admin/TaskPool
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add secret feature

Browse Source
This commit is contained in:
engigu
2026-03-27 14:51:29 +08:00
parent 06589e87c4
commit cc3316c4b8
19 changed files with 447 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/bootstrap/bootstrap.go
+1
View File
@@ -33,6 +33,7 @@ func New() *App {
func InitBasic() *App {
app := &App{}
utils.InitRuntime()
utils.InitSecretKey()
// 自动加载配置 (内部会自动处理 BH_CONFIG_PATH 环境变量与默认路径的优先级)
app.initConfigWithPath("")
internal/constant/constant.go
+5
View File
@@ -123,6 +123,7 @@ const (
// Agent 状态
AgentStatusOnline = "online"
AgentStatusOffline = "offline"
// AppLog 分类
LogCategoryDefault = "default"
LogCategorySystemNotice = "system_notice"
@@ -139,6 +140,10 @@ const (
LogStatusRead = "read"
LogStatusSuccess = "success"
LogStatusFailed = "failed"
// Env Type
EnvTypeNormal = "normal"
EnvTypeSecret = "secret"
)
// TablePrefix 表前缀，从配置文件读取
internal/controllers/env_controller.go
+27 -4
View File
@@ -1,7 +1,6 @@
package controllers
import (
"github.com/engigu/baihu-panel/internal/models/vo"
"github.com/engigu/baihu-panel/internal/services"
"github.com/engigu/baihu-panel/internal/utils"
@@ -17,6 +16,18 @@ func NewEnvController(envService *services.EnvService) *EnvController {
return &EnvController{envService: envService}
}
// GetSecretStatus 获取加密秘钥状态
// @Summary 获取加密秘钥状态
// @Description 返回系统是否已配置加密秘钥
// @Tags Env
// @Produce json
// @Success 200 {object} vo.Response{data=bool} "成功"
// @Router /env/secret-status [get]
// @Security BearerAuth
func (ec *EnvController) GetSecretStatus(c *gin.Context) {
utils.Success(c, utils.IsSecretKeySet())
}
// CreateEnvVar 创建环境变量
// @Summary 创建环境变量
// @Description 创建一个新的环境变量
@@ -34,6 +45,7 @@ func (ec *EnvController) CreateEnvVar(c *gin.Context) {
Name string `json:"name" binding:"required"`
Value string `json:"value" binding:"required"`
Remark string `json:"remark"`
Type string `json:"type"`
Hidden *bool `json:"hidden"`
Enabled *bool `json:"enabled"`
}
@@ -43,6 +55,10 @@ func (ec *EnvController) CreateEnvVar(c *gin.Context) {
return
}
if req.Type == "" {
req.Type = "normal"
}
hidden := true
if req.Hidden != nil {
hidden = *req.Hidden
@@ -53,7 +69,7 @@ func (ec *EnvController) CreateEnvVar(c *gin.Context) {
enabled = *req.Enabled
}
envVar := ec.envService.CreateEnvVar(req.Name, req.Value, req.Remark, hidden, enabled, userID)
envVar := ec.envService.CreateEnvVar(req.Name, req.Value, req.Remark, req.Type, hidden, enabled, userID)
utils.Success(c, vo.ToEnvVO(envVar))
}
@@ -67,13 +83,15 @@ func (ec *EnvController) CreateEnvVar(c *gin.Context) {
// @Param name query string false "按名称模糊查询"
// @Param page query int false "页码"
// @Param page_size query int false "每页数量"
// @Param type query string false "按类型筛选"
// @Success 200 {object} utils.Response{data=utils.PaginationData{data=[]vo.EnvVO}}
// @Router /env [get]
func (ec *EnvController) GetEnvVars(c *gin.Context) {
userID := c.GetString("userID")
p := utils.ParsePagination(c)
name := c.DefaultQuery("name", "")
envVars, total := ec.envService.GetEnvVarsWithPagination(userID, name, p.Page, p.PageSize)
envType := c.DefaultQuery("type", "")
envVars, total := ec.envService.GetEnvVarsWithPagination(userID, name, envType, p.Page, p.PageSize)
utils.PaginatedResponse(c, vo.ToEnvVOListFromModels(envVars), total, p)
}
@@ -142,6 +160,7 @@ func (ec *EnvController) UpdateEnvVar(c *gin.Context) {
