优化

internal/biz/authentication.go

@@ -111,6 +111,10 @@ func (uc *AuthenticationUsecase) Login(ctx context.Context, attempt *LoginAttemp
 	if err != nil {
 		return nil, fmt.Errorf("%w: %v", ErrTokenIssue, err)
 	}
+	// Record a successful credential login immediately after issuing the JWT.
+	// Multipoint-session persistence happens afterwards, so a Redis/cache
+	// failure must not erase the successful-login audit event.
+	uc.recordLogin(ctx, attempt, true, "登录成功", user.ID)
 	if uc.security.UseMultipoint() {
 		oldToken, cacheErr := uc.security.ActiveToken(ctx, user.Username)
 		if cacheErr != nil {
@@ -123,7 +127,6 @@ func (uc *AuthenticationUsecase) Login(ctx context.Context, attempt *LoginAttemp
 			return nil, fmt.Errorf("%w: %v", ErrLoginState, cacheErr)
 		}
 	}
-	uc.recordLogin(ctx, attempt, true, "登录成功", user.ID)
 	return &AuthenticationResult{User: user, Token: issued.Value, ExpiresAt: issued.ExpiresAt, NeedChangePassword: user.MustChangePassword}, nil
 }
 

internal/biz/authentication_test.go

@@ -0,0 +1,79 @@
+package biz
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+type authenticationUserRepo struct {
+	UserRepo
+	user *User
+}
+
+func (r *authenticationUserRepo) FindUserByUsername(context.Context, string) (*User, error) {
+	return r.user, nil
+}
+
+type authenticationSecurityRepo struct{ SecurityRepo }
+
+func (*authenticationSecurityRepo) SecurityConfig(context.Context) (*SecurityConfig, error) {
+	return &SecurityConfig{CaptchaOpen: 2, CaptchaTimeout: 60}, nil
+}
+
+type authenticationCache struct{ activeErr error }
+
+func (c *authenticationCache) Get(_ context.Context, key string) (string, bool, error) {
+	if key == "admin" {
+		return "", false, c.activeErr
+	}
+	return "", false, nil
+}
+func (*authenticationCache) Set(context.Context, string, string, time.Duration) error { return nil }
+func (*authenticationCache) Delete(context.Context, string) error                     { return nil }
+func (*authenticationCache) Increment(context.Context, string, time.Duration) (int64, error) {
+	return 1, nil
+}
+
+type authenticationSettings struct{ RuntimeSettings }
+
+func (*authenticationSettings) UseMultipoint() bool { return true }
+
+type authenticationIssuer struct{ TokenIssuer }
+
+func (*authenticationIssuer) IssueToken(*User, uint, bool, time.Duration) (*IssuedToken, error) {
+	return &IssuedToken{Value: "token", ExpiresAt: time.Now().Add(time.Hour), TTL: time.Hour}, nil
+}
+
+type authenticationAudit struct {
+	AuditRecordRepo
+	logins []*LoginLog
+}
+
+func (a *authenticationAudit) RecordLogin(_ context.Context, value *LoginLog) error {
+	a.logins = append(a.logins, value)
+	return nil
+}
+
+func TestLoginRecordsSuccessBeforeMultipointCacheFailure(t *testing.T) {
+	hash, err := bcrypt.GenerateFromPassword([]byte("secret"), bcrypt.MinCost)
+	if err != nil {
+		t.Fatal(err)
+	}
+	users := NewUserUsecase(&authenticationUserRepo{user: &User{ID: 1, Username: "admin", Password: string(hash), AuthorityID: 888, Enable: 1}})
+	cacheErr := errors.New("cache unavailable")
+	security := NewSecurityUsecase(&authenticationSecurityRepo{}, &authenticationCache{activeErr: cacheErr}, &authenticationSettings{}, nil)
+	audit := &authenticationAudit{}
+	uc := NewAuthenticationUsecase(users, security, &authenticationIssuer{}, audit)
+
+	_, err = uc.Login(context.Background(), &LoginAttempt{Username: "admin", Password: "secret", IP: "127.0.0.1", Agent: "test"})
+	if !errors.Is(err, ErrLoginState) {
+		t.Fatalf("expected login-state failure, got %v", err)
+	}
+	if len(audit.logins) != 1 || !audit.logins[0].Status || audit.logins[0].ErrorMessage != "登录成功" || audit.logins[0].UserID != 1 {
+		t.Fatalf("expected successful login audit before cache failure, got %+v", audit.logins)
+	}
+}

internal/biz/department.go

@@ -15,7 +15,7 @@ type Department struct {
 	Sort      int
 	LeaderID  uint
 	Leader    *User
-	Status    bool
+	Status    *bool
 	Children  []*Department
 	NamePath  string
 }

internal/biz/media.go

@@ -76,9 +76,14 @@ func (uc *MediaUsecase) Upload(ctx context.Context, userID uint, name, suppliedM
 	}
 	media := &MediaFile{Name: name, CategoryID: categoryID, URL: stored.URL, Tag: strings.TrimPrefix(filepath.Ext(name), "."), Key: key, Size: stored.Size, Mime: suppliedMIME, MD5: hex.EncodeToString(hash.Sum(nil)), UserID: userID}
 	if save {
-		if err = uc.CreateMedia(ctx, media); err != nil {
-			_ = uc.files.Delete(ctx, key)
-			return nil, err
+		count, countErr := uc.MediaKeyReferences(ctx, key)
+		if countErr != nil {
+			return nil, countErr
+		}
+		if count == 0 {
+			if err = uc.CreateMedia(ctx, media); err != nil {
+				return nil, err
+			}
 		}
 	}
 	return media, nil

internal/biz/media_upload.go

@@ -17,6 +17,8 @@ import (
 	"github.com/google/uuid"
 )
 
