223 lines
11 KiB
Go
223 lines
11 KiB
Go
package middleware
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"net/url"
|
|
"strconv"
|
|
"strings"
|
|
"time"
|
|
|
|
"kra/internal/conf"
|
|
"kra/internal/service"
|
|
"kra/internal/service/dto"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
const ctxOperationAuditPersistFailedKey = "operation_audit_persist_failed"
|
|
|
|
func OperationAudit(runtime *conf.Runtime, recorder *service.AuditRecorder) gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
if runtime == nil || recorder == nil {
|
|
c.Next()
|
|
return
|
|
}
|
|
path := c.Request.URL.Path
|
|
if !recordsOperation(c.Request.Method, path) {
|
|
c.Next()
|
|
return
|
|
}
|
|
var requestBody []byte
|
|
maxBytes := 1024
|
|
if config := runtime.Admin(); config != nil && config.Zap != nil && config.Zap.AccessLogMaxBytes > 0 {
|
|
maxBytes = int(config.Zap.AccessLogMaxBytes)
|
|
}
|
|
if c.Request.Method == http.MethodGet {
|
|
requestBody = operationQueryBody(c.Request.URL.RawQuery)
|
|
} else if value, ok := c.Get(ctxReqBodyKey); ok {
|
|
requestBody = []byte(stringValue(value))
|
|
} else if c.Request.Body != nil {
|
|
// Fallback for tests or custom middleware chains that omit AccessLog.
|
|
if strings.Contains(c.GetHeader("Content-Type"), "multipart/form-data") {
|
|
requestBody = []byte("[文件]")
|
|
} else {
|
|
limited := http.MaxBytesReader(c.Writer, c.Request.Body, defaultRequestBodyLimit)
|
|
var err error
|
|
requestBody, err = io.ReadAll(limited)
|
|
if err != nil {
|
|
var tooLarge *http.MaxBytesError
|
|
if errors.As(err, &tooLarge) {
|
|
c.AbortWithStatus(http.StatusRequestEntityTooLarge)
|
|
} else {
|
|
c.AbortWithStatus(http.StatusBadRequest)
|
|
}
|
|
return
|
|
}
|
|
c.Request.Body = io.NopCloser(bytes.NewReader(requestBody))
|
|
}
|
|
}
|
|
// The reference middleware captures up to the global 1 MiB response
|
|
// safety limit and only applies the configured operation-log limit when a
|
|
// download response is recorded. Using maxBytes here would silently
|
|
// truncate ordinary JSON responses before that decision is possible.
|
|
started := time.Now()
|
|
c.Next()
|
|
userID := uint(0)
|
|
if claims := Claims(c); claims != nil {
|
|
userID = claims.ID
|
|
} else if value, err := strconv.ParseUint(c.GetHeader("x-user-id"), 10, 64); err == nil {
|
|
userID = uint(value)
|
|
}
|
|
requestID, _ := c.Get("request_id")
|
|
status := c.Writer.Status()
|
|
responseBody := ""
|
|
if value, ok := c.Get(ctxRespBufferKey); ok {
|
|
if body, bok := value.(*bytes.Buffer); bok {
|
|
responseBody = body.String()
|
|
}
|
|
}
|
|
if isDownloadResponse(c) && len(responseBody) > maxBytes {
|
|
responseBody = "[超出记录长度]"
|
|
}
|
|
errorMessage := c.Errors.ByType(gin.ErrorTypePrivate).String()
|
|
operationBody := operationRequestBody(requestBody, c.GetHeader("Content-Type"), maxBytes)
|
|
if isPaymentIntegrationConfigWrite(c.Request.Method, path) {
|
|
operationBody = paymentConfigSummary(requestBody)
|
|
}
|
|
if err := recorder.RecordOperationRequest(c.Request.Context(), &dto.OperationRecordRequest{IP: c.ClientIP(), Method: c.Request.Method, Path: path, Status: status, LatencyMS: time.Since(started).Milliseconds(), Agent: c.Request.UserAgent(), ErrorMessage: errorMessage, Body: operationBody, Response: responseBody, UserID: userID, RequestID: stringValue(requestID), TraceID: stringValueFromContext(c, "trace_id"), DeviceID: c.GetHeader("X-Device-Id")}); err != nil {
|
|
// Preserve the business response, but expose audit persistence failures
|
|
// to the global access/error logging pipeline.
