From 7a8af8c19b40b8028e25ee0b669463d06f723a30 Mon Sep 17 00:00:00 2001
From: 刘帅 <rr.iii@qq.com>
Date: 星期一, 21 九月 2026 15:57:24 +0800
Subject: [PATCH] bug：测试问题统一修改
---
cloud-server-management/src/main/java/com/dsh/guns/modular/system/controller/system/SensitiveDataController.java | 45 +++++++++++++++++++++++++++++++++++++++++++++
1 files changed, 45 insertions(+), 0 deletions(-)
diff --git a/cloud-server-management/src/main/java/com/dsh/guns/modular/system/controller/system/SensitiveDataController.java b/cloud-server-management/src/main/java/com/dsh/guns/modular/system/controller/system/SensitiveDataController.java
index d133c0a..d4eb803 100644
--- a/cloud-server-management/src/main/java/com/dsh/guns/modular/system/controller/system/SensitiveDataController.java
+++ b/cloud-server-management/src/main/java/com/dsh/guns/modular/system/controller/system/SensitiveDataController.java
@@ -5,6 +5,8 @@
import com.dsh.guns.core.common.exception.BizExceptionEnum;
import com.dsh.guns.core.exception.GunsException;
import com.dsh.guns.modular.system.audit.ManagementAuditWriter;
+import com.dsh.guns.modular.system.model.SiteBooking;
+import com.dsh.guns.modular.system.service.ISiteBookingService;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestMapping;
@@ -25,6 +27,7 @@
@Resource private AppUserClient appUserClient;
@Resource private ManagementAuditWriter auditWriter;
@Resource private IUserService userService;
+ @Resource private ISiteBookingService siteBookingService;
@GetMapping("/app-user/{id}")
public Map<String, Object> appUser(@PathVariable Integer id) {
@@ -58,6 +61,26 @@
return result;
}
+ /**
+ * 预约管理查看关联预约人的敏感信息。
+ *
+ * <p>仅通过预约记录定位用户，避免前端以任意用户 ID 查询；该接口保留在
+ * /system/sensitive 路径下，以使用全局的脱敏豁免和网关放行策略。</p>
+ */
+ @GetMapping("/booking/{bookingId}")
+ public Map<String, Object> booking(@PathVariable Integer bookingId) {
+ assertAdmin();
+ SiteBooking booking = siteBookingService.getById(bookingId);
+ if (booking == null || booking.getAppUserId() == null) {
+ writeBookingAudit(bookingId, booking, null, "NOT_FOUND");
+ return null;
+ }
+
+ Map<String, Object> result = appUserClient.sensitiveAppUser(booking.getAppUserId());
+ writeBookingAudit(bookingId, booking, result, result == null ? "NOT_FOUND" : "SUCCESS");
+ return result;
+ }
+
private void assertAdmin() {
if (UserExt.getUser() == null || !"admin".equalsIgnoreCase(UserExt.getUser().getAccount())) {
throw new GunsException(BizExceptionEnum.NO_PERMITION);
@@ -84,6 +107,28 @@
auditWriter.append(audit);
}
+ private void writeBookingAudit(Integer bookingId, SiteBooking booking,
+ Map<String, Object> user, String result) {
+ Map<String, Object> audit = new HashMap<String, Object>();
+ audit.put("traceId", UUID.randomUUID().toString().replace("-", ""));
+ audit.put("sourceService", "mb-cloud-management");
+ audit.put("sourceType", "HTTP");
+ audit.put("operationType", "VIEW_SENSITIVE");
+ audit.put("riskLevel", "SENSITIVE");
+ audit.put("operationName", "超级管理员从预约管理查看敏感信息");
+ audit.put("requestMethod", "GET");
+ audit.put("requestUri", "/system/sensitive/booking/" + bookingId);
+ // 审计记录只存预约、用户标识和查询结果，绝不写入手机号、身份证号等明文。
+ audit.put("requestParams", "bookingId=" + bookingId + ", appUserId="
+ + (booking == null || booking.getAppUserId() == null ? "-" : booking.getAppUserId())
+ + ", targetUserName=" + (userName(user) == null ? "-" : userName(user)));
+ audit.put("userId", UserExt.getUser().getId());
+ audit.put("userAccount", "admin");
+ audit.put("result", result);
+ audit.put("createdAt", new Date());
+ auditWriter.append(audit);
+ }
+
private String userName(Map<String, Object> user) {
if (user == null || user.get("name") == null) return null;
return String.valueOf(user.get("name"));
--
Gitblit v1.7.1