+var ErrUploadSessionNotFound = errors.New("upload session not found")
+
 func (uc *MediaUsecase) chunkPrefix(uploadID uint) string {
 	directory := "uploads/chunks"
 	if uc.settings != nil {
@@ -44,11 +46,13 @@ func (uc *MediaUsecase) InitUpload(ctx context.Context, userID uint, name, hash
 		}
 	}
 	session, err := uc.FindUploadingSession(ctx, userID, hash)
-	if err != nil {
+	if errors.Is(err, ErrUploadSessionNotFound) {
 		session = &UploadSession{UserID: userID, FileName: name, FileHash: hash, FileSize: size, ChunkSize: chunkSize, ChunkTotal: total, Status: "uploading"}
 		if err = uc.CreateUploadSession(ctx, session); err != nil {
 			return nil, nil, nil, err
 		}
+	} else if err != nil {
+		return nil, nil, nil, err
 	}
 	chunks, err := uc.ListChunks(ctx, session.ID)
 	if err != nil {
@@ -146,7 +150,6 @@ func (uc *MediaUsecase) CompleteUpload(ctx context.Context, userID, uploadID uin
 	// byte count.
 	media := &MediaFile{Name: session.FileName, URL: stored.URL, Tag: strings.TrimPrefix(filepath.Ext(session.FileName), "."), Key: key, Size: session.FileSize, Mime: mime, MD5: hash, UserID: userID}
 	if err = uc.CreateMedia(ctx, media); err != nil {
-		_ = uc.files.Delete(ctx, key)
 		return fail(err)
 	}
 	_ = uc.CompleteUploadSession(ctx, uploadID, key, media.ID)

internal/biz/position.go

@@ -12,7 +12,7 @@ type Position struct {
 	Name      string
 	Code      string
 	Sort      int
-	Status    bool
+	Status    *bool
 	Remark    string
 }
 

internal/data/department.go

@@ -26,7 +26,7 @@ type departmentPO struct {
 	Ancestors string
 	Sort      int
 	LeaderID  uint
-	Status    bool `gorm:"default:true"`
+	Status    *bool `gorm:"default:true"`
 }
 
 func (departmentPO) TableName() string { return "sys_departments" }

internal/data/error_record.go

@@ -35,7 +35,23 @@ func (r *auditRecorderRepo) CreateError(ctx context.Context, v *biz.ErrorRecord)
 	return r.data.gormDB.WithContext(ctx).Create(&errorRecordPO{Form: v.Form, Info: v.Info, Level: v.Level, RequestID: v.RequestID, TraceID: v.TraceID, Solution: v.Solution, Status: v.Status}).Error
 }
 func (r *auditQueryRepo) UpdateError(ctx context.Context, v *biz.ErrorRecord) error {
-	return r.data.gormDB.WithContext(ctx).Model(&errorRecordPO{}).Where("id = ?", v.ID).Updates(map[string]any{"form": v.Form, "info": v.Info, "level": v.Level, "solution": v.Solution, "status": v.Status}).Error
+	updates := make(map[string]any, 5)
+	if v.Form != "" {
+		updates["form"] = v.Form
+	}
+	if v.Info != "" {
+		updates["info"] = v.Info
+	}
+	if v.Level != "" {
+		updates["level"] = v.Level
+	}
+	if v.Solution != "" {
+		updates["solution"] = v.Solution
+	}
+	if v.Status != "" {
+		updates["status"] = v.Status
+	}
+	return r.data.gormDB.WithContext(ctx).Model(&errorRecordPO{}).Where("id = ?", v.ID).Updates(updates).Error
 }
 func (r *auditQueryRepo) DeleteErrors(ctx context.Context, ids []uint) error {
 	return r.data.gormDB.WithContext(ctx).Delete(&errorRecordPO{}, ids).Error

internal/data/media_upload.go

@@ -2,6 +2,7 @@ package data
 
 import (
 	"context"
+	"errors"
 	"time"
 
 	"kra/internal/biz"
@@ -47,6 +48,9 @@ func uploadFromPO(v uploadSessionPO) *biz.UploadSession {
 func (r *mediaRepo) FindCompletedSession(ctx context.Context, userID uint, hash string) (*biz.UploadSession, error) {
 	var po uploadSessionPO
 	if err := r.data.gormDB.WithContext(ctx).Where("user_id = ? AND file_hash = ? AND status = ?", userID, hash, "completed").First(&po).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, biz.ErrUploadSessionNotFound
+		}
 		return nil, err
 	}
 	return uploadFromPO(po), nil
@@ -54,6 +58,9 @@ func (r *mediaRepo) FindCompletedSession(ctx context.Context, userID uint, hash
 func (r *mediaRepo) FindUploadingSession(ctx context.Context, userID uint, hash string) (*biz.UploadSession, error) {
 	var po uploadSessionPO
 	if err := r.data.gormDB.WithContext(ctx).Where("user_id = ? AND file_hash = ? AND status = ?", userID, hash, "uploading").First(&po).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, biz.ErrUploadSessionNotFound
+		}
 		return nil, err
 	}
 	return uploadFromPO(po), nil

internal/data/migrations.go

@@ -35,9 +35,8 @@ func migrateAll(db *gorm.DB) error {
 	return reconcileReferenceIndexes(db)
 }
 
-// Older Kra builds used a status label that is not part of the GVA error-log
-// contract and is therefore rendered as an unknown state by the compatible
-// administration page.
+// Older builds used a status label outside the administration page's supported
+// state set, so normalize existing rows during migration.
 func normalizeErrorRecordStatuses(db *gorm.DB) error {
 	return db.Model(&errorRecordPO{}).Where("status = ?", "未解决").Update("status", "未处理").Error
 }

internal/data/position.go

@@ -22,7 +22,7 @@ type positionPO struct {
 	Name      string         `gorm:"index"`
 	Code      string
 	Sort      int
-	Status    bool `gorm:"default:true"`
+	Status    *bool `gorm:"default:true"`
 	Remark    string
 }
 

