package jnpf.bizcommon.audit.service.support;
|
|
import com.alibaba.fastjson.JSON;
|
import jnpf.audit.diff.AuditFieldDiff;
|
|
import java.util.ArrayList;
|
import java.util.LinkedHashSet;
|
import java.util.List;
|
import java.util.Locale;
|
import java.util.Map;
|
import java.util.Set;
|
|
/** 审计查询响应的字段名装饰与签名凭证脱敏；不修改原始事件。 */
|
public final class AuditQueryResponseSanitizer {
|
|
public static final String SIGN_REFERENCE_LABEL = "电子签名已关联";
|
|
private AuditQueryResponseSanitizer() {
|
}
|
|
/**
|
* 装饰 field_diffs 的展示名，并对历史 biz_sign / *_sign 值做响应级脱敏。
|
* JSON 已损坏时返回 null，避免绕过结构化脱敏。
|
*/
|
@SuppressWarnings("unchecked")
|
public static String sanitizeFieldDiffs(
|
String json, Map<String, AuditFieldDiff.FieldMeta> metadata) {
|
if (json == null || json.trim().isEmpty()) {
|
return json;
|
}
|
try {
|
Object parsed = JSON.parse(json);
|
if (!(parsed instanceof List)) {
|
return null;
|
}
|
List<Object> effective = new ArrayList<>();
|
for (Object raw : (List<?>) parsed) {
|
if (!(raw instanceof Map)) {
|
continue;
|
}
|
Map<String, Object> item = (Map<String, Object>) raw;
|
if (isNoopDiff(item)) {
|
continue;
|
}
|
sanitizeChildDiff(item);
|
String field = string(item.get("field"));
|
if (field == null) {
|
continue;
|
}
|
AuditFieldDiff.FieldMeta meta = lookup(metadata, field);
|
if (isCredentialReference(field, item, meta)) {
|
item.put("fieldName", SIGN_REFERENCE_LABEL);
|
item.put("masked", true);
|
item.put("valueType", "masked");
|
item.put("componentType", "sign");
|
if (item.containsKey("oldData")) {
|
item.put("oldData", AuditFieldDiff.MASKED);
|
}
|
if (item.containsKey("newData")) {
|
item.put("newData", AuditFieldDiff.MASKED);
|
}
|
item.remove("oldDisplay");
|
item.remove("newDisplay");
|
effective.add(item);
|
continue;
|
}
|
|
String fieldName = string(item.get("fieldName"));
|
if (fieldName == null || (field != null && fieldName.equalsIgnoreCase(field))) {
|
String label = meta == null ? null : meta.label();
|
item.put("fieldName", label == null || label.trim().isEmpty()
|
? databaseFieldName(metadata, field) : label);
|
}
|
effective.add(item);
|
}
|
return JSON.toJSONString(effective);
|
} catch (Throwable t) {
|
return null;
|
}
|
}
|
|
/** 深度脱敏 extra / data_snapshot 中以敏感键承载的凭证值。 */
|
public static String sanitizeJson(String json) {
|
return sanitizeJson(json, null);
|
}
|
|
/** 深度脱敏，并用字段元数据识别非固定列名的签名控件。 */
|
public static String sanitizeJson(
|
String json, Map<String, AuditFieldDiff.FieldMeta> metadata) {
|
if (json == null || json.trim().isEmpty()) {
|
return json;
|
}
|
try {
|
Object parsed = JSON.parse(json);
|
sanitizeValue(parsed, metadata);
|
return JSON.toJSONString(parsed);
|
} catch (Throwable t) {
|
return null;
|
}
|
}
|
|
/** 从层 0 extra 取 sourceModelId，只用于查询当前字段元数据。 */
|
@SuppressWarnings("unchecked")
|
public static String sourceModelId(String extra) {
|
if (extra == null || extra.trim().isEmpty()) {
|
return null;
|
}
|
try {
|
Object parsed = JSON.parse(extra);
|
if (!(parsed instanceof Map)) {
|
return null;
|
}
|
return string(((Map<String, Object>) parsed).get("sourceModelId"));
|
} catch (Throwable t) {
|
return null;
|
}
|
}
|
|
public static boolean hidesTargetId(String targetTable) {
