Add files via upload

internal/audit/meta.go

@@ -0,0 +1,9 @@
+package audit
+
+// RetentionDays returns configured retention; 0 means keep forever.
+func (s *Service) RetentionDays() int {
+	if s == nil || s.cfg == nil {
+		return 0
+	}
+	return s.cfg.Audit.RetentionDaysEffective()
+}

internal/audit/record.go

@@ -0,0 +1,29 @@
+package audit
+
+import "github.com/gin-gonic/gin"
+
+// RecordAction writes a platform audit row with common defaults.
+func (s *Service) RecordAction(c *gin.Context, category, action, result, message, resourceType, resourceID string, detail map[string]interface{}) {
+	if s == nil {
+		return
+	}
+	s.Record(c, Entry{
+		Category:     category,
+		Action:       action,
+		Result:       result,
+		Message:      message,
+		ResourceType: resourceType,
+		ResourceID:   resourceID,
+		Detail:       detail,
+	})
+}
+
+// RecordOK is a shorthand for successful operations.
+func (s *Service) RecordOK(c *gin.Context, category, action, message, resourceType, resourceID string, detail map[string]interface{}) {
+	s.RecordAction(c, category, action, "success", message, resourceType, resourceID, detail)
+}
+
+// RecordFail is a shorthand for failed operations.
+func (s *Service) RecordFail(c *gin.Context, category, action, message string, detail map[string]interface{}) {
+	s.RecordAction(c, category, action, "failure", message, "", "", detail)
+}

internal/audit/retention.go

@@ -0,0 +1,24 @@
+package audit
+
+import (
+	"time"
+
+	"go.uber.org/zap"
+)
+
+// StartRetentionLoop periodically purges expired audit rows.
+func StartRetentionLoop(s *Service, logger *zap.Logger) {
+	if s == nil {
+		return
+	}
+	go func() {
+		ticker := time.NewTicker(24 * time.Hour)
+		defer ticker.Stop()
+		for range ticker.C {
+			s.PurgeExpired()
+			if logger != nil {
+				logger.Debug("audit retention tick completed")
+			}
+		}
+	}()
+}

internal/audit/sanitize.go

@@ -0,0 +1,58 @@
+package audit
+
+import (
+	"encoding/json"
+	"strings"
+)
+
+var sensitiveKeySubstrings = []string{
+	"password", "api_key", "apikey", "secret", "token", "authorization",
+	"credential", "private_key", "access_key",
+}
+
+// SanitizeDetail redacts sensitive keys and truncates serialized size.
+func SanitizeDetail(detail map[string]interface{}, maxBytes int) map[string]interface{} {
+	if detail == nil {
+		return nil
+	}
+	if maxBytes <= 0 {
+		maxBytes = 8192
+	}
+	out := sanitizeValue("", detail)
+	if m, ok := out.(map[string]interface{}); ok {
+		b, _ := json.Marshal(m)
+		if len(b) > maxBytes {
+			return map[string]interface{}{
+				"_truncated": true,
+				"_preview":   string(b[:maxBytes]),
+			}
+		}
+		return m
+	}
+	return map[string]interface{}{"value": out}
+}
+
+func sanitizeValue(key string, v interface{}) interface{} {
+	kl := strings.ToLower(key)
+	for _, sub := range sensitiveKeySubstrings {
+		if strings.Contains(kl, sub) {
+			return "***"
+		}
+	}
+	switch t := v.(type) {
+	case map[string]interface{}:
+		m := make(map[string]interface{}, len(t))
+		for k, val := range t {
+			m[k] = sanitizeValue(k, val)
+		}
+		return m
+	case []interface{}:
+		arr := make([]interface{}, len(t))
+		for i, val := range t {
+			arr[i] = sanitizeValue(key, val)
+		}
+		return arr
+	default:
+		return v
+	}
+}

