企业级Java项目金融应用领域——银行系统

银行系统

后端

• 核心框架: Spring Boot/Spring Cloud (微服务架构)

• 持久层: MyBatis/JPA, Hibernate

• 数据库: Oracle/MySQL (主从复制), Redis (缓存)

• 消息队列: RabbitMQ/Kafka (异步处理)

• API接口: RESTful API, Swagger文档

• 安全框架: Spring Security, OAuth2/JWT

• 分布式事务: Seata

• 搜索引擎: Elasticsearch (交易查询)

• 批处理: Spring Batch

前端

• Web框架: Vue.js/React + Element UI/Ant Design

• 移动端: 原生APP或React Native/Flutter

• 图表库: ECharts/D3.js (数据可视化)

**其他：**分布式锁: Redisson 分布式ID生成: Snowflake算法 文件处理: Apache POI (Excel), PDFBox 工作流引擎: Activiti/Camunda

• 容器化: Docker + Kubernetes

• 服务发现: Nacos/Eureka

• 配置中心: Apollo/Nacos

• 网关: Spring Cloud Gateway

• 监控: Prometheus + Grafana

• 日志: ELK Stack (Elasticsearch, Logstash, Kibana)

• CI/CD: Jenkins/

• GitLab CI

1. 账户管理

账户开户/销户

账户信息维护

账户状态管理(冻结/解冻)

账户余额查询

账户分级管理(个人/企业)

<dependencies>
<!– Spring Boot Starter –>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-jpa</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-validation</artifactId>
</dependency>

<!– Database –>
<dependency>
<groupId>mysql</groupId>
<artifactId>mysql-connector-java</artifactId>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>com.h2database</groupId>
<artifactId>h2</artifactId>
<scope>test</scope>
</dependency>

<!– Lombok –>
<dependency>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
<optional>true</optional>
</dependency>
<!– Spring Security –>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>

<!– JWT支持 –>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-api</artifactId>
<version>0.11.5</version>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-impl</artifactId>
<version>0.11.5</version>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-jackson</artifactId>
<version>0.11.5</version>
<scope>runtime</scope>
</dependency>

<!– 数据加密 –>
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcpkix-jdk15on</artifactId>
<version>1.70</version>
</dependency>

<!– 防XSS –>
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-text</artifactId>
<version>1.10.0</version>
</dependency>

<!– 限流 –>
<dependency>
<groupId>com.github.vladimir-bukhtoyarov</groupId>
<artifactId>bucket4j-core</artifactId>
<version>7.6.0</version>
</dependency>
<!– Other –>
<dependency>
<groupId>org.springdoc</groupId>
<artifactId>springdoc-openapi-ui</artifactId>
<version>1.6.14</version>
</dependency>
</dependencies>

spring:
datasource:
url: jdbc:mysql://localhost:3306/bank_account_db?useSSL=false&serverTimezone=UTC
username: root
password: password
driver-class-name: com.mysql.cj.jdbc.Driver
jpa:
hibernate:
ddl-auto: update
show-sql: true
properties:
hibernate:
format_sql: true
dialect: org.hibernate.dialect.MySQL8Dialect

server:
port: 8080

logging:
level:
com.bank.account: DEBUG
security:
jwt:
secret-key: your–256–bit–secret–key–change–this–to–something–secure
expiration: 86400000 # 24 hours in milliseconds
refresh-token.expiration: 604800000 # 7 days in milliseconds
encryption:
key: your–encryption–key–32bytes
iv: your–initialization–vector–16bytes
rate-limit:
enabled: true
capacity: 100
refill-rate: 100
refill-time: 1 # minutes

@Entity
@Table(name="bank_account")
@Data
public class Account{

@Id
@GeneratedValue(strategy=GenerationType.IDENTITY)
private Long id;

@Column(unique=true,nullable=false)
private String accountNumber;

@Column(nullable = false)
private Long customerId;

@Enumerated(EnumType.STRING)
@Column(nullable = false)
private AccountType accountType;//枚举类型：个人储蓄/活期,企业活期/贷款,信用卡

@Enumerated(EnumType.STRING)
@Column(nullable = false)
private AccountStatus status;//枚举状态：活跃、不活跃、冻结、已关闭、休眠

@Column(nullable = false, precision = 19, scale = 4)
private BigDecimal balance = BigDecimal.ZERO;

@Column(nullable = false, precision = 19, scale = 4)
private BigDecimal availableBalance = BigDecimal.ZERO;

@Column(nullable = false)
private String currency = "CNY";

@CreationTimestamp
private Date createdAt;

@UpdateTimestamp
private Date updatedAt;

@Version
private Long version; // 乐观锁版本号
}

/**
安全相关的实体
*/
@Data
@Builder
@NoArgsConstructor
@AllArgsConstructor
@Entity
@Table(name = "users")
public class User implements UserDetails {
@Id
@GeneratedValue(strategy = GenerationType.IDENTITY)
private Long id;

@Column(nullable = false, unique = true)
private String username;

@Column(nullable = false)
private String password;

@Enumerated(EnumType.STRING)
private Role role;

@Override
public Collection<? extends GrantedAuthority> getAuthorities() {
return List.of(new SimpleGrantedAuthority(role.name()));
}

@Override
public boolean isAccountNonExpired() {
return true;
}

@Override
public boolean isAccountNonLocked() {
return true;
}

@Override
public boolean isCredentialsNonExpired() {
return true;
}

@Override
public boolean isEnabled() {
return true;
}
}

public enum Role {
CUSTOMER,
TELLER,
MANAGER,
ADMIN
}

@Data
@Builder
@AllArgsConstructor
@NoArgsConstructor
public class AuthenticationRequest {
private String username;
private String password;
}

@Data
@Builder
@AllArgsConstructor
@NoArgsConstructor
public class AuthenticationResponse {
private String token;
private String refreshToken;
}

public enum AccountType {
PERSONAL_SAVINGS, // 个人储蓄账户
PERSONAL_CURRENT, // 个人活期账户
CORPORATE_CURRENT, // 企业活期账户
CORPORATE_LOAN, // 企业贷款账户
CREDIT_CARD // 信用卡账户
}

public enum AccountStatus {
ACTIVE, // 活跃
INACTIVE, // 不活跃
FROZEN, // 冻结
CLOSED, // 已关闭
DORMANT // 休眠
}

