脱敏接口调整及返回数据调整

刘帅

2026-09-28 2914eea299ec5a1d6bfdf40b2743226ef9cbc5af

 cloud-server-account/src/main/java/com/dsh/privacy/SensitiveDataMaskingAdvice.java

@@ -7,6 +7,9 @@
import org.springframework.web.servlet.mvc.method.annotation.ResponseBodyAdvice;

import javax.servlet.http.HttpServletRequest;
import java.util.Arrays;
import java.util.HashSet;
import java.util.Set;
import java.lang.reflect.Array;
import java.lang.reflect.Field;
import java.lang.reflect.Modifier;
@@ -22,6 +25,11 @@
@ControllerAdvice
public class SensitiveDataMaskingAdvice implements ResponseBodyAdvice<Object> {
    private static final String INTERNAL_SENSITIVE_ACCESS = "X-Internal-Sensitive-Access";
    /** APP endpoints whose clients receive original values and mask only when displaying them. */
    private static final Set<String> APP_UNMASKED_PATHS = new HashSet<String>(Arrays.asList(
            "/base/exploreWP/storeDetail",
            "/base/exploreWP/customerList"
    ));

    private final HttpServletRequest request;

@@ -31,9 +39,13 @@

    @Override
    public boolean supports(MethodParameter returnType, Class<? extends HttpMessageConverter<?>> converterType) {
        // The only unmasked account response is the management-only endpoint.
        return !(request.getRequestURI().startsWith("/internal/sensitive/")
                && "true".equalsIgnoreCase(request.getHeader(INTERNAL_SENSITIVE_ACCESS)));
        String path = request.getRequestURI();
        // Internal management calls require their sensitive-access header. The
        // two explicitly listed APP endpoints return original values for
        // client-side display masking; all other account responses are masked.
        return !(APP_UNMASKED_PATHS.contains(path)
                || (path.startsWith("/internal/sensitive/")
                && "true".equalsIgnoreCase(request.getHeader(INTERNAL_SENSITIVE_ACCESS))));
    }

    @Override