feat: add Go backend

server/utility/encrypt/aes.go

@@ -0,0 +1,42 @@
+// Package encrypt
+// @Link  https://github.com/bufanyun/hotgo
+// @Copyright  Copyright (c) 2023 HotGo CLI
+// @Author  Ms <133814250@qq.com>
+// @License  https://github.com/bufanyun/hotgo/blob/master/LICENSE
+//
+package encrypt
+
+import (
+	"encoding/base64"
+	"github.com/forgoer/openssl"
+)
+
+// AesECBEncrypt 加密
+func AesECBEncrypt(src, key []byte) (dst []byte, err error) {
+	return openssl.AesECBEncrypt(src, key, openssl.PKCS7_PADDING)
+}
+
+// AesECBDecrypt 解密
+func AesECBDecrypt(src, key []byte) (dst []byte, err error) {
+	return openssl.AesECBDecrypt(src, key, openssl.PKCS7_PADDING)
+}
+
+// MustAesECBEncryptToString
+// Return the encryption result directly. Panic error
+func MustAesECBEncryptToString(bytCipher, key string) string {
+	dst, err := AesECBEncrypt([]byte(bytCipher), []byte(key))
+	if err != nil {
+		panic(err)
+	}
+	return base64.StdEncoding.EncodeToString(dst)
+}
+
+// MustAesECBDecryptToString
+// Directly return decryption result, panic error
+func MustAesECBDecryptToString(bytCipher, key string) string {
+	dst, err := AesECBDecrypt([]byte(bytCipher), []byte(key))
+	if err != nil {
+		panic(err)
+	}
+	return string(dst)
+}

server/utility/encrypt/encrypt.go

@@ -0,0 +1,29 @@
+// Package encrypt
+// @Link  https://github.com/bufanyun/hotgo
+// @Copyright  Copyright (c) 2023 HotGo CLI
+// @Author  Ms <133814250@qq.com>
+// @License  https://github.com/bufanyun/hotgo/blob/master/LICENSE
+//
+package encrypt
+
+import (
+	"crypto/md5"
+	"fmt"
+	"hash/fnv"
+)
+
+// Md5ToString 生成md5
+func Md5ToString(str string) string {
+	return fmt.Sprintf("%x", md5.Sum([]byte(str)))
+}
+
+// Md5 生成md5
+func Md5(b []byte) string {
+	return fmt.Sprintf("%x", md5.Sum(b))
+}
+
+func Hash32(b []byte) uint32 {
+	h := fnv.New32a()
+	h.Write(b)
+	return h.Sum32()
+}

server/utility/encrypt/field.go

@@ -0,0 +1,130 @@
+package encrypt
+
+import (
+	"context"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"io"
+	"strings"
+
+	"github.com/gogf/gf/v2/errors/gerror"
+	"github.com/gogf/gf/v2/frame/g"
+)
+
+func fieldKey(ctx context.Context) ([]byte, error) {
+	secret := strings.TrimSpace(g.Cfg().MustGet(ctx, "security.dataKey").String())
+	if secret == "" {
+		return nil, gerror.New("敏感字段加密密钥未配置")
+	}
+	sum := sha256.Sum256([]byte(secret))
+	return sum[:], nil
+}
+
+// EncryptField encrypts one sensitive value with AES-256-GCM and a fresh nonce.
+func EncryptField(ctx context.Context, plaintext string) (string, error) {
+	if plaintext == "" {
+		return "", nil
+	}
+	key, err := fieldKey(ctx)
+	if err != nil {
+		return "", err
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return "", gerror.Wrap(err, "初始化敏感字段加密失败")
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return "", gerror.Wrap(err, "初始化敏感字段加密失败")
+	}
+	nonce := make([]byte, gcm.NonceSize())
+	if _, err = io.ReadFull(rand.Reader, nonce); err != nil {
+		return "", gerror.Wrap(err, "生成敏感字段随机数失败")
+	}
+	sealed := gcm.Seal(nonce, nonce, []byte(plaintext), nil)
+	return base64.RawURLEncoding.EncodeToString(sealed), nil
+}
+
+func DecryptField(ctx context.Context, encoded string) (string, error) {
+	if encoded == "" {
+		return "", nil
+	}
+	key, err := fieldKey(ctx)
+	if err != nil {
+		return "", err
+	}
+	raw, err := base64.RawURLEncoding.DecodeString(encoded)
+	if err != nil {
+		return "", gerror.Wrap(err, "敏感字段密文格式错误")
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return "", err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return "", err
+	}
+	if len(raw) < gcm.NonceSize() {
+		return "", gerror.New("敏感字段密文不完整")
+	}
+	plain, err := gcm.Open(nil, raw[:gcm.NonceSize()], raw[gcm.NonceSize():], nil)
+	if err != nil {
+		return "", gerror.Wrap(err, "敏感字段解密失败")
+	}
+	return string(plain), nil
+}
+
+// HashField creates a deterministic, non-reversible lookup key with a secret pepper.
+func HashField(ctx context.Context, value string) (string, error) {
+	key, err := fieldKey(ctx)
+	if err != nil {
+		return "", err
+	}
+	h := hmac.New(sha256.New, key)
+	_, _ = h.Write([]byte(strings.TrimSpace(value)))
+	return hex.EncodeToString(h.Sum(nil)), nil
+}
+
+func MaskMobile(value string) string {
+	value = strings.TrimSpace(value)
+	if len(value) < 7 {
+		return "***"
+	}
+	return value[:3] + "****" + value[len(value)-4:]
+}
+
+func MaskName(value string) string {
+	runes := []rune(strings.TrimSpace(value))
+	if len(runes) == 0 {
+		return ""
+	}
+	if len(runes) == 1 {
+		return "*"
+	}
+	return string(runes[0]) + strings.Repeat("*", len(runes)-1)
+}
+
+func MaskAccount(value string) string {
+	value = strings.TrimSpace(value)
+	if len(value) <= 2 {
+		return "****"
+	}
+	if len(value) <= 8 {
+		return "****" + value[len(value)-2:]
+	}
+	return value[:4] + strings.Repeat("*", len(value)-8) + value[len(value)-4:]
+}
+
+func MaskAddress(value string) string {
+	runes := []rune(strings.TrimSpace(value))
+	if len(runes) <= 6 {
+		return "******"
+	}
+	return string(runes[:6]) + "****"
+}

server/utility/encrypt/field_test.go

@@ -0,0 +1,15 @@
+package encrypt
+
+import "testing"
+
+func TestMasking(t *testing.T) {
+	if got := MaskMobile("13800000001"); got != "138****0001" {
+		t.Fatalf("mobile mask: %s", got)
+	}
+	if got := MaskName("测试会员"); got != "测***" {
+		t.Fatalf("name mask: %s", got)
+	}
+	if got := MaskAccount("6222020202020202001"); got != "6222***********2001" {
+		t.Fatalf("account mask: %s", got)
+	}
+}