加固后台管理安全

backend/internal/modules/paymentconfig/handler.go

@@ -61,8 +61,17 @@ func (h *Handler) Get(c *gin.Context) {
 	}
 
 	includeSecret := c.Query("include_secret") == "true"
+	var actorID uint64
+	if includeSecret {
+		var ok bool
+		actorID, ok = currentAdminID(c)
+		if !ok {
+			response.Unauthorized(c, "未授权")
+			return
+		}
+	}
 
-	config, err := h.service.Get(c.Request.Context(), id, includeSecret)
+	config, err := h.service.Get(c.Request.Context(), id, includeSecret, actorID, auditMeta(c))
 	if err == ErrConfigNotFound {
 		response.NotFound(c, "配置不存在")
 		return

backend/internal/modules/paymentconfig/query.go

@@ -65,7 +65,7 @@ func (r *Repository) List(ctx context.Context, query ListQuery) ([]ConfigDTO, in
 // FindByID 根据 ID 查询配置
 
 // FindByID 根据 ID 查询配置
-func (r *Repository) FindByID(ctx context.Context, id uint64, includeSecret bool) (*ConfigDTO, error) {
+func (r *Repository) FindByID(ctx context.Context, id uint64, includeSecret bool, actorID uint64, meta AuditMeta) (*ConfigDTO, error) {
 	var item model.PaymentMerchantConfig
 	if err := r.db.WithContext(ctx).Where("id = ?", id).First(&item).Error; err != nil {
 		if errors.Is(err, gorm.ErrRecordNotFound) {
@@ -77,6 +77,15 @@ func (r *Repository) FindByID(ctx context.Context, id uint64, includeSecret bool
 	if err != nil {
 		return nil, err
 	}
+	if includeSecret {
+		if err := appendAuditLog(r.db.WithContext(ctx), actorID, "payment_config.view_secret", item.ID, meta, map[string]any{
+			"name":        item.Name,
+			"provider":    item.Provider,
+			"merchant_id": item.MerchantID,
+		}); err != nil {
+			return nil, err
+		}
+	}
 	return &dto, nil
 }
 

backend/internal/modules/paymentconfig/service.go

@@ -35,8 +35,8 @@ func (s *Service) List(ctx context.Context, query ListQuery) (*ListResponse, err
 }
 
 // Get 获取单个配置
-func (s *Service) Get(ctx context.Context, id uint64, includeSecret bool) (*ConfigDTO, error) {
-	return s.repo.FindByID(ctx, id, includeSecret)
+func (s *Service) Get(ctx context.Context, id uint64, includeSecret bool, actorID uint64, meta AuditMeta) (*ConfigDTO, error) {
+	return s.repo.FindByID(ctx, id, includeSecret, actorID, meta)
 }
 
 // ExportBackup 导出支付配置备份。