@Data
public class AccountDTO {
private Long id;
private String accountNumber;
private Long customerId;
private AccountType accountType;
private AccountStatus status;
private BigDecimal balance;
private BigDecimal availableBalance;
private String currency;
private Date createdAt;
private Date updatedAt;
}

@Data
public class CreateAccountRequest {
@NotNull
private Long customerId;

@NotNull
private AccountType accountType;

private String currency = "CNY";
}

@Data
public class AccountOperationResponse {
private boolean success;
private String message;
private String accountNumber;
private BigDecimal newBalance;
}

@Getter
public class AccountException extends RuntimeException {
private final ErrorCode errorCode;

public AccountException(ErrorCode errorCode) {
super(errorCode.getMessage());
this.errorCode = errorCode;
}
}

@Getter
public enum ErrorCode {
ACCOUNT_NOT_FOUND(404, "Account not found"),
ACCOUNT_NOT_ACTIVE(400, "Account is not active"),
ACCOUNT_ALREADY_FROZEN(400, "Account is already frozen"),
ACCOUNT_NOT_FROZEN(400, "Account is not frozen"),
ACCOUNT_ALREADY_CLOSED(400, "Account is already closed"),
ACCOUNT_BALANCE_NOT_ZERO(400, "Account balance is not zero"),
INSUFFICIENT_BALANCE(400, "Insufficient balance"),
INVALID_AMOUNT(400, "Amount must be positive");

private final int status;
private final String message;

ErrorCode(int status, String message) {
this.status = status;
this.message = message;
}
}

@RestControllerAdvice
public class GlobalExceptionHandler {
@ExceptionHandler(AccountException.class)
public ResponseEntity<ErrorResponse> handleAccountException(AccountException e) {
ErrorCode errorCode = e.getErrorCode();
return ResponseEntity
.status(errorCode.getStatus())
.body(new ErrorResponse(errorCode.getStatus(), errorCode.getMessage()));
}
}

安全配置类和限流配置类

@Configuration
@EnableWebSecurity
@EnableMethodSecurity(prePostEnabled = true)
@RequiredArgsConstructor
public class SecurityConfig {
private final JwtAuthenticationFilter jwtAuthFilter;
private final AuthenticationProvider authenticationProvider;

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
http
.cors(cors -> cors.configurationSource(corsConfigurationSource()))
.csrf(AbstractHttpConfigurer::disable)
.authorizeHttpRequests(auth -> auth
.requestMatchers(
"/api/auth/**",
"/v3/api-docs/**",
"/swagger-ui/**",
"/swagger-ui.html"
).permitAll()
.anyRequest().authenticated()
)
.sessionManagement(sess -> sess.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
.authenticationProvider(authenticationProvider)
.addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class);

return http.build();
}

@Bean
CorsConfigurationSource corsConfigurationSource() {
CorsConfiguration configuration = new CorsConfiguration();
configuration.setAllowedOrigins(List.of("https://bank.com", "https://admin.bank.com"));
configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE"));
configuration.setAllowedHeaders(List.of("*"));
configuration.setExposedHeaders(List.of("X-Rate-Limit-Remaining"));
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", configuration);
return source;
}
}

@Configuration
@EnableCaching
public class RateLimitConfig {
@Bean
public CacheManager cacheManager() {
CacheManager cacheManager = Caching.getCachingProvider().getCacheManager();
MutableConfiguration<String, byte[]> config = new MutableConfiguration<>();
cacheManager.createCache("rate-limit-buckets", config);
return cacheManager;
}

@Bean
ProxyManager<String> proxyManager(CacheManager cacheManager) {
return new JCacheProxyManager<>(cacheManager.getCache("rate-limit-buckets"));
}

@Bean
public BucketConfiguration bucketConfiguration() {
return BucketConfiguration.builder()
.addLimit(Bandwidth.classic(100, Refill.intervally(100, Duration.ofMinutes(1))))
.build();
}

@Bean
public Bucket bucket(ProxyManager<String> proxyManager, BucketConfiguration bucketConfiguration) {
return proxyManager.builder().build("global-limit", bucketConfiguration);
}
}

JWT认证实现

@Service
public class JwtService {
@Value("${security.jwt.secret-key}")
private String secretKey;

@Value("${security.jwt.expiration}")
private long jwtExpiration;

@Value("${security.jwt.refresh-token.expiration}")
private long refreshExpiration;

public String extractUsername(String token) {
return extractClaim(token, Claims::getSubject);
}

public <T> T extractClaim(String token, Function<Claims, T> claimsResolver) {
final Claims claims = extractAllClaims(token);
return claimsResolver.apply(claims);
}

public String generateToken(UserDetails userDetails) {
return generateToken(new HashMap<>(), userDetails);
}

public String generateToken(
Map<String, Object> extraClaims,
UserDetails userDetails
) {
return buildToken(extraClaims, userDetails, jwtExpiration);
}

public String generateRefreshToken(
UserDetails userDetails
) {
return buildToken(new HashMap<>(), userDetails, refreshExpiration);
}

private String buildToken(
Map<String, Object> extraClaims,
UserDetails userDetails,
long expiration
) {
return Jwts
.builder()
.setClaims(extraClaims)
.setSubject(userDetails.getUsername())
.setIssuedAt(new Date(System.currentTimeMillis()))
.setExpiration(new Date(System.currentTimeMillis() + expiration))
.signWith(getSignInKey(), SignatureAlgorithm.HS256)
.compact();
}

public boolean isTokenValid(String token, UserDetails userDetails) {
final String username = extractUsername(token);
return (username.equals(userDetails.getUsername())) && !isTokenExpired(token);
}

private boolean isTokenExpired(String token) {
return extractExpiration(token).before(new Date());
}

private Date extractExpiration(String token) {
return extractClaim(token, Claims::getExpiration);
}

private Claims extractAllClaims(String token) {
return Jwts
.parserBuilder()
.setSigningKey(getSignInKey())
.build()
.parseClaimsJws(token)
.getBody();
}

private Key getSignInKey() {
byte[] keyBytes = Decoders.BASE64.decode(secretKey);
return Keys.hmacShaKeyFor(keyBytes);
}
}

