feat: 重建 Sense 认证权限与审计 (#64)

Sense/server/common/middleware/logger.go

@@ -95,11 +95,54 @@ func LoggerToFile() gin.HandlerFunc {
 			log.Fields(map[string]interface{}{})
 		}()
 		if c.Request.Method != "OPTIONS" && config.LoggerConfig.EnabledDB && statusCode != 404 {
-			SetDBOperLog(c, clientIP, statusCode, reqUri, reqMethod, latencyTime, body, result, statusBus)
+			SetDBOperLog(c, clientIP, statusCode, reqUri, reqMethod, latencyTime, sanitizeAuditJSON(body), sanitizeAuditJSON(result), statusBus)
 		}
 	}
 }
 
+func sanitizeAuditJSON(value string) string {
+	if strings.TrimSpace(value) == "" {
+		return ""
+	}
+	var decoded interface{}
+	if err := json.Unmarshal([]byte(value), &decoded); err != nil {
+		return "[内容已隐藏]"
+	}
+	redactAuditValue(decoded)
+	encoded, err := json.Marshal(decoded)
+	if err != nil {
+		return "[内容已隐藏]"
+	}
+	return string(encoded)
+}
+
+func redactAuditValue(value interface{}) {
+	switch current := value.(type) {
+	case map[string]interface{}:
+		for key, item := range current {
+			if isSensitiveAuditKey(key) {
+				current[key] = "[已隐藏]"
+				continue
+			}
+			redactAuditValue(item)
+		}
+	case []interface{}:
+		for _, item := range current {
+			redactAuditValue(item)
+		}
+	}
+}
+
+func isSensitiveAuditKey(key string) bool {
+	normalized := strings.ToLower(strings.ReplaceAll(strings.ReplaceAll(key, "_", ""), "-", ""))
+	switch normalized {
+	case "password", "oldpassword", "newpassword", "token", "refreshtoken", "secret", "code", "uuid":
+		return true
+	default:
+		return false
+	}
+}
+
 // SetDBOperLog 写入操作日志表 fixme 该方法后续即将弃用
 func SetDBOperLog(c *gin.Context, clientIP string, statusCode int, reqUri string, reqMethod string, latencyTime time.Duration, body string, result string, status int) {