131 lines
3.1 KiB
Go
131 lines
3.1 KiB
Go
package encrypt
|
|
|
|
import (
|
|
"context"
|
|
"crypto/aes"
|
|
"crypto/cipher"
|
|
"crypto/hmac"
|
|
"crypto/rand"
|
|
"crypto/sha256"
|
|
"encoding/base64"
|
|
"encoding/hex"
|
|
"io"
|
|
"strings"
|
|
|
|
"github.com/gogf/gf/v2/errors/gerror"
|
|
"github.com/gogf/gf/v2/frame/g"
|
|
)
|
|
|
|
func fieldKey(ctx context.Context) ([]byte, error) {
|
|
secret := strings.TrimSpace(g.Cfg().MustGet(ctx, "security.dataKey").String())
|
|
if secret == "" {
|
|
return nil, gerror.New("敏感字段加密密钥未配置")
|
|
}
|
|
sum := sha256.Sum256([]byte(secret))
|
|
return sum[:], nil
|
|
}
|
|
|
|
// EncryptField encrypts one sensitive value with AES-256-GCM and a fresh nonce.
|
|
func EncryptField(ctx context.Context, plaintext string) (string, error) {
|
|
if plaintext == "" {
|
|
return "", nil
|
|
}
|
|
key, err := fieldKey(ctx)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
block, err := aes.NewCipher(key)
|
|
if err != nil {
|
|
return "", gerror.Wrap(err, "初始化敏感字段加密失败")
|
|
}
|
|
gcm, err := cipher.NewGCM(block)
|
|
if err != nil {
|
|
return "", gerror.Wrap(err, "初始化敏感字段加密失败")
|
|
}
|
|
nonce := make([]byte, gcm.NonceSize())
|
|
if _, err = io.ReadFull(rand.Reader, nonce); err != nil {
|
|
return "", gerror.Wrap(err, "生成敏感字段随机数失败")
|
|
}
|
|
sealed := gcm.Seal(nonce, nonce, []byte(plaintext), nil)
|
|
return base64.RawURLEncoding.EncodeToString(sealed), nil
|
|
}
|
|
|
|
func DecryptField(ctx context.Context, encoded string) (string, error) {
|
|
if encoded == "" {
|
|
return "", nil
|
|
}
|
|
key, err := fieldKey(ctx)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
raw, err := base64.RawURLEncoding.DecodeString(encoded)
|
|
if err != nil {
|
|
return "", gerror.Wrap(err, "敏感字段密文格式错误")
|
|
}
|
|
block, err := aes.NewCipher(key)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
gcm, err := cipher.NewGCM(block)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
if len(raw) < gcm.NonceSize() {
|
|
return "", gerror.New("敏感字段密文不完整")
|
|
}
|
|
plain, err := gcm.Open(nil, raw[:gcm.NonceSize()], raw[gcm.NonceSize():], nil)
|
|
if err != nil {
|
|
return "", gerror.Wrap(err, "敏感字段解密失败")
|
|
}
|
|
return string(plain), nil
|
|
}
|
|
|
|
// HashField creates a deterministic, non-reversible lookup key with a secret pepper.
|
|
func HashField(ctx context.Context, value string) (string, error) {
|
|
key, err := fieldKey(ctx)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
h := hmac.New(sha256.New, key)
|
|
_, _ = h.Write([]byte(strings.TrimSpace(value)))
|
|
return hex.EncodeToString(h.Sum(nil)), nil
|
|
}
|
|
|
|
func MaskMobile(value string) string {
|
|
value = strings.TrimSpace(value)
|
|
if len(value) < 7 {
|
|
return "***"
|
|
}
|
|
return value[:3] + "****" + value[len(value)-4:]
|
|
}
|
|
|
|
func MaskName(value string) string {
|
|
runes := []rune(strings.TrimSpace(value))
|
|
if len(runes) == 0 {
|
|
return ""
|
|
}
|
|
if len(runes) == 1 {
|
|
return "*"
|
|
}
|
|
return string(runes[0]) + strings.Repeat("*", len(runes)-1)
|
|
}
|
|
|
|
func MaskAccount(value string) string {
|
|
value = strings.TrimSpace(value)
|
|
if len(value) <= 2 {
|
|
return "****"
|
|
}
|
|
if len(value) <= 8 {
|
|
return "****" + value[len(value)-2:]
|
|
}
|
|
return value[:4] + strings.Repeat("*", len(value)-8) + value[len(value)-4:]
|
|
}
|
|
|
|
func MaskAddress(value string) string {
|
|
runes := []rune(strings.TrimSpace(value))
|
|
if len(runes) <= 6 {
|
|
return "******"
|
|
}
|
|
return string(runes[:6]) + "****"
|
|
}
|