bsm-infra/full
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix version 1

Browse Source
This commit is contained in:
yanweidong
2026-09-22 21:15:34 +08:00
parent 9f86366638
commit d63d7e8b3a
277 changed files with 9959 additions and 1514 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
module/base/cloud/internal/logic/private/create_private_data.go
View File

@@ -35,6 +35,13 @@ func CreatePrivateData(ctx context.Context, in *pb.CreatePrivateDataRequest) (re
}
// logic code
// 使用服务端密钥加密资料内容后落库，客户端传入的 is_encrypted 不再作为依据
encryptedData, err := encryptPrivateData(in.Data)
if err != nil {
printer.Error("Encrypt private data error: %v", err)
return nil, err
}
record := models.CloudPrivate{
Std_IICUDS: types.Std_IICUDS{
Identity: utils.UUID(),
@@ -50,8 +57,8 @@ func CreatePrivateData(ctx context.Context, in *pb.CreatePrivateDataRequest) (re
DataType: in.DataType,
Title: in.Title,
Description: in.Description,
Data: in.Data,
IsEncrypted: in.IsEncrypted,
Data: encryptedData,
IsEncrypted: true,
Tags: in.Tags,
}

73
module/base/cloud/internal/logic/private/crypto.go Normal file
View File

@@ -0,0 +1,73 @@
package private
import (
"os"
"strings"
"git.apinb.com/bsm-sdk/core/crypto/aes"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/printer"
)
// privateDataKey 返回服务端持有的私人资料加密密钥，仅从环境变量 BSM_CloudPrivateKey 读取。
// 请求参数中传入的密钥一律不作为服务端密钥使用；
// 未配置或长度不足时直接报错，禁止回退到公开默认值（否则等同于未加密）。
func privateDataKey() ([]byte, error) {
secret := strings.TrimSpace(os.Getenv("BSM_CloudPrivateKey"))
if secret == "" {
printer.Error("环境变量 BSM_CloudPrivateKey 未配置，私人资料加密不可用")
return nil, errcode.ErrInternal
}
key := []byte(secret)
switch {
case len(key) >= 32:
return key[:32], nil
case len(key) >= 24:
return key[:24], nil
case len(key) >= 16:
return key[:16], nil
default:
printer.Error("环境变量 BSM_CloudPrivateKey 长度不足 16 字节，私人资料加密不可用")
return nil, errcode.ErrInternal
}
}
// encryptPrivateData 使用服务端密钥加密私人资料内容，返回十六进制密文
func encryptPrivateData(plain string) (string, error) {
key, err := privateDataKey()
if err != nil {
return "", err
}
cipherText, err := aes.AESGCMEncrypt([]byte(plain), key)
if err != nil {
return "", errcode.ErrInternal
}
return cipherText, nil
}
// decryptPrivateData 使用服务端密钥解密私人资料内容
func decryptPrivateData(cipherText string) (string, error) {
key, err := privateDataKey()
if err != nil {
return "", err
}
plain, err := aes.AESGCMDecrypt(cipherText, key)
if err != nil {
return "", errcode.ErrInternal
}
return string(plain), nil
}
// decryptPrivateDataForRead 读取私人资料时解密内容。
// 历史记录未由服务端加密（或标记与内容不符）时按原值返回，避免旧数据不可读。
func decryptPrivateDataForRead(data string, isEncrypted bool) string {
if !isEncrypted || data == "" {
return data
}
plain, err := decryptPrivateData(data)
if err != nil {
return data
}
return plain
}

53
module/base/cloud/internal/logic/private/decrypt_data.go
View File

@@ -2,18 +2,16 @@ package private
import (
"context"
"crypto/aes"
"crypto/cipher"
"encoding/base64"
"strings"
"time"
pb "bsm/full/module/base/cloud/pb"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/printer"
"git.apinb.com/bsm-sdk/core/service"
)
// 解密数据
// 解密数据（使用服务端密钥，客户端传入的 Key 不再作为服务端密钥）
func DecryptData(ctx context.Context, in *pb.DataRequest) (reply *pb.StatusReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, nil)
@@ -25,57 +23,16 @@ func DecryptData(ctx context.Context, in *pb.DataRequest) (reply *pb.StatusReply
if strings.TrimSpace(in.Data) == "" {
return nil, errcode.ErrInvalidArgument
}
if strings.TrimSpace(in.Key) == "" {
return nil, errcode.ErrInvalidArgument
}
// logic code
// 解码base64数据
ciphertext, err := base64.StdEncoding.DecodeString(in.Data)
if err != nil {
return nil, errcode.ErrInvalidArgument
}
key := []byte(in.Key)
if len(key) != 32 {
// 如果密钥长度不是32字节，进行填充或截断
if len(key) < 32 {
for len(key) < 32 {
key = append(key, 0)
}
} else {
key = key[:32]
}
}
block, err := aes.NewCipher(key)
if err != nil {
return nil, errcode.ErrInternal
}
// 使用GCM模式进行解密
gcm, err := cipher.NewGCM(block)
if err != nil {
return nil, errcode.ErrInternal
}
// 检查数据长度
if len(ciphertext) < gcm.NonceSize() {
return nil, errcode.ErrInvalidArgument
}
// 分离nonce和密文
nonce := ciphertext[:gcm.NonceSize()]
ciphertext = ciphertext[gcm.NonceSize():]
// 解密数据
plaintext, err := gcm.Open(nil, nonce, ciphertext, nil)
plainData, err := decryptPrivateData(in.Data)
if err != nil {
printer.Error("Decrypt data error: %v", err)
return nil, errcode.ErrInvalidArgument
}
return &pb.StatusReply{
Details: string(plaintext),
Details: plainData,
Timeseq: time.Now().UnixMilli(),
}, nil
}

