优化结构

internal/server/middleware/audit.go

@@ -135,12 +135,24 @@ func operationRequestBody(raw []byte, contentType string, limit int) string {
 	return text
 }
 
+// operationSecretKeys holds the normalized JSON keys whose values never reach
+// the operation record. Keys are compared after lowercasing and stripping
+// separators, so "new_password" and "newPassword" both match "newpassword".
+var operationSecretKeys = map[string]struct{}{
+	"password": {}, "newpassword": {}, "oldpassword": {}, "confirmpassword": {},
+	"passwd": {}, "pwd": {}, "token": {}, "accesstoken": {}, "refreshtoken": {},
+	"secret": {}, "clientsecret": {}, "apikey": {}, "privatekey": {}, "idcard": {},
+	"appkey": {}, "mchkey": {}, "apiv3key": {}, "clientcert": {}, "clientkey": {},
+	"platformcert": {}, "platformserialno": {}, "credentialcode": {}, "certfile": {},
+	"keyfile": {}, "publickey": {}, "rootcert": {}, "appcert": {}, "webhookid": {},
+}
+
 func maskOperationBody(value any) {
 	switch current := value.(type) {
 	case map[string]any:
 		for key, item := range current {
 			normalized := strings.ToLower(strings.ReplaceAll(strings.ReplaceAll(key, "_", ""), "-", ""))
-			if normalized == "password" || normalized == "newpassword" || normalized == "oldpassword" || normalized == "confirmpassword" || normalized == "passwd" || normalized == "pwd" || normalized == "token" || normalized == "accesstoken" || normalized == "refreshtoken" || normalized == "secret" || normalized == "clientsecret" || normalized == "apikey" || normalized == "privatekey" || normalized == "idcard" || normalized == "appkey" || normalized == "mchkey" || normalized == "apiv3key" || normalized == "clientcert" || normalized == "clientkey" || normalized == "platformcert" || normalized == "platformserialno" || normalized == "credentialcode" || normalized == "certfile" || normalized == "keyfile" || normalized == "publickey" || normalized == "rootcert" || normalized == "appcert" || normalized == "webhookid" {
+			if _, secret := operationSecretKeys[normalized]; secret {
 				current[key] = "***"
 				continue
 			}
@@ -153,21 +165,26 @@ func maskOperationBody(value any) {
 	}
 }
 
-func isDownloadResponse(c *gin.Context) bool {
-	header := c.Writer.Header()
-	return strings.Contains(header.Get("Pragma"), "public") ||
-		strings.Contains(header.Get("Expires"), "0") ||
-		strings.Contains(header.Get("Cache-Control"), "must-revalidate, post-check=0, pre-check=0") ||
-		strings.Contains(header.Get("Content-Type"), "application/force-download") ||
-		strings.Contains(header.Get("Content-Type"), "application/octet-stream") ||
-		strings.Contains(header.Get("Content-Type"), "application/vnd.ms-excel") ||
-		strings.Contains(header.Get("Content-Type"), "application/download") ||
-		strings.Contains(header.Get("Content-Disposition"), "attachment") ||
-		strings.Contains(header.Get("Content-Transfer-Encoding"), "binary")
+// operationDownloadHeaders lists the response headers whose presence marks a
+// download: the value is the substring that identifies it.
+var operationDownloadHeaders = [...]struct{ header, marker string }{
+	{"Pragma", "public"},
+	{"Expires", "0"},
+	{"Cache-Control", "must-revalidate, post-check=0, pre-check=0"},
+	{"Content-Type", "application/force-download"},
+	{"Content-Type", "application/octet-stream"},
+	{"Content-Type", "application/vnd.ms-excel"},
+	{"Content-Type", "application/download"},
+	{"Content-Disposition", "attachment"},
+	{"Content-Transfer-Encoding", "binary"},
 }
 
-// recordsOperation remains as a small compatibility helper for tests and
-// custom middleware chains that do not have a Gin context.
-func recordsOperation(method, path string) bool {
-	return routecatalog.ShouldAudit(method, path)
+func isDownloadResponse(c *gin.Context) bool {
+	header := c.Writer.Header()
+	for _, candidate := range operationDownloadHeaders {
+		if strings.Contains(header.Get(candidate.header), candidate.marker) {
+			return true
+		}
+	}
+	return false
 }