feat: 数据脱敏体系重构 — 全局设置+masked_columns+前端去硬编码
后端: - applyDataMasking 新增 masked_columns 返回字段，告诉前端哪些列被脱敏 - seedDefaultSettings 添加 data_masking 分组(启用开关+敏感字段列表) - 脱敏逻辑: 全局敏感字段 + 实例级 mask_fields 合并，开关关闭则跳过 前端: - QueriesPage 去掉硬编码 sensitiveKeywords 和 maskData() - 改用后端返回的 masked_columns 显示'敏'标签 - 脱敏值由后端统一处理(替换为*) - PlatformConfigPage 数据脱敏分组独立显示 - EditInstanceDialog 脱敏字段简化为逗号分隔输入 验证: - 设置页开关可正常开关/保存 - 查询 ghost_test: email列被脱敏为*，列头显示'敏'标签 - 非敏感列(name, id, status)正常显示
This commit is contained in:
logan committed
1 parent
e81eed288c
commit
557d88d3ed
6 files changed
+155
-62
No files matched your search
@@ -60,6 +60,9 @@ func main() {
|
||||
&model.UserGroup{},
|
||||
)
|
||||
|
||||
// Seed default settings (idempotent)
|
||||
seedDefaultSettings(db)
|
||||
|
||||
// Setup Gin
|
||||
r := gin.Default()
|
||||
r.Use(middleware.CORSMiddleware())
|
||||
@@ -79,3 +82,21 @@ func main() {
|
||||
log.Fatalf("Failed to start server: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func seedDefaultSettings(db *gorm.DB) {
|
||||
defaults := []model.SystemSetting{
|
||||
// Data masking group
|
||||
{Key: "data_masking_enabled", Value: "true", ValueType: "boolean", Group: "data_masking", Label: "启用数据脱敏", Desc: strPtr("启用后，查询结果中的敏感字段将被替换为 *"), DefaultValue: strPtr("true"), SortOrder: 1},
|
||||
{Key: "data_masking_sensitive_fields", Value: "mobile,concat_mobile,email_alias,email,password,ga_key,private_key,secret,secret_key,key_snow,telephone,username,real_name,token,two_factor_secret,content,phone", ValueType: "string", Group: "data_masking", Label: "默认敏感字段列表", Desc: strPtr("全局敏感字段，逗号分隔。匹配列名（不区分大小写）"), DefaultValue: strPtr("mobile,concat_mobile,email_alias,email,password,ga_key,private_key,secret,secret_key,key_snow,telephone,username,real_name,token,two_factor_secret,content,phone"), SortOrder: 2},
|
||||
}
|
||||
for _, s := range defaults {
|
||||
var existing model.SystemSetting
|
||||
if db.Where("`key` = ?", s.Key).First(&existing).Error != nil {
|
||||
db.Create(&s)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func strPtr(s string) *string {
|
||||
return &s
|
||||
}
|
||||
@@ -457,7 +457,7 @@ func ListSettings(c *gin.Context) {
|
||||
// PUT /api/v1/settings — batch update settings
|
||||
func UpdateSettings(c *gin.Context) {
|
||||
var items []struct {
|
||||
ID int `json:"id"`
|
||||
Key string `json:"key"`
|
||||
Value string `json:"value"`
|
||||
}
|
||||
if err := c.ShouldBindJSON(&items); err != nil {
|
||||
@@ -465,7 +465,7 @@ func UpdateSettings(c *gin.Context) {
|
||||
return
|
||||
}
|
||||
for _, item := range items {
|
||||
model.DB.Model(&model.SystemSetting{}).Where("id = ?", item.ID).Update("value", item.Value)
|
||||
model.DB.Model(&model.SystemSetting{}).Where("`key` = ?", item.Key).Update("value", item.Value)
|
||||
}
|
||||
c.JSON(http.StatusOK, gin.H{"message": "Settings updated"})
|
||||
}
|
||||
|
||||
@@ -550,6 +550,7 @@ func ExecuteQuery(c *gin.Context) {
|
||||
}
|
||||
result["cost_ms"] = costMs
|
||||
rowsInterface, _ := result["rows"].([]interface{})
|
||||
applyDataMasking(result, &instance)
|
||||
saveQueryHistory(userID, input.InstanceID, input.Database, input.SQL, costMs, len(rowsInterface))
|
||||
c.JSON(http.StatusOK, result)
|
||||
|
||||
@@ -565,6 +566,7 @@ func ExecuteQuery(c *gin.Context) {
|
||||
if rowsArr, ok := result["rows"].([]interface{}); ok {
|
||||
rowCount = len(rowsArr)
|
||||
}
|
||||
applyDataMasking(result, &instance)
|
||||
saveQueryHistory(userID, input.InstanceID, input.Database, input.SQL, costMs, rowCount)
|
||||
c.JSON(http.StatusOK, result)
|
||||
|
||||
@@ -577,6 +579,7 @@ func ExecuteQuery(c *gin.Context) {
|
||||
}
|
||||
result["cost_ms"] = costMs
|
||||
rowsInterface, _ := result["rows"].([]interface{})
|
||||
applyDataMasking(result, &instance)
|
||||
saveQueryHistory(userID, input.InstanceID, input.Database, input.SQL, costMs, len(rowsInterface))
|
||||
c.JSON(http.StatusOK, result)
|
||||
|
||||
@@ -1316,3 +1319,101 @@ func saveQueryHistory(userID int, instanceID int, database string, sqlStr string
|
||||
}
|
||||
model.DB.Create(&history)
|
||||
}
|
||||
|
||||
// applyDataMasking masks sensitive fields in query results with "*".