45
module/base/cloud/internal/logic/private/encrypt_data.go
View File

@@ -2,20 +2,16 @@ package private
import (
"context"
"crypto/aes"
"crypto/cipher"
"crypto/rand"
"encoding/base64"
"io"
"strings"
"time"
pb "bsm/full/module/base/cloud/pb"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/printer"
"git.apinb.com/bsm-sdk/core/service"
)
// 加密数据
// 加密数据（使用服务端密钥，客户端传入的 Key 不再作为服务端密钥）
func EncryptData(ctx context.Context, in *pb.DataRequest) (reply *pb.StatusReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, nil)
@@ -27,47 +23,14 @@ func EncryptData(ctx context.Context, in *pb.DataRequest) (reply *pb.StatusReply
if strings.TrimSpace(in.Data) == "" {
return nil, errcode.ErrInvalidArgument
}
if strings.TrimSpace(in.Key) == "" {
return nil, errcode.ErrInvalidArgument
}
// logic code
// 简单的AES加密实现
key := []byte(in.Key)
if len(key) != 32 {
// 如果密钥长度不是32字节，进行填充或截断
if len(key) < 32 {
for len(key) < 32 {
key = append(key, 0)
}
} else {
key = key[:32]
}
}
block, err := aes.NewCipher(key)
encryptedData, err := encryptPrivateData(in.Data)
if err != nil {
printer.Error("Encrypt data error: %v", err)
return nil, errcode.ErrInternal
}
// 使用GCM模式进行加密
gcm, err := cipher.NewGCM(block)
if err != nil {
return nil, errcode.ErrInternal
}
// 生成随机nonce
nonce := make([]byte, gcm.NonceSize())
if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
return nil, errcode.ErrInternal
}
// 加密数据
ciphertext := gcm.Seal(nonce, nonce, []byte(in.Data), nil)
// 返回base64编码的加密数据
encryptedData := base64.StdEncoding.EncodeToString(ciphertext)
return &pb.StatusReply{
Details: encryptedData,
Timeseq: time.Now().UnixMilli(),

2
module/base/cloud/internal/logic/private/get_private_data.go
View File

@@ -46,7 +46,7 @@ func GetPrivateData(ctx context.Context, in *pb.IdentRequest) (reply *pb.CloudPr
DataType: privateData.DataType,
Title: privateData.Title,
Description: privateData.Description,
Data: privateData.Data,
Data: decryptPrivateDataForRead(privateData.Data, privateData.IsEncrypted),
IsEncrypted: privateData.IsEncrypted,
Tags: privateData.Tags,
CreatedAt: privateData.CreatedAt.Format(time.RFC3339),

2
module/base/cloud/internal/logic/private/get_private_data_by_type.go
View File

@@ -65,7 +65,7 @@ func GetPrivateDataByType(ctx context.Context, in *pb.FetchRequest) (reply *pb.L
DataType: data.DataType,
Title: data.Title,
Description: data.Description,
Data: data.Data,
Data: decryptPrivateDataForRead(data.Data, data.IsEncrypted),
IsEncrypted: data.IsEncrypted,
Tags: data.Tags,
CreatedAt: data.CreatedAt.Format(time.RFC3339),

2
module/base/cloud/internal/logic/private/list_private_data.go
View File

@@ -54,7 +54,7 @@ func ListPrivateData(ctx context.Context, in *pb.FetchRequest) (reply *pb.ListPr
DataType: data.DataType,
Title: data.Title,
Description: data.Description,
Data: data.Data,
Data: decryptPrivateDataForRead(data.Data, data.IsEncrypted),
IsEncrypted: data.IsEncrypted,
Tags: data.Tags,
CreatedAt: data.CreatedAt.Format(time.RFC3339),

2
module/base/cloud/internal/logic/private/search_private_data.go
View File

@@ -64,7 +64,7 @@ func SearchPrivateData(ctx context.Context, in *pb.FetchRequest) (reply *pb.List
DataType: data.DataType,
Title: data.Title,
Description: data.Description,
Data: data.Data,
Data: decryptPrivateDataForRead(data.Data, data.IsEncrypted),
IsEncrypted: data.IsEncrypted,
Tags: data.Tags,
CreatedAt: data.CreatedAt.Format(time.RFC3339),

11
module/base/cloud/internal/logic/private/update_private_data.go
View File

@@ -48,12 +48,19 @@ func UpdatePrivateData(ctx context.Context, in *pb.CloudPrivateItem) (reply *pb.
return nil, errcode.ErrInvalidArgument
}
// 使用服务端密钥加密资料内容后落库，客户端传入的 is_encrypted 不再作为依据
encryptedData, err := encryptPrivateData(in.Data)
if err != nil {
printer.Error("Encrypt private data error: %v", err)
return nil, err
}
// 更新字段
privateData.DataType = in.DataType
privateData.Title = in.Title
privateData.Description = in.Description
privateData.Data = in.Data
privateData.IsEncrypted = in.IsEncrypted
privateData.Data = encryptedData
privateData.IsEncrypted = true
privateData.Tags = in.Tags
if err := impl.DBService.Save(&privateData).Error; err != nil {