From 6ca561404dcd8d25556727d5a20a2d8424a80e30 Mon Sep 17 00:00:00 2001
From: Trae AI <trae@example.com>
Date: Wed, 17 Jun 2026 23:40:31 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20AppCryptoMiddleware=E6=B7=BB=E5=8A=A0?=
 =?UTF-8?q?=E8=AF=B7=E6=B1=82=E4=BD=93=E8=A7=A3=E5=AF=86=E9=80=BB=E8=BE=91?=
 =?UTF-8?q?=EF=BC=8C=E4=BF=AE=E5=A4=8DAES=E5=8A=A0=E5=AF=86=E9=80=9A?=
 =?UTF-8?q?=E4=BF=A1=E7=99=BB=E5=BD=95=E5=A4=B1=E8=B4=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../internal/router/app/app_crypto_helper.go  | 47 ++++++++++++++++++-
 1 file changed, 46 insertions(+), 1 deletion(-)

diff --git a/backend/internal/router/app/app_crypto_helper.go b/backend/internal/router/app/app_crypto_helper.go
index d0f12dc..b1b5fb4 100644
--- a/backend/internal/router/app/app_crypto_helper.go
+++ b/backend/internal/router/app/app_crypto_helper.go
@@ -1,6 +1,9 @@
 package app
 
 import (
+	"bytes"
+	"encoding/json"
+	"io"
 	"verification-platform-backend/internal/database"
 	"verification-platform-backend/internal/model"
 	"verification-platform-backend/pkg/crypto"
@@ -41,9 +44,51 @@ func AppCryptoMiddleware() gin.HandlerFunc {
 		}
 
 		shouldEncrypt := encryptType != crypto.EncryptTypeNone
+		cm := crypto.NewCryptoManager(encryptType, app.EncryptKey)
+
+		// 解密请求体
+		if shouldEncrypt {
+			contentType := c.GetHeader("Content-Type")
+			if contentType != "" {
+				// 先尝试从 X-Encrypted-Data Header 解密
+				encryptedHeader := c.GetHeader("X-Encrypted-Data")
+				if encryptedHeader != "" {
+					decrypted, err := cm.Decrypt(encryptedHeader)
+					if err != nil {
+						c.JSON(400, gin.H{"code": 400, "message": "解密失败: " + err.Error()})
+						c.Abort()
+						return
+					}
+					c.Request.Body = io.NopCloser(bytes.NewBufferString(decrypted))
+					c.Request.ContentLength = int64(len(decrypted))
+				} else {
+					// 从请求体 JSON 的 data 字段解密
+					body, err := io.ReadAll(c.Request.Body)
+					if err == nil && len(body) > 0 {
+						var req map[string]interface{}
+						if json.Unmarshal(body, &req) == nil {
+							if dataStr, ok := req["data"].(string); ok {
+								decrypted, err := cm.Decrypt(dataStr)
+								if err != nil {
+									c.JSON(400, gin.H{"code": 400, "message": "解密失败: " + err.Error()})
+									c.Abort()
+									return
+								}
+								c.Request.Body = io.NopCloser(bytes.NewBufferString(decrypted))
+								c.Request.ContentLength = int64(len(decrypted))
+							} else {
+								c.Request.Body = io.NopCloser(bytes.NewBuffer(body))
+							}
+						} else {
+							c.Request.Body = io.NopCloser(bytes.NewBuffer(body))
+						}
+					}
+				}
+			}
+		}
 
 		c.Set("should_encrypt_response", shouldEncrypt)
-		c.Set("crypto_manager", crypto.NewCryptoManager(encryptType, app.EncryptKey))
+		c.Set("crypto_manager", cm)
 		c.Set("app", &app)
 
 		c.Next()