ThreadLocal线程本地变量在dubbo服务使用时候遇到的一个坑

我昨天遇到一个问题，就是我springboot项目里面有一个提供代办服务审核的dubbo接口，这个接口给房源项目调用，但是碰到一个问题就是，房源项目每天凌晨5点会查询满足条件过期的数据，然后调用我这边的代办审核dubbo接口，将这个代办任务变成自动拒绝

@Override
@Transactional
public WorkListDataResult auditWorkList(WorkListAuditCmd workListAuditCmd, WorkListLoginUserVo loginUserVo) {log.info("auditWorkList WorkListAuditCmd={},WorkListLoginUserVo={}", JSON.toJSONString(workListAuditCmd), JSON.toJSONString(loginUserVo));LoginUserUtil.setCurrentUser(loginUserVo);WorkListAuditAdapterCmd workListAuditAdapterCmd = AutoMapper.transform(WorkListAuditAdapterCmd.class, workListAuditCmd);workListAuditAdapterCmd.setAuditComments(AuditStatusEnum.PASS.getCode().equals(workListAuditCmd.getAuditStatus()) || AuditStatusEnum.PENDING_REEVALUATION.getCode().equals(workListAuditCmd.getAuditStatus()) ? "系统通过" : "系统拒绝");workListAuditAdapterCmd.setExtAuditComments(workListAuditAdapterCmd.getAuditComments());auditWorkListInternal(workListAuditAdapterCmd);WorkListAuditReq workListAuditReq = AutoMapper.transform(WorkListAuditReq.class, workListAuditCmd);Boolean needCallback = workListAuditAdapterCmd.getNeedCallback();if (needCallback != null && needCallback) {//如果dubbo接口里面参数需要回调则回调// 注册事务同步器，在事务提交后执行异步任务TransactionSynchronizationManager.registerSynchronization(new TransactionSynchronizationAdapter() {@Overridepublic void afterCommit() {// 确保数据提交后执行异步任务CompletableFuture.runAsync(() -> pushAuditResultToBusiness(workListAuditReq), threadPoolExecutor);}});}return new WorkListDataResult();
}

这个定时任务调用这个rpc接口时候，第二个参数WorkListLoginUserVo是传的null，这里到后面审核的时候会根据这个 LoginUserUtil.getCurrentUser 判断不为空，就不会进入权限校验的逻辑

protected void auditMultiProcessWorkTaskInternal(WorkListAuditAdapterCmd workListAuditAdapterCmd) {log.info("auditMultiProcessWorkTaskInternal WorkListAuditAdapterCmd={}",JSON.toJSONString(workListAuditAdapterCmd));//校验是否有审核的WorkListRespVo workListInfo = workListQueryService.getWorkListInfoByKeyId(workListAuditAdapterCmd.getWorkListKeyId());setAuditInfo(workListAuditAdapterCmd);Integer auditStatus = workListInfo.getAuditStatus();LoginUser currentUser = Identify.getCurrentUser();if(AuditStatusEnum.PENDING_REVIEW.getCode().equals(auditStatus)){workListAuditAdapterCmd.setFirstAuditDeptKeyId(currentUser == null ? workListAuditAdapterCmd.getAuditDeptKeyId() : currentUser.getDepartmentKeyId());workListAuditAdapterCmd.setFirstAuditUserKeyId(currentUser == null ? workListAuditAdapterCmd.getAuditUserKeyId() : currentUser.getUserKeyId());workListAuditAdapterCmd.setAuditStatus(AuditStatusEnum.PASS.getCode().equals(workListAuditAdapterCmd.getAuditStatus()) || AuditStatusEnum.PENDING_REEVALUATION.getCode().equals(workListAuditAdapterCmd.getAuditStatus()) ? AuditStatusEnum.PENDING_REEVALUATION.getCode() : AuditStatusEnum.REFUSE.getCode());workListAuditAdapterCmd.setFirstAuditTime(LocalDateTime.now());}else {workListAuditAdapterCmd.setSecondAuditUserKeyId(currentUser == null ? workListAuditAdapterCmd.getAuditUserKeyId() : currentUser.getUserKeyId());workListAuditAdapterCmd.setSecondAuditDeptKeyId(currentUser == null ? workListAuditAdapterCmd.getAuditDeptKeyId() : currentUser.getDepartmentKeyId());workListAuditAdapterCmd.setSecondAuditTime(LocalDateTime.now());workListAuditAdapterCmd.setFirstAuditTime(null);workListAuditAdapterCmd.setFirstAuditDeptKeyId(null);workListAuditAdapterCmd.setFirstAuditUserKeyId(null);}log.info("auditMultiProcessWorkTaskInternal WorkListAuditAdapterCmd={},WorkListRespVo={}",JSON.toJSONString(workListAuditAdapterCmd),JSON.toJSONString(workListInfo));// 获取权限代码setPermissionCode(workListAuditAdapterCmd, workListInfo);//校验是否有审核权限,排除房源定时Job调用的情况if(currentUser != null && StringUtils.isNotBlank(currentUser.getUserKeyId()) && StringUtils.isNotBlank(currentUser.getRoleKeyId())){checkAuditPermission(currentUser,workListAuditAdapterCmd,workListInfo);}//更新代办任务数据updateWorkList(workListAuditAdapterCmd);
}

