Java后端开发者：从需求到上线 — 工作思路全纪实

@Service @Slf4j public class PhoneBindingServiceImpl implements PhoneBindingService { @Autowired private StringRedisTemplate redis; @Autowired private SmsGatewayClient smsClient; // 短信网关 @Autowired private UserPhoneBindingMapper bindingMapper; @Autowired private RedissonClient redisson; // 分布式锁 /** * 发送验证码 — 4层防护 * 1. 60秒内不能重发 * 2. 当日不超过5次 * 3. 手机号格式校验 * 4. 生成6位随机码 + 存Redis + 调网关 */ public SendCodeResult sendCode(String phone) { // 1. 手机号格式校验 if (!PhoneUtil.isValid(phone)) { throw new BizException("手机号格式不正确"); } // 2. 60秒发送间隔限制 String limitKey = "sms:limit:" + phone; Boolean notExpired = redis.hasKey(limitKey); if (BooleanUtil.isTrue(notExpired)) { throw new BizException("发送太频繁，请60秒后重试"); } // 3. 当日次数限制（最多5次） String countKey = "sms:count:" + phone + ":" + DateUtil.today(); Long count = redis.opsForValue().increment(countKey); if (count == 1) { redis.expire(countKey, Duration.ofDays(1)); } if (count > 5) { throw new BizException("今日发送次数已达上限"); } // 4. 生成6位验证码 String code = RandomUtil.randomNumbers(6); // 5. 调短信网关发送 try { smsClient.send(phone, "您的验证码是：" + code + "，5分钟内有效"); } catch (Exception e) { log.error("短信发送失败, phone={}", phone, e); throw new BizException("验证码发送失败，请稍后重试"); } // 6. 存Redis（5分钟过期）+ 设60秒间隔锁 redis.opsForValue().set( "sms:code:" + phone, code, Duration.ofSeconds(300)); redis.opsForValue().set(limitKey, "1", Duration.ofSeconds(60)); log.info("验证码发送成功, phone={}, code={}", phone, code); return new SendCodeResult(300); } /** * 绑定手机号 — 并发安全处理 */ @Transactional(rollbackFor = Exception.class) public BindResult bindPhone(Long userId, String phone, String code) { // 1. 验证码校验 String cacheCode = redis.opsForValue().get("sms:code:" + phone); if (cacheCode == null) { throw new BizException("验证码已过期，请重新获取"); } if (!cacheCode.equals(code)) { // 验证码错误，增加重试计数 Long retries = redis.opsForValue().increment("sms:retry:" + phone); if (retries >= 5) { redis.delete("sms:code:" + phone); // 锁定，删验证码 throw new BizException("验证码错误次数过多，请重新获取"); } throw new BizException("验证码错误，还可尝试" + (5 - retries) + "次"); } // 2. 分布式锁：防止同一用户并发绑定 RLock lock = redisson.getLock("phone:bind:lock:" + phone); try { boolean locked = lock.tryLock(3, TimeUnit.SECONDS); if (!locked) { throw new BizException("系统繁忙，请稍后重试"); } // 3. 检查手机号是否已被绑定（唯一性校验） boolean exists = bindingMapper.existsActiveBinding(phone); if (exists) { throw new BizException("该手机号已被其他账号绑定"); } // 4. 写入绑定记录（加密存储） UserPhoneBinding binding = new UserPhoneBinding(); binding.setUserId(userId); binding.setPhone(AESUtil.encrypt(phone)); binding.setStatus(2); // 已绑定 bindingMapper.insert(binding); // 5. 删除验证码（一次性使用） redis.delete("sms:code:" + phone); // 6. 异步发送站内通知 // (通过MQ发送，不阻塞主流程) log.info("手机号绑定成功, userId={}, phone={}", userId, phone); return new BindResult(PhoneUtil.mask(phone)); } finally { if (lock.isHeldByCurrentThread()) { lock.unlock(); } } } }