internal/audit/service.go

@@ -0,0 +1,166 @@
+package audit
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"strings"
+	"time"
+
+	"cyberstrike-ai/internal/config"
+	"cyberstrike-ai/internal/database"
+	"cyberstrike-ai/internal/security"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"go.uber.org/zap"
+)
+
+// Service persists platform audit logs.
+type Service struct {
+	db           *database.DB
+	cfg          *config.Config
+	logger       *zap.Logger
+	failThrottle *failureThrottle
+}
+
+// NewService creates an audit service.
+func NewService(db *database.DB, cfg *config.Config, logger *zap.Logger) *Service {
+	return &Service{
+		db:           db,
+		cfg:          cfg,
+		logger:       logger,
+		failThrottle: newFailureThrottle(),
+	}
+}
+
+// Enabled reports whether audit persistence is on.
+func (s *Service) Enabled() bool {
+	if s == nil || s.cfg == nil {
+		return false
+	}
+	return s.cfg.Audit.EnabledEffective()
+}
+
+// Record writes one audit row from a Gin request context.
+func (s *Service) Record(c *gin.Context, e Entry) {
+	if s == nil || !s.Enabled() || s.db == nil {
+		return
+	}
+	if strings.TrimSpace(e.Category) == "" || strings.TrimSpace(e.Action) == "" {
+		return
+	}
+	if e.Result == "failure" && !s.allowFailureAudit(c, e) {
+		return
+	}
+	if strings.TrimSpace(e.Result) == "" {
+		e.Result = "success"
+	}
+	if strings.TrimSpace(e.Level) == "" {
+		if e.Result == "failure" {
+			e.Level = "warn"
+		} else {
+			e.Level = "info"
+		}
+	}
+	if strings.TrimSpace(e.Actor) == "" {
+		e.Actor = "admin"
+	}
+	if e.SessionHint == "" && c != nil {
+		if token := c.GetString(security.ContextAuthTokenKey); token != "" {
+			e.SessionHint = sessionHint(token)
+		}
+	}
+	maxDetail := s.cfg.Audit.MaxDetailBytesEffective()
+	detail := SanitizeDetail(e.Detail, maxDetail)
+
+	row := &database.AuditLog{
+		ID:           "audit_" + strings.ReplaceAll(uuid.New().String(), "-", ""),
+		CreatedAt:    time.Now(),
+		Level:        e.Level,
+		Category:     e.Category,
+		Action:       e.Action,
+		Result:       e.Result,
+		Actor:        e.Actor,
+		SessionHint:  e.SessionHint,
+		ClientIP:     clientIP(c),
+		UserAgent:    userAgent(c),
+		ResourceType: e.ResourceType,
+		ResourceID:   e.ResourceID,
+		Message:      e.Message,
+		Detail:       detail,
+	}
+	if err := s.db.AppendAuditLog(row); err != nil && s.logger != nil {
+		s.logger.Warn("写入审计日志失败",
+			zap.String("action", e.Action),
+			zap.Error(err),
+		)
+	}
+}
+
+// RecordSystem writes an audit row without HTTP context (e.g. retention cleanup).
+func (s *Service) RecordSystem(e Entry) {
+	s.Record(nil, e)
+}
+
+// PurgeExpired deletes rows older than retention_days when configured.
+func (s *Service) PurgeExpired() {
+	if s == nil || s.db == nil || s.cfg == nil {
+		return
+	}
+	days := s.cfg.Audit.RetentionDaysEffective()
+	if days <= 0 {
+		return
+	}
+	cutoff := time.Now().AddDate(0, 0, -days)
+	n, err := s.db.DeleteAuditLogsBefore(cutoff)
+	if err != nil {
+		if s.logger != nil {
+			s.logger.Warn("清理过期审计日志失败", zap.Error(err))
+		}
+		return
+	}
+	if n > 0 && s.logger != nil {
+		s.logger.Info("已清理过期审计日志", zap.Int64("deleted", n))
+	}
+}
+
+// HintFromToken returns a short stable hash prefix for a session token.
+func HintFromToken(token string) string {
+	return sessionHint(token)
+}
+
+func sessionHint(token string) string {
+	token = strings.TrimSpace(token)
+	if token == "" {
+		return ""
+	}
+	sum := sha256.Sum256([]byte(token))
+	return hex.EncodeToString(sum[:4])
+}
+
+func (s *Service) allowFailureAudit(c *gin.Context, e Entry) bool {
+	if !isAuthFailureThrottled(e.Category, e.Action) {
+		return true
+	}
+	cooldown := time.Duration(s.cfg.Audit.AuthFailureCooldownEffective()) * time.Second
+	key := authFailureThrottleKey(e.Category, e.Action, clientIP(c))
+	return s.failThrottle.allow(key, cooldown)
+}
+
+func clientIP(c *gin.Context) string {
+	if c == nil {
+		return ""
+	}
+	return c.ClientIP()
+}
+
+func userAgent(c *gin.Context) string {
+	if c == nil {
+		return ""
+	}
+	ua := c.GetHeader("User-Agent")
+	if len(ua) > 512 {
+		return ua[:512]
+	}
+	return ua
+}

internal/audit/throttle.go

@@ -0,0 +1,55 @@
+package audit
+
+import (
+	"sync"
+	"time"
+)
+
+// failureThrottle deduplicates high-frequency failure audit rows (e.g. wrong password).
+type failureThrottle struct {
+	mu   sync.Mutex
+	last map[string]time.Time
+}
+
+func newFailureThrottle() *failureThrottle {
+	return &failureThrottle{last: make(map[string]time.Time)}
+}
+
+// allow reports whether a row with the given key may be written now.
+func (t *failureThrottle) allow(key string, cooldown time.Duration) bool {
+	if t == nil || cooldown <= 0 || key == "" {
+		return true
+	}
+	now := time.Now()
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	if prev, ok := t.last[key]; ok && now.Sub(prev) < cooldown {
+		return false
+	}
+	t.last[key] = now
+	if len(t.last) > 4096 {
+		for k, ts := range t.last {
+			if now.Sub(ts) > cooldown*2 {
+				delete(t.last, k)
+			}
+		}
+	}
+	return true
+}
+
+// authFailureThrottleKey builds a per-IP key for auth failure deduplication.
+func authFailureThrottleKey(category, action, clientIP string) string {
+	return category + ":" + action + ":" + clientIP
+}
+
+func isAuthFailureThrottled(category, action string) bool {
+	if category != "auth" {
+		return false
+	}
+	switch action {
+	case "login", "change_password":
+		return true
+	default:
+		return false
+	}
+}

internal/audit/types.go

@@ -0,0 +1,15 @@
+package audit
+
+// Entry describes one platform audit record (not chat/tool execution bodies).
+type Entry struct {
+	Level        string
+	Category     string
+	Action       string
+	Result       string // success | failure
+	Actor        string
+	SessionHint  string
+	ResourceType string
+	ResourceID   string
+	Message      string
+	Detail       map[string]interface{}
+}