fix: 完成商务迁移复核与接口优化并清理历史资料

internal/server/middleware/payment_audit_test.go

@@ -59,3 +59,16 @@ func TestPaymentIntegrationConfigUsesRouteLevelSummary(t *testing.T) {
 		t.Fatal("payment test route was not recognized as sensitive")
 	}
 }
+
+func TestCertificateAliasesAreRedactedInNestedPayloads(t *testing.T) {
+	raw := []byte(`{"config":{"app_cert_content":"secret-cert","keys":[{"key_content":"secret-key"}],"cert_path":"private-file","template_content":"keep"}}`)
+	got := redactJSON(raw, "application/json", 4096)
+	for _, secret := range []string{"secret-cert", "secret-key", "private-file"} {
+		if strings.Contains(got, secret) {
+			t.Fatalf("certificate alias leaked: %s", got)
+		}
+	}
+	if !strings.Contains(got, `"template_content":"keep"`) {
+		t.Fatal("ordinary content was masked")
+	}
+}

internal/server/middleware/redact.go

@@ -1,6 +1,9 @@
 package middleware
 
-import "strings"
+import (
+	"kra/internal/biz/integration"
+	"strings"
+)
 
 // redactedValue replaces a sensitive value in every log line and audit record.
 const redactedValue = "***"
@@ -36,6 +39,9 @@ func isSensitiveHeader(key string) bool {
 // isSensitivePayloadKey also matches every key ending in "token" so provider
 // specific token names stay masked without being enumerated.
 func isSensitivePayloadKey(key string) bool {
+	if integration.IsIntegrationSecretKey(key) {
+		return true
+	}
 	normalized := strings.ToLower(strings.ReplaceAll(strings.ReplaceAll(key, "_", ""), "-", ""))
 	if _, sensitive := sensitivePayloadKeys[normalized]; sensitive {
 		return true