|
||||
// It reads global settings (data_masking_enabled + sensitive fields) and
|
||||
// merges with instance-level mask_fields.
|
||||
func applyDataMasking(result gin.H, instance *model.Instance) {
|
||||
// Check global enable flag
|
||||
var enabledSetting model.SystemSetting
|
||||
if model.DB.Where("`key` = ?", "data_masking_enabled").First(&enabledSetting).Error != nil {
|
||||
return // setting not found, skip masking
|
||||
}
|
||||
if enabledSetting.Value != "true" {
|
||||
return // masking disabled
|
||||
}
|
||||
|
||||
// Collect global sensitive fields
|
||||
var fieldsSetting model.SystemSetting
|
||||
globalFields := map[string]bool{}
|
||||
if model.DB.Where("`key` = ?", "data_masking_sensitive_fields").First(&fieldsSetting).Error == nil {
|
||||
for _, f := range strings.Split(fieldsSetting.Value, ",") {
|
||||
f = strings.TrimSpace(f)
|
||||
if f != "" {
|
||||
globalFields[strings.ToLower(f)] = true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Merge instance-level mask_fields
|
||||
instanceFields := map[string]bool{}
|
||||
if instance.MaskFields != nil && *instance.MaskFields != "" {
|
||||
for _, f := range strings.Split(*instance.MaskFields, ",") {
|
||||
f = strings.TrimSpace(f)
|
||||
if f != "" {
|
||||
instanceFields[strings.ToLower(f)] = true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Combine all mask fields
|
||||
allMaskFields := make(map[string]bool)
|
||||
for k := range globalFields {
|
||||
allMaskFields[k] = true
|
||||
}
|
||||
for k := range instanceFields {
|
||||
allMaskFields[k] = true
|
||||
}
|
||||
|
||||
if len(allMaskFields) == 0 {
|
||||
return
|
||||
}
|
||||
|
||||
// Apply masking to rows and collect masked column names
|
||||
rows, ok := result["rows"].([]interface{})
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
maskedCols := []string{}
|
||||
for _, rowIface := range rows {
|
||||
row, ok := rowIface.(map[string]interface{})
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
for colName, val := range row {
|
||||
if allMaskFields[strings.ToLower(colName)] {
|
||||
row[colName] = maskValue(val)
|
||||
// Track masked column (deduplicate)
|
||||
found := false
|
||||
for _, mc := range maskedCols {
|
||||
if mc == colName {
|
||||
found = true
|
||||
break
|
||||
}
|
||||
}
|
||||
if !found {
|
||||
maskedCols = append(maskedCols, colName)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
if len(maskedCols) > 0 {
|
||||
result["masked_columns"] = maskedCols
|
||||
}
|
||||
}
|
||||
|
||||
// maskValue replaces a value with asterisks, preserving length info for strings
|
||||
func maskValue(val interface{}) string {
|
||||
if val == nil {
|
||||
return "***"
|
||||
}
|
||||
s := fmt.Sprintf("%v", val)
|
||||
if len(s) == 0 {
|
||||
return "*"
|
||||
}
|
||||
// Replace all chars with *, keep reasonable length
|
||||
if len(s) > 20 {
|
||||
return "********************"
|
||||
}
|
||||
return strings.Repeat("*", len(s))
|
||||
}
|
||||
Reference in new issue
Block a user