners where first_name = ? and last_name = ?",
    new PreparedStatementSetter(){
     public void setValues(PreparedStatement ps) throws SQLException {
      ps.setString(1, "Jeff");
      ps.setString(2, "Black");
     }
    },
    new RowMapper(){
     public Object mapRow(ResultSet rs, int rowNum) throws SQLException {      
      return rs.getString("address");
     }
    }));
  
  System.out.println(jt.execute(
    new PreparedStatementCreator(){
     public PreparedStatement createPreparedStatement(Connection con) throws SQLException {
      return con.prepareStatement("select address from owners");
     }
    },
    new PreparedStatementCallback(){
     public Object doInPreparedStatement(PreparedStatement ps) throws SQLException, DataAccessException {
      List<String> list = new ArrayList<String>();
      ResultSet rs = null;
      try{
       rs = ps.executeQuery();
       while(rs.next()){
        list.add(rs.getString("address"));
       }
      }finally{
       JdbcUtils.closeResultSet(rs);
      }
      return list;
     }
    }));
  
 }

}

public class BindStatus
extends Object

Simple adapter to expose the bind status of a field or object. Set as a variable both by the JSP bind tag and Velocity/FreeMarker macros.

  简单的适配器获取域或者是对象绑定状态， 同样适用于模板。
Obviously, object status representations (i.e. errors at the object level rather than the field level) do not have an expression and a value but only error codes and messages. For simplicity's sake and to be able to use the same tags and macros, the same status class is used for both scenarios.
显然，对象的状态表示（例如错误是对象级的而不是域级别的）没有表达式或者值，而是只有错误码和消息

1. /**

   
   
2. * Copyright: Copyright (c) 2005-2005
   
3. * Company: JavaResearch(http://www.javaresearch.org)
   
4. */
   
5. package org.javaresearch.jerch;
   
6. 
   
7. import java.sql.PreparedStatement;
   
8. import java.sql.SQLException;
   
9. 
   
10. /**
    
11. * PreparedStatement回调接口定义。
    
12. * 最后更新日期:2005年3月28日
    
13. * @author cherami
    
14. */
    
15. publicinterfacePreparedStatementCallback {
    
16.   /**
    
17.    * 定义PreparedStatement中的执行内容。
    
18.    * 执行前PreparedStatement的参数等内容都已经设置好了。
    
19.    * @param stmt PreparedStatement
    
20.    * @return 执行的结果
    
21.    * @throws SQLException
    
22.    */
    
23.   publicObject doInPreparedStatement(PreparedStatement stmt) throwsSQLException;
    
24. }

List perList = (List)jt.query("select * from vets",
    new ResultSetExtractor(){
      public Object extractData(ResultSet rs) throws SQLException, DataAccessException {
       List<Person> personList = new ArrayList<Person>();
       while(rs.next()){
        Person per = new Person();
        per.setId(rs.getInt("id"));
        per.setFirstName(rs.getString("first_name"));
        per.setLastName(rs.getString("last_name"));
        personList.add(per);
       }
       return personList;
    }
  });

1. List rows = jdbcTemplate.queryForList("SELECT * FROM USER");   
2. Iterator it = rows.iterator();   
3. while(it.hasNext()) {   
4.     Map userMap = (Map) it.next();   
5.     System.out.print(userMap.get("user_id") + "\t");   
6.     System.out.print(userMap.get("name") + "\t");   
7.     System.out.print(userMap.get("sex") + "\t");   
8.     System.out.println(userMap.get("age") + "\t");   
9. }

控制器的概念是MVC设计模式的一部分(确切地说，是MVC中的C）。应用程序的行为通常被定义为服务接口，而控制器使得用户可以访问应用所提供的服务。控制器解析用户输入，并将其转换成合理的模型数据，从而可以进一步由视图展示给用户。Spring以一种抽象的方式实现了控制器概念，这样使得不同类型的控制器可以被创建。Spring本身包含表单控制器、命令控制器、向导型控制器等多种多样的控制器。