internal/data/system_init.go

@@ -174,11 +174,12 @@ func (r *initializationRepo) Initialize(ctx context.Context, input *biz.Database
 				return err
 			}
 		}
-		department := departmentPO{Name: "总公司", ParentID: 0, Ancestors: "0", Sort: 0, Status: true}
+		enabled := true
+		department := departmentPO{Name: "总公司", ParentID: 0, Ancestors: "0", Sort: 0, Status: &enabled}
 		if err := tx.Where("name = ?", department.Name).FirstOrCreate(&department).Error; err != nil {
 			return err
 		}
-		for _, position := range []positionPO{{Name: "总经理", Code: "CEO", Sort: 1, Status: true}, {Name: "普通员工", Code: "STAFF", Sort: 2, Status: true}} {
+		for _, position := range []positionPO{{Name: "总经理", Code: "CEO", Sort: 1, Status: &enabled}, {Name: "普通员工", Code: "STAFF", Sort: 2, Status: &enabled}} {
 			if err := tx.Where("code = ?", position.Code).FirstOrCreate(&position).Error; err != nil {
 				return err
 			}

internal/data/transactions_test.go

@@ -63,6 +63,25 @@ func TestUserAuthorityWritesAreAtomic(t *testing.T) {
 	}
 }
 
+func TestSetUserAuthoritiesRejectsMissingUser(t *testing.T) {
+	data := newTransactionTestData(t)
+	ctx := context.Background()
+	if err := data.gormDB.WithContext(ctx).Create(&authorityPO{AuthorityID: 888, AuthorityName: "admin"}).Error; err != nil {
+		t.Fatal(err)
+	}
+	repo := &userRepo{data: data}
+	if err := repo.SetUserAuthorities(ctx, 999999, []uint{888}); err == nil || err.Error() != "查询用户数据失败" {
+		t.Fatalf("expected the compatible missing-user error, got %v", err)
+	}
+	var links int64
+	if err := data.gormDB.WithContext(ctx).Model(&userAuthorityPO{}).Where("sys_user_id = ?", 999999).Count(&links).Error; err != nil {
+		t.Fatal(err)
+	}
+	if links != 0 {
+		t.Fatalf("unexpected authority links for missing user: %d", links)
+	}
+}
+
 func TestDictionaryImportKeepsHierarchyInOneTransaction(t *testing.T) {
 	data := newTransactionTestData(t)
 	ctx := context.Background()

internal/data/user.go

@@ -486,6 +486,10 @@ func (r *userRepo) ListAuthorities(ctx context.Context) ([]*biz.Authority, error
 
 func (r *userRepo) SetUserAuthorities(ctx context.Context, id uint, authorityIDs []uint) error {
 	return r.data.gormDB.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		var user userPO
+		if err := tx.Where("id = ?", id).First(&user).Error; err != nil {
+			return errors.New("查询用户数据失败")
+		}
 		access := &authorityAccessRepo{data: r.data}
 		for _, authorityID := range authorityIDs {
 			if err := access.checkAuthorityIDAuth(ctx, authorityID); err != nil {

internal/server/gin.go

@@ -6,6 +6,7 @@ import (
 	"net/http"
 	"os"
 	"path"
+	"sort"
 	"strings"
 	"time"
 
@@ -20,10 +21,10 @@ import (
 	kratoshttp "github.com/go-kratos/kratos/v3/transport/http"
 )
 
-func NewGinEngine(runtime *conf.Runtime, access *service.AccessControlService, handlers *handler.Set, auth *service.AuthService, security *service.SecurityService, audit *service.AuditRecorder, logger *slog.Logger) *gin.Engine {
+func NewGinEngine(runtime *conf.Runtime, access *service.AccessControlService, handlers *handler.Set, auth *service.AuthService, security *service.SecurityService, audit *service.AuditRecorder, logger *slog.Logger, version string) *gin.Engine {
 	gin.SetMode(gin.ReleaseMode)
 	engine := gin.New()
-	engine.Use(servermiddleware.RequestMeta(), servermiddleware.Recovery(audit, logger), servermiddleware.AccessLog(runtime, logger), servermiddleware.ErrorAudit(audit), servermiddleware.SecurityRateLimit(security))
+	engine.Use(servermiddleware.RequestMeta(), servermiddleware.Recovery(audit, logger), servermiddleware.AccessLog(runtime, logger, version), servermiddleware.CORS(runtime), servermiddleware.ErrorAudit(audit), servermiddleware.SecurityRateLimit(security))
 
 	prefix := ""
 	config := runtime.Admin()
@@ -66,9 +67,28 @@ func NewGinEngine(runtime *conf.Runtime, access *service.AccessControlService, h
 		}
 		httpx.Fail(c, "请求的接口不存在")
 	})
+	logRegisteredRoutes(engine, logger)
 	return engine
 }
 
+func logRegisteredRoutes(engine *gin.Engine, logger *slog.Logger) {
+	if logger == nil {
+		return
+	}
+	routes := append([]gin.RouteInfo(nil), engine.Routes()...)
+	sort.Slice(routes, func(i, j int) bool {
+		if routes[i].Path == routes[j].Path {
+			return routes[i].Method < routes[j].Method
+		}
+		return routes[i].Path < routes[j].Path
+	})
+	systemLogger := logger.With("mod", "system")
+	for _, route := range routes {
+		systemLogger.Info("router registered", "method", route.Method, "path", route.Path)
+	}
+	systemLogger.Info("router register success", "route_count", len(routes))
+}
+
 func NewGinServer(c *conf.Server, engine *gin.Engine) *kratoshttp.Server {
 	network, address := "tcp", ":8000"
 	if c != nil && c.Http != nil {

