实现审计覆盖门禁与外部集成日志闭环

pkg/logger/middleware_test.go

@@ -92,6 +92,8 @@ func TestSensitiveRouteMatrixNeverLogsRawPayload(t *testing.T) {
 			})
 			request := httptest.NewRequest("POST", tc.path+"?signature=query-secret", strings.NewReader(tc.body))
 			request.Header.Set("Content-Type", tc.contentType)
+			request.Header.Set("Authorization", "Bearer header-secret")
+			request.Header.Set("Cookie", "session=cookie-secret")
 			response, err := app.Test(request)
 			if err != nil {
 				t.Fatalf("执行敏感路由请求失败：%v", err)
@@ -99,7 +101,7 @@ func TestSensitiveRouteMatrixNeverLogsRawPayload(t *testing.T) {
 			_, _ = io.Copy(io.Discard, response.Body)
 			_ = response.Body.Close()
 			logged := output.String()
-			for _, secret := range []string{tc.secret, "query-secret", "response-secret"} {
+			for _, secret := range []string{tc.secret, "query-secret", "response-secret", "header-secret", "cookie-secret"} {
 				if strings.Contains(logged, secret) {
 					t.Fatalf("敏感路由日志泄露 %q：%s", secret, logged)
 				}
@@ -131,6 +133,92 @@ func TestSensitiveRouteLongBodyRecordsTruncationWithoutRawSecret(t *testing.T) {
 	}
 }
 
+func TestRealConfigurationRoutesOnlyLogSafeSummary(t *testing.T) {
+	for _, path := range []string{
+		"/api/admin/system-configs/payment.private_key",
+		"/api/admin/wechat-configs/1",
+	} {
+		t.Run(path, func(t *testing.T) {
+			var output bytes.Buffer
+			log := zap.New(zapcore.NewCore(zapcore.NewJSONEncoder(zap.NewProductionEncoderConfig()), zapcore.AddSync(&output), zapcore.InfoLevel))
+			app := fiber.New()
+			app.Use(MiddlewareWithLogger(log))
+			app.Put(path, func(c *fiber.Ctx) error {
+				return c.JSON(fiber.Map{"value": "response-private-material", "status": "ok"})
+			})
+			request := httptest.NewRequest("PUT", path, strings.NewReader(`{"value":"request-private-material","config_key":"payment.private_key"}`))
+			request.Header.Set("Content-Type", "application/json")
+			response, err := app.Test(request)
+			if err != nil {
+				t.Fatalf("执行配置路由请求失败：%v", err)
+			}
+			_ = response.Body.Close()
+			logged := output.String()
+			for _, secret := range []string{"request-private-material", "response-private-material"} {
+				if strings.Contains(logged, secret) {
+					t.Fatalf("配置路由日志泄露 %q：%s", secret, logged)
+				}
+			}
+			if !strings.Contains(logged, `"body_policy":"sensitive_config"`) {
+				t.Fatalf("配置路由未应用安全摘要策略：%s", logged)
+			}
+			if !strings.Contains(logged, `\"present\":true`) || !strings.Contains(logged, `\"length\":`) {
+				t.Fatalf("配置路由未记录字段存在性和长度：%s", logged)
+			}
+		})
+	}
+}
+
+func TestLoginRouteDoesNotLogUsernameAndOnlyKeepsPresenceLength(t *testing.T) {
+	var output bytes.Buffer
+	log := zap.New(zapcore.NewCore(zapcore.NewJSONEncoder(zap.NewProductionEncoderConfig()), zapcore.AddSync(&output), zapcore.InfoLevel))
+	app := fiber.New()
+	app.Use(MiddlewareWithLogger(log))
+	app.Post("/api/auth/login", func(c *fiber.Ctx) error {
+		return c.JSON(fiber.Map{"username": "visible-user", "success": true})
+	})
+	request := httptest.NewRequest("POST", "/api/auth/login", strings.NewReader(`{"username":"visible-user","password":"login-secret"}`))
+	request.Header.Set("Content-Type", "application/json")
+	response, err := app.Test(request)
+	if err != nil {
+		t.Fatalf("执行登录请求失败：%v", err)
+	}
+	_ = response.Body.Close()
+	logged := output.String()
+	if strings.Contains(logged, "visible-user") || strings.Contains(logged, "login-secret") {
+		t.Fatalf("登录路由泄露账号或凭证：%s", logged)
+	}
+	if !strings.Contains(logged, `\"present\":true`) || !strings.Contains(logged, `\"length\":`) {
+		t.Fatalf("登录路由未记录字段存在性和长度：%s", logged)
+	}
+}
+
+func TestPaymentRouteOnlyLogsPresenceLengthAndSafeResult(t *testing.T) {
+	var output bytes.Buffer
+	log := zap.New(zapcore.NewCore(zapcore.NewJSONEncoder(zap.NewProductionEncoderConfig()), zapcore.AddSync(&output), zapcore.InfoLevel))
+	app := fiber.New()
+	app.Use(MiddlewareWithLogger(log))
+	app.Post("/api/callback/alipay", func(c *fiber.Ctx) error {
+		return c.JSON(fiber.Map{"payment_no": "PAY-SECRET-1", "amount": 12345, "status": "success"})
+	})
+	request := httptest.NewRequest("POST", "/api/callback/alipay", strings.NewReader("order_no=ORDER-SECRET-1&amount=12345&sign=signature-secret"))
+	request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	response, err := app.Test(request)
+	if err != nil {
+		t.Fatalf("执行支付路由请求失败：%v", err)
+	}
+	_ = response.Body.Close()
+	logged := output.String()
+	for _, value := range []string{"PAY-SECRET-1", "ORDER-SECRET-1", "signature-secret"} {
+		if strings.Contains(logged, value) {
+			t.Fatalf("支付路由泄露原值 %q：%s", value, logged)
+		}
+	}
+	if !strings.Contains(logged, `\"present\":true`) || !strings.Contains(logged, `\"status\":\"success\"`) {
+		t.Fatalf("支付路由缺少存在性摘要或安全结果：%s", logged)
+	}
+}
+
 func TestSanitizeInvalidJSONNeverFallsBackToRawBody(t *testing.T) {
 	t.Parallel()