Spring控制器架构的基础是org.springframework.mvc.Controller接口，其代码如下：

public interface Controller {

    /**
     * Process the request and return a ModelAndView object which the DispatcherServlet
     * will render.
     */
    ModelAndView handleRequest(
        HttpServletRequest request,
        HttpServletResponse response) throws Exception;

}

你可以发现Controller接口仅仅声明了一个方法，它负责处理请求并返回合适的模型和视图。Spring MVC实现的基础就是这三个概念：Mdel、View（ModelAndView）以及 Controller。虽然Controller接口是完全抽象的，但Spring也提供了许多你可能会用到的控制器。Controller接口仅仅定义了每个控制器都必须提供的基本功能：处理请求并返回一个模型和一个视图。

package samples;

public class SampleController extends AbstractController {

    public ModelAndView handleRequestInternal(
        HttpServletRequest request,
        HttpServletResponse response) throws Exception {

        ModelAndView mav = new ModelAndView("hello");
        mav.addObject("message", "Hello World!");
        return mav;        
    }
}

<bean id="sampleController" class="samples.SampleController">
    <property name="cacheSeconds" value="120"/>
</bean>

								
										// anyMeaningfulName can be replaced by any methodname
								
public [ModelAndView | Map | void] anyMeaningfulName(HttpServletRequest, HttpServletResponse [, Exception | AnyObject]);

public ModelAndView doRequest(HttpServletRequest, HttpServletResponse)

public ModelAndView doLogin(HttpServletRequest, HttpServletResponse, Login)

public ModelAndView processException(HttpServletRequest, HttpServletResponse, IllegalArgumentException)

public void goHome(HttpServletRequest, HttpServletResponse)

public Map doRequest(HttpServletRequest, HttpServletResponse)

<bean id="paramResolver" class="org....mvc.multiaction.ParameterMethodNameResolver">
  <property name="paramName" value="method"/>
</bean>

<bean id="paramMultiController" class="org....mvc.multiaction.MultiActionController">
  <property name="methodNameResolver" ref="paramResolver"/>
  <property name="delegate" ref="sampleDelegate"/>
</bean>

<bean id="sampleDelegate" class="samples.SampleDelegate"/>

## together with

public class SampleDelegate {

    public ModelAndView retrieveIndex(HttpServletRequest req, HttpServletResponse resp) {

        return new ModelAndView("index", "date", new Long(System.currentTimeMillis()));
    }
}

<bean id="propsResolver" class="org....mvc.multiaction.PropertiesMethodNameResolver">
  <property name="mappings">
    <value>
        /index/welcome.html=retrieveIndex
        /**/notwelcome.html=retrieveIndex
        /*/user?.html=retrieveIndex
    </value>
  </property>
</bean>

<bean id="paramMultiController" class="org....mvc.multiaction.MultiActionController">
    <property name="methodNameResolver" ref="propsResolver"/>
    <property name="delegate" ref="sampleDelegate"/>
</bean>

就象和Spring集成的其他表现层技术一样，对于JSP页面你需要一个视图解析器来解析。最常用的JSP视图解析器是InternalResourceViewResolver和ResourceBundleViewResolver。它们被定义在WebApplicationContext里：

# The ResourceBundleViewResolver:
<bean id="viewResolver" class="org.springframework.web.servlet.view.ResourceBundleViewResolver">
    <property name="basename"><value>views</value></property>
</bean>

# And a sample properties file is uses (views.properties in WEB-INF/classes):
welcome.class=org.springframework.web.servlet.view.JstlView
welcome.url=/WEB-INF/jsp/welcome.jsp

productList.class=org.springframework.web.servlet.view.JstlView
productList.url=/WEB-INF/jsp/productlist.jsp

你可以看到ResourceBundleViewResolver需要一个属性文件来把视图名称映射到 1)类和 2) URL。 通过ResolverBundleViewResolver，你可以用一个解析器来解析两种类型的视图。

<bean id="viewResolver" class="org.springframework.web.servlet.view.InternalResourceViewResolver">
    <property name="viewClass"><value>org.springframework.web.servlet.view.JstlView</value></property>
    <property name="prefix"><value>/WEB-INF/jsp/</value></property>
    <property name="suffix"><value>.jsp</value></property>
</bean>

InternalResourceBundleViewResolver可以配置成使用JSP页面。作为好的实现方式，强烈推荐你将JSP文件放在WEB-INF下的一个目录中，这样客户端就不会直接访问到它们。

Spring-mvc 的处理流程

public abstract class HttpServletBean
extends HttpServlet

Simple extension of HttpServlet which treats its config parameters (init-param entries within the servlet tag in web.xml) as bean properties.

