kra-new/internal/server/middleware/audit.go

package middleware

import (
	"bytes"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"net/http"
	"net/url"
	"strconv"
	"strings"
	"time"

	"kra/internal/config"
	"kra/internal/routecatalog"
	"kra/internal/service"
	"kra/internal/service/dto"

	"github.com/gin-gonic/gin"
)

const ctxOperationAuditPersistFailedKey = "operation_audit_persist_failed"

func OperationAudit(runtime *config.Store, recorder *service.AuditRecorder) gin.HandlerFunc {
	return func(c *gin.Context) {
		if runtime == nil || recorder == nil {
			c.Next()
			return
		}
		routePath := c.FullPath()
		if routePath == "" {
			routePath = c.Request.URL.Path
		}
		path := c.Request.URL.Path
		if !routecatalog.ShouldAudit(c.Request.Method, routePath) {
			c.Next()
			return
		}
		var requestBody []byte
		maxBytes := 1024
		if snapshot := runtime.Snapshot(); snapshot != nil && snapshot.Admin != nil && snapshot.Admin.Zap != nil && snapshot.Admin.Zap.AccessLogMaxBytes > 0 {
			maxBytes = snapshot.Admin.Zap.AccessLogMaxBytes
		}
		if c.Request.Method == http.MethodGet {
			requestBody = operationQueryBody(c.Request.URL.RawQuery)
		} else if value, ok := c.Get(ctxReqBodyKey); ok {
			requestBody = []byte(stringValue(value))
		} else if c.Request.Body != nil {
			// Fallback for tests or custom middleware chains that omit AccessLog.
			if strings.Contains(c.GetHeader("Content-Type"), "multipart/form-data") {
				requestBody = []byte("[文件]")
			} else {
				limited := http.MaxBytesReader(c.Writer, c.Request.Body, defaultRequestBodyLimit)
				var err error
				requestBody, err = io.ReadAll(limited)
				if err != nil {
					var tooLarge *http.MaxBytesError
					if errors.As(err, &tooLarge) {
						c.AbortWithStatus(http.StatusRequestEntityTooLarge)
					} else {
						c.AbortWithStatus(http.StatusBadRequest)
					}
					return
				}
				c.Request.Body = io.NopCloser(bytes.NewReader(requestBody))
			}
		}
		// The reference middleware captures up to the global 1 MiB response
		// safety limit and only applies the configured operation-log limit when a
		// download response is recorded. Using maxBytes here would silently
		// truncate ordinary JSON responses before that decision is possible.
		started := time.Now()
		c.Next()
		userID := uint(0)
		if claims := Claims(c); claims != nil {
			userID = claims.ID
		} else if value, err := strconv.ParseUint(c.GetHeader("x-user-id"), 10, 64); err == nil {
			userID = uint(value)
		}
		requestID, _ := c.Get("request_id")
		status := c.Writer.Status()
		responseBody := ""
		if value, ok := c.Get(ctxRespBufferKey); ok {
			if body, bok := value.(*bytes.Buffer); bok {
				responseBody = body.String()
			}
		}
		if isDownloadResponse(c) && len(responseBody) > maxBytes {
			responseBody = "[超出记录长度]"
		}
		errorMessage := c.Errors.ByType(gin.ErrorTypePrivate).String()
		operationBody := operationRequestBody(requestBody, c.GetHeader("Content-Type"), maxBytes)
		if routecatalog.BodyPolicyFor(c.Request.Method, path) == routecatalog.BodyPolicyPaymentConfig {
			operationBody = paymentConfigSummary(requestBody)
		}
		if err := recorder.RecordOperationRequest(c.Request.Context(), &dto.OperationRecordRequest{IP: c.ClientIP(), Method: c.Request.Method, Path: path, Status: status, LatencyMS: time.Since(started).Milliseconds(), Agent: c.Request.UserAgent(), ErrorMessage: errorMessage, Body: operationBody, Response: responseBody, UserID: userID, RequestID: stringValue(requestID), TraceID: stringValueFromContext(c, "trace_id"), DeviceID: c.GetHeader("X-Device-Id")}); err != nil {
			// Preserve the business response, but expose audit persistence failures
			// to the global access/error logging pipeline.
			c.Set(ctxOperationAuditPersistFailedKey, true)
			_ = c.Error(fmt.Errorf("operation audit persist: %w", err))
		}
	}
}

func operationQueryBody(raw string) []byte {
	parsed, _ := url.ParseQuery(raw)
	values := make(map[string]string, len(parsed))
	for key, items := range parsed {
		if len(items) > 0 {
			values[key] = items[len(items)-1]
		}
	}
	body, _ := json.Marshal(&values)
	return body
}

func operationRequestBody(raw []byte, contentType string, limit int) string {
	if strings.Contains(contentType, "multipart/form-data") {
		return "[文件]"
	}
	text := string(raw)
	if strings.Contains(strings.ToLower(contentType), "json") && text != "" {
		var value any
		if json.Unmarshal(raw, &value) == nil {
			maskOperationBody(value)
			if encoded, err := json.Marshal(value); err == nil {
				text = string(encoded)
			}
		}
	}
	if len(text) > limit {
		return "[超出记录长度]"
	}
	return text
}

func maskOperationBody(value any) {
	switch current := value.(type) {
	case map[string]any:
		for key, item := range current {
			normalized := strings.ToLower(strings.ReplaceAll(strings.ReplaceAll(key, "_", ""), "-", ""))
			if normalized == "password" || normalized == "newpassword" || normalized == "oldpassword" || normalized == "confirmpassword" || normalized == "passwd" || normalized == "pwd" || normalized == "token" || normalized == "accesstoken" || normalized == "refreshtoken" || normalized == "secret" || normalized == "clientsecret" || normalized == "apikey" || normalized == "privatekey" || normalized == "idcard" || normalized == "appkey" || normalized == "mchkey" || normalized == "apiv3key" || normalized == "clientcert" || normalized == "clientkey" || normalized == "platformcert" || normalized == "platformserialno" || normalized == "credentialcode" || normalized == "certfile" || normalized == "keyfile" || normalized == "publickey" || normalized == "rootcert" || normalized == "appcert" || normalized == "webhookid" {
				current[key] = "***"
				continue
			}
			maskOperationBody(item)
		}
	case []any:
		for _, item := range current {
			maskOperationBody(item)
		}
	}
}

func isDownloadResponse(c *gin.Context) bool {
	header := c.Writer.Header()
	return strings.Contains(header.Get("Pragma"), "public") ||
		strings.Contains(header.Get("Expires"), "0") ||
		strings.Contains(header.Get("Cache-Control"), "must-revalidate, post-check=0, pre-check=0") ||
		strings.Contains(header.Get("Content-Type"), "application/force-download") ||
		strings.Contains(header.Get("Content-Type"), "application/octet-stream") ||
		strings.Contains(header.Get("Content-Type"), "application/vnd.ms-excel") ||
		strings.Contains(header.Get("Content-Type"), "application/download") ||
		strings.Contains(header.Get("Content-Disposition"), "attachment") ||
		strings.Contains(header.Get("Content-Transfer-Encoding"), "binary")
}

// recordsOperation remains as a small compatibility helper for tests and
// custom middleware chains that do not have a Gin context.
func recordsOperation(method, path string) bool {
	return routecatalog.ShouldAudit(method, path)
}