internal/server/gin_test.go

@@ -0,0 +1,33 @@
+package server
+
+import (
+	"testing"
+
+	"kra/internal/conf"
+	"kra/internal/server/handler"
+)
+
+func TestGinRouteContract(t *testing.T) {
+	handlers := &handler.Set{
+		Authority: &handler.Authority{}, Menu: &handler.Menu{}, API: &handler.API{},
+		Permission: &handler.Permission{}, Organization: &handler.Organization{},
+		Announcement: &handler.Announcement{}, Email: &handler.Email{}, Task: &handler.Task{},
+		Media: &handler.Media{}, Audit: &handler.Audit{}, Export: &handler.Export{},
+		Version: &handler.Version{}, Dictionary: &handler.Dictionary{}, Parameter: &handler.Parameter{},
+		APIToken: &handler.APIToken{}, SystemConfig: &handler.SystemConfig{}, Public: &handler.Public{},
+		User: &handler.User{}, Navigation: &handler.Navigation{}, Session: &handler.Session{},
+	}
+	engine := NewGinEngine(conf.NewRuntime(nil, &conf.AdminBackend{}), nil, handlers, nil, nil, nil, nil, "test")
+	routes := engine.Routes()
+	if len(routes) != 177 {
+		t.Fatalf("route contract changed: got %d routes, want 177", len(routes))
+	}
+	seen := make(map[string]struct{}, len(routes))
+	for _, route := range routes {
+		key := route.Method + " " + route.Path
+		if _, exists := seen[key]; exists {
+			t.Fatalf("duplicate route %s", key)
+		}
+		seen[key] = struct{}{}
+	}
+}

internal/server/handler/audit.go

@@ -3,6 +3,7 @@ package handler
 import (
 	"errors"
 	"io"
+	"log/slog"
 	"strconv"
 	"time"
 
@@ -18,10 +19,11 @@ type Audit struct {
 	service  *service.AuditService
 	recorder *service.AuditRecorder
 	logs     *service.LogViewerService
+	logger   *slog.Logger
 }
 
-func NewAudit(service *service.AuditService, recorder *service.AuditRecorder, logs *service.LogViewerService) *Audit {
-	return &Audit{service: service, recorder: recorder, logs: logs}
+func NewAudit(service *service.AuditService, recorder *service.AuditRecorder, logs *service.LogViewerService, logger *slog.Logger) *Audit {
+	return &Audit{service: service, recorder: recorder, logs: logs, logger: logger}
 }
 
 func page(c *gin.Context) (int, int) {
@@ -53,8 +55,8 @@ func IDsFromQuery(c *gin.Context) []uint {
 	return ids
 }
 
-// auditID accepts both forms used by the GVA web client over time: DELETE
-// requests may carry the identifier in the query string or in a JSON body.
+// auditID accepts both DELETE encodings supported by the administration API:
+// the identifier may be carried in the query string or in a JSON body.
 func auditID(c *gin.Context) (uint, error) {
 	if raw := c.Query("ID"); raw != "" {
 		value, err := strconv.ParseUint(raw, 10, 64)
@@ -68,7 +70,7 @@ func auditID(c *gin.Context) (uint, error) {
 }
 
 // auditIDs mirrors auditID for bulk deletes and supports both query-array and
-// JSON-body encodings used by compatible GVA pages.
+// JSON-body encodings used by compatible administration pages.
 func auditIDs(c *gin.Context) ([]uint, error) {
 	if ids := IDsFromQuery(c); len(ids) > 0 {
 		return ids, nil
@@ -230,7 +232,7 @@ func (h *Audit) LogDates(c *gin.Context) {
 	}
 	data, err := h.logs.LogDates(c.Request.Context(), month)
 	if err != nil {
-		failLogViewer(c, err)
+		failLogViewer(c, err, h.logger)
 		return
 	}
 	httpx.Write(c, httpx.CodeSuccess, data, "获取成功")
@@ -243,7 +245,7 @@ func (h *Audit) LogFiles(c *gin.Context) {
 	}
 	data, err := h.logs.LogFiles(c.Request.Context(), date)
 	if err != nil {
-		failLogViewer(c, err)
+		failLogViewer(c, err, h.logger)
 		return
 	}
 	httpx.Write(c, httpx.CodeSuccess, data, "获取成功")
@@ -267,13 +269,16 @@ func (h *Audit) LogContent(c *gin.Context) {
 	// "日志文件路径不合法" error rather than rejecting them as binding errors.
 	data, err := h.logs.LogContent(c.Request.Context(), date, path, cursor)
 	if err != nil {
-		failLogViewer(c, err)
+		failLogViewer(c, err, h.logger)
 		return
 	}
 	httpx.Write(c, httpx.CodeSuccess, data, "获取成功")
 }
 
-func failLogViewer(c *gin.Context, err error) {
+func failLogViewer(c *gin.Context, err error, logger *slog.Logger) {
+	if logger != nil {
+		logger.ErrorContext(c.Request.Context(), "日志查看失败", "mod", "log-viewer", "error", err)
+	}
 	message := "读取日志失败"
 	switch {
 	case errors.Is(err, biz.ErrInvalidLogMonth):

internal/server/handler/dictionary.go

@@ -149,6 +149,10 @@ func (h *Dictionary) FindDetail(c *gin.Context) {
 		httpx.Fail(c, err.Error())
 		return
 	}
+	if req.ID == 0 {
+		httpx.Fail(c, "ID值不能为空")
+		return
+	}
 	item, err := h.service.DictionaryDetail(c.Request.Context(), req.ID)
 	if err != nil {
 		httpx.Fail(c, "查询失败")

internal/server/middleware/access_log.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"io"
 	"log/slog"
+	"net/http"
 	"strings"
 	"time"
 
