优化结构

internal/server/middleware/access_log.go

@@ -31,7 +31,7 @@ func AccessLog(runtime *config.Store, logger *slog.Logger, version string) gin.H
 		started := time.Now()
 		var requestBody []byte
 		multipart := strings.Contains(c.GetHeader("Content-Type"), "multipart/form-data")
-		mediaUpload := multipart && isMediaUploadRoute(c.FullPath())
+		mediaUpload := multipart && routecatalog.BodyPolicyFor(c.Request.Method, c.Request.URL.Path) == routecatalog.BodyPolicyUpload
 		var admin *config.Admin
 		if runtime != nil {
 			if snapshot := runtime.Snapshot(); snapshot != nil {
@@ -170,11 +170,6 @@ func AccessLog(runtime *config.Store, logger *slog.Logger, version string) gin.H
 	}
 }
 
-func isMediaUploadRoute(route string) bool {
-	return strings.HasSuffix(route, "/fileUploadAndDownload/upload") ||
-		strings.HasSuffix(route, "/mediaUpload/chunk")
-}
-
 func paymentCallbackProvider(path string) string {
 	parts := strings.Split(strings.Trim(path, "/"), "/")
 	for index := 0; index+2 < len(parts); index++ {

internal/server/middleware/audit.go

@@ -80,7 +80,7 @@ func OperationAudit(runtime *config.Store, recorder *systemservice.AuditRecorder
 		responseBody := ""
 		if value, ok := c.Get(ctxRespBufferKey); ok {
 			if body, bok := value.(*bytes.Buffer); bok {
-				responseBody = body.String()
+				responseBody = redactJSON(body.Bytes(), c.Writer.Header().Get("Content-Type"), maxBytes)
 			}
 		}
 		if isDownloadResponse(c) && len(responseBody) > maxBytes {

internal/server/middleware/payment_audit_test.go

@@ -9,7 +9,7 @@ import (
 )
 
 func TestPaymentIntegrationSecretsAreRedacted(t *testing.T) {
-	raw := []byte(`{"enabled":true,"config":{"app_id":"app","mch_key":"merchant-secret","api_v3_key":"v3-secret","client_cert":"certificate","client_key":"private-key","platform_cert":"platform-certificate","credential_code":"credential","webhook_id":"webhook"}}`)
+	raw := []byte(`{"enabled":true,"config":{"app_id":"app","mch_key":"merchant-secret","api_v3_key":"v3-secret","client_cert":"certificate","client_key":"private-key","platform_cert":"platform-certificate","credential_code":"credential","webhook_id":"webhook","key":"institution-secret","public_cert":"public-certificate","signing_key":"jwt-secret","secret_key":"cloud-secret"}}`)
 	redacted := redactJSON(raw, "application/json", 4096)
 	var payload struct {
 		Config map[string]string `json:"config"`
@@ -17,7 +17,7 @@ func TestPaymentIntegrationSecretsAreRedacted(t *testing.T) {
 	if err := json.Unmarshal([]byte(redacted), &payload); err != nil {
 		t.Fatalf("decode redacted payload: %v", err)
 	}
-	for _, key := range []string{"mch_key", "api_v3_key", "client_cert", "client_key", "platform_cert", "credential_code", "webhook_id"} {
+	for _, key := range []string{"mch_key", "api_v3_key", "client_cert", "client_key", "platform_cert", "credential_code", "webhook_id", "key", "public_cert", "signing_key", "secret_key"} {
 		if payload.Config[key] != "***" {
 			t.Fatalf("payment secret %q was not redacted: %s", key, redacted)
 		}
@@ -55,4 +55,7 @@ func TestPaymentIntegrationConfigUsesRouteLevelSummary(t *testing.T) {
 	if routecatalog.BodyPolicyFor("PUT", "/api/integration/configs/mq/emqx") == routecatalog.BodyPolicyPaymentConfig {
 		t.Fatal("non-payment integration was treated as payment configuration")
 	}
+	if routecatalog.BodyPolicyFor("POST", "/api/integration/configs/payment/saobei/test") != routecatalog.BodyPolicyPaymentConfig {
+		t.Fatal("payment test route was not recognized as sensitive")
+	}
 }

internal/server/middleware/redact.go

@@ -19,8 +19,9 @@ var sensitivePayloadKeys = map[string]struct{}{
 	"password": {}, "newpassword": {}, "oldpassword": {}, "confirmpassword": {},
 	"passwd": {}, "pwd": {}, "token": {}, "accesstoken": {}, "refreshtoken": {},
 	"secret": {}, "clientsecret": {}, "apikey": {}, "privatekey": {}, "idcard": {},
+	"key": {}, "signingkey": {}, "secretkey": {},
 	"appkey": {}, "mchkey": {}, "apiv3key": {}, "clientcert": {}, "clientkey": {},
-	"platformcert": {}, "platformserialno": {}, "credentialcode": {}, "certfile": {},
+	"platformcert": {}, "platformserialno": {}, "publiccert": {}, "credentialcode": {}, "certfile": {},
 	"keyfile": {}, "publickey": {}, "rootcert": {}, "appcert": {}, "webhookid": {},
 	"authorization": {},
 }