工具类

/**
账号生成工具
*/
@Component
public class AccountNumberGenerator {
private static final String BANK_CODE = "888";
private final AtomicLong sequence = new AtomicLong(1);

public String generate(AccountType accountType) {
long seq = sequence.getAndIncrement();
String prefix = getAccountPrefix(accountType);
String seqStr = String.format("%010d", seq);

// 简单校验码计算
String rawNumber = BANK_CODE + prefix + seqStr;
int checkDigit = calculateCheckDigit(rawNumber);

return rawNumber + checkDigit;
}

private String getAccountPrefix(AccountType accountType) {
return switch (accountType) {
case PERSONAL_SAVINGS -> "10";
case PERSONAL_CURRENT -> "11";
case CORPORATE_CURRENT -> "20";
case CORPORATE_LOAN -> "21";
case CREDIT_CARD -> "30";
};
}

private int calculateCheckDigit(String number) {
int sum = 0;
for (int i = 0; i < number.length(); i++) {
int digit = Character.getNumericValue(number.charAt(i));
sum += (i % 2 == 0) ? digit * 1 : digit * 3;
}
return (10 – (sum % 10)) % 10;
}
}

/**
数据加密工具
*/
@Component
public class EncryptionUtil {
@Value("${security.encryption.key}")
private String encryptionKey;

@Value("${security.encryption.iv}")
private String iv;

static {
Security.addProvider(new BouncyCastleProvider());
}

public String encrypt(String data) {
try {
IvParameterSpec ivSpec = new IvParameterSpec(iv.getBytes(StandardCharsets.UTF_8));
SecretKeySpec keySpec = new SecretKeySpec(encryptionKey.getBytes(StandardCharsets.UTF_8), "AES");

Cipher cipher = Cipher.getInstance("AES/CBC/PKCS7Padding", "BC");
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec);

byte[] encrypted = cipher.doFinal(data.getBytes(StandardCharsets.UTF_8));
return Base64.getEncoder().encodeToString(encrypted);
} catch (Exception e) {
throw new RuntimeException("Encryption failed", e);
}
}

public String decrypt(String encryptedData) {
try {
IvParameterSpec ivSpec = new IvParameterSpec(iv.getBytes(StandardCharsets.UTF_8));
SecretKeySpec keySpec = new SecretKeySpec(encryptionKey.getBytes(StandardCharsets.UTF_8), "AES");

Cipher cipher = Cipher.getInstance("AES/CBC/PKCS7Padding", "BC");
cipher.init(Cipher.DECRYPT_MODE, keySpec, ivSpec);

byte[] decoded = Base64.getDecoder().decode(encryptedData);
byte[] decrypted = cipher.doFinal(decoded);
return new String(decrypted, StandardCharsets.UTF_8);
} catch (Exception e) {
throw new RuntimeException("Decryption failed", e);
}
}
}

防XSS过滤器

@Component
public class XSSFilter extends OncePerRequestFilter {
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
FilterChain filterChain) throws ServletException, IOException {
filterChain.doFilter(new XSSRequestWrapper(request), response);
}

private static class XSSRequestWrapper extends HttpServletRequestWrapper {
private final Map<String, String[]> escapedParameterValuesMap = new ConcurrentHashMap<>();

public XSSRequestWrapper(HttpServletRequest request) {
super(request);
}

@Override
public String getParameter(String name) {
String parameter = super.getParameter(name);
return parameter != null ? StringEscapeUtils.escapeHtml4(parameter) : null;
}

@Override
public String[] getParameterValues(String name) {
String[] parameterValues = super.getParameterValues(name);
if (parameterValues == null) {
return null;
}

return escapedParameterValuesMap.computeIfAbsent(name, k -> {
String[] escapedValues = new String[parameterValues.length];
for (int i = 0; i < parameterValues.length; i++) {
escapedValues[i] = StringEscapeUtils.escapeHtml4(parameterValues[i]);
}
return escapedValues;
});
}

@Override
public Map<String, String[]> getParameterMap() {
Map<String, String[]> parameterMap = super.getParameterMap();
Map<String, String[]> escapedParameterMap = new ConcurrentHashMap<>();

for (Map.Entry<String, String[]> entry : parameterMap.entrySet()) {
escapedParameterMap.put(entry.getKey(), getParameterValues(entry.getKey()));
}

return escapedParameterMap;
}

@Override
public Enumeration<String> getParameterNames() {
return Collections.enumeration(getParameterMap().keySet());
}
}
}

Controller层

@RestController
@RequestMapping("/api/accounts")
@RequiredArgsConstructor
public class AccountController {
private final AccountService accountService;

@PostMapping
public ResponseEntity<AccountDTO> createAccount(@Valid @RequestBody CreateAccountRequest request){
AccountDTO account = accountService.createAccount(request);
return ResponseEntity.ok(account);
}

@GetMapping("/{accountNumber}")
public ResponseEntity<AccountDTO> getAccount(@PathVariable String accountNumber) {
AccountDTO account = accountService.getAccount(accountNumber);
return ResponseEntity.ok(account);
}

@PostMapping("/{accountNumber}/deposit")
public ResponseEntity<AccountOperationResponse> deposit(
@PathVariable String accountNumber,
@RequestParam BigDecimal amount) {
AccountOperationResponse response = accountService.deposit(accountNumber, amount);
return ResponseEntity.ok(response);
}

@PostMapping("/{accountNumber}/withdraw")
public ResponseEntity<AccountOperationResponse> withdraw(
@PathVariable String accountNumber,
@RequestParam BigDecimal amount) {
AccountOperationResponse response = accountService.withdraw(accountNumber, amount);
return ResponseEntity.ok(response);
}

@PostMapping("/{accountNumber}/freeze")
public ResponseEntity<AccountOperationResponse> freezeAccount(@PathVariable String accountNumber) {
AccountOperationResponse response = accountService.freezeAccount(accountNumber);
return ResponseEntity.ok(response);
}

