chore: seed migration objects batch 21

server/internal/logic/sys/log.go

@@ -159,7 +159,7 @@ func (s *sSysLog) AnalysisLog(ctx context.Context) entity.SysLog {
 		module     = mctx.Module
 		clientIp   = location.GetClientIp(request)
 		postData   = gjson.New(consts.NilJsonToString)
-		getData    = gjson.New(request.URL.Query())
+		getData    = s.MaskSensitiveJson(gjson.New(request.URL.Query()))
 		headerData = gjson.New(consts.NilJsonToString)
 		errorData  = gjson.New(consts.NilJsonToString)
 		data       entity.SysLog
@@ -194,7 +194,7 @@ func (s *sSysLog) AnalysisLog(ctx context.Context) entity.SysLog {
 
 	// post参数
 	if body, ok := mctx.Data["request.body"].(*gjson.Json); ok {
-		postData = body
+		postData = s.MaskSensitiveJson(body)
 	}
 
 	// post表单
@@ -208,12 +208,7 @@ func (s *sSysLog) AnalysisLog(ctx context.Context) entity.SysLog {
 	if postData.IsNil() || len(postData.Map()) == 0 {
 		postData = gjson.New(consts.NilJsonToString)
 	} else {
-		// 隐藏明文显示的密码
-		for k := range postData.Map() {
-			if gstr.ContainsI(k, "password") {
-				postData.MustSet(k, "******")
-			}
-		}
+		postData = s.MaskSensitiveJson(postData)
 	}
 
 	// 当前登录用户
@@ -247,7 +242,7 @@ func (s *sSysLog) AnalysisLog(ctx context.Context) entity.SysLog {
 		Url:        request.URL.Path,
 		GetData:    getData,
 		PostData:   postData,
-		HeaderData: s.SimplifyHeaderParams(headerData),
+		HeaderData: s.SimplifyHeaderParams(s.MaskSensitiveJson(headerData)),
 		Ip:         clientIp,
 		ProvinceId: ipData.ProvinceCode,
 		CityId:     ipData.CityCode,
@@ -273,6 +268,10 @@ func (s *sSysLog) SimplifyHeaderParams(data *gjson.Json) *gjson.Json {
 	var filters = []string{"Accept", "Authorization", "Cookie"}
 	for _, filter := range filters {
 		v := data.Get(filter)
+		if isSensitiveLogField(filter) {
+			data.MustSet(filter, "******")
+			continue
+		}
 		if len(v.String()) > 128 {
 			data.MustRemove(filter)
 		}
@@ -280,6 +279,58 @@ func (s *sSysLog) SimplifyHeaderParams(data *gjson.Json) *gjson.Json {
 	return data
 }
 
+// MaskSensitiveJson masks sensitive request fields before access logs are stored.
+func (s *sSysLog) MaskSensitiveJson(data *gjson.Json) *gjson.Json {
+	if data == nil || data.IsNil() {
+		return data
+	}
+	return gjson.New(maskSensitiveValue(data.Map()))
+}
+
+func maskSensitiveValue(v interface{}) interface{} {
+	switch value := v.(type) {
+	case map[string]interface{}:
+		res := make(map[string]interface{}, len(value))
+		for k, item := range value {
+			if isSensitiveLogField(k) {
+				res[k] = "******"
+				continue
+			}
+			res[k] = maskSensitiveValue(item)
+		}
+		return res
+	case map[string][]string:
+		res := make(map[string]interface{}, len(value))
+		for k, item := range value {
+			if isSensitiveLogField(k) {
+				res[k] = "******"
+				continue
+			}
+			res[k] = item
+		}
+		return res
+	case []interface{}:
+		for i, item := range value {
+			value[i] = maskSensitiveValue(item)
+		}
+		return value
+	default:
+		return v
+	}
+}
+
+func isSensitiveLogField(field string) bool {
+	sensitive := []string{"password", "invitecode", "invite_code", "servicesecret", "service_secret", "authorization", "x-service-secret"}
+	normalized := gstr.Replace(gstr.Replace(gstr.ToLower(field), "-", ""), "_", "")
+	for _, item := range sensitive {
+		item = gstr.Replace(gstr.Replace(item, "-", ""), "_", "")
+		if normalized == item || gstr.Contains(normalized, item) {
+			return true
+		}
+	}
+	return false
+}
+
 // View 获取指定请求日志信息
 func (s *sSysLog) View(ctx context.Context, in *sysin.LogViewInp) (res *sysin.LogViewModel, err error) {
 	mod := s.Model(ctx)