Apache ShenYu is a production-grade, plugin-based API gateway and microservices proxy platform written in Java. The runtime gateway (shenyu-bootstrap, a Spring WebFlux application) ingests HTTP/HTTPS/WebSocket traffic and processes each exchange through an ordered chain of ShenyuPlugin implementations covering protocol translation (HTTP, gRPC, Apache Dubbo, SOFA, Tars, MQTT, TCP), security (sign, JWT, OAuth2, key-auth, cryptor, WAF), traffic management (rate limiting, resilience4j), caching, logging (Kafka, Elasticsearch, RocketMQ, console), request rewriting, mocking, and AI proxy/token limiting. Routing, selector, rule, and plugin data is not hardcoded; it is synchronized dynamically from the admin plane. The management plane is shenyu-admin, a Spring MVC/MyBatis application exposing roughly 40 REST controllers for managing plugins, selectors, rules, metadata, namespaces, app auth, users/roles/permissions, discovery, and configuration import/export. Persistence supports H2, MySQL, PostgreSQL, OpenGauss, and Oracle via MyBatis mappers, with upgrade SQL scripts under db/upgrade. Configuration changes flow from admin to gateways through WebSocket, HTTP long polling, ZooKeeper, Nacos, etcd, or Apollo listeners, all built on shared abstract data-changed-listener templates. Client SDK modules (shenyu-client-*) auto-register Spring MVC, Dubbo, gRPC, SOFA, Tars, and WebSocket APIs using annotation-based extractors and a Disruptor-based async publish pipeline; a Kubernetes controller reconciles ingress/gateway-api resources. The repository demonstrates strong craftsmanship: a Dubbo-style SPI framework (@SPI/@Join/ExtensionLoader) drives pluggable match strategies, predicate judges, load balancers (Random, RoundRobin, LeastActive, P2C, ShortestResponse), cryptors, and rate limiter algorithms; shenyu-common contains a W-TinyLFU cache and memory-bounded queues that prevent OOM under burst; the admin uses domain events for audit logging and an observer pattern for Prometheus-driven auto-scaling. Testing is extensive (per-module unit tests, Spring Boot integration tests, Docker-Compose e2e suites, K8s examples). Main weaknesses are surface-area boilerplate across dozens of plugin modules, some experimental/placeholder code (WASM, AI, MCP), and a few disabled tests — typical for a large Apache project. Maintenance is active with recent commits, CodeQL scanning, and zero dependabot alerts; technical drift is low.
hsweb-framework is a modular Java backend development framework, not a single deployable application. It is built as a multi-module Maven monorepo providing reactive-first CRUD scaffolding, RBAC/authorization, an OAuth2 authorization server, dynamic datasource switching, reactive caching, access logging, i18n, dictionary/enum support, and file upload services. The code is dominated by Spring Boot auto-configurations, SPI extension points, and reusable controller/service interfaces that applications consume as dependencies. It supports both WebFlux (R2DBC) and WebMVC (JDBC) stacks, with reactive APIs as the primary design direction. Architecturally, the framework centers on hsweb-core (bean utilities, i18n, exceptions, ID generation), hsweb-commons (generic CRUD services/controllers, query helpers, SQL analysis), hsweb-authorization (authentication model, token management, AOP method authorization, OAuth2 granters/authenticators), hsweb-datasource (dynamic schema/table/datasource switching), hsweb-concurrent-cache (ReactiveCache with Guava/Caffeine/Redis backends), hsweb-logging (AOP access logs), and hsweb-system (default user, permission, dictionary, and file modules). Key entry points are Java annotations such as @Authorize, @Resource, @EnableEasyormRepository, @EnableEntityEvent, and interface contracts like ReactiveServiceCrudController and CrudService, which auto-generate REST endpoints for entities. Primary data flows move from HTTP requests through WebFlux/WebMVC controllers into reactive or synchronous CrudService implementations, then through EasyORM repositories to R2DBC/JDBC databases. Authorization flows are layered: token parsing/generation, AuthenticationManager initialization, AOP authorization definition parsing, data-permission handlers, and OAuth2 grant/redirect handling. Entity lifecycle events, cache invalidation, and query rewriting are cross-cutting mechanisms implemented via Spring application events, Reactor context, and JSqlParser-based SQL analysis. Redis is used for token storage and cache synchronization; Caffeine/Guava support local reactive caches. External dependencies include Spring Boot 3.x, Reactor, R2DBC, JDBC, Redis, JSqlParser, and Javassist. The codebase demonstrates strong engineering in isolated utilities like FastBeanCopier, reactive cache invalidation, streaming JSON response writing, and SQL query analysis. However, it carries notable drift: mixed javax/jakarta annotations, deprecated legacy APIs, a coexistence of servlet and reactive paths, some ignored/incomplete tests, and complex compatibility layers around OAuth2 and cache semantics. Overall it is a mature, actively maintained framework with substantial reusable components, though consumers should expect to navigate Chinese-language comments and some legacy baggage.
This repository is a historical demo application showcasing JWT-based authentication and authorization in a Spring WebFlux reactive stack. It implements a custom security filter chain that first authenticates via HTTP Basic (returning a signed JWT) and then validates Bearer tokens on protected endpoints. The code uses Spring Boot 2.1.1, Java 8, and the Nimbus JOSE library for JWT signing and verification. The architecture is a simple monolith with in-memory user details and hardcoded secrets, intended for educational purposes rather than production use. The README explicitly states the project has been superseded by a modernized version (Spring Boot 4, Java 21, Spring Security 7) and is kept for historical reference. The code demonstrates key patterns: custom ServerAuthenticationSuccessHandler, functional bearer token converter, and a dummy ReactiveAuthenticationManager for stateless JWT authentication. However, it suffers from significant technical drift (outdated dependencies, Java 8, deprecated APIs) and lacks proper error handling, tests, and configurability.