401 lines
10 KiB
Go
401 lines
10 KiB
Go
package middleware
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"io"
|
|
"net/http"
|
|
"strings"
|
|
"time"
|
|
"unicode/utf8"
|
|
"yintai-api/app/common/cache"
|
|
"yintai-api/app/common/dao"
|
|
"yintai-api/app/common/model"
|
|
"yintai-api/base/global"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
log "github.com/sirupsen/logrus"
|
|
)
|
|
|
|
const (
|
|
operateBodyLimit = 8000
|
|
operateQueryLimit = 1024
|
|
operateHeaderLimit = 8000
|
|
operateMessageLimit = 512
|
|
operateAccountLimit = 64
|
|
operateForwardLimit = 512
|
|
operatePathLimit = 255
|
|
operateActionLimit = 64
|
|
)
|
|
|
|
// 写操作、登录、退出、获取验证码，以及所有失败请求都记。成功的普通查询不记。
|
|
var operateActions = map[string]string{
|
|
"POST /yt/user/login": "登录",
|
|
"GET /yt/user/logout": "退出",
|
|
"GET /yt/user/captcha": "获取验证码",
|
|
"POST /yt/user": "创建用户",
|
|
"PUT /yt/user": "修改用户",
|
|
"DELETE /yt/user": "删除用户",
|
|
"GET /yt/user": "查询用户",
|
|
"POST /yt/resource": "创建资源",
|
|
"PUT /yt/resource": "修改资源",
|
|
"DELETE /yt/resource": "删除资源",
|
|
"GET /yt/resource": "查询资源",
|
|
"POST /yt/role": "创建角色",
|
|
"PUT /yt/role": "修改角色",
|
|
"DELETE /yt/role": "删除角色",
|
|
"GET /yt/role": "查询角色",
|
|
"GET /yt/role/:id": "查询角色",
|
|
"GET /yt/role/account/:id": "查询角色账号",
|
|
"GET /yt/translate": "翻译",
|
|
"POST /yt/category": "创建分类",
|
|
"PUT /yt/category": "修改分类",
|
|
"DELETE /yt/category": "删除分类",
|
|
"GET /yt/category": "查询分类",
|
|
"POST /yt/process": "创建历程",
|
|
"PUT /yt/process": "修改历程",
|
|
"DELETE /yt/process": "删除历程",
|
|
"GET /yt/process": "查询历程",
|
|
"GET /yt/process/:id": "查询历程",
|
|
"POST /yt/news": "创建新闻",
|
|
"PUT /yt/news": "修改新闻",
|
|
"DELETE /yt/news": "删除新闻",
|
|
"GET /yt/news": "查询新闻",
|
|
"GET /yt/news/:id": "查询新闻",
|
|
"POST /yt/job": "创建招聘",
|
|
"PUT /yt/job": "修改招聘",
|
|
"DELETE /yt/job": "删除招聘",
|
|
"GET /yt/job": "查询招聘",
|
|
"GET /yt/job/:id": "查询招聘",
|
|
"POST /yt/doc": "创建文档",
|
|
"PUT /yt/doc": "修改文档",
|
|
"DELETE /yt/doc": "删除文档",
|
|
"GET /yt/doc": "查询文档",
|
|
"GET /yt/doc/:id": "查询文档",
|
|
"POST /yt/page": "创建页面",
|
|
"PUT /yt/page": "修改页面",
|
|
"DELETE /yt/page": "删除页面",
|
|
"GET /yt/page": "查询页面",
|
|
"POST /yt/upload": "上传文件",
|
|
"GET /yt/upload/token": "获取上传凭证",
|
|
}
|
|
|
|
var saveOperateLog = func(row *model.AdminOperateLog) error {
|
|
if global.GetDB() == nil {
|
|
return errDBNotReady
|
|
}
|
|
return dao.NewAdminOperateLog().Create(row)
|
|
}
|
|
|
|
var loadOperateUser = func(token string) *model.UserWithRole {
|
|
token = strings.TrimSpace(token)
|
|
if token == "" {
|
|
return nil
|
|
}
|
|
client := global.GetRedis()
|
|
if client == nil {
|
|
return nil
|
|
}
|
|
val := client.Get(cache.NewKeys().User() + token).Val()
|
|
if val == "" {
|
|
return nil
|
|
}
|
|
var user model.UserWithRole
|
|
if err := json.Unmarshal([]byte(val), &user); err != nil {
|
|
return nil
|
|
}
|
|
return &user
|
|
}
|
|
|
|
type operateDBError string
|
|
|
|
func (e operateDBError) Error() string { return string(e) }
|
|
|
|
const errDBNotReady operateDBError = "admin operate log: db not ready"
|
|
|
|
type bodyWriter struct {
|
|
gin.ResponseWriter
|
|
buf bytes.Buffer
|
|
}
|
|
|
|
func (w *bodyWriter) Write(b []byte) (int, error) {
|
|
w.buf.Write(b)
|
|
return w.ResponseWriter.Write(b)
|
|
}
|
|
|
|
func (w *bodyWriter) WriteString(s string) (int, error) {
|
|
w.buf.WriteString(s)
|
|
return w.ResponseWriter.WriteString(s)
|
|
}
|
|
|
|
// OperateLog 必须注册在 Recovery 之前。业务错误是 panic 抛出的，
|
|
// Recovery 接住并写完响应之后，这里才能把失败也记下来。
|
|
func OperateLog() gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
start := time.Now()
|
|
reqBody := readOperateBody(c)
|
|
user := loadOperateUser(c.GetHeader("token"))
