fix: close platform admin final audit findings

backend/api/internal/logic/platform/task4_resources.go

@@ -94,7 +94,7 @@ func listResource(ctx *gin.Context, model any) {
 	page, size := pageSize(ctx)
 	list := reflect.New(reflect.SliceOf(reflect.TypeOf(model).Elem()))
 	var total int64
-	query := impl.DBService.Model(model)
+	query := applyKeywordFilter(ctx, impl.DBService.Model(model), model)
 	if err := query.Count(&total).Error; err != nil {
 		infra.Response.Error(ctx, err)
 		return
@@ -108,7 +108,7 @@ func listResource(ctx *gin.Context, model any) {
 		infra.Response.Error(ctx, err)
 		return
 	}
-	infra.Response.Success(ctx, gin.H{"total": total, "list": response})
+	infra.Response.Success(ctx, gin.H{"total": total, "list": protectPreciseLocation(ctx, model, response)})
 }
 
 func getResource(ctx *gin.Context, model any) {
@@ -122,7 +122,7 @@ func getResource(ctx *gin.Context, model any) {
 		infra.Response.Error(ctx, err)
 		return
 	}
-	infra.Response.Success(ctx, response)
+	infra.Response.Success(ctx, protectPreciseLocation(ctx, model, response))
 }
 
 func createResource(ctx *gin.Context, model any, allowedFields []string, relations []ResourceRelation) {
@@ -146,7 +146,88 @@ func createResource(ctx *gin.Context, model any, allowedFields []string, relatio
 		infra.Response.Error(ctx, err)
 		return
 	}
-	infra.Response.Success(ctx, resourceResponse(data.Interface()))
+	respondCreatedResource(ctx, data.Interface())
+}
+
+func respondCreatedResource(ctx *gin.Context, value any) {
+	response, err := publicResourceResponse(value)
+	if err != nil {
+		infra.Response.Error(ctx, err)
+		return
+	}
+	infra.Response.Success(ctx, maskCreatedSensitiveFields(response))
+}
+
+func maskCreatedSensitiveFields(value any) any {
+	switch data := value.(type) {
+	case map[string]any:
+		if phone, ok := data["phone"].(string); ok {
+			data["phone_masked"] = maskPhone(phone)
+			delete(data, "phone")
+		}
+		if realName, ok := data["real_name"].(string); ok {
+			data["real_name_masked"] = maskSecret(realName)
+			delete(data, "real_name")
+		}
+		if credentialNo, ok := data["credential_no"].(string); ok {
+			data["credential_no_masked"] = maskSecret(credentialNo)
+			delete(data, "credential_no")
+		}
+		delete(data, "longitude")
+		delete(data, "latitude")
+		for key, item := range data {
+			data[key] = maskCreatedSensitiveFields(item)
+		}
+	case []any:
+		for index := range data {
+			data[index] = maskCreatedSensitiveFields(data[index])
+		}
+	}
+	return value
+}
+
+func maskSecret(value string) string {
+	characters := []rune(value)
+	if len(characters) <= 1 {
+		return "*"
+	}
+	visible := 1
+	if len(characters) > 4 {
+		visible = 4
+	}
+	return strings.Repeat("*", len(characters)-visible) + string(characters[len(characters)-visible:])
+}
+
+func protectPreciseLocation(ctx *gin.Context, model, value any) any {
+	if reflect.TypeOf(model) != reflect.TypeOf(&models.DeliveryTrackPoint{}) || hasPreciseLocationScope(ctx) {
+		return value
+	}
+	clearCoordinateFields(value)
+	return value
+}
+
+func hasPreciseLocationScope(ctx *gin.Context) bool {
+	claims, err := middleware.ParseAuth(ctx)
+	return err == nil && claims.Extend["location_scope"] == "precise"
+}
+
+func clearCoordinateFields(value any) {
+	switch data := value.(type) {
+	case map[string]any:
+		if _, ok := data["longitude"]; ok {
+			data["longitude"] = ""
+		}
+		if _, ok := data["latitude"]; ok {
+			data["latitude"] = ""
+		}
+		for _, item := range data {
+			clearCoordinateFields(item)
+		}
+	case []any:
+		for _, item := range data {
+			clearCoordinateFields(item)
+		}
+	}
 }
 
 func updateResource(ctx *gin.Context, model any, allowedFields []string, relations []ResourceRelation) {
@@ -521,11 +602,7 @@ func GetDeliveryTrack(ctx *gin.Context) {
 		infra.Response.Error(ctx, err)
 		return
 	}
-	precise := false
-	if claims, err := middleware.ParseAuth(ctx); err == nil {
-		precise = claims.Extend["location_scope"] == "precise"
-	}
-	if !precise {
+	if !hasPreciseLocationScope(ctx) {
 		for index := range points {
 			points[index].Longitude = ""
 			points[index].Latitude = ""