csxj2026/junhong_cmp_fiber
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases Wiki Activity

实现审计覆盖门禁与外部集成日志闭环
All checks were successful
构建并部署到测试环境（无 SSH） / build-and-deploy (push) Successful in 10m19s
Details

Browse Source
This commit is contained in:
break
2026-07-23 21:31:22 +09:00
parent 7e0171a8b4
commit ff44305d0e
21 changed files with 12770 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
pkg/logger/access_policy.go
View File

@@ -1,6 +1,7 @@
package logger
import (
"fmt"
"net/url"
"path/filepath"
"strings"
@@ -10,25 +11,34 @@ import (
// AccessPolicy 是敏感路由的安全摘要策略。
type AccessPolicy struct {
Name string
Sensitive bool
SafeFields map[string]struct{}
FileFields map[string]struct{}
Name string
Sensitive bool
PresenceOnly bool
SafeFields map[string]struct{}
ResultFields map[string]struct{}
FileFields map[string]struct{}
}
var (
loginPolicy = AccessPolicy{
Name: "login_token", Sensitive: true,
SafeFields: fieldSet("username", "user_id", "account_id", "success", "result_code"),
Name: "login_token", Sensitive: true, PresenceOnly: true,
SafeFields: fieldSet("username", "user_id", "account_id", "success", "result_code"),
ResultFields: fieldSet("success", "result_code", "status"),
}
paymentPolicy = AccessPolicy{
Name: "payment", Sensitive: true,
SafeFields: fieldSet("order_no", "payment_no", "channel", "payment_method", "result_code", "amount", "status"),
Name: "payment", Sensitive: true, PresenceOnly: true,
SafeFields: fieldSet("order_no", "payment_no", "channel", "payment_method", "result_code", "amount", "status"),
ResultFields: fieldSet("result_code", "status"),
}
wecomPolicy = AccessPolicy{
Name: "wecom_callback", Sensitive: true,
SafeFields: fieldSet("event_type", "resource_type", "resource_id", "result_code", "status"),
}
configPolicy = AccessPolicy{
Name: "sensitive_config", Sensitive: true, PresenceOnly: true,
SafeFields: fieldSet("config_key", "value_type", "module", "readonly", "sensitive", "configured", "status", "result_code"),
ResultFields: fieldSet("readonly", "sensitive", "configured", "status", "result_code"),
}
filePolicy = AccessPolicy{
Name: "file_export", Sensitive: true,
SafeFields: fieldSet("content_type", "file_size", "size", "count", "task_id", "status", "result_code"),
@@ -50,6 +60,8 @@ func policyForPath(path string) AccessPolicy {
switch {
case strings.Contains(normalized, "/login"), strings.Contains(normalized, "token"):
return loginPolicy
case strings.Contains(normalized, "/system-configs"), strings.Contains(normalized, "/wechat-configs"):
return configPolicy
case strings.Contains(normalized, "/callback") && (strings.Contains(normalized, "wecom") || strings.Contains(normalized, "wework")):
return wecomPolicy
case strings.Contains(normalized, "payment"), strings.Contains(normalized, "wechat-pay"),
@@ -102,7 +114,13 @@ func collectSafeFields(value any, policy AccessPolicy, output map[string]any) {
case string:
collectSafeScalar(key, scalar, policy, output)
case float64, bool:
if _, allowed := policy.SafeFields[strings.ToLower(key)]; allowed {
if policy.PresenceOnly {
if _, isResult := policy.ResultFields[strings.ToLower(key)]; isResult {
output[key] = scalar
} else {
output[key] = map[string]any{"present": true, "length": len(fmt.Sprint(scalar))}
}
} else if _, allowed := policy.SafeFields[strings.ToLower(key)]; allowed {
output[key] = scalar
}
default:
@@ -118,6 +136,14 @@ func collectSafeFields(value any, policy AccessPolicy, output map[string]any) {
func collectSafeScalar(key, value string, policy AccessPolicy, output map[string]any) {
normalized := strings.ToLower(key)
if policy.PresenceOnly {
if _, isResult := policy.ResultFields[normalized]; isResult {
output[key] = value
return
}
output[key] = map[string]any{"present": true, "length": len(value)}
return
}
if _, isFileName := policy.FileFields[normalized]; isFileName {
base := filepath.Base(value)
hash := digest([]byte(base))