Name string `json:"name"`
Value string `json:"value"`
Remark string `json:"remark"`
Type string `json:"type"`
Hidden *bool `json:"hidden"`
Enabled *bool `json:"enabled"`
}
@@ -151,6 +170,10 @@ func (ec *EnvController) UpdateEnvVar(c *gin.Context) {
return
}
if req.Type == "" {
req.Type = "normal"
}
// 对于更新，获取现有数据
existing := ec.envService.GetEnvVarByID(id)
if existing == nil {
@@ -168,7 +191,7 @@ func (ec *EnvController) UpdateEnvVar(c *gin.Context) {
enabled = *req.Enabled
}
envVar := ec.envService.UpdateEnvVar(id, req.Name, req.Value, req.Remark, hidden, enabled)
envVar := ec.envService.UpdateEnvVar(id, req.Name, req.Value, req.Remark, req.Type, hidden, enabled)
if envVar == nil {
utils.NotFound(c, "环境变量不存在")
return
internal/executor/scheduler.go
+6 -2
View File
@@ -69,6 +69,7 @@ type ExecutionRequest struct {
Command string // 命令
WorkDir string // 工作目录
Envs []string // 环境变量
Secrets []string // 需要脱敏的密码
Timeout int // 超时时间（分钟）
Languages []map[string]string // 语言环境配置
UseMise bool // 是否使用 mise
@@ -467,9 +468,12 @@ func (s *Scheduler) executeTask(req *ExecutionRequest) (*ExecutionResult, error)
LogID: req.LogID, // 传递 LogID
}
// 统一获取输出并调用封装的脱敏函数
rawStr := utils.MaskSecrets(combinedBuf.String(), req.Secrets)
if execResult != nil {
result.Success = execResult.Status == constant.TaskStatusSuccess
result.Output = combinedBuf.String()
result.Output = rawStr
result.Status = execResult.Status
result.Duration = execResult.Duration
result.ExitCode = execResult.ExitCode
@@ -481,7 +485,7 @@ func (s *Scheduler) executeTask(req *ExecutionRequest) (*ExecutionResult, error)
result.StartTime = start
result.EndTime = time.Now()
result.Duration = result.EndTime.Sub(result.StartTime).Milliseconds()
result.Output = combinedBuf.String()
result.Output = rawStr
}
if execErr != nil {
internal/models/env.go
+1
View File
@@ -12,6 +12,7 @@ type EnvironmentVariable struct {
Name string `json:"name" gorm:"size:255;not null"`
Value BigText `json:"value"`
Remark string `json:"remark" gorm:"size:500"`
Type string `json:"type" gorm:"size:20;default:'normal'"`
Hidden bool `json:"hidden" gorm:"default:true"`
Enabled bool `json:"enabled" gorm:"default:true"`
UserID string `json:"user_id" gorm:"size:20;index"`
internal/models/vo/sys_vo.go
+8 -1
View File
@@ -1,6 +1,7 @@
package vo
import (
"github.com/engigu/baihu-panel/internal/constant"
"github.com/engigu/baihu-panel/internal/models"
)
@@ -35,6 +36,7 @@ type EnvVO struct {
Name string `json:"name"`
Value string `json:"value"`
Remark string `json:"remark"`
Type string `json:"type"`
Hidden bool `json:"hidden"`
Enabled bool `json:"enabled"`
CreatedAt models.LocalTime `json:"created_at"`
@@ -46,11 +48,16 @@ func ToEnvVO(env *models.EnvironmentVariable) *EnvVO {
if env == nil {
return nil
}
val := string(env.Value)
if env.Type == constant.EnvTypeSecret {
val = "********"
}
return &EnvVO{
ID: env.ID,
Name: env.Name,
Value: string(env.Value),
Value: val,
Remark: env.Remark,
Type: env.Type,
Hidden: env.Hidden,
Enabled: env.Enabled,
CreatedAt: env.CreatedAt,
internal/router/api_routes.go
+1
View File
@@ -89,6 +89,7 @@ func registerTaskRoutes(g *gin.RouterGroup, c *Controllers) {
func registerEnvRoutes(g *gin.RouterGroup, c *Controllers) {
env := g.Group("/env")
{
env.GET("/secret-status", c.Env.GetSecretStatus)
env.POST("", c.Env.CreateEnvVar)
env.GET("", c.Env.GetEnvVars)
env.GET("/all", c.Env.GetAllEnvVars)