@@ -14,38 +15,42 @@ import (
 
 // AccessLog is the single global request/response capture point, matching
 // the reference middleware ordering and making every HTTP request observable.
-func AccessLog(runtime *conf.Runtime, logger *slog.Logger) gin.HandlerFunc {
+func AccessLog(runtime *conf.Runtime, logger *slog.Logger, version string) gin.HandlerFunc {
 	return func(c *gin.Context) {
+		started := time.Now()
 		var requestBody []byte
 		multipart := strings.Contains(c.GetHeader("Content-Type"), "multipart/form-data")
+		bytesIn := c.Request.ContentLength
 		if c.Request.Body != nil && !multipart {
 			requestBody, _ = io.ReadAll(c.Request.Body)
 			c.Request.Body = io.NopCloser(bytes.NewReader(requestBody))
+			bytesIn = int64(len(requestBody))
+		}
+		if bytesIn < 0 {
+			bytesIn = 0
 		}
 		maxBytes := 1 << 20
 		writer := &captureWriter{ResponseWriter: c.Writer, maxBytes: maxBytes}
 		c.Writer = writer
-		started := time.Now()
+		c.Header("X-Kra-Version", version)
+		config := runtime.Admin()
+		logLimit := 1024
+		if config != nil && config.Zap != nil && config.Zap.AccessLogMaxBytes > 0 {
+			logLimit = int(config.Zap.AccessLogMaxBytes)
+		}
+		requestText := ""
+		if multipart {
+			requestText = "[文件]"
+		} else {
+			requestText = redactJSON(requestBody, c.GetHeader("Content-Type"), logLimit)
+		}
+		c.Set(ctxReqBodyKey, requestText)
+		c.Set(ctxRespBufferKey, &writer.body)
 		c.Next()
 		if logger == nil {
 			return
 		}
-		requestText, responseText := "", ""
-		config := runtime.Admin()
-		logLimit := 32768
-		if config != nil && config.Zap != nil && config.Zap.AccessLogMaxBytes > 0 {
-			logLimit = int(config.Zap.AccessLogMaxBytes)
-		}
-		if config == nil || config.Zap == nil || config.Zap.AccessReqBody {
-			if multipart {
-				requestText = "[文件]"
-			} else {
-				requestText = redactJSONLimit(requestBody, logLimit)
-			}
-		}
-		if config == nil || config.Zap == nil || config.Zap.AccessRespData {
-			responseText = redactJSONLimit(writer.body.Bytes(), logLimit)
-		}
+		responseText := redactJSON(writer.body.Bytes(), c.Writer.Header().Get("Content-Type"), logLimit)
 		userID, authorityID := uint(0), uint(0)
 		if claims := Claims(c); claims != nil {
 			userID, authorityID = claims.ID, claims.AuthorityID
@@ -54,27 +59,41 @@ func AccessLog(runtime *conf.Runtime, logger *slog.Logger) gin.HandlerFunc {
 		if route == "" {
 			route = "unmatched"
 		}
-		attributes := []any{
-			"ip", c.ClientIP(), "method", c.Request.Method, "path", c.Request.URL.Path, "http_route", route,
-			"status", c.Writer.Status(), "latency_ms", time.Since(started).Milliseconds(),
-			"request_id", stringValueFromContext(c, "request_id"), "trace_id", stringValueFromContext(c, "trace_id"),
-			"bytes_in", len(requestBody), "bytes_out", c.Writer.Size(), "user_id", userID, "authority_id", authorityID,
-			"ua", c.Request.UserAgent(), "query", c.Request.URL.RawQuery, "request", requestText, "response", responseText}
-		if config != nil && config.Zap != nil && config.Zap.AccessReqHeaders {
-			attributes = append(attributes, "headers", redactHeaders(c.Request.Header))
+		bytesOut := int64(c.Writer.Size())
+		if bytesOut < 0 {
+			bytesOut = 0
 		}
-		logger.InfoContext(c.Request.Context(), "http access", attributes...)
+		privateErrors := strings.TrimRight(c.Errors.ByType(gin.ErrorTypePrivate).String(), "\n")
+		attributes := []any{
+			"mod", "http", "ip", c.ClientIP(), "method", c.Request.Method, "http_path", c.Request.URL.Path, "http_route", route,
+			"http_status", c.Writer.Status(), "latency_ms", time.Since(started).Milliseconds(),
+			"request_id", stringValueFromContext(c, "request_id"), "trace_id", stringValueFromContext(c, "trace_id"),
+			"bytes_in", bytesIn, "bytes_out", bytesOut, "user_id", userID, "authority_id", authorityID,
+			"error", c.Writer.Status() >= http.StatusInternalServerError || privateErrors != "", "ua", c.Request.UserAgent(), "req_query", c.Request.URL.RawQuery}
+		if config != nil && config.Zap != nil && config.Zap.AccessReqHeaders {
+			attributes = append(attributes, "req_headers", redactHeaders(c.Request.Header))
+		}
+		if config != nil && config.Zap != nil && config.Zap.AccessReqBody {
+			attributes = append(attributes, "req_body", requestText)
+		}
+		if config != nil && config.Zap != nil && config.Zap.AccessRespData {
+			attributes = append(attributes, "resp_data", responseText)
+		}
+		if privateErrors != "" {
+			attributes = append(attributes, "error_msg", privateErrors)
+		}
+		logger.InfoContext(c.Request.Context(), "请求完成", attributes...)
 	}
 }
 
-func redactHeaders(headers map[string][]string) map[string][]string {
-	out := make(map[string][]string, len(headers))
+func redactHeaders(headers map[string][]string) map[string]string {
+	out := make(map[string]string, len(headers))
 	for key, values := range headers {
 		lower := strings.ToLower(key)
-		if strings.Contains(lower, "token") || lower == "authorization" || lower == "cookie" {
-			out[key] = []string{"******"}
+		if lower == "authorization" || lower == "cookie" || lower == "set-cookie" || lower == "x-token" {
+			out[key] = "***"
 		} else {
-			out[key] = values
+			out[key] = strings.Join(values, ",")
 		}
 	}
 	return out

