优化结构

internal/server/middleware/access_log.go

@@ -31,7 +31,7 @@ func AccessLog(runtime *config.Store, logger *slog.Logger, version string) gin.H
 		started := time.Now()
 		var requestBody []byte
 		multipart := strings.Contains(c.GetHeader("Content-Type"), "multipart/form-data")
-		mediaUpload := multipart && routecatalog.BodyPolicyFor(c.Request.Method, c.Request.URL.Path) == routecatalog.BodyPolicyUpload
+		mediaUpload := routecatalog.BodyPolicyFor(c.Request.Method, c.Request.URL.Path) == routecatalog.BodyPolicyUpload
 		var admin *config.Admin
 		if runtime != nil {
 			if snapshot := runtime.Snapshot(); snapshot != nil {
@@ -46,7 +46,14 @@ func AccessLog(runtime *config.Store, logger *slog.Logger, version string) gin.H
 			}
 		}
 		bytesIn := c.Request.ContentLength
+		logLimit := 1024
+		if admin != nil && admin.Zap != nil && admin.Zap.AccessLogMaxBytes > 0 {
+			logLimit = admin.Zap.AccessLogMaxBytes
+		}
 		maxBytes := 1 << 20
+		if logLimit > maxBytes {
+			maxBytes = logLimit
+		}
 		writer := &captureWriter{ResponseWriter: c.Writer, maxBytes: maxBytes}
 		c.Writer = writer
 		c.Header("X-Kra-Version", version)
@@ -75,10 +82,6 @@ func AccessLog(runtime *config.Store, logger *slog.Logger, version string) gin.H
 		if bytesIn < 0 {
 			bytesIn = 0
 		}
-		logLimit := 1024
-		if admin != nil && admin.Zap != nil && admin.Zap.AccessLogMaxBytes > 0 {
-			logLimit = admin.Zap.AccessLogMaxBytes
-		}
 		bodyPolicy := routecatalog.BodyPolicyFor(c.Request.Method, c.Request.URL.Path)
 		paymentCallback := bodyPolicy == routecatalog.BodyPolicyPaymentCallback
 		paymentConfigWrite := bodyPolicy == routecatalog.BodyPolicyPaymentConfig

internal/server/middleware/audit.go

@@ -65,10 +65,6 @@ func OperationAudit(runtime *config.Store, recorder *systemservice.AuditRecorder
 				c.Request.Body = io.NopCloser(bytes.NewReader(requestBody))
 			}
 		}
-		// The reference middleware captures up to the global 1 MiB response
-		// safety limit and only applies the configured operation-log limit when a
-		// download response is recorded. Using maxBytes here would silently
-		// truncate ordinary JSON responses before that decision is possible.
 		started := time.Now()
 		c.Next()
 		userID := uint(0)

internal/server/middleware/cors.go

@@ -34,7 +34,7 @@ func CORS(runtime *config.Store) gin.HandlerFunc {
 		corsHandled := false
 		if mode == "allow-all" {
 			if origin != "" {
-				setCORSHeaders(c, origin, defaultCORSHeaders, defaultCORSMethods, defaultCORSExpose, true)
+				setCORSHeaders(c, origin, defaultCORSHeaders, defaultCORSMethods, defaultCORSExpose, false)
 				corsHandled = true
 			}
 		} else if rule := matchingCORSRule(cors.Whitelist, origin); rule != nil {