From 9820e89e1c7e4d6ba76ec9c39932d737cf618aeb Mon Sep 17 00:00:00 2001
From: Austin <xxxx@gmail.com>
Date: Mon, 21 Sep 2026 16:25:26 +0800
Subject: [PATCH] =?UTF-8?q?refactor(server/auth):=20=E7=A7=BB=E9=99=A4?=
 =?UTF-8?q?=E8=B4=A6=E5=8F=B7=E6=8E=A9=E7=A0=81=E5=87=BD=E6=95=B0=E5=B9=B6?=
 =?UTF-8?q?=E7=AE=80=E5=8C=96=E5=AE=A1=E8=AE=A1=E6=97=A5=E5=BF=97=E5=AD=98?=
 =?UTF-8?q?=E5=82=A8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

1.  移除不再使用的maskLoginAccount工具函数
2.  登录审计日志直接存储原始账号而非掩码后的版本
3.  重命名测试函数以匹配新的业务逻辑
---
 server/auth_audit.go      | 22 ++--------------------
 server/auth_audit_test.go | 13 +------------
 2 files changed, 3 insertions(+), 32 deletions(-)

diff --git a/server/auth_audit.go b/server/auth_audit.go
index a062eac..d637301 100644
--- a/server/auth_audit.go
+++ b/server/auth_audit.go
@@ -42,7 +42,7 @@ func recordSessionLoginSuccess(s *Session, rec *auth.Rec, scheme, suppliedAccoun
 	}
 	event := &types.LoginAuditEvent{
 		UserID: rec.Uid, Username: username, AccountType: accountType,
-		AccountHash: hashLoginAccount(account), AccountMask: maskLoginAccount(account),
+		AccountHash: hashLoginAccount(account), AccountMask: account,
 		LoginType: loginAuditType(scheme), EventType: "login", SessionID: truncateAuditValue(s.sid, 96),
 		DeviceID: truncateAuditValue(s.deviceID, 255), Platform: normalizeAuditPlatform(s.platf),
 		AppVersion: truncateAuditValue(versionToString(s.ver), 32), IP: sessionAuditIP(s.remoteAddr),
@@ -79,7 +79,7 @@ func recordSessionLoginFailure(s *Session, scheme string, secret []byte, rec *au
 		riskLevel = "high"
 	}
 	event := &types.LoginFailureEvent{
-		UserID: uid, AccountType: accountType, AccountHash: hashLoginAccount(account), AccountMask: maskLoginAccount(account),
+		UserID: uid, AccountType: accountType, AccountHash: hashLoginAccount(account), AccountMask: account,
 		FailureType: failureType, Reason: reason, Detail: truncateAuditValue(loginFailureDetail(cause), 500),
 		IP: sessionAuditIP(s.remoteAddr), DeviceID: truncateAuditValue(s.deviceID, 255), Platform: normalizeAuditPlatform(s.platf),
 		AppVersion: truncateAuditValue(versionToString(s.ver), 32), UserAgent: truncateAuditValue(s.userAgent, 512),
@@ -241,24 +241,6 @@ func isPhoneLike(value string) bool {
 	return digits >= 7
 }
 
-func maskLoginAccount(account string) string {
-	account = strings.TrimSpace(account)
-	if account == "" {
-		return ""
-	}
-	if at := strings.LastIndex(account, "@"); at > 0 {
-		return string([]rune(account[:at])[:1]) + "***" + account[at:]
-	}
-	runes := []rune(account)
-	if isPhoneLike(account) && len(runes) > 7 {
-		return string(runes[:3]) + "****" + string(runes[len(runes)-4:])
-	}
-	if len(runes) <= 2 {
-		return strings.Repeat("*", len(runes))
-	}
-	return string(runes[:1]) + strings.Repeat("*", len(runes)-2) + string(runes[len(runes)-1:])
-}
-
 func hashLoginAccount(account string) string {
 	account = strings.ToLower(strings.TrimSpace(account))
 	if account == "" {
diff --git a/server/auth_audit_test.go b/server/auth_audit_test.go
index 962e260..1aee4c6 100644
--- a/server/auth_audit_test.go
+++ b/server/auth_audit_test.go
@@ -22,18 +22,7 @@ func TestLoginAuditAccountDoesNotTreatTokenAsAccount(t *testing.T) {
 	}
 }
 
-func TestMaskAndHashLoginAccount(t *testing.T) {
-	tests := map[string]string{
-		"13800138000":       "138****8000",
-		"alice@example.com": "a***@example.com",
-		"alice":             "a***e",
-		"ab":                "**",
-	}
-	for input, want := range tests {
-		if got := maskLoginAccount(input); got != want {
-			t.Errorf("maskLoginAccount(%q)=%q want %q", input, got, want)
-		}
-	}
+func TestHashLoginAccount(t *testing.T) {
 	hash := hashLoginAccount(" Alice ")
 	if len(hash) != 64 || hash != hashLoginAccount("alice") || strings.Contains(hash, "alice") {
 		t.Fatalf("unexpected account hash %q", hash)