internal/server/middleware/audit.go

@@ -31,7 +31,10 @@ func OperationAudit(runtime *conf.Runtime, service *service.AuditRecorder) gin.H
 		}
 		if c.Request.Method == http.MethodGet {
 			requestBody = operationQueryBody(c.Request.URL.RawQuery)
+		} else if value, ok := c.Get(ctxReqBodyKey); ok {
+			requestBody = []byte(stringValue(value))
 		} else if c.Request.Body != nil {
+			// Fallback for tests or custom middleware chains that omit AccessLog.
 			if strings.Contains(c.GetHeader("Content-Type"), "multipart/form-data") {
 				requestBody = []byte("[文件]")
 			} else {
@@ -43,8 +46,6 @@ func OperationAudit(runtime *conf.Runtime, service *service.AuditRecorder) gin.H
 		// safety limit and only applies the configured operation-log limit when a
 		// download response is recorded. Using maxBytes here would silently
 		// truncate ordinary JSON responses before that decision is possible.
-		writer := &captureWriter{ResponseWriter: c.Writer, maxBytes: 1 << 20}
-		c.Writer = writer
 		started := time.Now()
 		c.Next()
 		userID := uint(0)
@@ -55,7 +56,12 @@ func OperationAudit(runtime *conf.Runtime, service *service.AuditRecorder) gin.H
 		}
 		requestID, _ := c.Get("request_id")
 		status := c.Writer.Status()
-		responseBody := writer.body.String()
+		responseBody := ""
+		if value, ok := c.Get(ctxRespBufferKey); ok {
+			if body, bok := value.(*bytes.Buffer); bok {
+				responseBody = body.String()
+			}
+		}
 		if isDownloadResponse(c) && len(responseBody) > maxBytes {
 			responseBody = "[超出记录长度]"
 		}

internal/server/middleware/capture.go

@@ -8,6 +8,14 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
+// The global access logger is the single request/response capture point.
+// OperationAudit consumes these values after the handler returns, avoiding a
+// second body read/writer wrapper.
+const (
+	ctxReqBodyKey    = "kra_req_body"
+	ctxRespBufferKey = "kra_resp_buffer"
+)
+
 type captureWriter struct {
 	gin.ResponseWriter
 	body     bytes.Buffer
@@ -17,7 +25,7 @@ type captureWriter struct {
 func (w *captureWriter) Write(data []byte) (int, error) {
 	limit := w.maxBytes
 	if limit <= 0 {
-		limit = 32768
+		limit = 1024
 	}
 	if w.body.Len() < limit {
 		remaining := limit - w.body.Len()
@@ -30,44 +38,32 @@ func (w *captureWriter) Write(data []byte) (int, error) {
 	return w.ResponseWriter.Write(data)
 }
 
-func redactJSON(raw []byte) string {
-	return redactJSONLimit(raw, 32768)
-}
-
-func redactJSONLimit(raw []byte, limit int) string {
+func redactJSON(raw []byte, contentType string, limit int) string {
 	if len(raw) == 0 {
 		return ""
 	}
 	if limit <= 0 {
-		limit = 32768
+		limit = 1024
 	}
-	if len(raw) > limit {
-		raw = raw[:limit]
+	text := string(raw)
+	if !strings.Contains(strings.ToLower(contentType), "json") {
+		if len(text) > limit {
+			return "[超出记录长度]"
+		}
+		return text
 	}
 	var value any
 	if json.Unmarshal(raw, &value) != nil {
-		return string(raw)
-	}
-	var clean func(any)
-	clean = func(current any) {
-		switch v := current.(type) {
-		case map[string]any:
-			for key, item := range v {
-				lower := strings.ToLower(key)
-				if strings.Contains(lower, "password") || strings.Contains(lower, "token") || strings.Contains(lower, "secret") {
-					v[key] = "******"
-				} else {
-					clean(item)
-				}
-			}
-		case []any:
-			for _, item := range v {
-				clean(item)
-			}
+		if len(text) > limit {
+			return "[超出记录长度]"
 		}
+		return text
 	}
-	clean(value)
+	maskOperationBody(value)
 	encoded, _ := json.Marshal(value)
+	if len(encoded) > limit {
+		return "[超出记录长度]"
+	}
 	return string(encoded)
 }
 

internal/server/middleware/cors.go

@@ -0,0 +1,62 @@
+package middleware
+
+import (
+	"net/http"
+	"strings"
+
+	"kra/internal/conf"
+
+	"github.com/gin-gonic/gin"
+)
+
+const (
+	defaultCORSHeaders = "Content-Type,AccessToken,X-CSRF-Token, Authorization, Token,X-Token,X-User-Id"
+	defaultCORSMethods = "POST, GET, OPTIONS,DELETE,PUT"
+	defaultCORSExpose  = "Content-Length, Access-Control-Allow-Origin, Access-Control-Allow-Headers, Content-Type, New-Token, New-Expires-At"
+)
+
+// CORS applies the current administration CORS rules on every request so a
+// configuration reload takes effect without rebuilding the Gin engine.
+func CORS(runtime *conf.Runtime) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		config := runtime.Admin()
+		if config == nil || config.Cors == nil {
+			c.Next()
+			return
+		}
+		mode := strings.TrimSpace(config.Cors.Mode)
+		origin := c.GetHeader("Origin")
+		if mode == "allow-all" {
+			setCORSHeaders(c, origin, defaultCORSHeaders, defaultCORSMethods, defaultCORSExpose, true)
+		} else if rule := matchingCORSRule(config.Cors.Whitelist, origin); rule != nil {
+			setCORSHeaders(c, rule.AllowOrigin, rule.AllowHeaders, rule.AllowMethods, rule.ExposeHeaders, rule.AllowCredentials)
+		} else if mode == "strict-whitelist" && !(c.Request.Method == http.MethodGet && c.Request.URL.Path == "/health") {
+			c.AbortWithStatus(http.StatusForbidden)
+			return
+		}
+		if c.Request.Method == http.MethodOptions {
+			c.AbortWithStatus(http.StatusNoContent)
+			return
+		}
+		c.Next()
+	}
+}
+
+func matchingCORSRule(rules []*conf.AdminBackend_CORSRule, origin string) *conf.AdminBackend_CORSRule {
+	for _, rule := range rules {
+		if rule != nil && origin == rule.AllowOrigin {
+			return rule
+		}
+	}
+	return nil
+}
+
+func setCORSHeaders(c *gin.Context, origin, headers, methods, expose string, credentials bool) {
+	c.Header("Access-Control-Allow-Origin", origin)
+	c.Header("Access-Control-Allow-Headers", headers)
+	c.Header("Access-Control-Allow-Methods", methods)
+	c.Header("Access-Control-Expose-Headers", expose)
+	if credentials {
+		c.Header("Access-Control-Allow-Credentials", "true")
+	}
+}

internal/server/middleware/error_audit.go

@@ -1,6 +1,7 @@
 package middleware
 
 import (
+	"bytes"
 	"encoding/json"
 	"strings"
 