@PostMapping("/{accountNumber}/unfreeze")
public ResponseEntity<AccountOperationResponse> unfreezeAccount(@PathVariable String accountNumber) {
AccountOperationResponse response = accountService.unfreezeAccount(accountNumber);
return ResponseEntity.ok(response);
}

@PostMapping("/{accountNumber}/close")
public ResponseEntity<AccountOperationResponse> closeAccount(@PathVariable String accountNumber) {
AccountOperationResponse response = accountService.closeAccount(accountNumber);
return ResponseEntity.ok(response);
}
}

@RestController
@RequestMapping("/api/auth")
@RequiredArgsConstructor
public class AuthenticationController {
private final AuthenticationService authenticationService;

@PostMapping("/register/customer")
public ResponseEntity<AuthenticationResponse> registerCustomer(
@RequestBody AuthenticationRequest request
) {
return ResponseEntity.ok(authenticationService.register(request, Role.CUSTOMER));
}

@PostMapping("/register/teller")
public ResponseEntity<AuthenticationResponse> registerTeller(
@RequestBody AuthenticationRequest request
) {
return ResponseEntity.ok(authenticationService.register(request, Role.TELLER));
}

@PostMapping("/authenticate")
public ResponseEntity<AuthenticationResponse> authenticate(
@RequestBody AuthenticationRequest request
) {
return ResponseEntity.ok(authenticationService.authenticate(request));
}
}

Service层

@Service
@RequiredArgsConstructor
@Slf4j
public class AccountService{

private final AccountRepository accountRepository;
private final AccountNumberGenerator accountNumberGenerator;

private final EncryptionUtil encryptionUtil;
private final RateLimitConfig rateLimitConfig;

@Transactional
public AccountDTO createAccount(CreateAccountRequest request){

String accountNumber = accountNumberGenerator.generate(request.getAccountType());
Account account = new Account();
account.setAccountNumber(accountNumber);
account.setCustomerId(request.getCustomerId());
account.setAccountType(request.getAccountType());
account.setStatus(AccountStatus.ACTIVE);
account.setCurrency(request.getCurrency());

Account savedAccount = accountRepository.save(account);
log.info("Account created: {}", accountNumber);

return convertToDTO(savedAccount);
}

@Transactional(readOnly = true)
@PreAuthorize("hasAnyRole('TELLER', 'MANAGER', 'ADMIN') || "
+ "(hasRole('CUSTOMER') && @accountSecurityService.isAccountOwner(authentication, #accountNumber))")
public AccountDTO getAccount(String accountNumber) {

// 限流检查
Bucket bucket = rateLimitConfig.bucket();
if (!bucket.tryConsume(1)) {
throw new AccountException(ErrorCode.TOO_MANY_REQUESTS);
}
Account account = accountRepository.findByAccountNumber(accountNumber)
.orElseThrow(() -> new AccountException(ErrorCode.ACCOUNT_NOT_FOUND));

//敏感数据加密
AccountDTO dto = convertToDto(account);
dto.setAccountNumber(encryptionUtil.encrypt(dto.getAccountNumber()));
return dto;
}

@Transactional
@PreAuthorize("hasAnyRole('TELLER', 'MANAGER', 'ADMIN')")
public AccountOperationResponse deposit(String accountNumber, BigDecimal amount) {

//解密账号
String decryptedAccountNumber = encryptionUtil.decrypt(accountNumber);
if (amount.compareTo(BigDecimal.ZERO) <= 0) {
throw new AccountException(ErrorCode.INVALID_AMOUNT);
}

Account account = accountRepository.findByAccountNumberForUpdate(accountNumber)
.orElseThrow(() -> new AccountException(ErrorCode.ACCOUNT_NOT_FOUND));

if (account.getStatus() != AccountStatus.ACTIVE) {
throw new AccountException(ErrorCode.ACCOUNT_NOT_ACTIVE);
}

BigDecimal newBalance = account.getBalance().add(amount);
account.setBalance(newBalance);
account.setAvailableBalance(newBalance);

accountRepository.save(account);
log.info("Deposit {} to account {}", amount, accountNumber);

// 审计日志
logSecurityEvent("DEPOSIT", decryptedAccountNumber, amount);

return buildSuccessResponse(accountNumber, newBalance, "Deposit successful");
}

@Transactional
public AccountOperationResponse withdraw(String accountNumber, BigDecimal amount) {
if (amount.compareTo(BigDecimal.ZERO) <= 0) {
throw new AccountException(ErrorCode.INVALID_AMOUNT);
}

Account account = accountRepository.findByAccountNumberForUpdate(accountNumber)
.orElseThrow(() -> new AccountException(ErrorCode.ACCOUNT_NOT_FOUND));

if (account.getStatus() != AccountStatus.ACTIVE) {
throw new AccountException(ErrorCode.ACCOUNT_NOT_ACTIVE);
}

if (account.getAvailableBalance().compareTo(amount) < 0) {
throw new AccountException(ErrorCode.INSUFFICIENT_BALANCE);
}

BigDecimal newBalance = account.getBalance().subtract(amount);
account.setBalance(newBalance);
account.setAvailableBalance(newBalance);

accountRepository.save(account);
log.info("Withdraw {} from account {}", amount, accountNumber);

return buildSuccessResponse(accountNumber, newBalance, "Withdrawal successful");
}

@Transactional
public AccountOperationResponse freezeAccount(String accountNumber) {
Account account = accountRepository.findByAccountNumberForUpdate(accountNumber)
.orElseThrow(() -> new AccountException(ErrorCode.ACCOUNT_NOT_FOUND));

if (account.getStatus() == AccountStatus.FROZEN) {
throw new AccountException(ErrorCode.ACCOUNT_ALREADY_FROZEN);
}

account.setStatus(AccountStatus.FROZEN);
accountRepository.save(account);
log.info("Account {} frozen", accountNumber);

return buildSuccessResponse(accountNumber, account.getBalance(), "Account frozen successfully");
}

@Transactional
public AccountOperationResponse unfreezeAccount(String accountNumber) {
Account account = accountRepository.findByAccountNumberForUpdate(accountNumber)
.orElseThrow(() -> new AccountException(ErrorCode.ACCOUNT_NOT_FOUND));

if (account.getStatus() != AccountStatus.FROZEN) {
throw new AccountException(ErrorCode.ACCOUNT_NOT_FROZEN);
}

account.setStatus(AccountStatus.ACTIVE);
accountRepository.save(account);
log.info("Account {} unfrozen", accountNumber);

return buildSuccessResponse(accountNumber, account.getBalance(), "Account unfrozen successfully");
}

