fix: 完成商务迁移复核与接口优化并清理历史资料

internal/server/gin.go

@@ -113,11 +113,7 @@ func NewGinEngineWithRuntime(runtime *config.Store, access *systemservice.Access
 		logger.Info("websocket endpoint initialized", "mod", "websocket",
 			"enabled", ws != nil && ws.Enabled(), "path", websocketRoutePath(prefix, ws))
 	}
-	env := ""
-	if snapshot != nil && snapshot.Admin != nil && snapshot.Admin.App != nil {
-		env = strings.ToLower(strings.TrimSpace(snapshot.Admin.App.Env))
-	}
-	if env == "" || env == "development" || env == "dev" || env == "test" || env == "local" {
+	if snapshot != nil && config.SwaggerEnabled(snapshot.Admin) {
 		registerSwagger(engine, prefix, version, logger)
 	}
 	staticfiles.Register(engine, runtime)

internal/server/gin_test.go

@@ -51,7 +51,7 @@ func emptyHandlers() *handler.Set {
 }
 
 func TestGinRouteContract(t *testing.T) {
-	engine := NewGinEngine(config.NewStore(&config.Config{Admin: &config.Admin{}}), nil, emptyHandlers(), nil, nil, nil, nil, "test")
+	engine := NewGinEngine(config.NewStore(&config.Config{Admin: &config.Admin{App: &config.App{Env: "test"}}}), nil, emptyHandlers(), nil, nil, nil, nil, "test")
 	routes := engine.Routes()
 	actual := make([]string, 0, len(routes))
 	seen := make(map[string]struct{}, len(routes))
@@ -85,7 +85,7 @@ func TestGinRouteContract(t *testing.T) {
 }
 
 func TestGinRoutesMatchSharedCatalog(t *testing.T) {
-	engine := NewGinEngine(config.NewStore(&config.Config{Admin: &config.Admin{}}), nil, emptyHandlers(), nil, nil, nil, nil, "test")
+	engine := NewGinEngine(config.NewStore(&config.Config{Admin: &config.Admin{App: &config.App{Env: "test"}}}), nil, emptyHandlers(), nil, nil, nil, nil, "test")
 	registered := make(map[string]struct{}, len(engine.Routes()))
 	for _, route := range engine.Routes() {
 		key := route.Method + " " + route.Path
@@ -102,10 +102,36 @@ func TestGinRoutesMatchSharedCatalog(t *testing.T) {
 	}
 }
 
+func TestEveryPrivateRouteRequiresAuthentication(t *testing.T) {
+	for _, prefix := range []string{"", "/api"} {
+		engine := NewGinEngine(config.NewStore(&config.Config{Admin: &config.Admin{RouterPrefix: prefix}}), nil, emptyHandlers(), nil, nil, nil, nil, "test")
+		for _, descriptor := range routecatalog.Descriptors() {
+			if descriptor.Public {
+				continue
+			}
+			path := descriptor.Path
+			parts := strings.Split(path, "/")
+			for i, part := range parts {
+				if strings.HasPrefix(part, ":") {
+					parts[i] = "1"
+				}
+			}
+			path = prefix + strings.Join(parts, "/")
+			t.Run(descriptor.Method+" "+path, func(t *testing.T) {
+				recorder := httptest.NewRecorder()
+				engine.ServeHTTP(recorder, httptest.NewRequest(descriptor.Method, path, nil))
+				if recorder.Code != http.StatusUnauthorized {
+					t.Fatalf("anonymous private request returned %d: %s", recorder.Code, recorder.Body.String())
+				}
+			})
+		}
+	}
+}
+
 func TestGinStartupLogsEveryRegisteredRoute(t *testing.T) {
 	var output bytes.Buffer
 	logger := slog.New(slog.NewJSONHandler(&output, nil))
-	engine := NewGinEngine(config.NewStore(&config.Config{Admin: &config.Admin{}}), nil, emptyHandlers(), nil, nil, nil, logger, "test")
+	engine := NewGinEngine(config.NewStore(&config.Config{Admin: &config.Admin{App: &config.App{Env: "test"}}}), nil, emptyHandlers(), nil, nil, nil, logger, "test")
 	text := output.String()
 	if got, want := strings.Count(text, `"msg":"router registered"`), len(engine.Routes()); got != want {
 		t.Fatalf("registered route log count = %d, want %d", got, want)
@@ -116,7 +142,7 @@ func TestGinStartupLogsEveryRegisteredRoute(t *testing.T) {
 }
 
 func TestSwaggerUsesRegisteredGinRoutes(t *testing.T) {
-	engine := NewGinEngine(config.NewStore(&config.Config{Admin: &config.Admin{}}), nil, emptyHandlers(), nil, nil, nil, nil, "v1.0.0")
+	engine := NewGinEngine(config.NewStore(&config.Config{Admin: &config.Admin{App: &config.App{Env: "test"}}}), nil, emptyHandlers(), nil, nil, nil, nil, "v1.0.0")
 	response := httptest.NewRecorder()
 	request := httptest.NewRequest(http.MethodGet, "/swagger/doc.json", nil)
 	engine.ServeHTTP(response, request)
@@ -132,7 +158,7 @@ func TestSwaggerUsesRegisteredGinRoutes(t *testing.T) {
 }
 
