[前端業(yè)務系統(tǒng)]
↓ HTTP
[SpringBoot 技能中臺] ←→ [MySQL/Redis]
↓ MCP Protocol
[OpenClaw Gateway] ←→ [各類 Skills：GitHub/瀏覽器/文件系統(tǒng)]

git clone https://github.com/openclaw/openclaw.git
cd openclaw
docker-compose up -d

# 進容器里裝插件
docker compose exec openclaw-gateway node dist/index.js plugins install mcp-adapter

    
        org.springframework.boot
        spring-boot-starter-webflux
        org.springframework.boot
        spring-boot-starter-data-jpa
        mysql
        mysql-connector-java

openclaw:
  mcp:
    base-url: http://localhost:8080  # MCP 適配器地址
    timeout: 30000                   # AI 執(zhí)行可能慢，給 30 秒

@Configuration
public class OpenClawConfig {
    @Bean
    public WebClient openClawWebClient(@Value("${openclaw.mcp.base-url}") String baseUrl) {
        return WebClient.builder()
                .baseUrl(baseUrl)
                .codecs(configurer -> configurer.defaultCodecs().maxInMemorySize(2 * 1024 * 1024)) // 防止 AI 返回超長內容爆內存
                .build();
    }
}

@Service
@Slf4j
public class OpenClawSkillService {
    @Autowired
    private WebClient webClient;
    @Autowired
    private SkillAuditRepository auditRepository; // 審計日志_repo
    /**
     * 拉取 OpenClaw 當前所有可用技能
     * 相當于給 AI 做"資產盤點"
     */
    public List discoverSkills() {
        return webClient.post()
                .uri("/mcp/tools/list")
                .header("Content-Type", "application/json")
                .bodyValue(Map.of("jsonrpc", "2.0", "id", 1, "method", "tools/list"))
                .retrieve()
                .bodyToMono(JsonNode.class)
                .map(response -> {
                    List skills = new ArrayList<>();
                    JsonNode tools = response.get("result").get("tools");
                    tools.forEach(tool -> {
                        skills.add(new SkillInfo(
                            tool.get("name").asText(),
                            tool.get("description").asText()
                        ));
                    });
                    return skills;
                })
                .block(); // 啟動時同步加載，后面可以改成緩存
    }
    /**
     * 調用具體技能，帶審計日志
     * @param skillName 技能名，比如 "github-pr-create"
     * @param parameters 參數，比如 {"repo": "myproject", "title": "fix bug"}
     * @param operator 操作人，從 Spring Security 上下文中取
     */
    public SkillResult invokeSkill(String skillName, Map parameters, String operator) {
        // 1. 先記日志：誰想調什么
        SkillAudit audit = new SkillAudit();
        audit.setOperator(operator);
        audit.setSkillName(skillName);
        audit.setRequestParams(parameters.toString());
        audit.setInvokeTime(LocalDateTime.now());
        try {
            // 2. 調 OpenClaw
            JsonNode response = webClient.post()
                    .uri("/mcp/tools/call")
                    .bodyValue(Map.of(
                        "jsonrpc", "2.0",
                        "id", System.currentTimeMillis(),
                        "method", "tools/call",
                        "params", Map.of(
                            "name", skillName,
                            "arguments", parameters
                        )
                    ))
                    .retrieve()
                    .bodyToMono(JsonNode.class)
                    .timeout(Duration.ofSeconds(30))
                    .block();
            // 3. 處理結果
            String result = response.get("result").get("content").get(0).get("text").asText();
            audit.setStatus("SUCCESS");
            audit.setResponse(result.substring(0, Math.min(result.length(), 1000))); // 太長的截斷存
            return new SkillResult(true, result, null);
        } catch (Exception e) {
            log.error("技能調用失敗: {}", skillName, e);
            audit.setStatus("FAILED");
            audit.setErrorMsg(e.getMessage());
            return new SkillResult(false, null, e.getMessage());
        } finally {
            auditRepository.save(audit); // 落庫，留痕
        }
    }
}