|
return targetTable != null && "lims_sign".equalsIgnoreCase(targetTable.trim());
|
}
|
|
/** 列表摘要与详情共用的有效 diff 计数；会排除空到空及相同值伪变更。 */
|
@SuppressWarnings("unchecked")
|
public static int effectiveDiffCount(String json) {
|
return effectiveDiffFields(json).size();
|
}
|
|
/** 返回有效变更字段，供同一操作的多条业务事件按字段并集合并摘要。 */
|
@SuppressWarnings("unchecked")
|
public static Set<String> effectiveDiffFields(String json) {
|
Set<String> fields = new LinkedHashSet<>();
|
if (json == null || json.trim().isEmpty()) {
|
return fields;
|
}
|
try {
|
Object parsed = JSON.parse(json);
|
if (!(parsed instanceof List)) {
|
return fields;
|
}
|
for (Object raw : (List<?>) parsed) {
|
if (!(raw instanceof Map)) {
|
continue;
|
}
|
Map<String, Object> item = (Map<String, Object>) raw;
|
String field = string(item.get("field"));
|
if (field != null && !isNoopDiff(item)) {
|
String targetTable = string(item.get("targetTable"));
|
fields.add(AuditDiffKey.of(targetTable, field));
|
}
|
}
|
} catch (Throwable ignored) {
|
// 非法历史 JSON 按无变更降级，不能影响列表查询。
|
}
|
return fields;
|
}
|
|
public static boolean isCredentialReference(String field) {
|
if (field == null) {
|
return false;
|
}
|
String trimmed = field.trim();
|
String lower = trimmed.toLowerCase(Locale.ROOT);
|
return "biz_sign".equals(lower)
|
|| "bizsign".equals(lower)
|
|| "sign_id".equals(lower)
|
|| "signid".equals(lower)
|
|| lower.endsWith("_sign")
|
|| trimmed.endsWith("Sign")
|
|| trimmed.endsWith("SignId");
|
}
|
|
/** 字段名、事件快照元数据和当前表单元数据任一确认是签名凭证，都必须脱敏。 */
|
public static boolean isCredentialReference(String field, Map<String, Object> item,
|
AuditFieldDiff.FieldMeta metadata) {
|
return isCredentialReference(field)
|
|| bool(item == null ? null : item.get("masked"))
|
|| "masked".equalsIgnoreCase(string(item == null ? null : item.get("valueType")))
|
|| isSignComponent(item == null ? null : item.get("componentType"))
|
|| isSignComponent(item == null ? null : item.get("jnpfKey"))
|
|| AuditFieldDiff.isCredentialMetadata(metadata);
|
}
|
|
private static boolean isNoopDiff(Map<String, Object> item) {
|
// 历史坏数据可能只保留 field/fieldName。没有完整前后值时无法证明是伪变更，
|
// 应继续返回供证据追踪；只有两侧值键都存在时才过滤空到空或完全相同。
|
if (!item.containsKey("oldData") || !item.containsKey("newData")) {
|
return false;
|
}
|
Object oldValue = item.get("oldData");
|
Object newValue = item.get("newData");
|
if (AuditFieldDiff.MASKED.equals(String.valueOf(oldValue))
|
|| AuditFieldDiff.MASKED.equals(String.valueOf(newValue))) {
|
return false;
|
}
|
return canonical(oldValue).equals(canonical(newValue));
|
}
|
|
@SuppressWarnings("unchecked")
|
private static void sanitizeChildDiff(Map<String, Object> item) {
|
Object fieldsRaw = item.get("chidField");
|
Object dataRaw = item.get("chidData");
|
if (!(fieldsRaw instanceof List) || !(dataRaw instanceof List)) {
|
return;
|
}
|
for (Object rawField : (List<?>) fieldsRaw) {
|
if (!(rawField instanceof Map)) {
|
continue;
|
}
|
Map<String, Object> field = (Map<String, Object>) rawField;
|
String prop = string(field.get("prop"));
|
boolean credential = prop != null && (isCredentialReference(prop)
|
|| isSignComponent(field.get("jnpfKey"))
|