 func TestSwaggerSupportsRouterPrefix(t *testing.T) {
-	engine := NewGinEngine(config.NewStore(&config.Config{Admin: &config.Admin{RouterPrefix: "/admin"}}), nil, emptyHandlers(), nil, nil, nil, nil, "v1.0.0")
+	engine := NewGinEngine(config.NewStore(&config.Config{Admin: &config.Admin{RouterPrefix: "/admin", App: &config.App{Env: "test"}}}), nil, emptyHandlers(), nil, nil, nil, nil, "v1.0.0")
 	for _, path := range []string{"/admin/swagger/index.html", "/admin/swagger/doc.json"} {
 		response := httptest.NewRecorder()
 		request := httptest.NewRequest(http.MethodGet, path, nil)
@@ -158,7 +184,7 @@ func TestHealthEndpointKeepsRootProbePathWithRouterPrefix(t *testing.T) {
 }
 
 func TestSwaggerUsesRootBasePathWithoutRouterPrefix(t *testing.T) {
-	engine := NewGinEngine(config.NewStore(&config.Config{Admin: &config.Admin{}}), nil, emptyHandlers(), nil, nil, nil, nil, "v1.0.0")
+	engine := NewGinEngine(config.NewStore(&config.Config{Admin: &config.Admin{App: &config.App{Env: "test"}}}), nil, emptyHandlers(), nil, nil, nil, nil, "v1.0.0")
 	response := httptest.NewRecorder()
 	engine.ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/swagger/doc.json", nil))
 	if response.Code != http.StatusOK || !strings.Contains(response.Body.String(), `"basePath":"/"`) {
@@ -167,7 +193,7 @@ func TestSwaggerUsesRootBasePathWithoutRouterPrefix(t *testing.T) {
 }
 
 func TestGinDoesNotTrustForwardedIPByDefault(t *testing.T) {
-	engine := NewGinEngine(config.NewStore(&config.Config{Admin: &config.Admin{}}), nil, emptyHandlers(), nil, nil, nil, nil, "test")
+	engine := NewGinEngine(config.NewStore(&config.Config{Admin: &config.Admin{App: &config.App{Env: "test"}}}), nil, emptyHandlers(), nil, nil, nil, nil, "test")
 	engine.GET("/client-ip", func(c *gin.Context) { c.String(http.StatusOK, c.ClientIP()) })
 	request := httptest.NewRequest(http.MethodGet, "/client-ip", nil)
 	request.RemoteAddr = "203.0.113.10:4321"
@@ -181,7 +207,7 @@ func TestGinDoesNotTrustForwardedIPByDefault(t *testing.T) {
 }
 
 func TestAnnouncementDataSourceRequiresAuthentication(t *testing.T) {
-	engine := NewGinEngine(config.NewStore(&config.Config{Admin: &config.Admin{}}), nil, emptyHandlers(), nil, nil, nil, nil, "test")
+	engine := NewGinEngine(config.NewStore(&config.Config{Admin: &config.Admin{App: &config.App{Env: "test"}}}), nil, emptyHandlers(), nil, nil, nil, nil, "test")
 	response := httptest.NewRecorder()
 	engine.ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/info/getInfoDataSource", nil))
 	if response.Code != http.StatusUnauthorized {

internal/server/middleware/payment_audit_test.go

@@ -59,3 +59,16 @@ func TestPaymentIntegrationConfigUsesRouteLevelSummary(t *testing.T) {
 		t.Fatal("payment test route was not recognized as sensitive")
 	}
 }
+
+func TestCertificateAliasesAreRedactedInNestedPayloads(t *testing.T) {
+	raw := []byte(`{"config":{"app_cert_content":"secret-cert","keys":[{"key_content":"secret-key"}],"cert_path":"private-file","template_content":"keep"}}`)
+	got := redactJSON(raw, "application/json", 4096)
+	for _, secret := range []string{"secret-cert", "secret-key", "private-file"} {
+		if strings.Contains(got, secret) {
+			t.Fatalf("certificate alias leaked: %s", got)
+		}
+	}
+	if !strings.Contains(got, `"template_content":"keep"`) {
+		t.Fatal("ordinary content was masked")
+	}
+}

internal/server/middleware/redact.go

@@ -1,6 +1,9 @@
 package middleware
 
-import "strings"
+import (
+	"kra/internal/biz/integration"
+	"strings"
+)
 
 // redactedValue replaces a sensitive value in every log line and audit record.
 const redactedValue = "***"
@@ -36,6 +39,9 @@ func isSensitiveHeader(key string) bool {
 // isSensitivePayloadKey also matches every key ending in "token" so provider
 // specific token names stay masked without being enumerated.
 func isSensitivePayloadKey(key string) bool {
+	if integration.IsIntegrationSecretKey(key) {
+		return true
+	}
 	normalized := strings.ToLower(strings.ReplaceAll(strings.ReplaceAll(key, "_", ""), "-", ""))
 	if _, sensitive := sensitivePayloadKeys[normalized]; sensitive {
 		return true