@Transactional
public AccountOperationResponse closeAccount(String accountNumber) {
Account account = accountRepository.findByAccountNumberForUpdate(accountNumber)
.orElseThrow(() -> new AccountException(ErrorCode.ACCOUNT_NOT_FOUND));

if (account.getStatus() == AccountStatus.CLOSED) {
throw new AccountException(ErrorCode.ACCOUNT_ALREADY_CLOSED);
}

if (account.getBalance().compareTo(BigDecimal.ZERO) != 0) {
throw new AccountException(ErrorCode.ACCOUNT_BALANCE_NOT_ZERO);
}

account.setStatus(AccountStatus.CLOSED);
accountRepository.save(account);
log.info("Account {} closed", accountNumber);

return buildSuccessResponse(accountNumber, account.getBalance(), "Account closed successfully");
}

private AccountDTO convertToDTO(Account account) {
AccountDTO dto = new AccountDTO();
dto.setId(account.getId());
dto.setAccountNumber(account.getAccountNumber());
dto.setCustomerId(account.getCustomerId());
dto.setAccountType(account.getAccountType());
dto.setStatus(account.getStatus());
dto.setBalance(account.getBalance());
dto.setAvailableBalance(account.getAvailableBalance());
dto.setCurrency(account.getCurrency());
dto.setCreatedAt(account.getCreatedAt());
dto.setUpdatedAt(account.getUpdatedAt());
return dto;
}

private AccountOperationResponse buildSuccessResponse(String accountNumber, BigDecimal newBalance, String message) {
AccountOperationResponse response = new AccountOperationResponse();
response.setSuccess(true);
response.setMessage(message);
response.setAccountNumber(accountNumber);
response.setNewBalance(newBalance);
return response;
}
}

/**
安全服务
*/
@Service
@RequiredArgsConstructor
public class AuthenticationService {
private final UserRepository userRepository;
private final PasswordEncoder passwordEncoder;
private final JwtService jwtService;
private final AuthenticationManager authenticationManager;

public AuthenticationResponse register(AuthenticationRequest request, Role role) {
var user = User.builder()
.username(request.getUsername())
.password(passwordEncoder.encode(request.getPassword()))
.role(role)
.build();
userRepository.save(user);

var jwtToken = jwtService.generateToken(user);
var refreshToken = jwtService.generateRefreshToken(user);

return AuthenticationResponse.builder()
.token(jwtToken)
.refreshToken(refreshToken)
.build();
}

public AuthenticationResponse authenticate(AuthenticationRequest request) {
authenticationManager.authenticate(
new UsernamePasswordAuthenticationToken(
request.getUsername(),
request.getPassword()
)
);

var user = userRepository.findByUsername(request.getUsername())
.orElseThrow();

var jwtToken = jwtService.generateToken(user);
var refreshToken = jwtService.generateRefreshToken(user);

return AuthenticationResponse.builder()
.token(jwtToken)
.refreshToken(refreshToken)
.build();
}
}

Repository层

public interface AccountRepository extends JpaRepository<Account,Long>{

Optional<Account> findByAccountNumber(String accountNumber);

@Lock(LockModeType.PESSIMISTIC_WRITE)
@Query("SELECT a FROM Account a WHERE a.accountNumber = :accountNumber")
Optional<Account> findByAccountNumberForUpdate(@Param("accountNumber") String accountNumber);

boolean existsByAccountNumber(String accountNumber);
}

2. 交易处理

存款/取款

转账(同行/跨行)

批量交易处理

交易流水记录

交易限额管理

# 在原有配置基础上添加
service:
account:
url: http://account–service:8080

security:
transaction:
max-retry-attempts: 3
retry-delay: 1000 # ms

@Entity
@Table(name = "transaction")
@Data
public class Transaction {
@Id
@GeneratedValue(strategy = GenerationType.IDENTITY)
private Long id;

@Column(nullable = false, unique = true)
private String transactionId;

@Column(nullable = false)
private String accountNumber;

@Column
private String counterpartyAccountNumber;

@Enumerated(EnumType.STRING)
@Column(nullable = false)
private TransactionType transactionType;

@Enumerated(EnumType.STRING)
@Column(nullable = false)
private TransactionStatus status;//处理中、已完成、失败、已冲正、已取消

@Column(nullable = false, precision = 19, scale = 4)
private BigDecimal amount;

@Column(precision = 19, scale = 4)
private BigDecimal fee;

@Column(nullable = false)
private String currency = "CNY";

@Column
private String description;

@Column(nullable = false)
private String reference;

@CreationTimestamp
private LocalDateTime createdAt;

@UpdateTimestamp
private LocalDateTime updatedAt;

@Version
private Long version;
}

@Entity
@Table(name = "transaction_limit")
@Data
public class TransactionLimit {
@Id
@GeneratedValue(strategy = GenerationType.IDENTITY)
private Long id;

@Enumerated(EnumType.STRING)
@Column(nullable = false)
private TransactionType transactionType;//存款、取款、转账、账单支付、贷款还款、费用收取

@Column(nullable = false)
private String accountType;

@Column(nullable = false, precision = 19, scale = 4)
private BigDecimal dailyLimit;

@Column(nullable = false, precision = 19, scale = 4)
private BigDecimal perTransactionLimit;

@Column(nullable = false)
private Integer dailyCountLimit;
}

@Data
public class TransactionDTO {
private String transactionId;
private String accountNumber;
private String counterpartyAccountNumber;
private TransactionType transactionType;
private TransactionStatus status;
private BigDecimal amount;
private BigDecimal fee;
private String currency;
private String description;
private String reference;
private LocalDateTime createdAt;
private LocalDateTime updatedAt;
}

@Data
public class DepositRequest {
@NotNull
private String accountNumber;

@NotNull
@Positive
private BigDecimal amount;

private String description;
}

@Data
public class WithdrawalRequest {
@NotNull
private String accountNumber;