|
|
writer := &bodyWriter{ResponseWriter: c.Writer}
|
|
c.Writer = writer
|
|
c.Next()
|
|
|
|
resp := writer.buf.Bytes()
|
|
if user == nil && c.FullPath() == "/yt/user/login" {
|
|
if code, _, ok := parseOperateResult(resp); ok && code == 0 {
|
|
if token := loginToken(resp); token != "" {
|
|
if loaded := loadOperateUser(token); loaded != nil {
|
|
user = loaded
|
|
}
|
|
}
|
|
}
|
|
}
|
|
row := collectOperateLog(c, start, reqBody, resp, user)
|
|
if row == nil {
|
|
return
|
|
}
|
|
if err := saveOperateLog(row); err != nil {
|
|
log.Errorf("admin operate log %s %s: %v", row.Method, row.Path, err)
|
|
}
|
|
}
|
|
}
|
|
|
|
func collectOperateLog(c *gin.Context, start time.Time, reqBody, resp []byte, user *model.UserWithRole) *model.AdminOperateLog {
|
|
route := c.FullPath()
|
|
if route == "" {
|
|
route = c.Request.URL.Path
|
|
}
|
|
code, message, _ := parseOperateResult(resp)
|
|
success := 0
|
|
if code == 0 {
|
|
success = 1
|
|
}
|
|
if !shouldRecord(c.Request.Method, route, success == 1) {
|
|
return nil
|
|
}
|
|
|
|
account := ""
|
|
var userID, roleID int64
|
|
if user != nil {
|
|
account = user.Account
|
|
userID = user.ID
|
|
roleID = user.RoleID
|
|
} else {
|
|
account = accountFromBody(reqBody)
|
|
}
|
|
|
|
cost := int(time.Since(start).Milliseconds())
|
|
if cost < 0 {
|
|
cost = 0
|
|
}
|
|
return &model.AdminOperateLog{
|
|
Account: cut(strings.TrimSpace(account), operateAccountLimit),
|
|
UserID: userID,
|
|
RoleID: roleID,
|
|
CreateTime: start.Unix(),
|
|
CostMs: cost,
|
|
IP: cut(c.ClientIP(), 64),
|
|
ForwardedFor: cut(c.GetHeader("X-Forwarded-For"), operateForwardLimit),
|
|
Method: cut(c.Request.Method, 16),
|
|
Path: cut(c.Request.URL.Path, operatePathLimit),
|
|
Query: cut(c.Request.URL.RawQuery, operateQueryLimit),
|
|
Request: requestText(c, reqBody),
|
|
Action: cut(operateAction(c.Request.Method, route), operateActionLimit),
|
|
Code: code,
|
|
Message: cut(message, operateMessageLimit),
|
|
Response: responseText(route, resp),
|
|
Success: success,
|
|
Header: headerText(c.Request.Header),
|
|
}
|
|
}
|
|
|
|
func shouldRecord(method, route string, success bool) bool {
|
|
if !success {
|
|
return true
|
|
}
|
|
switch method {
|
|
case http.MethodPost, http.MethodPut, http.MethodDelete:
|
|
return true
|
|
}
|
|
return route == "/yt/user/logout" || route == "/yt/user/captcha"
|
|
}
|
|
|
|
func operateAction(method, route string) string {
|
|
if name, ok := operateActions[method+" "+route]; ok {
|
|
return name
|
|
}
|
|
return method + " " + route
|
|
}
|
|
|
|
func readOperateBody(c *gin.Context) []byte {
|
|
if strings.HasPrefix(strings.ToLower(c.GetHeader("Content-Type")), "multipart/") {
|
|
return nil
|
|
}
|
|
if c.Request.Body == nil {
|
|
return nil
|
|
}
|
|
body, err := io.ReadAll(c.Request.Body)
|
|
_ = c.Request.Body.Close()
|
|
if err != nil {
|
|
c.Request.Body = io.NopCloser(bytes.NewReader(nil))
|
|
return nil
|
|
}
|
|
c.Request.Body = io.NopCloser(bytes.NewReader(body))
|
|
return body
|
|
}
|
|
|
|
func requestText(c *gin.Context, body []byte) string {
|
|
if strings.HasPrefix(strings.ToLower(c.GetHeader("Content-Type")), "multipart/") {
|
|
return cut(multipartRequest(c), operateBodyLimit)
|
|
}
|
|
return maskAndCut(body, false)
|
|
}
|
|
|
|
func responseText(route string, body []byte) string {
|
|
return maskAndCut(body, route == "/yt/user/captcha")
|
|
}
|
|
|
|
func multipartRequest(c *gin.Context) string {
|
|
form := c.Request.MultipartForm
|
|
if form == nil {
|
|
return ""
|
|
}
|
|
fields := make(map[string][]string, len(form.Value))
|
|
for key, values := range form.Value {
|
|
copied := append([]string(nil), values...)