@Entity
public class SkillPermission {
    @Id
    private Long id;
    private String role;      // ADMIN/DEVELOPER/GUEST
    private String skillName; // 支持通配符，比如 "github-*"
    private boolean allowed;  // true 允許，false 拒絕
}

@Aspect
@Component
public class SkillSecurityAspect {
    
    @Autowired
    private SkillPermissionRepository permissionRepo;
    
    @Before("execution(* com.example.openclaw.service.OpenClawSkillService.invokeSkill(..)) && args(skillName,..,operator)")
    public void checkPermission(String skillName, String operator) {
        // 查用戶角色（簡化示例，實際從 JWT 或 Session ?。?
        String role = getRoleByOperator(operator);
        
        List permissions = permissionRepo.findByRoleAndSkillNameLike(role, skillName);
        
        boolean allowed = permissions.stream().anyMatch(SkillPermission::isAllowed);
        if (!allowed) {
            throw new AccessDeniedException("您無權調用技能: " + skillName);
        }
    }
}

@Service
public class SkillOrchestrationService {
    
    @Autowired
    private OpenClawSkillService skillService;
    
    /**
     * 執(zhí)行工作流
     * @param workflow 定義好的步驟列表
     * @param context  上下文，用于步驟間傳參
     */
    public void executeWorkflow(List workflow, Map context, String operator) {
        for (WorkflowStep step : workflow) {
            // 1. 參數模板渲染（比如把上一步的返回值塞進去）
            Map params = renderTemplate(step.getParamsTemplate(), context);
            
            // 2. 調技能
            SkillResult result = skillService.invokeSkill(step.getSkillName(), params, operator);
            
            if (!result.isSuccess()) {
                throw new WorkflowException("步驟 " + step.getName() + " 失敗: " + result.getError());
            }
            
            // 3. 結果寫回上下文，下一步能用
            context.put(step.getOutputKey(), result.getData());
        }
    }
    
    private Map renderTemplate(Map template, Map context) {
        Map rendered = new HashMap<>();
        template.forEach((k, v) -> {
            // 簡單替換，比如 "{{github.commits}}" 換成 context 里的真實數據
            if (v.startsWith("{{") && v.endsWith("}}")) {
                String key = v.substring(2, v.length() - 2);
                rendered.put(k, context.get(key));
            } else {
                rendered.put(k, v);
            }
        });
        return rendered;
    }
}

// 定義一個"晨會報告"工作流
List morningReport = Arrays.asList(
    new WorkflowStep("github-commits-yesterday", Map.of("repo", "myapp"), "commits"),
    new WorkflowStep("chart-generate", Map.of("data", "{{commits}}", "type", "bar"), "chart"),
    new WorkflowStep("email-send", Map.of("attachment", "{{chart}}", "to", "team@company.com"), null)
);

orchestrationService.executeWorkflow(morningReport, new HashMap<>(), "admin");

@RestController
@RequestMapping("/api/admin/audit")
public class AuditController {
    
    @GetMapping("/stats")
    public Map getStats(
            @RequestParam @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate start,
            @RequestParam @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate end) {
        
        // 統(tǒng)計每天調用量、成功率、Top10 熱門技能
        return Map.of(
            "totalCalls", auditRepository.countByDateRange(start, end),
            "successRate", auditRepository.calcSuccessRate(start, end),
            "topSkills", auditRepository.findTopSkills(start, end, PageRequest.of(0, 10))
        );
    }
}

@Component
public class OpenClawHealthChecker {
    
    @Autowired
    private WebClient webClient;
    
    @Scheduled(fixedRate = 60000) // 每分鐘
    public void check() {
        try {
            webClient.get()
                    .uri("/health") // OpenClaw 自帶健康端點
                    .retrieve()
                    .toBodilessEntity()
                    .timeout(Duration.ofSeconds(5))
                    .block();
            // 上報 Prometheus 指標，標記為 UP
        } catch (Exception e) {
            // 標記為 DOWN，觸發(fā)告警
            alertService.send("OpenClaw Gateway 失聯，請檢查 Docker 容器狀態(tài)");
        }
    }
}