@NotNull
@Positive
private BigDecimal amount;

private String description;
}

@Data
public class TransferRequest {
@NotNull
private String fromAccountNumber;

@NotNull
private String toAccountNumber;

@NotNull
@Positive
private BigDecimal amount;

private String description;
}

@Data
public class BatchTransactionRequest {
@NotEmpty
@Valid
private List<TransferRequest> transactions;
}

异常

@Getter
public enum ErrorCode {
// 原有错误码…
TRANSACTION_LIMIT_NOT_FOUND(400, "Transaction limit not found"),
EXCEED_PER_TRANSACTION_LIMIT(400, "Exceed per transaction limit"),
EXCEED_DAILY_LIMIT(400, "Exceed daily limit"),
EXCEED_DAILY_COUNT_LIMIT(400, "Exceed daily count limit"),
DEPOSIT_FAILED(400, "Deposit failed"),
WITHDRAWAL_FAILED(400, "Withdrawal failed"),
TRANSFER_FAILED(400, "Transfer failed"),
ACCOUNT_SERVICE_UNAVAILABLE(503, "Account service unavailable"),
TRANSACTION_SERVICE_UNAVAILABLE(503, "Transaction service unavailable");

private final int status;
private final String message;

ErrorCode(int status, String message) {
this.status = status;
this.message = message;
}
}

工具类

@Component
public class TransactionIdGenerator {
private static final String BANK_CODE = "888";
private final AtomicLong sequence = new AtomicLong(1);

public String generate() {
long timestamp = Instant.now().toEpochMilli();
long seq = sequence.getAndIncrement();
return String.format("%s-TRX-%d-%06d", BANK_CODE, timestamp, seq);
}
}

Controller层

@Controller
@RequestMapping("/api/transactions")
@RequiredArgsConstructor
public class TransactionController{

private final TransactionService transactionService;

@PostMapping("/deposit")
@PreAuthorize("hasAnyRole('TELLER', 'MANAGER', 'ADMIN')")
public ResponseEntity<TransactionDTO> deposit(@Valid @RequestBody DepositRequest request) {
return ResponseEntity.ok(transactionService.deposit(request));
}

@PostMapping("/withdraw")
public ResponseEntity<TransactionDTO> withdraw(@Valid @RequestBody WithdrawalRequest request) {
return ResponseEntity.ok(transactionService.withdraw(request));
}

@PostMapping("/transfer")
public ResponseEntity<TransactionDTO> transfer(@Valid @RequestBody TransferRequest request) {
return ResponseEntity.ok(transactionService.transfer(request));
}

@PostMapping("/batch-transfer")
@PreAuthorize("hasAnyRole('TELLER', 'MANAGER', 'ADMIN')")
public ResponseEntity<List<TransactionDTO>> batchTransfer(@Valid @RequestBody BatchTransactionRequest request) {
return ResponseEntity.ok(transactionService.batchTransfer(request));
}

@GetMapping("/history")
public ResponseEntity<List<TransactionDTO>> getTransactionHistory(
@RequestParam String accountNumber,
@RequestParam @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate startDate,
@RequestParam @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate endDate) {
return ResponseEntity.ok(transactionService.getTransactionHistory(accountNumber, startDate, endDate));
}

}

Service层

@Service
@RequiredArgsConstructor
@Slf4j
public class TransactionService {
private final TransactionRepository transactionRepository;
private final TransactionLimitRepository limitRepository;
private final AccountClientService accountClientService;
private final TransactionIdGenerator idGenerator;
private final EncryptionUtil encryptionUtil;

@Transactional
@PreAuthorize("hasAnyRole('TELLER', 'MANAGER', 'ADMIN')")
public TransactionDTO deposit(DepositRequest request) {
// 解密账号
String decryptedAccountNumber = encryptionUtil.decrypt(request.getAccountNumber());

// 验证金额
validateAmount(request.getAmount());

// 检查账户状态
checkAccountStatus(decryptedAccountNumber);

// 执行存款
BigDecimal newBalance = accountClientService.deposit(decryptedAccountNumber, request.getAmount());

// 记录交易
Transaction transaction = new Transaction();
transaction.setTransactionId(idGenerator.generate());
transaction.setAccountNumber(decryptedAccountNumber);
transaction.setTransactionType(TransactionType.DEPOSIT);
transaction.setStatus(TransactionStatus.COMPLETED);
transaction.setAmount(request.getAmount());
transaction.setCurrency("CNY");
transaction.setDescription(request.getDescription());
transaction.setReference("DEP-" + System.currentTimeMillis());

Transaction saved = transactionRepository.save(transaction);
log.info("Deposit completed: {}", saved.getTransactionId());

return convertToDTO(saved);
}

@Transactional
@PreAuthorize("hasAnyRole('TELLER', 'MANAGER', 'ADMIN') || "
+ "(hasRole('CUSTOMER') && @accountSecurityService.isAccountOwner(authentication, #request.accountNumber))")
public TransactionDTO withdraw(WithdrawalRequest request) {
// 解密账号
String decryptedAccountNumber = encryptionUtil.decrypt(request.getAccountNumber());

// 验证金额
validateAmount(request.getAmount());

// 检查账户状态
checkAccountStatus(decryptedAccountNumber);

// 检查交易限额
checkWithdrawalLimit(decryptedAccountNumber, request.getAmount());

// 执行取款
BigDecimal newBalance = accountClientService.withdraw(decryptedAccountNumber, request.getAmount());

// 记录交易
Transaction transaction = new Transaction();
transaction.setTransactionId(idGenerator.generate());
transaction.setAccountNumber(decryptedAccountNumber);
transaction.setTransactionType(TransactionType.WITHDRAWAL);
transaction.setStatus(TransactionStatus.COMPLETED);
transaction.setAmount(request.getAmount().negate());
transaction.setCurrency("CNY");
transaction.setDescription(request.getDescription());
transaction.setReference("WTH-" + System.currentTimeMillis());