|
|
if strings.EqualFold(key, "token") {
|
|
for i := range copied {
|
|
copied[i] = maskToken(copied[i])
|
|
}
|
|
}
|
|
fields[key] = copied
|
|
}
|
|
files := make(map[string][]map[string]any, len(form.File))
|
|
for key, headers := range form.File {
|
|
items := make([]map[string]any, 0, len(headers))
|
|
for _, header := range headers {
|
|
items = append(items, map[string]any{
|
|
"filename": header.Filename,
|
|
"size": header.Size,
|
|
})
|
|
}
|
|
files[key] = items
|
|
}
|
|
raw, err := json.Marshal(map[string]any{"fields": fields, "files": files})
|
|
if err != nil {
|
|
return ""
|
|
}
|
|
return string(raw)
|
|
}
|
|
|
|
func parseOperateResult(body []byte) (int, string, bool) {
|
|
if len(bytes.TrimSpace(body)) == 0 {
|
|
return -1, "", false
|
|
}
|
|
var rsp struct {
|
|
Code int `json:"code"`
|
|
Message string `json:"message"`
|
|
}
|
|
if err := json.Unmarshal(body, &rsp); err != nil {
|
|
return -1, "", false
|
|
}
|
|
return rsp.Code, rsp.Message, true
|
|
}
|
|
|
|
func accountFromBody(body []byte) string {
|
|
var req struct {
|
|
Account string `json:"account"`
|
|
}
|
|
if err := json.Unmarshal(body, &req); err != nil {
|
|
return ""
|
|
}
|
|
return strings.TrimSpace(req.Account)
|
|
}
|
|
|
|
func loginToken(body []byte) string {
|
|
var rsp struct {
|
|
Data struct {
|
|
Token string `json:"token"`
|
|
} `json:"data"`
|
|
}
|
|
if err := json.Unmarshal(body, &rsp); err != nil {
|
|
return ""
|
|
}
|
|
return rsp.Data.Token
|
|
}
|
|
|
|
func maskAndCut(body []byte, omitImage bool) string {
|
|
if len(bytes.TrimSpace(body)) == 0 {
|
|
return ""
|
|
}
|
|
var value any
|
|
if err := json.Unmarshal(body, &value); err != nil {
|
|
return cut(string(body), operateBodyLimit)
|
|
}
|
|
maskJSON(value, omitImage)
|
|
raw, err := json.Marshal(value)
|
|
if err != nil {
|
|
return cut(string(body), operateBodyLimit)
|
|
}
|
|
return cut(string(raw), operateBodyLimit)
|
|
}
|
|
|
|
func maskJSON(value any, omitImage bool) {
|
|
switch node := value.(type) {
|
|
case map[string]any:
|
|
for key, item := range node {
|
|
switch {
|
|
case strings.EqualFold(key, "token"):
|
|
node[key] = maskToken(asString(item))
|
|
case omitImage && strings.EqualFold(key, "image"):
|
|
node[key] = "[omitted]"
|
|
default:
|
|
maskJSON(item, omitImage)
|
|
}
|
|
}
|
|
case []any:
|
|
for _, item := range node {
|
|
maskJSON(item, omitImage)
|
|
}
|
|
}
|
|
}
|
|
|
|
func headerText(header http.Header) string {
|
|
copied := make(map[string]string, len(header))
|
|
for key, values := range header {
|
|
val := strings.Join(values, ",")
|
|
switch strings.ToLower(key) {
|
|
case "token", "cookie", "authorization", "set-cookie":
|
|
val = maskToken(val)
|
|
}
|
|
copied[key] = val
|
|
}
|
|
raw, err := json.Marshal(copied)
|
|
if err != nil {
|
|
return ""
|
|
}
|
|
return cut(string(raw), operateHeaderLimit)
|
|
}
|
|
|
|
func maskToken(token string) string {
|
|
if len(token) <= 12 {
|
|
return "****"
|
|
}
|
|
return token[:4] + "****" + token[len(token)-4:]
|
|
}
|
|
|
|
func asString(value any) string {
|
|
text, _ := value.(string)
|
|
return text
|
|
}
|
|
|
|
func cut(s string, n int) string {
|
|
if len(s) <= n {
|
|
return s
|
|
}
|
|
b := []byte(s[:n])
|
|
for len(b) > 0 && !utf8.Valid(b) {
|
|
b = b[:len(b)-1]
|
|
}
|
|
return string(b)
|
|
}
|