一个请求，要过几道关？

import jakarta.servlet.*;          // ← 只有包名随版本变
import jakarta.servlet.http.*;

// ① 门卫：每个进楼的请求都经过（OncePerRequestFilter 保证同一请求只过一次）
@Component
@Order(1)
public class TraceFilter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest req, HttpServletResponse res,
                                    FilterChain chain) throws ServletException, IOException {
        MDC.put("traceId", UUID.randomUUID().toString());   // 放行前
        try {
            chain.doFilter(req, res);                       // 放行：后面的所有人
        } finally {
            MDC.clear();                                    // 放行后
        }
    }
}

// ② 秘书：只管进了 DispatcherServlet 的请求
@Component
public class LoginInterceptor implements HandlerInterceptor {
    @Override
    public boolean preHandle(HttpServletRequest req, HttpServletResponse res, Object handler) {
        if (req.getHeader("Authorization") != null) return true;   // 放行
        res.setStatus(401);
        return false;                                                // 拦下
    }
}

// ③ 装修清单：启动时调用一次，把秘书安排到门口
@Configuration
public class WebConfig implements WebMvcConfigurer {
    private final LoginInterceptor loginInterceptor;

    public WebConfig(LoginInterceptor loginInterceptor) {   // 注入 Bean，别 new
        this.loginInterceptor = loginInterceptor;
    }

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(loginInterceptor)
                .addPathPatterns("/api/**")
                .excludePathPatterns("/api/login", "/error");
    }
}