优化结构

internal/server/middleware/audit.go

@@ -81,7 +81,11 @@ func OperationAudit(runtime *conf.Runtime, recorder *service.AuditRecorder) gin.
 			responseBody = "[超出记录长度]"
 		}
 		errorMessage := c.Errors.ByType(gin.ErrorTypePrivate).String()
-		if err := recorder.RecordOperationRequest(c.Request.Context(), &dto.OperationRecordRequest{IP: c.ClientIP(), Method: c.Request.Method, Path: path, Status: status, LatencyMS: time.Since(started).Milliseconds(), Agent: c.Request.UserAgent(), ErrorMessage: errorMessage, Body: operationRequestBody(requestBody, c.GetHeader("Content-Type"), maxBytes), Response: responseBody, UserID: userID, RequestID: stringValue(requestID), TraceID: stringValueFromContext(c, "trace_id"), DeviceID: c.GetHeader("X-Device-Id")}); err != nil {
+		operationBody := operationRequestBody(requestBody, c.GetHeader("Content-Type"), maxBytes)
+		if isPaymentIntegrationConfigWrite(c.Request.Method, path) {
+			operationBody = paymentConfigSummary(requestBody)
+		}
+		if err := recorder.RecordOperationRequest(c.Request.Context(), &dto.OperationRecordRequest{IP: c.ClientIP(), Method: c.Request.Method, Path: path, Status: status, LatencyMS: time.Since(started).Milliseconds(), Agent: c.Request.UserAgent(), ErrorMessage: errorMessage, Body: operationBody, Response: responseBody, UserID: userID, RequestID: stringValue(requestID), TraceID: stringValueFromContext(c, "trace_id"), DeviceID: c.GetHeader("X-Device-Id")}); err != nil {
 			// Preserve the business response, but expose audit persistence failures
 			// to the global access/error logging pipeline.
 			c.Set(ctxOperationAuditPersistFailedKey, true)
@@ -128,7 +132,7 @@ func maskOperationBody(value any) {
 	case map[string]any:
 		for key, item := range current {
 			normalized := strings.ToLower(strings.ReplaceAll(strings.ReplaceAll(key, "_", ""), "-", ""))
-			if normalized == "password" || normalized == "newpassword" || normalized == "oldpassword" || normalized == "confirmpassword" || normalized == "passwd" || normalized == "pwd" || normalized == "token" || normalized == "accesstoken" || normalized == "refreshtoken" || normalized == "secret" || normalized == "clientsecret" || normalized == "apikey" || normalized == "privatekey" || normalized == "idcard" {
+			if normalized == "password" || normalized == "newpassword" || normalized == "oldpassword" || normalized == "confirmpassword" || normalized == "passwd" || normalized == "pwd" || normalized == "token" || normalized == "accesstoken" || normalized == "refreshtoken" || normalized == "secret" || normalized == "clientsecret" || normalized == "apikey" || normalized == "privatekey" || normalized == "idcard" || normalized == "appkey" || normalized == "mchkey" || normalized == "apiv3key" || normalized == "clientcert" || normalized == "clientkey" || normalized == "platformcert" || normalized == "platformserialno" || normalized == "credentialcode" || normalized == "certfile" || normalized == "keyfile" || normalized == "publickey" || normalized == "rootcert" || normalized == "appcert" || normalized == "webhookid" {
 				current[key] = "***"
 				continue
 			}
@@ -157,17 +161,49 @@ func isDownloadResponse(c *gin.Context) bool {
 // recordsOperation mirrors the routes on which operation records are enabled.
 // Matching by suffix keeps the behavior stable when router-prefix is configured.
 func recordsOperation(method, path string) bool {
-	_, ok := operationRoutes[method+" "+routeSuffix(path)]
-	return ok
+	for route := range operationRoutes {
+		parts := strings.SplitN(route, " ", 2)
+		if len(parts) != 2 || parts[0] != method || !operationPathMatches(parts[1], path) {
+			continue
+		}
+		return true
+	}
+	return false
+}
+
+func operationPathMatches(pattern, path string) bool {
+	patternParts := strings.Split(strings.Trim(pattern, "/"), "/")
+	pathParts := strings.Split(strings.Trim(path, "/"), "/")
+	if len(pathParts) < len(patternParts) {
+		return false
+	}
+	pathParts = pathParts[len(pathParts)-len(patternParts):]
+	for index, patternPart := range patternParts {
+		if strings.HasPrefix(patternPart, "*") {
+			return index <= len(pathParts)
+		}
+		if index >= len(pathParts) || (strings.HasPrefix(patternPart, ":") == false && patternPart != pathParts[index]) {
+			return false
+		}
+	}
+	return len(patternParts) == len(pathParts)
 }
 
 func routeSuffix(path string) string {
-	for _, marker := range []string{"/user/", "/api/", "/casbin/", "/authority/", "/menu/", "/department/", "/position/", "/sysDictionary/", "/sysDictionaryDetail/", "/sysParams/", "/securityConfig/", "/system/", "/sysApiToken/", "/sysVersion/", "/sysExportTemplate/", "/sysError/", "/sysLoginLog/", "/sysOperationRecord/", "/dataAccessLog/", "/timedTask/", "/info/", "/email/"} {
+	bestIndex := -1
+	bestPath := path
+	for _, marker := range []string{"/user/", "/api/", "/casbin/", "/authority/", "/menu/", "/department/", "/position/", "/sysDictionary/", "/sysDictionaryDetail/", "/sysParams/", "/securityConfig/", "/system/", "/sysApiToken/", "/sysVersion/", "/sysExportTemplate/", "/sysError/", "/sysLoginLog/", "/sysOperationRecord/", "/dataAccessLog/", "/timedTask/", "/info/", "/email/", "/integration/", "/payment/"} {
 		if index := strings.Index(path, marker); index >= 0 {
-			return path[index:]
+			// Router prefixes may themselves contain a registered route marker
+			// (for example /api/integration/...). Keep the deepest match so the
+			// policy and audit route remain the actual application endpoint.
+			if index > bestIndex {
+				bestIndex = index
+				bestPath = path[index:]
+			}
 		}
 	}
-	return path
+	return bestPath
 }
 
 var operationRoutes = func() map[string]struct{} {
@@ -189,6 +225,8 @@ var operationRoutes = func() map[string]struct{} {
 		"DELETE /sysLoginLog/deleteLoginLog", "DELETE /sysLoginLog/deleteLoginLogByIds", "DELETE /dataAccessLog/deleteDataAccessLogByIds",
 		"POST /timedTask/createTimedTask", "PUT /timedTask/updateTimedTask", "DELETE /timedTask/deleteTimedTask", "POST /timedTask/toggleTimedTask", "POST /timedTask/triggerTimedTask",
 		"POST /info/createInfo", "DELETE /info/deleteInfo", "DELETE /info/deleteInfoByIds", "PUT /info/updateInfo", "POST /email/emailTest", "POST /email/sendEmail",
+		"PUT /integration/configs/:kind/:provider", "DELETE /integration/configs/:kind/:provider",
+		"POST /payment/create", "POST /payment/query", "POST /payment/refund", "POST /payment/orders/:provider/:tradeNo/refund", "POST /payment/fulfill", "POST /payment/orders/:provider/:tradeNo/fulfill", "POST /payment/providers/:provider/test",
 	}
 	out := make(map[string]struct{}, len(values))
 	for _, value := range values {