Transaction saved = transactionRepository.save(transaction);
log.info("Withdrawal completed: {}", saved.getTransactionId());

return convertToDTO(saved);
}

@Transactional
@PreAuthorize("hasAnyRole('TELLER', 'MANAGER', 'ADMIN') || "
+ "(hasRole('CUSTOMER') && @accountSecurityService.isAccountOwner(authentication, #request.fromAccountNumber))")
public TransactionDTO transfer(TransferRequest request) {
// 解密账号
String decryptedFromAccount = encryptionUtil.decrypt(request.getFromAccountNumber());
String decryptedToAccount = encryptionUtil.decrypt(request.getToAccountNumber());

// 验证金额
validateAmount(request.getAmount());

// 检查账户状态
checkAccountStatus(decryptedFromAccount);
checkAccountStatus(decryptedToAccount);

// 检查转账限额
checkTransferLimit(decryptedFromAccount, request.getAmount());

// 执行转账
BigDecimal fromNewBalance = accountClientService.withdraw(decryptedFromAccount, request.getAmount());
BigDecimal toNewBalance = accountClientService.deposit(decryptedToAccount, request.getAmount());

// 记录交易(借方)
Transaction debitTransaction = new Transaction();
debitTransaction.setTransactionId(idGenerator.generate());
debitTransaction.setAccountNumber(decryptedFromAccount);
debitTransaction.setCounterpartyAccountNumber(decryptedToAccount);
debitTransaction.setTransactionType(TransactionType.TRANSFER);
debitTransaction.setStatus(TransactionStatus.COMPLETED);
debitTransaction.setAmount(request.getAmount().negate());
debitTransaction.setCurrency("CNY");
debitTransaction.setDescription(request.getDescription());
debitTransaction.setReference("TFR-DEBIT-" + System.currentTimeMillis());

// 记录交易(贷方)
Transaction creditTransaction = new Transaction();
creditTransaction.setTransactionId(idGenerator.generate());
creditTransaction.setAccountNumber(decryptedToAccount);
creditTransaction.setCounterpartyAccountNumber(decryptedFromAccount);
creditTransaction.setTransactionType(TransactionType.TRANSFER);
creditTransaction.setStatus(TransactionStatus.COMPLETED);
creditTransaction.setAmount(request.getAmount());
creditTransaction.setCurrency("CNY");
creditTransaction.setDescription(request.getDescription());
creditTransaction.setReference("TFR-CREDIT-" + System.currentTimeMillis());

transactionRepository.save(debitTransaction);
transactionRepository.save(creditTransaction);
log.info("Transfer completed: {} -> {}", debitTransaction.getTransactionId(), creditTransaction.getTransactionId());

return convertToDTO(debitTransaction);
}

@Transactional
@PreAuthorize("hasAnyRole('TELLER', 'MANAGER', 'ADMIN')")
public List<TransactionDTO> batchTransfer(BatchTransactionRequest request) {
return request.getTransactions().stream()
.map(this::transfer)
.collect(Collectors.toList());
}

@Transactional(readOnly = true)
@PreAuthorize("hasAnyRole('TELLER', 'MANAGER', 'ADMIN') || "
+ "(hasRole('CUSTOMER') && @accountSecurityService.isAccountOwner(authentication, #accountNumber))")
public List<TransactionDTO> getTransactionHistory(String accountNumber, LocalDate startDate, LocalDate endDate) {
String decryptedAccountNumber = encryptionUtil.decrypt(accountNumber);

LocalDateTime start = startDate.atStartOfDay();
LocalDateTime end = endDate.atTime(LocalTime.MAX);

return transactionRepository
.findByAccountNumberAndCreatedAtBetween(decryptedAccountNumber, start, end)
.stream()
.map(this::convertToDTO)
.peek(dto -> dto.setAccountNumber(encryptionUtil.encrypt(dto.getAccountNumber())))
.peek(dto -> {
if (dto.getCounterpartyAccountNumber() != null) {
dto.setCounterpartyAccountNumber(encryptionUtil.encrypt(dto.getCounterpartyAccountNumber()));
}
})
.collect(Collectors.toList());
}

private void validateAmount(BigDecimal amount) {
if (amount.compareTo(BigDecimal.ZERO) <= 0) {
throw new AccountException(ErrorCode.INVALID_AMOUNT);
}
}

private void checkAccountStatus(String accountNumber) {
AccountDTO account = accountClientService.getAccount(accountNumber);
if (account.getStatus() != AccountStatus.ACTIVE) {
throw new AccountException(ErrorCode.ACCOUNT_NOT_ACTIVE);
}
}

private void checkWithdrawalLimit(String accountNumber, BigDecimal amount) {
AccountDTO account = accountClientService.getAccount(accountNumber);
TransactionLimit limit = limitRepository.findByTransactionTypeAndAccountType(
TransactionType.WITHDRAWAL, account.getAccountType().name())
.orElseThrow(() -> new AccountException(ErrorCode.TRANSACTION_LIMIT_NOT_FOUND));

// 检查单笔限额
if (amount.compareTo(limit.getPerTransactionLimit()) > 0) {
throw new AccountException(ErrorCode.EXCEED_PER_TRANSACTION_LIMIT);
}

// 检查当日累计限额
LocalDateTime todayStart = LocalDate.now().atStartOfDay();
LocalDateTime todayEnd = LocalDate.now().atTime(LocalTime.MAX);

BigDecimal todayTotal = transactionRepository
.findByAccountNumberAndCreatedAtBetween(accountNumber, todayStart, todayEnd)
.stream()
.filter(t -> t.getTransactionType() == TransactionType.WITHDRAWAL)
.map(Transaction::getAmount)
.reduce(BigDecimal.ZERO, BigDecimal::add)
.abs();

if (todayTotal.add(amount).compareTo(limit.getDailyLimit()) > 0) {
throw new AccountException(ErrorCode.EXCEED_DAILY_LIMIT);
}

// 检查当日交易次数
long todayCount = transactionRepository
.findByAccountNumberAndCreatedAtBetween(accountNumber, todayStart, todayEnd)
.stream()
.filter(t -> t.getTransactionType() == TransactionType.WITHDRAWAL)
.count();

if (todayCount >= limit.getDailyCountLimit()) {
throw new AccountException(ErrorCode.EXCEED_DAILY_COUNT_LIMIT);
}
}

private void checkTransferLimit(String accountNumber, BigDecimal amount) {
AccountDTO account = accountClientService.getAccount(accountNumber);
TransactionLimit limit = limitRepository.findByTransactionTypeAndAccountType(
TransactionType.TRANSFER, account.getAccountType().name())
.orElseThrow(() -> new AccountException(ErrorCode.TRANSACTION_LIMIT_NOT_FOUND));