|| bool(field.get("masked")));
|
if (!credential) {
|
continue;
|
}
|
field.put("masked", true);
|
for (Object rawRow : (List<?>) dataRaw) {
|
if (!(rawRow instanceof Map)) {
|
continue;
|
}
|
Map<String, Object> row = (Map<String, Object>) rawRow;
|
if (row.containsKey(prop)) {
|
row.put(prop, AuditFieldDiff.MASKED);
|
}
|
String oldProp = "jnpf_old_" + prop;
|
if (row.containsKey(oldProp)) {
|
row.put(oldProp, AuditFieldDiff.MASKED);
|
}
|
}
|
}
|
}
|
|
private static String canonical(Object value) {
|
if (value == null) {
|
return "";
|
}
|
if (value instanceof CharSequence) {
|
String text = value.toString();
|
return text.trim().isEmpty() ? "" : "string:" + text;
|
}
|
if (value instanceof java.util.Collection && ((java.util.Collection<?>) value).isEmpty()) {
|
return "";
|
}
|
if (value instanceof Map && ((Map<?, ?>) value).isEmpty()) {
|
return "";
|
}
|
return "json:" + JSON.toJSONString(value);
|
}
|
|
@SuppressWarnings("unchecked")
|
private static void sanitizeValue(
|
Object value, Map<String, AuditFieldDiff.FieldMeta> metadata) {
|
if (value instanceof Map) {
|
Map<Object, Object> map = (Map<Object, Object>) value;
|
for (Map.Entry<Object, Object> entry : map.entrySet()) {
|
String field = String.valueOf(entry.getKey());
|
if (isCredentialReference(field)
|
|| AuditFieldDiff.isCredentialMetadata(lookup(metadata, field))) {
|
entry.setValue(AuditFieldDiff.MASKED);
|
} else {
|
sanitizeValue(entry.getValue(), metadata);
|
}
|
}
|
} else if (value instanceof List) {
|
for (Object item : (List<?>) value) {
|
sanitizeValue(item, metadata);
|
}
|
}
|
}
|
|
private static boolean isSignComponent(Object value) {
|
String component = string(value);
|
return "sign".equalsIgnoreCase(component) || "signature".equalsIgnoreCase(component);
|
}
|
|
private static boolean bool(Object value) {
|
return value instanceof Boolean ? (Boolean) value
|
: value != null && "true".equalsIgnoreCase(String.valueOf(value));
|
}
|
|
private static AuditFieldDiff.FieldMeta lookup(
|
Map<String, AuditFieldDiff.FieldMeta> metadata, String field) {
|
if (metadata == null || field == null) {
|
return null;
|
}
|
AuditFieldDiff.FieldMeta exact = metadata.get(field);
|
if (exact != null) {
|
return exact;
|
}
|
AuditFieldDiff.FieldMeta normalized = metadata.get(field.toLowerCase(Locale.ROOT));
|
return normalized != null ? normalized : metadata.get(camelToSnake(field));
|
}
|
|
private static String databaseFieldName(
|
Map<String, AuditFieldDiff.FieldMeta> metadata, String field) {
|
String snake = camelToSnake(field);
|
return metadata != null && metadata.containsKey(snake) ? snake : field;
|
}
|
|
private static String camelToSnake(String value) {
|
StringBuilder out = new StringBuilder(value.length() + 8);
|
for (int i = 0; i < value.length(); i++) {
|
char ch = value.charAt(i);
|
if (Character.isUpperCase(ch)) {
|
out.append('_').append(Character.toLowerCase(ch));
|
} else {
|
out.append(Character.toLowerCase(ch));
|
}
|
}
|
return out.toString();
|
}
|
|
private static String string(Object value) {
|
if (value == null) {
|
return null;
|
}
|
String text = String.valueOf(value).trim();
|
return text.isEmpty() ? null : text;
|
}
|
}
|