internal/services/config_service.go
+4
View File
@@ -45,6 +45,7 @@ var Config *AppConfig
func getEnvStr(key string, target *string) {
if v := os.Getenv(key); v != "" {
*target = v
_ = os.Unsetenv(key)
}
}
@@ -54,6 +55,7 @@ func getEnvBool(key string, target *bool) {
if b, err := strconv.ParseBool(v); err == nil {
*target = b
}
_ = os.Unsetenv(key)
}
}
@@ -63,6 +65,7 @@ func getEnvInt(key string, target *int) {
if n, err := strconv.Atoi(v); err == nil {
*target = n
}
_ = os.Unsetenv(key)
}
}
@@ -130,6 +133,7 @@ func LoadConfig(path string) (*AppConfig, error) {
if v := os.Getenv("BH_DEMO_MODE"); v == "true" || v == "1" {
constant.DemoMode = true
logger.Info("[Config] 演示模式已启用")
_ = os.Unsetenv("BH_DEMO_MODE")
}
// 输出配置信息（隐藏敏感信息）
internal/services/env_service.go
+108 -6
View File
@@ -3,6 +3,7 @@ package services
import (
"strings"
"github.com/engigu/baihu-panel/internal/constant"
"github.com/engigu/baihu-panel/internal/database"
"github.com/engigu/baihu-panel/internal/models"
"github.com/engigu/baihu-panel/internal/utils"
@@ -16,12 +17,19 @@ func NewEnvService() *EnvService {
return &EnvService{}
}
func (es *EnvService) CreateEnvVar(name, value, remark string, hidden, enabled bool, userID string) *models.EnvironmentVariable {
func (es *EnvService) CreateEnvVar(name, value, remark, envType string, hidden, enabled bool, userID string) *models.EnvironmentVariable {
if envType == constant.EnvTypeSecret {
if encValue, err := utils.Encrypt(value); err == nil {
value = encValue
}
}
env := &models.EnvironmentVariable{
ID: utils.GenerateID(),
Name: name,
Value: models.BigText(value),
Remark: remark,
Type: envType,
Hidden: hidden,
Enabled: enabled,
UserID: userID,
@@ -44,7 +52,7 @@ func (es *EnvService) GetFormattedEnvVarsByUserID(userID string) []string {
return es.formatEnvVars(envs)
}
func (es *EnvService) GetEnvVarsWithPagination(userID string, name string, page, pageSize int) ([]models.EnvironmentVariable, int64) {
func (es *EnvService) GetEnvVarsWithPagination(userID string, name string, envType string, page, pageSize int) ([]models.EnvironmentVariable, int64) {
var envs []models.EnvironmentVariable
var total int64
@@ -52,6 +60,9 @@ func (es *EnvService) GetEnvVarsWithPagination(userID string, name string, page,
if name != "" {
query = query.Where("name LIKE ?", "%"+name+"%")
}
if envType != "" {
query = query.Where("type = ?", envType)
}
query.Count(&total)
query.Order("id DESC").Offset((page - 1) * pageSize).Limit(pageSize).Find(&envs)
@@ -67,16 +78,27 @@ func (es *EnvService) GetEnvVarByID(id string) *models.EnvironmentVariable {
return &env
}
func (es *EnvService) UpdateEnvVar(id string, name, value, remark string, hidden, enabled bool) *models.EnvironmentVariable {
func (es *EnvService) UpdateEnvVar(id string, name, value, remark, envType string, hidden, enabled bool) *models.EnvironmentVariable {
var env models.EnvironmentVariable
res := database.DB.Where("id = ?", id).Limit(1).Find(&env)
if res.Error != nil || res.RowsAffected == 0 {
return nil
}
if envType == constant.EnvTypeSecret && value != "********" && value != "" {
if encValue, err := utils.Encrypt(value); err == nil {
value = encValue
}
} else if envType == constant.EnvTypeSecret && (value == "********" || value == "") {
// Keep the original encrypted value
value = string(env.Value)
}
updates := map[string]interface{}{
"name": name,
"value": models.BigText(value),
"remark": remark,
