Mikroservis Katmanları — İstek Nereden Geçiyor

1
spring:
2
  cloud:
3
    gateway:
4
      routes:
5
        - id: mobile-bff
6
          uri: lb://mobile-bff
7
          predicates:
8
            - Path=/mobile/**
9
          filters:
10
            - TokenRelay=                            # pass the verified token downstream
11
            - name: RequestRateLimiter
12
              args:
13
                key-resolver: "#{@clientIdKeyResolver}"   # per app installation, not per IP
14
                redis-rate-limiter.replenishRate: 20
15
                redis-rate-limiter.burstCapacity: 40
16
        - id: open-banking
17
          uri: lb://open-banking-api
18
          predicates:
19
            - Path=/openbanking/**                   # third-party apps: a separate route and limit
20
  security:
21
    oauth2:
22
      resourceserver:
23
        jwt:
24
          issuer-uri: https://auth.bank.example/realms/retail

1
@RestController
2
@RequestMapping("/mobile/accounts")
3
class AccountPageController {
4

5
    private final AccountsClient accounts;
6
    private final MovementsClient movements;
7
    private final CardsClient cards;
8

9
    AccountPageController(AccountsClient accounts, MovementsClient movements, CardsClient cards) {
10
        this.accounts = accounts;
11
        this.movements = movements;
12
        this.cards = cards;
13
    }
14

15
    // One round trip from the phone. The three calls happen inside the data centre.
16
    @GetMapping("/{iban}/page")
17
    AccountPageView page(@PathVariable String iban, @AuthenticationPrincipal Jwt token) {
18
        var account = accounts.get(iban);
19
        var lastTen = movements.latest(iban, 10);
20
        var debitCard = cards.debitCardFor(iban);            // may be empty
21
        return AccountPageView.of(account, lastTen, debitCard);
22
    }
23
}

1
// Shaped for this one screen: nothing the screen does not show, nothing the phone must reformat.
2
public record AccountPageView(
3
        String title,               // "Vadesiz TL · …1326"
4
        String maskedIban,          // "TR33 **** **** **** **** **13 26"
5
        String availableBalance,    // "12.450,75 TL", formatted server-side for the tr-TR locale
6
        List<MovementRow> latest,
7
        Optional<String> debitCardLast4) {
8

9
    public record MovementRow(String date, String description, String amount, boolean incoming) {}
10

11
    static AccountPageView of(AccountDto account, List<MovementDto> movements, Optional<CardDto> card) {
12
        // formatting helpers omitted
13
        return new AccountPageView(Titles.of(account), Ibans.mask(account.iban()),
14
                Money.format(account.available()), MovementRow.from(movements),
15
                card.map(CardDto::last4));
16
    }
17
}

1
// The rule lives with the domain that owns it. Mobile, web, branch and the open-banking
2
// API all reach it, so they all get the same answer.
3
@Component
4
class TransferLimitPolicy {
5

6
    private final DailyUsage usage;
7
    private final CustomerLimits limits;
8

9
    TransferLimitPolicy(DailyUsage usage, CustomerLimits limits) {
10
        this.usage = usage;
11
        this.limits = limits;
12
    }
13

14
    LimitCheck check(String customerNo, Channel channel, BigDecimal amount, LocalDate day) {
15
        BigDecimal limit = limits.dailyLimit(customerNo, channel);     // set by the customer, capped by the bank
16
        BigDecimal used = usage.of(customerNo, channel, day);
17
        return used.add(amount).compareTo(limit) <= 0
18
                ? LimitCheck.ok(limit.subtract(used).subtract(amount))
19
                : LimitCheck.exceeded(limit.subtract(used));
20
    }
21
}

1
// A business rule that leaked into the gateway. It started as "just one check":
2
// now web and branch are not covered, nobody owns it, and it cannot see the daily usage.
3
@Component
4
class TransferAmountFilter implements GlobalFilter {
5

6
    @Override
7
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
8
        if (exchange.getRequest().getPath().value().startsWith("/mobile/transfers")) {
9
            // parse the body, compare the amount with a hard-coded 50 000 … (the smell)
10
        }
11
        return chain.filter(exchange);
12
    }
13
}