← projects
$ logged-lib
Annotation-driven, AOP-based method observability library for Java and Spring Boot that never logs method arguments, return values, or exception messages by design.
- →Split along hexagonal boundaries into logged-core (the @Logged annotation, event model, and port interfaces, zero runtime dependencies, usable by any interception mechanism) and logged-spring (the Spring AOP adapter, Micrometer metrics, Spring Security-aware caller resolution, and full auto-configuration).
- →The event model has no field for method arguments or a return value at all, and captures only an exception's simple class name, never its message the guarantee against leaking sensitive data into logs comes from the data structure itself, not from a masking rule someone has to remember to configure.
- →Nested @Logged calls across separate beans share a trace id and an increasing depth via a ThreadLocal-backed FlowContext, so a failure partway through a call chain can be traced back to exactly which link broke, verified against chains up to seven levels deep.
- →Resolved a Spring Boot auto-configuration ordering bug where a MeterRegistry bean created by Actuator was not yet visible when this library's own auto-configuration ran, by deferring the Micrometer-or-no-op decision to the first actual invocation via ObjectProvider instead of deciding it during context refresh.
- →Hardened the AOP advice against a misbehaving MetricsRecorder or InvocationEventEmitter implementation throwing inside a finally block, which would otherwise silently replace the intercepted method's own exception the collaborator's failure is now caught and logged instead of masking the real one.
- →Caller identity resolves in three tiers depending on what is on the classpath: an authenticated Spring Security principal with an IP fallback, plain IP resolution for services that carry Spring Web but not Spring Security at all (for example an internal microservice behind a gateway), or unknown if neither is present IP resolution was deliberately decoupled from Spring Security since the two concerns are unrelated. by default the client IP is read from the request's remote address rather than a client-controlled X-Forwarded-For header, which is only trusted if explicitly opted into.
- →Verified with JMH: the aspect adds roughly 1 microsecond of overhead per intercepted call, three to four orders of magnitude below the database or HTTP calls the annotation is meant to instrument. Covered by Pitest mutation testing (97-100% across both modules) and published on JitPack, cross-checked from a separate throwaway consumer project exercising a real Spring Boot application end to end rather than relying on the local build.
JavaSpring BootAOPObservabilityMicrometerHexagonal ArchitectureSecurityJitPack