@PostMapping("/order")
@ApiSecurity(decryptRequest = true, encryptResponse = true)   // ← 就這么一行
public OrderResp createOrder(@RequestBody OrderReq req) {
    return service.create(req);
}

@Data
public class ApiSecurityParam {
    private String appId;      // 應(yīng)用標(biāo)識(shí)
    private String key;        // RSA 加密后的 AES 密鑰(Base64)
    private String data;       // AES 加密的業(yè)務(wù) JSON(Base64)
    private String sign;       // 簽名
    private String timestamp;  // 防重放
    private String nonce;      // 防重放
}

@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
public @interface ApiSecurity {
    boolean decryptRequest()  default false; // 請(qǐng)求體是否解密
    boolean encryptResponse() default false; // 響應(yīng)體是否加密
    boolean sign()            default true;  // 是否驗(yàn)簽/加簽
}

@RestControllerAdvice
@Order(Ordered.HIGHEST_PRECEDENCE)
public class DecryptRequestAdvice implements RequestBodyAdvice {
    @Override
    public boolean supports(MethodParameter methodParameter, Type targetType,
                            Class<? extends HttpMessageConverter<?>> converterType) {
        return methodParameter.hasMethodAnnotation(ApiSecurity.class)
                && methodParameter.getMethodAnnotation(ApiSecurity.class).decryptRequest();
    }
    @Override
    public Object handleEmptyBody(Object body, HttpInputMessage inputMessage,
                                  MethodParameter parameter, Type targetType,
                                  Class<? extends HttpMessageConverter<?>> converterType) {
        return body;
    }
    @SneakyThrows
    @Override
    public HttpInputMessage beforeBodyRead(HttpInputMessage inputMessage,
                                           MethodParameter parameter, Type targetType,
                                           Class<? extends HttpMessageConverter<?>> converterType) {
        String body = StreamUtils.copyToString(inputMessage.getBody(), StandardCharsets.UTF_8);
        ApiSecurityParam param = JSON.parseObject(body, ApiSecurityParam.class);
        // 1. 防重放校驗(yàn)（timestamp、nonce）
        checkReplay(param);
        // 2. RSA 私鑰解密 AES 密鑰
        String aesKey = RSAUtil.decryptByPrivateKey(param.getKey(), RsaKeyHolder.PRIVATE_KEY);
        // 3. AES 解密業(yè)務(wù) JSON
        String json = AESUtil.decrypt(param.getData(), aesKey);
        // 4. 驗(yàn)簽
        boolean ok = RSAUtil.verify(json + param.getTimestamp() + param.getNonce(),
                                    RsaKeyHolder.PUBLIC_KEY, param.getSign());
        if (!ok) throw new BizException("驗(yàn)簽失敗");
        return new MappingJacksonInputMessage(new ByteArrayInputStream(json.getBytes()),
                                              inputMessage.getHeaders());
    }
}

@RestControllerAdvice
@Order(Ordered.HIGHEST_PRECEDENCE)
public class EncryptResponseAdvice implements ResponseBodyAdvice<Object> {
    @Override
    public boolean supports(MethodParameter returnType,
                            Class<? extends HttpMessageConverter<?>> converterType) {
        ApiSecurity anno = returnType.getMethodAnnotation(ApiSecurity.class);
        return anno != null && anno.encryptResponse();
    }
    @SneakyThrows
    @Override
    public Object beforeBodyWrite(Object body, MethodParameter returnType,
                                  MediaType selectedContentType,
                                  Class<? extends HttpMessageConverter<?>> selectedConverterType,
                                  ServerHttpRequest request, ServerHttpResponse response) {
        String json = JSON.toJSONString(body);
        // 1. 隨機(jī) AES 密鑰
        String aesKey = AESUtil.randomKey(128);
        // 2. AES 加密響應(yīng)
        String data = AESUtil.encrypt(json, aesKey);
        // 3. RSA 公鑰加密 AES 密鑰
        String encKey = RSAUtil.encryptByPublicKey(aesKey, RsaKeyHolder.PUBLIC_KEY);
        // 4. 生成簽名
        String sign = RSAUtil.sign(json, RsaKeyHolder.PRIVATE_KEY);
        ApiSecurityParam resp = new ApiSecurityParam();
        resp.setKey(encKey);
        resp.setData(data);
        resp.setSign(sign);
        resp.setTimestamp(String.valueOf(System.currentTimeMillis()));
        return resp;
    }
}