生产上面却发现了一个问题，就是有一定概率会有些数据进行了权限校验，也就是currentUser不为空了，后面跟踪房源那边代码才发现，那边调用这个审核的dubbo接口，会调用另外一个查询的rpc接口，

public WorkListDataResult<List<WorkListRespDto>> getWorkListStatusByCondion(WorkListStatusReq req, WorkListLoginUserVo loginUserVo) {log.info("getWorkListStatusByCondion WorkListStatusReq={},WorkListLoginUserVo={}", JSON.toJSONString(req), JSON.toJSONString(loginUserVo));LoginUserUtil.setCurrentUser(loginUserVo);WorkListDataResult<List<WorkListRespDto>> result = new WorkListDataResult<>();if (StringUtils.isBlank(req.getApplyType())) {result.setFlag(false);result.setErrorMessage("待办类型不能为空！");return result;}if (StringUtils.isBlank(req.getPropertyKeyId())) {result.setFlag(false);result.setErrorMessage("房源ID不能为空！");return result;}List<WorkListRespDto> listResps = new ArrayList<>();List<UserByIdOrNumberRpcDto> userList = new ArrayList<>();//用于存放用户ID的集合List<String> userKeyIdList = new ArrayList<>();List<DepartmentByIdOrNoRpcDto> deptList = new ArrayList<>();//用于存放部门ID的集合List<String> deptIdList = new ArrayList<>();//将空值置为nullSpringBeanUtil.convertEmptyToNull(req);WorkListSearchVo workListSearchVo = AutoMapper.transform(WorkListSearchVo.class, req);log.info("getWorkListStatusByCondion WorkListSearchVo={}", JSON.toJSONString(workListSearchVo));List<WorkListRespVo> list = workListQueryService.getWorkListStatusByCondion(workListSearchVo);log.info("getWorkListStatusByCondion list.total=" + list.size());if (list != null && list.size() > 0) {for (WorkListRespVo viewResp : list) {if (viewResp != null) {//设置userId和deptId集合setDeptOrUserList(viewResp, userKeyIdList, deptIdList);}}if (userKeyIdList != null && userKeyIdList.size() > 0) {//批量查询用户信息userList = userAndDeptDubboService.queryUserByIdOrNumber(userKeyIdList);log.info("getWorkListStatusByCondion userList={}", userList.toString());}if (deptIdList != null && deptIdList.size() > 0) {//批量查询部门信息deptList = userAndDeptDubboService.queryByKeyIdOrNo(deptIdList);log.info("getWorkListStatusByCondion deptList={}", deptList.toString());}for (WorkListRespVo viewResp : list) {//设置枚举描述setWorkListVoDesc(viewResp);//设置待办对象用户和部门信息setWorkListRespVoDeptOrUser(viewResp, userList, deptList);WorkListRespDto workListRespVo = AutoMapper.transform(WorkListRespDto.class, viewResp);listResps.add(workListRespVo);}}result.setFlag(true);result.setData(listResps);return result;
}

这个查询的接口也进行了LoginUserUtil.setCurrentUser(loginUserVo)，这段代码会放到ThreadLocal 的线程本地变量里面

而整个这个查询和审核的接口都没有进行这个ThreadLocal线程变量的清除，因为dubbo提供的rpc接口，本质上是使用了线程池技术，会复用一些线程，比如说19号先执行了这个查询代办任务的rpc接口，这个时候设置了currentUser,然后后面调用这个代办审核的接口时候，又刚好拿到了这个19号线程，这个时候通过getCuurentUser拿到的用户就不为空，然后就进入了权限校验的逻辑，解决办法通过自定义dubbo的过滤器，在过滤器里面完成资源的清除