// 检查单笔限额
if (amount.compareTo(limit.getPerTransactionLimit()) > 0) {
throw new AccountException(ErrorCode.EXCEED_PER_TRANSACTION_LIMIT);
}

// 检查当日累计限额
LocalDateTime todayStart = LocalDate.now().atStartOfDay();
LocalDateTime todayEnd = LocalDate.now().atTime(LocalTime.MAX);

BigDecimal todayTotal = transactionRepository
.findByAccountNumberAndCreatedAtBetween(accountNumber, todayStart, todayEnd)
.stream()
.filter(t -> t.getTransactionType() == TransactionType.TRANSFER)
.map(Transaction::getAmount)
.reduce(BigDecimal.ZERO, BigDecimal::add)
.abs();

if (todayTotal.add(amount).compareTo(limit.getDailyLimit()) > 0) {
throw new AccountException(ErrorCode.EXCEED_DAILY_LIMIT);
}
}

private TransactionDTO convertToDTO(Transaction transaction) {
TransactionDTO dto = new TransactionDTO();
dto.setTransactionId(transaction.getTransactionId());
dto.setAccountNumber(transaction.getAccountNumber());
dto.setCounterpartyAccountNumber(transaction.getCounterpartyAccountNumber());
dto.setTransactionType(transaction.getTransactionType());
dto.setStatus(transaction.getStatus());
dto.setAmount(transaction.getAmount());
dto.setFee(transaction.getFee());
dto.setCurrency(transaction.getCurrency());
dto.setDescription(transaction.getDescription());
dto.setReference(transaction.getReference());
dto.setCreatedAt(transaction.getCreatedAt());
dto.setUpdatedAt(transaction.getUpdatedAt());
return dto;
}
}

@Service
@RequiredArgsConstructor
public class AccountClientService {
private final RestTemplate restTemplate;
private final EncryptionUtil encryptionUtil;

@Value("${service.account.url}")
private String accountServiceUrl;

public AccountDTO getAccount(String accountNumber) {
try {
String encryptedAccountNumber = encryptionUtil.encrypt(accountNumber);

HttpHeaders headers = new HttpHeaders();
headers.set("X-Internal-Service", "transaction-service");

ResponseEntity<AccountDTO> response = restTemplate.exchange(
accountServiceUrl + "/api/accounts/" + encryptedAccountNumber,
HttpMethod.GET,
new HttpEntity<>(headers),
AccountDTO.class);

AccountDTO account = response.getBody();
if (account != null) {
account.setAccountNumber(accountNumber); // 返回解密后的账号
}
return account;
} catch (HttpClientErrorException.NotFound e) {
throw new AccountException(ErrorCode.ACCOUNT_NOT_FOUND);
} catch (Exception e) {
throw new AccountException(ErrorCode.ACCOUNT_SERVICE_UNAVAILABLE);
}
}

public BigDecimal deposit(String accountNumber, BigDecimal amount) {
try {
String encryptedAccountNumber = encryptionUtil.encrypt(accountNumber);

HttpHeaders headers = new HttpHeaders();
headers.set("X-Internal-Service", "transaction-service");

ResponseEntity<AccountOperationResponse> response = restTemplate.exchange(
accountServiceUrl + "/api/accounts/" + encryptedAccountNumber + "/deposit?amount=" + amount,
HttpMethod.POST,
new HttpEntity<>(headers),
AccountOperationResponse.class);

AccountOperationResponse result = response.getBody();
if (result == null || !result.isSuccess()) {
throw new AccountException(ErrorCode.DEPOSIT_FAILED);
}
return result.getNewBalance();
} catch (Exception e) {
throw new AccountException(ErrorCode.ACCOUNT_SERVICE_UNAVAILABLE);
}
}

public BigDecimal withdraw(String accountNumber, BigDecimal amount) {
try {
String encryptedAccountNumber = encryptionUtil.encrypt(accountNumber);

HttpHeaders headers = new HttpHeaders();
headers.set("X-Internal-Service", "transaction-service");

ResponseEntity<AccountOperationResponse> response = restTemplate.exchange(
accountServiceUrl + "/api/accounts/" + encryptedAccountNumber + "/withdraw?amount=" + amount,
HttpMethod.POST,
new HttpEntity<>(headers),
AccountOperationResponse.class);

AccountOperationResponse result = response.getBody();
if (result == null || !result.isSuccess()) {
throw new AccountException(ErrorCode.WITHDRAWAL_FAILED);
}
return result.getNewBalance();
} catch (Exception e) {
throw new AccountException(ErrorCode.ACCOUNT_SERVICE_UNAVAILABLE);
}
}
}

Repository层

public interface TransactionRepository extends JpaRepository<Transaction, Long> {
Optional<Transaction> findByTransactionId(String transactionId);

List<Transaction> findByAccountNumberAndCreatedAtBetween(
String accountNumber, LocalDateTime startDate, LocalDateTime endDate);

@Lock(LockModeType.PESSIMISTIC_WRITE)
@Query("SELECT t FROM Transaction t WHERE t.transactionId = :transactionId")
Optional<Transaction> findByTransactionIdForUpdate(@Param("transactionId") String transactionId);
}

public interface TransactionLimitRepository extends JpaRepository<TransactionLimit, Long> {
Optional<TransactionLimit> findByTransactionTypeAndAccountType(
TransactionType transactionType, String accountType);
}

3. 支付结算

支付订单处理

清算对账

手续费计算

第三方支付对接

# 在原有配置基础上添加
payment:
settlement:
auto-enabled: true
time: "02:00" # 自动结算时间
third-party:
timeout: 5000 # 第三方支付超时时间(ms)
retry-times: 3 # 重试次数

@Entity
@Table(name = "payment_order")
@Data
public class PaymentOrder {
@Id
@GeneratedValue(strategy = GenerationType.IDENTITY)
private Long id;

@Column(nullable = false, unique = true)
private String orderNo;