"type": envType,
"hidden": hidden,
"enabled": enabled,
}
@@ -146,7 +168,25 @@ func (es *EnvService) GetEnvVarsByIDs(envIDs string) []string {
return es.formatEnvVars(envs)
}
// GetAllEnvVars 获取系统中所有的环境变量，并按 NAME=VALUE 格式返回（支持重名合并）
// GetEnvVarsAndSecretsByIDs 根据逗号分隔的ID字符串获取环境变量列表和安全机密值列表
func (es *EnvService) GetEnvVarsAndSecretsByIDs(envIDs string) ([]string, []string) {
if envIDs == "" {
return nil, nil
}
ids := splitEnvIDs(envIDs)
var envs []models.EnvironmentVariable
for _, id := range ids {
env := es.GetEnvVarByID(id)
if env != nil {
envs = append(envs, *env)
}
}
return es.formatEnvVarsAndSecrets(envs)
}
// GetAllEnvVars获取系统中所有的环境变量，并按 NAME=VALUE 格式返回
func (es *EnvService) GetAllEnvVars() []string {
var envs []models.EnvironmentVariable
if err := database.DB.Find(&envs).Error; err != nil {
@@ -155,7 +195,16 @@ func (es *EnvService) GetAllEnvVars() []string {
return es.formatEnvVars(envs)
}
// formatEnvVars 将环境变量列表格式化为 NAME=VALUE 数组，并处理重名合并
// GetAllEnvVarsAndSecrets 获取系统中所有的环境变量和安全机密值列表
func (es *EnvService) GetAllEnvVarsAndSecrets() ([]string, []string) {
var envs []models.EnvironmentVariable
if err := database.DB.Find(&envs).Error; err != nil {
return nil, nil
}
return es.formatEnvVarsAndSecrets(envs)
}
// formatEnvVars 将环境变量列表格式化为 NAME=VALUE 数组，并处理重名合并 (过滤掉所有的 Secret)
func (es *EnvService) formatEnvVars(envs []models.EnvironmentVariable) []string {
if len(envs) == 0 {
return nil
@@ -169,6 +218,11 @@ func (es *EnvService) formatEnvVars(envs []models.EnvironmentVariable) []string
nameToIndex := make(map[string]int)
for _, env := range envs {
// 非调度器入口，直接当做没有（跳过 Secret）
if env.Type == constant.EnvTypeSecret {
continue
}
value := string(env.Value)
if !env.Enabled {
value = ""
@@ -185,13 +239,61 @@ func (es *EnvService) formatEnvVars(envs []models.EnvironmentVariable) []string
}
}
var result []string
for _, item := range mergedList {
val := strings.Join(item.values, "&")
result = append(result, item.name+"="+val)
}
return result
}
// formatEnvVarsAndSecrets 将环境变量列表格式化为 NAME=VALUE 数组，并提取明文安全机密列表
func (es *EnvService) formatEnvVarsAndSecrets(envs []models.EnvironmentVariable) ([]string, []string) {
if len(envs) == 0 {
return nil, nil
}
type mergedEnv struct {
name string
values []string
}
var mergedList []mergedEnv
var secrets []string
nameToIndex := make(map[string]int)
for _, env := range envs {
value := string(env.Value)
if env.Type == constant.EnvTypeSecret {
if decValue, err := utils.Decrypt(value); err == nil {
value = decValue
if env.Enabled && value != "" {
secrets = append(secrets, value)
}
}
}
if !env.Enabled {
value = ""
}
if idx, ok := nameToIndex[env.Name]; ok {
mergedList[idx].values = append(mergedList[idx].values, value)
} else {
nameToIndex[env.Name] = len(mergedList)
mergedList = append(mergedList, mergedEnv{
name: env.Name,
values: []string{value},
})
}
}
var result []string
for _, item := range mergedList {
// 多个值使用 & 拼接
val := strings.Join(item.values, "&")
result = append(result, item.name+"="+val)
}
return result
return result, secrets
}
// splitEnvIDs 解析逗号分隔的ID字符串
internal/services/tasks/executor_service.go
+14 -10
View File
@@ -38,6 +38,8 @@ type SettingsService interface {
type EnvService interface {
GetEnvVarsByIDs(ids string) []string
GetAllEnvVars() []string
GetEnvVarsAndSecretsByIDs(ids string) ([]string, []string)
GetAllEnvVarsAndSecrets() ([]string, []string)
}
type ExecutorService struct {
