bug：测试问题统一修改

刘帅

2026-09-21 7a8af8c19b40b8028e25ee0b669463d06f723a30

 cloud-server-management/src/main/java/com/dsh/guns/modular/system/controller/system/SensitiveDataController.java

@@ -5,6 +5,8 @@
import com.dsh.guns.core.common.exception.BizExceptionEnum;
import com.dsh.guns.core.exception.GunsException;
import com.dsh.guns.modular.system.audit.ManagementAuditWriter;
import com.dsh.guns.modular.system.model.SiteBooking;
import com.dsh.guns.modular.system.service.ISiteBookingService;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestMapping;
@@ -25,12 +27,13 @@
    @Resource private AppUserClient appUserClient;
    @Resource private ManagementAuditWriter auditWriter;
    @Resource private IUserService userService;
    @Resource private ISiteBookingService siteBookingService;

    @GetMapping("/app-user/{id}")
    public Map<String, Object> appUser(@PathVariable Integer id) {
        assertAdmin();
        Map<String, Object> result = appUserClient.sensitiveAppUser(id);
        writeAudit("app-user", id, result == null ? "NOT_FOUND" : "SUCCESS");
        writeAudit("app-user", id, userName(result), result == null ? "NOT_FOUND" : "SUCCESS");
        return result;
    }

@@ -46,7 +49,35 @@
            result.put("phone", employee.getPhone());
            result.put("idCard", employee.getIdCard());
        }
        writeAudit("employee", id, result == null ? "NOT_FOUND" : "SUCCESS");
        writeAudit("employee", id, employee == null ? null : employee.getName(), result == null ? "NOT_FOUND" : "SUCCESS");
        return result;
    }

    @GetMapping("/student/{id}")
    public Map<String, Object> student(@PathVariable Integer id) {
        assertAdmin();
        Map<String, Object> result = appUserClient.sensitiveStudent(id);
        writeAudit("student", id, userName(result), result == null ? "NOT_FOUND" : "SUCCESS");
        return result;
    }

    /**
     * 预约管理查看关联预约人的敏感信息。
     *
     * <p>仅通过预约记录定位用户，避免前端以任意用户 ID 查询；该接口保留在
     * /system/sensitive 路径下，以使用全局的脱敏豁免和网关放行策略。</p>
     */
    @GetMapping("/booking/{bookingId}")
    public Map<String, Object> booking(@PathVariable Integer bookingId) {
        assertAdmin();
        SiteBooking booking = siteBookingService.getById(bookingId);
        if (booking == null || booking.getAppUserId() == null) {
            writeBookingAudit(bookingId, booking, null, "NOT_FOUND");
            return null;
        }

        Map<String, Object> result = appUserClient.sensitiveAppUser(booking.getAppUserId());
        writeBookingAudit(bookingId, booking, result, result == null ? "NOT_FOUND" : "SUCCESS");
        return result;
    }

@@ -56,7 +87,7 @@
        }
    }

    private void writeAudit(String resource, Integer targetUserId, String result) {
    private void writeAudit(String resource, Integer targetUserId, String targetUserName, String result) {
        Map<String, Object> audit = new HashMap<String, Object>();
        audit.put("traceId", UUID.randomUUID().toString().replace("-", ""));
        audit.put("sourceService", "mb-cloud-management");
@@ -66,11 +97,40 @@
        audit.put("operationName", "超级管理员查看敏感信息");
        audit.put("requestMethod", "GET");
        audit.put("requestUri", "/system/sensitive/" + resource + "/" + targetUserId);
        audit.put("requestParams", "targetUserId=" + targetUserId);
        // 敏感信息访问需同时记录对象名称，避免日志中只有无法识别的 ID。
        audit.put("requestParams", "targetUserId=" + targetUserId + ", targetUserName="
                + (targetUserName == null ? "-" : targetUserName));
        audit.put("userId", UserExt.getUser().getId());
        audit.put("userAccount", "admin");
        audit.put("result", result);
        audit.put("createdAt", new Date());
        auditWriter.append(audit);
    }

    private void writeBookingAudit(Integer bookingId, SiteBooking booking,
                                   Map<String, Object> user, String result) {
        Map<String, Object> audit = new HashMap<String, Object>();
        audit.put("traceId", UUID.randomUUID().toString().replace("-", ""));
        audit.put("sourceService", "mb-cloud-management");
        audit.put("sourceType", "HTTP");
        audit.put("operationType", "VIEW_SENSITIVE");
        audit.put("riskLevel", "SENSITIVE");
        audit.put("operationName", "超级管理员从预约管理查看敏感信息");
        audit.put("requestMethod", "GET");
        audit.put("requestUri", "/system/sensitive/booking/" + bookingId);
        // 审计记录只存预约、用户标识和查询结果，绝不写入手机号、身份证号等明文。
        audit.put("requestParams", "bookingId=" + bookingId + ", appUserId="
                + (booking == null || booking.getAppUserId() == null ? "-" : booking.getAppUserId())
                + ", targetUserName=" + (userName(user) == null ? "-" : userName(user)));
        audit.put("userId", UserExt.getUser().getId());
        audit.put("userAccount", "admin");
        audit.put("result", result);
        audit.put("createdAt", new Date());
        auditWriter.append(audit);
    }

    private String userName(Map<String, Object> user) {
        if (user == null || user.get("name") == null) return null;
        return String.valueOf(user.get("name"));
    }
}