@@ -16,14 +17,18 @@ import (
 // system errors and therefore are not inserted into sys_error.
 func ErrorAudit(audit *service.AuditRecorder) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		writer := &captureWriter{ResponseWriter: c.Writer, maxBytes: 1 << 20}
-		c.Writer = writer
 		c.Next()
 		if strings.Contains(c.Request.URL.Path, "/sysError/") || c.Writer.Status() >= 300 && c.Writer.Status() < 500 {
 			return
 		}
 		var response httpx.Response
-		if json.Unmarshal(writer.body.Bytes(), &response) != nil || response.Code == httpx.CodeSuccess || expectedClientFailure(response.Msg) {
+		var body []byte
+		if value, ok := c.Get(ctxRespBufferKey); ok {
+			if buffer, valid := value.(*bytes.Buffer); valid {
+				body = buffer.Bytes()
+			}
+		}
+		if json.Unmarshal(body, &response) != nil || response.Code == httpx.CodeSuccess || expectedClientFailure(response.Msg) {
 			return
 		}
 		requestID, _ := c.Get("request_id")

internal/server/middleware/recovery.go

@@ -33,7 +33,7 @@ func Recovery(audit *service.AuditRecorder, logger *slog.Logger) gin.HandlerFunc
 			request, _ := httputil.DumpRequest(c.Request, false)
 			info := fmt.Sprintf("error=%v request=%s stack=%s", panicValue, request, debug.Stack())
 			if logger != nil {
-				logger.ErrorContext(c.Request.Context(), "recovery from panic", "error", panicValue, "request", string(request), "stack", string(debug.Stack()))
+				logger.ErrorContext(c.Request.Context(), "recovery from panic", "mod", "error", "error", panicValue, "request", string(request), "stack", string(debug.Stack()))
 			}
 			requestID, _ := c.Get("request_id")
 			_ = audit.CreateErrorRequest(c.Request.Context(), &dto.ErrorRecordRequest{Form: c.Request.URL.Path, Info: info, Level: "error", RequestID: stringValue(requestID), TraceID: stringValueFromContext(c, "trace_id")})

internal/server/middleware/request.go

@@ -3,15 +3,14 @@ package middleware
 import (
 	"crypto/rand"
 	"encoding/hex"
-	"regexp"
 	"strings"
 
+	"kra/pkg/logging"
+
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 )
 
-var traceParentPattern = regexp.MustCompile(`^00-([0-9a-f]{32})-([0-9a-f]{16})-[0-9a-f]{2}$`)
-
 func randomHex(bytes int) string {
 	value := make([]byte, bytes)
 	_, _ = rand.Read(value)
@@ -21,13 +20,13 @@ func randomHex(bytes int) string {
 func RequestMeta() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		requestID := c.GetHeader("X-Request-Id")
-		if requestID == "" || len(requestID) > 128 || strings.ContainsAny(requestID, "\r\n") {
+		if !saneHeaderID(requestID) {
 			requestID = uuid.NewString()
 		}
 		traceID, parentSpanID := "", ""
-		if match := traceParentPattern.FindStringSubmatch(strings.ToLower(c.GetHeader("traceparent"))); len(match) == 3 {
-			traceID, parentSpanID = match[1], match[2]
-		} else if candidate := c.GetHeader("X-Trace-Id"); len(candidate) <= 128 && !strings.ContainsAny(candidate, "\r\n") {
+		if upstreamTraceID, upstreamSpanID, ok := parseTraceparent(c.GetHeader("traceparent")); ok {
+			traceID, parentSpanID = upstreamTraceID, upstreamSpanID
+		} else if candidate := c.GetHeader("X-Trace-Id"); saneHeaderID(candidate) {
 			traceID = candidate
 		}
 		if traceID == "" {
@@ -36,13 +35,68 @@ func RequestMeta() gin.HandlerFunc {
 		spanID := randomHex(8)
 		c.Header("X-Request-Id", requestID)
 		c.Header("X-Trace-Id", traceID)
-		if len(traceID) == 32 {
+		if validTraceID(traceID) {
 			c.Header("traceparent", "00-"+traceID+"-"+spanID+"-01")
 		}
 		c.Set("request_id", requestID)
 		c.Set("trace_id", traceID)
 		c.Set("span_id", spanID)
 		c.Set("parent_span_id", parentSpanID)
+		c.Request = c.Request.WithContext(logging.WithContextFields(c.Request.Context(), &logging.ContextFields{
+			RequestID: requestID, TraceID: traceID, SpanID: spanID, ParentSpanID: parentSpanID,
+			DeviceID: c.GetHeader("X-Device-Id"), ClientIP: c.ClientIP(),
+			HTTPMethod: c.Request.Method, HTTPPath: c.Request.URL.Path,
+		}))
 		c.Next()
 	}
 }
+
+func parseTraceparent(value string) (traceID, parentSpanID string, ok bool) {
+	parts := strings.Split(value, "-")
+	if len(parts) < 4 {
+		return "", "", false
+	}
+	version, traceID, parentSpanID, flags := parts[0], parts[1], parts[2], parts[3]
+	if !lowerHex(version, 2) || version == "ff" || version == "00" && len(parts) != 4 ||
+		!validTraceID(traceID) || !lowerHex(parentSpanID, 16) || allZero(parentSpanID) || !lowerHex(flags, 2) {
+		return "", "", false
+	}
+	return traceID, parentSpanID, true
+}
+
+func saneHeaderID(value string) bool {
+	if value == "" || len(value) > 64 {
+		return false
+	}
+	for index := 0; index < len(value); index++ {
+		if value[index] <= 0x20 || value[index] > 0x7e {
+			return false
+		}
+	}
+	return true
+}
+
+func validTraceID(value string) bool { return lowerHex(value, 32) && !allZero(value) }
+
+func lowerHex(value string, length int) bool {
+	if len(value) != length {
+		return false
+	}
+	for index := 0; index < len(value); index++ {
+		if current := value[index]; current < '0' || current > '9' {
+			if current < 'a' || current > 'f' {
+				return false
+			}
+		}
+	}
+	return true
+}
+
+func allZero(value string) bool {
+	for index := 0; index < len(value); index++ {
+		if value[index] != '0' {
+			return false
+		}
+	}
+	return true
+}