@@ -143,7 +145,7 @@ func (h *ServerSchedulerHandler) OnTaskExecuting(req *executor.ExecutionRequest)
req.Metadata.GoID = goid
// 3. 创建 TinyLog 实时日志收集器
tl, err := NewTinyLog(taskLog.ID)
tl, err := NewTinyLog(taskLog.ID, req.Secrets)
if err != nil {
h.es.RemoveRunningGo(task.ID, goid) // 回滚运行状态
return nil, nil, fmt.Errorf("创建日志收集器失败: %v", err)
@@ -374,13 +376,14 @@ func (es *ExecutorService) HandleTaskRetry(task *models.Task, req *executor.Exec
return nil
}
newEnvs := es.loadEnvVars(latestTask.ID, string(latestTask.Envs))
newEnvs, newSecrets := es.loadEnvVars(latestTask.ID, string(latestTask.Envs))
return &executor.ExecutionRequest{
TaskID: req.TaskID,
Name: latestTask.Name,
Command: string(latestTask.Command),
WorkDir: latestTask.WorkDir,
Envs: newEnvs,
Secrets: newSecrets,
Timeout: latestTask.Timeout,
Languages: []map[string]string(latestTask.Languages),
UseMise: latestTask.UseMise(),
@@ -507,7 +510,7 @@ func (es *ExecutorService) AddCronTask(task *models.Task) error {
return nil
}
// 在加入调度器前，预先加载好环境信息
task.RuntimeEnvs = es.loadEnvVars(task.ID, string(task.Envs))
task.RuntimeEnvs, _ = es.loadEnvVars(task.ID, string(task.Envs))
return es.cronManager.AddTask(task)
}
@@ -588,7 +591,7 @@ func (es *ExecutorService) ExecuteTask(taskID string, extraEnvs []string) *execu
}
}
envs := es.loadEnvVars(task.ID, string(task.Envs))
envs, secrets := es.loadEnvVars(task.ID, string(task.Envs))
if len(extraEnvs) > 0 {
envs = append(envs, extraEnvs...)
}
@@ -599,6 +602,7 @@ func (es *ExecutorService) ExecuteTask(taskID string, extraEnvs []string) *execu
Command: string(task.Command),
WorkDir: task.WorkDir,
Envs: envs,
Secrets: secrets,
Timeout: task.Timeout,
Languages: []map[string]string(task.Languages),
UseMise: task.UseMise(),
@@ -1001,8 +1005,8 @@ func (es *ExecutorService) BuildRepoCommand(task *models.Task) (string, string)
return buildRepoCommandEnvPrefix()+cmdStr, filepath.Dir(exePath)
}
// loadEnvVars 加载环境变量，支持全局注入及重名合并
func (es *ExecutorService) loadEnvVars(taskID string, envIDs string) []string {
// loadEnvVars 加载环境变量和掩码信息，支持全局注入及重名合并
func (es *ExecutorService) loadEnvVars(taskID string, envIDs string) ([]string, []string) {
// 1. 检查是否开启了注入全部环境变量
if taskID != "" && es.taskService != nil {
task := es.taskService.GetTaskByID(taskID)
@@ -1011,7 +1015,7 @@ func (es *ExecutorService) loadEnvVars(taskID string, envIDs string) []string {
if err := json.Unmarshal([]byte(task.Config), &config); err == nil {
if config.AllEnvs {
if es.envService != nil {
return es.envService.GetAllEnvVars()
return es.envService.GetAllEnvVarsAndSecrets()
}
}
}
@@ -1020,14 +1024,14 @@ func (es *ExecutorService) loadEnvVars(taskID string, envIDs string) []string {
// 2. 否则按 ID 列表进行加载（支持合并逻辑在 envService 中处理）
if envIDs == "" {
return nil
return nil, nil
}
if es.envService != nil {
return es.envService.GetEnvVarsByIDs(envIDs)
return es.envService.GetEnvVarsAndSecretsByIDs(envIDs)
}
return nil
return nil, nil
}
func (es *ExecutorService) ResolvePath(path string) string {
internal/services/tasks/tiny_log.go
+7 -5
View File
@@ -56,11 +56,12 @@ type TinyLog struct {
writer *bufio.Writer
subscribers []chan []byte
remainder []byte // Leftover bytes from previous write (partial multi-byte characters)
masks []string // Secrets to mask
closed bool
}
// NewTinyLog 创建一个新的 TinyLog 实例（基于临时文件存储）并注册它
func NewTinyLog(logID string) (*TinyLog, error) {
// NewTinyLog 创建一个新的 TinyLog 实例（基于临时文件存储）并注册它，支持将配置的 masks 替换为 ********