HttpServlet的简单扩展用来处理 （init-param）in the web.xml
A handy superclass for any type of servlet. Type conversion of config parameters is automatic, with the corresponding setter method getting invoked with the converted value. It is also possible for subclasses to specify required properties. Parameters without matching bean property setter will simply be ignored.

This servlet leaves request handling to subclasses, inheriting the default behavior of HttpServlet (doGet, doPost, etc).

This generic servlet base class has no dependency on the Spring ApplicationContext concept. Simple servlets usually don't load their own context but rather access service beans from the Spring root application context, accessible via the filter's ServletContext (see WebApplicationContextUtils).

The FrameworkServlet class is a more specific servlet base class which loads its own application context. FrameworkServlet serves as direct base class of Spring's full-fledged DispatcherServlet.

public abstract class FrameworkServlet
extends HttpServletBean
implements ApplicationListener

Base servlet for Spring's web framework. Provides integration with a Spring application context, in a JavaBean-based overall solution.

spring web Framework的基础 servlet  ，提供在以javabean为基础的整体解决方案已完成与spring应用上下文的集成
This class offers the following functionality:
1.管理一个servlet一个网络应用上下文实例，这个servlet的配置由servlet命名空间里的bean来决定
2.根据请求处理发布事件，是否请求成功的被处理了

• Manages a WebApplicationContext instance per servlet. The servlet's configuration is determined by beans in the servlet's namespace.
• Publishes events on request processing, whether or not a request is successfully handled.

Subclasses must implement doService(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse) to handle requests. Because this extends HttpServletBean rather than HttpServlet directly, bean properties are automatically mapped onto it. Subclasses can override initFrameworkServlet() for custom initialization.

因为它继承自httpservletBean 所以bean的属性已经被自动的装配了，子类可以通过覆盖initFrameworkServlet来定制初始化bean

Detects a "contextClass" parameter at the servlet init-param level, falling back to the default context class, XmlWebApplicationContext, if not found. Note that, with the default FrameworkServlet, a custom context class needs to implement the ConfigurableWebApplicationContext SPI.

Passes a "contextConfigLocation" servlet init-param to the context instance, parsing it into potentially multiple file paths which can be separated by any number of commas and spaces, like "test-servlet.xml, myServlet.xml". If not explicitly specified, the context implementation is supposed to build a default location from the namespace of the servlet.

Note: In case of multiple config locations, later bean definitions will override ones defined in earlier loaded files, at least when using Spring's default ApplicationContext implementation. This can be leveraged to deliberately override certain bean definitions via an extra XML file.

The default namespace is "'servlet-name'-servlet", e.g. "test-servlet" for a servlet-name "test" (leading to a "/WEB-INF/test-servlet.xml" default location with XmlWebApplicationContext). The namespace can also be set explicitly via the "namespace" servlet init-param.

<bean id="exampleInitBean" class="examples.ExampleBean" init-method="cleanup"/>

public interface Lifecycle

Interface defining methods for start/stop lifecycle control. The typical use case for this is to control asynchronous processing.

Can be implemented by both components (typically a Spring bean defined in a Spring BeanFactory) and containers (typically a Spring ApplicationContext). Containers will propagate start/stop signals to all components that apply.

Can be used for direct invocations or for management operations via JMX. In the latter case, the MBeanExporter will typically be defined with an InterfaceBasedMBeanInfoAssembler, restricting the visibility of activity-controlled components to the Lifecycle interface.

Since:

2.0

Author:

Juergen Hoeller

See Also:

ConfigurableApplicationContext , AbstractMessageListenerContainer, SchedulerFactoryBean