internal/service/dictionary_import.go

@@ -17,8 +17,14 @@ func (s *DictionaryService) ImportDictionaryJSON(ctx context.Context, raw string
 		Description string                        `json:"desc"`
 		Details     []dto.DictionaryDetailRequest `json:"sysDictionaryDetails"`
 	}
-	if json.Unmarshal([]byte(raw), &payload) != nil || payload.Name == "" || payload.Type == "" {
-		return errors.New("JSON 格式错误")
+	if err := json.Unmarshal([]byte(raw), &payload); err != nil {
+		return errors.New("JSON 格式错误: " + err.Error())
+	}
+	if payload.Name == "" {
+		return errors.New("字典名称不能为空")
+	}
+	if payload.Type == "" {
+		return errors.New("字典类型不能为空")
 	}
 	dictionary := dictionaryDomain(&dto.DictionaryRequest{Name: payload.Name, Type: payload.Type, Status: payload.Status, Description: payload.Description})
 	details := make([]*biz.DictionaryDetail, 0, len(payload.Details))

internal/service/dto/organization.go

@@ -8,7 +8,7 @@ type DepartmentRequest struct {
 	ParentID uint   `json:"parentId"`
 	Sort     int    `json:"sort"`
 	LeaderID uint   `json:"leaderId"`
-	Status   bool   `json:"status"`
+	Status   *bool  `json:"status"`
 }
 
 type DepartmentListRequest struct {
@@ -38,7 +38,7 @@ type DepartmentResponse struct {
 	Sort      int                   `json:"sort"`
 	LeaderID  uint                  `json:"leaderId"`
 	Leader    any                   `json:"leader"`
-	Status    bool                  `json:"status"`
+	Status    *bool                 `json:"status"`
 	Children  []*DepartmentResponse `json:"children"`
 	NamePath  string                `json:"namePath"`
 }
@@ -48,7 +48,7 @@ type PositionRequest struct {
 	Name   string `json:"name"`
 	Code   string `json:"code"`
 	Sort   int    `json:"sort"`
-	Status bool   `json:"status"`
+	Status *bool  `json:"status"`
 	Remark string `json:"remark"`
 }
 
@@ -79,6 +79,6 @@ type PositionResponse struct {
 	Name      string    `json:"name"`
 	Code      string    `json:"code"`
 	Sort      int       `json:"sort"`
-	Status    bool      `json:"status"`
+	Status    *bool     `json:"status"`
 	Remark    string    `json:"remark"`
 }

internal/worker/task_scheduler.go

@@ -34,7 +34,7 @@ type scheduledEntry struct {
 }
 
 func NewTaskScheduler(tasks *biz.TaskUsecase, authorities *biz.AuthorityUsecase, executor *TaskExecutor, logger *slog.Logger) *TaskScheduler {
-	return &TaskScheduler{tasks: tasks, authorities: authorities, executor: executor, logger: logger, standard: cron.New(), seconds: cron.New(cron.WithSeconds()), entries: map[uint]scheduledEntry{}, subscribers: map[uint]map[chan []byte]struct{}{}}
+	return &TaskScheduler{tasks: tasks, authorities: authorities, executor: executor, logger: logger.With("mod", "timedTask"), standard: cron.New(), seconds: cron.New(cron.WithSeconds()), entries: map[uint]scheduledEntry{}, subscribers: map[uint]map[chan []byte]struct{}{}}
 }
 
 func NewTaskRuntime(scheduler *TaskScheduler) biz.TaskRuntime { return scheduler }
@@ -48,13 +48,17 @@ func (s *TaskScheduler) Start(ctx context.Context) error {
 	s.seconds.Start()
 	items, _, err := s.tasks.ListTasks(ctx, 0, 0, nil)
 	if err == nil {
+		loaded := 0
 		for _, task := range items {
 			if task.Enabled {
 				if scheduleErr := s.Schedule(task); scheduleErr != nil {
 					s.logger.ErrorContext(ctx, "restore timed task failed", "id", task.ID, "error", scheduleErr)
+				} else {
+					loaded++
 				}
 			}
 		}
+		s.logger.InfoContext(ctx, "定时任务加载完成", "task_count", loaded)
 	} else {
 		s.logger.WarnContext(ctx, "timed task table is not ready", "error", err)
 	}
@@ -117,6 +121,7 @@ func (s *TaskScheduler) Reload(ctx context.Context) error {
 			}
 		}
 	}
+	s.logger.InfoContext(ctx, "定时任务重载完成", "task_count", len(items))
 	return nil
 }
 
@@ -131,6 +136,15 @@ func (s *TaskScheduler) executionContext() context.Context {
 
 func (s *TaskScheduler) run(task *biz.TimedTask, trigger string) {
 	log := s.executor.Run(s.executionContext(), task, trigger)
+	attributes := []any{"task_id", log.TaskID, "task_name", log.TaskName, "trigger_type", log.TriggerType, "status", log.Status, "duration_ms", log.DurationMS, "started_at", log.StartedAt, "finished_at", log.FinishedAt}
+	if log.ErrorMsg != "" {
+		attributes = append(attributes, "error", log.ErrorMsg)
+	}
+	if log.Status == "success" {
+		s.logger.Info("timed task finished", attributes...)
+	} else {
+		s.logger.Error("timed task finished", attributes...)
+	}
 	if log.Status != "success" {
 		ids, err := s.authorities.AuthorityUserIDs(context.Background(), 888)
 		if err != nil {