func NewTinyLog(logID string, masks []string) (*TinyLog, error) {
f, err := os.CreateTemp("", "task_log_*.log")
if err != nil {
return nil, err
@@ -72,6 +73,7 @@ func NewTinyLog(logID string) (*TinyLog, error) {
path: f.Name(),
writer: bufio.NewWriter(f),
subscribers: make([]chan []byte, 0),
masks: masks,
}
globalTinyLogManager.Register(tl)
return tl, nil
@@ -115,8 +117,8 @@ func (l *TinyLog) Write(p []byte) (n int, err error) {
return originalInputLen, nil
}
// 3. 仅将完整的部分转换为 UTF-8
text := utils.ToUTF8(payload[:lastSafe])
// 3. 仅将完整的部分转换为 UTF-8，并调用封装的函数进行脱敏处理
text := utils.MaskSecrets(utils.ToUTF8(payload[:lastSafe]), l.masks)
data := []byte(text)
// 4. 写入文件缓冲区
@@ -179,7 +181,7 @@ func (l *TinyLog) Close() error {
// 处理剩余的字节
if len(l.remainder) > 0 {
text := utils.ToUTF8(l.remainder)
text := utils.MaskSecrets(utils.ToUTF8(l.remainder), l.masks)
data := []byte(text)
_, _ = l.writer.Write(data)
internal/utils/crypto.go
+114
View File
@@ -0,0 +1,114 @@
package utils
import (
"crypto/aes"
"crypto/cipher"
"crypto/rand"
"crypto/sha256"
"encoding/base64"
"errors"
"io"
"os"
"strings"
)
var (
masterSecretKey []byte
ErrKeyNotSet = errors.New("加密秘钥未配置，请按照文档使用 BAIHU_SECRET_KEY 环境变量启动服务配置秘钥")
)
// InitSecretKey initialized the master secret key from the environment and unsets it
func InitSecretKey() {
key := os.Getenv("BAIHU_SECRET_KEY")
if key != "" {
hash := sha256.Sum256([]byte(key))
masterSecretKey = hash[:]
// Ensure it's only in memory by unsetting the environment variable
os.Unsetenv("BAIHU_SECRET_KEY")
}
}
// IsSecretKeySet returns true if the master secret key is configured
func IsSecretKeySet() bool {
return len(masterSecretKey) > 0
}
// Encrypt encrypts a plaintext string using AES-GCM
func Encrypt(plaintext string) (string, error) {
if plaintext == "" {
return "", nil
}
if !IsSecretKeySet() {
return "", ErrKeyNotSet
}
block, err := aes.NewCipher(masterSecretKey)
if err != nil {
return "", err
}
aesGCM, err := cipher.NewGCM(block)
if err != nil {
return "", err
}
nonce := make([]byte, aesGCM.NonceSize())
if _, err = io.ReadFull(rand.Reader, nonce); err != nil {
return "", err
}
ciphertext := aesGCM.Seal(nonce, nonce, []byte(plaintext), nil)
return base64.StdEncoding.EncodeToString(ciphertext), nil
}
// Decrypt decrypts a ciphertext string using AES-GCM
// Returns the original string if decryption fails or if it wasn't encrypted
func Decrypt(ciphertext string) (string, error) {
if ciphertext == "" {
return "", nil
}
if !IsSecretKeySet() {
return ciphertext, ErrKeyNotSet
}
data, err := base64.StdEncoding.DecodeString(ciphertext)
if err != nil {
return ciphertext, err
}
block, err := aes.NewCipher(masterSecretKey)
if err != nil {
return ciphertext, err
}
aesGCM, err := cipher.NewGCM(block)
if err != nil {
return ciphertext, err
}
nonceSize := aesGCM.NonceSize()
if len(data) < nonceSize {
return ciphertext, errors.New("ciphertext too short")
}
nonce, ciphertextBytes := data[:nonceSize], data[nonceSize:]
plaintext, err := aesGCM.Open(nil, nonce, ciphertextBytes, nil)
if err != nil {
return ciphertext, err
}
return string(plaintext), nil
}
// MaskSecrets 将文本中的所有敏感机密值替换为脱敏字符串 "********"
func MaskSecrets(text string, secrets []string) string {
if len(secrets) == 0 || text == "" {
return text
}
for _, mask := range secrets {
if mask != "" {
text = strings.ReplaceAll(text, mask, "********")
}
}
return text
}