|
|
c.Set(ctxOperationAuditPersistFailedKey, true)
|
|
_ = c.Error(fmt.Errorf("operation audit persist: %w", err))
|
|
}
|
|
}
|
|
}
|
|
|
|
func operationQueryBody(raw string) []byte {
|
|
parsed, _ := url.ParseQuery(raw)
|
|
values := make(map[string]string, len(parsed))
|
|
for key, items := range parsed {
|
|
if len(items) > 0 {
|
|
values[key] = items[len(items)-1]
|
|
}
|
|
}
|
|
body, _ := json.Marshal(&values)
|
|
return body
|
|
}
|
|
|
|
func operationRequestBody(raw []byte, contentType string, limit int) string {
|
|
if strings.Contains(contentType, "multipart/form-data") {
|
|
return "[文件]"
|
|
}
|
|
text := string(raw)
|
|
if strings.Contains(strings.ToLower(contentType), "json") && text != "" {
|
|
var value any
|
|
if json.Unmarshal(raw, &value) == nil {
|
|
maskOperationBody(value)
|
|
if encoded, err := json.Marshal(value); err == nil {
|
|
text = string(encoded)
|
|
}
|
|
}
|
|
}
|
|
if len(text) > limit {
|
|
return "[超出记录长度]"
|
|
}
|
|
return text
|
|
}
|
|
|
|
func maskOperationBody(value any) {
|
|
switch current := value.(type) {
|
|
case map[string]any:
|
|
for key, item := range current {
|
|
normalized := strings.ToLower(strings.ReplaceAll(strings.ReplaceAll(key, "_", ""), "-", ""))
|
|
if normalized == "password" || normalized == "newpassword" || normalized == "oldpassword" || normalized == "confirmpassword" || normalized == "passwd" || normalized == "pwd" || normalized == "token" || normalized == "accesstoken" || normalized == "refreshtoken" || normalized == "secret" || normalized == "clientsecret" || normalized == "apikey" || normalized == "privatekey" || normalized == "idcard" || normalized == "appkey" || normalized == "mchkey" || normalized == "apiv3key" || normalized == "clientcert" || normalized == "clientkey" || normalized == "platformcert" || normalized == "platformserialno" || normalized == "credentialcode" || normalized == "certfile" || normalized == "keyfile" || normalized == "publickey" || normalized == "rootcert" || normalized == "appcert" || normalized == "webhookid" {
|
|
current[key] = "***"
|
|
continue
|
|
}
|
|
maskOperationBody(item)
|
|
}
|
|
case []any:
|
|
for _, item := range current {
|
|
maskOperationBody(item)
|
|
}
|
|
}
|
|
}
|
|
|
|
func isDownloadResponse(c *gin.Context) bool {
|
|
header := c.Writer.Header()
|
|
return strings.Contains(header.Get("Pragma"), "public") ||
|
|
strings.Contains(header.Get("Expires"), "0") ||
|
|
strings.Contains(header.Get("Cache-Control"), "must-revalidate, post-check=0, pre-check=0") ||
|
|
strings.Contains(header.Get("Content-Type"), "application/force-download") ||
|
|
strings.Contains(header.Get("Content-Type"), "application/octet-stream") ||
|
|
strings.Contains(header.Get("Content-Type"), "application/vnd.ms-excel") ||
|
|
strings.Contains(header.Get("Content-Type"), "application/download") ||
|
|
strings.Contains(header.Get("Content-Disposition"), "attachment") ||
|
|
strings.Contains(header.Get("Content-Transfer-Encoding"), "binary")
|
|
}
|
|
|
|
// recordsOperation mirrors the routes on which operation records are enabled.
|
|
// Matching by suffix keeps the behavior stable when router-prefix is configured.
|
|
func recordsOperation(method, path string) bool {
|
|
for route := range operationRoutes {
|
|
parts := strings.SplitN(route, " ", 2)
|
|
if len(parts) != 2 || parts[0] != method || !operationPathMatches(parts[1], path) {
|
|
continue
|
|
}
|
|
return true
|
|
}
|
|
return false
|
|
}
|
|
|
|
func operationPathMatches(pattern, path string) bool {
|
|
patternParts := strings.Split(strings.Trim(pattern, "/"), "/")
|
|
pathParts := strings.Split(strings.Trim(path, "/"), "/")
|
|
if len(pathParts) < len(patternParts) {
|
|
return false
|
|
}
|
|
pathParts = pathParts[len(pathParts)-len(patternParts):]
|
|
for index, patternPart := range patternParts {
|
|
if strings.HasPrefix(patternPart, "*") {
|
|
return index <= len(pathParts)
|
|
}
|
|
if index >= len(pathParts) || (strings.HasPrefix(patternPart, ":") == false && patternPart != pathParts[index]) {
|
|
return false
|
|
}
|
|
}
|
|
return len(patternParts) == len(pathParts)
|
|
}
|
|
|
|
var operationRoutes = func() map[string]struct{} {
|
|
values := []string{
|
|
"POST /user/admin_register", "POST /user/changePassword", "POST /user/setUserAuthority", "DELETE /user/deleteUser", "PUT /user/setUserInfo", "PUT /user/setSelfInfo", "POST /user/setUserAuthorities", "POST /user/setUserDepartments", "POST /user/setUserPositions", "POST /user/resetPassword", "PUT /user/setSelfSetting",
|
|
"GET /api/getApiGroups", "GET /api/syncApi", "POST /api/ignoreApi", "POST /api/enterSyncApi", "POST /api/createApi", "POST /api/deleteApi", "POST /api/getApiById", "POST /api/updateApi", "DELETE /api/deleteApisByIds", "POST /api/setApiRoles", "POST /casbin/updateCasbin",
|
|
"POST /authority/createAuthority", "POST /authority/deleteAuthority", "PUT /authority/updateAuthority", "POST /authority/copyAuthority", "POST /authority/setDataScope", "POST /authority/setRoleUsers",
|
|
"POST /menu/addBaseMenu", "POST /menu/addMenuAuthority", "POST /menu/deleteBaseMenu", "POST /menu/updateBaseMenu", "POST /menu/setMenuRoles",
|
|
"POST /department/createDepartment", "PUT /department/updateDepartment", "DELETE /department/deleteDepartment", "POST /department/setDepartmentUsers",
|
|
"POST /position/createPosition", "PUT /position/updatePosition", "DELETE /position/deletePosition", "POST /position/setPositionUsers",
|
|
"POST /sysDictionary/createSysDictionary", "DELETE /sysDictionary/deleteSysDictionary", "PUT /sysDictionary/updateSysDictionary", "POST /sysDictionary/importSysDictionary", "GET /sysDictionary/exportSysDictionary",
|
|
"POST /sysDictionaryDetail/createSysDictionaryDetail", "DELETE /sysDictionaryDetail/deleteSysDictionaryDetail", "PUT /sysDictionaryDetail/updateSysDictionaryDetail",
|
|
"POST /sysParams/createSysParams", "DELETE /sysParams/deleteSysParams", "DELETE /sysParams/deleteSysParamsByIds", "PUT /sysParams/updateSysParams",
|
|
"POST /securityConfig/setSecurityConfig", "POST /system/setSystemConfig", "POST /system/reloadSystem",
|
|
"POST /sysApiToken/createApiToken", "POST /sysApiToken/getApiTokenList", "POST /sysApiToken/deleteApiToken",
|
|
"DELETE /sysVersion/deleteSysVersion", "DELETE /sysVersion/deleteSysVersionByIds", "POST /sysVersion/exportVersion", "POST /sysVersion/importVersion",
|
|
"POST /sysExportTemplate/createSysExportTemplate", "DELETE /sysExportTemplate/deleteSysExportTemplate", "DELETE /sysExportTemplate/deleteSysExportTemplateByIds", "PUT /sysExportTemplate/updateSysExportTemplate", "POST /sysExportTemplate/importExcel",
|
|
"DELETE /sysError/deleteSysError", "DELETE /sysError/deleteSysErrorByIds", "PUT /sysError/updateSysError",
|
|
"DELETE /sysLoginLog/deleteLoginLog", "DELETE /sysLoginLog/deleteLoginLogByIds", "DELETE /dataAccessLog/deleteDataAccessLogByIds",
|
|
"POST /timedTask/createTimedTask", "PUT /timedTask/updateTimedTask", "DELETE /timedTask/deleteTimedTask", "POST /timedTask/toggleTimedTask", "POST /timedTask/triggerTimedTask",
|
|
"POST /info/createInfo", "DELETE /info/deleteInfo", "DELETE /info/deleteInfoByIds", "PUT /info/updateInfo", "POST /email/emailTest", "POST /email/sendEmail",
|
|
"PUT /integration/configs/:kind/:provider", "POST /integration/configs/:kind/:provider/test", "DELETE /integration/configs/:kind/:provider",
|
|
"POST /payment/create", "POST /payment/query", "POST /payment/refund", "POST /payment/orders/:provider/:tradeNo/refund", "POST /payment/fulfill", "POST /payment/orders/:provider/:tradeNo/fulfill", "POST /payment/providers/:provider/test",
|
|
}
|
|
out := make(map[string]struct{}, len(values))
|
|
for _, value := range values {
|
|
out[value] = struct{}{}
|
|
}
|
|
return out
|
|
}()
|