84 lines
3.4 KiB
Python
84 lines
3.4 KiB
Python
|
# ============================================================
|
|||
|
|
# 审计合规导出与保留脱敏 v1（moduleId: core-audit-export, 可重生 ✅）
|
|||
|
|
# plan.md §3.6 / 矩阵「全审计」：合规导出（json/csv）+ 敏感字段脱敏
|
|||
|
|
# ============================================================
|
|||
|
|
from __future__ import annotations # 前向类型引用
|
|||
|
|
|
|||
|
|
import csv # CSV 导出
|
|||
|
|
import io # 内存流
|
|||
|
|
import json # JSON 序列化
|
|||
|
|
from datetime import datetime # 时间戳
|
|||
|
|
from typing import Any # 类型标注
|
|||
|
|
|
|||
|
|
REDACTED = "***REDACTED***"
|
|||
|
|
# 精确敏感键集合（避免子串误伤 worldKey/monkey 等字段）
|
|||
|
|
_SENSITIVE_KEYS = frozenset({
|
|||
|
|
"token", "access_token", "refresh_token", "id_token", "session_token",
|
|||
|
|
"password", "passwd", "secret", "client_secret", "api_key", "apikey",
|
|||
|
|
"authorization", "credential", "credentials", "private_key",
|
|||
|
|
})
|
|||
|
|
|
|||
|
|
|
|||
|
|
def _is_sensitive_key(key: str) -> bool:
|
|||
|
|
low = str(key).lower().strip()
|
|||
|
|
return low in _SENSITIVE_KEYS or low.endswith("_secret")
|
|||
|
|
|
|||
|
|
|
|||
|
|
def sanitize_value(value: Any) -> Any:
|
|||
|
|
"""递归脱敏：敏感键名的值替换为掩码，其余原样保留。"""
|
|||
|
|
if isinstance(value, dict):
|
|||
|
|
return {
|
|||
|
|
k: (REDACTED if _is_sensitive_key(k) else sanitize_value(v))
|
|||
|
|
for k, v in value.items()
|
|||
|
|
}
|
|||
|
|
if isinstance(value, list):
|
|||
|
|
return [sanitize_value(v) for v in value]
|
|||
|
|
return value
|
|||
|
|
|
|||
|
|
|
|||
|
|
def sanitize_event(event: dict[str, Any]) -> dict[str, Any]:
|
|||
|
|
"""对单条审计事件脱敏（顶层与嵌套均覆盖敏感键）。"""
|
|||
|
|
return sanitize_value(dict(event))
|
|||
|
|
|
|||
|
|
|
|||
|
|
def export_events(events: list[dict[str, Any]], fmt: str = "json") -> str:
|
|||
|
|
"""导出当前作用域审计事件（脱敏后）。
|
|||
|
|
|
|||
|
|
fmt: json（列表 + 元信息）/ csv（表头 + 行）。
|
|||
|
|
"""
|
|||
|
|
cleaned = [sanitize_event(e) for e in events]
|
|||
|
|
if fmt == "json":
|
|||
|
|
try: # 完整 Merkle 根（矩阵 104 行）
|
|||
|
|
from server.agent_core.audit_merkle import merkle_root
|
|||
|
|
merkle = merkle_root(events)
|
|||
|
|
except Exception:
|
|||
|
|
merkle = None
|
|||
|
|
payload = {
|
|||
|
|
"exportedAt": _now_iso(),
|
|||
|
|
"count": len(cleaned),
|
|||
|
|
"chainOk": None, # 调用方可通过 verify 填充
|
|||
|
|
"merkleRoot": merkle, # 二叉树 Merkle 根（可复算校验）
|
|||
|
|
"events": cleaned,
|
|||
|
|
}
|
|||
|
|
return json.dumps(payload, ensure_ascii=False, indent=1)
|
|||
|
|
if fmt == "csv":
|
|||
|
|
buf = io.StringIO()
|
|||
|
|
writer = csv.writer(buf)
|
|||
|
|
if cleaned:
|
|||
|
|
writer.writerow(sorted(cleaned[0].keys()))
|
|||
|
|
for ev in cleaned:
|
|||
|
|
row = []
|
|||
|
|
for key in sorted(cleaned[0].keys()):
|
|||
|
|
val = ev.get(key)
|
|||
|
|
if isinstance(val, (dict, list)):
|
|||
|
|
val = json.dumps(val, ensure_ascii=False, sort_keys=True, default=str)
|
|||
|
|
row.append("" if val is None else str(val))
|
|||
|
|
writer.writerow(row)
|
|||
|
|
return buf.getvalue()
|
|||
|
|
raise ValueError(f"unsupported export format: {fmt!r}")
|
|||
|
|
|
|||
|
|
|
|||
|
|
def _now_iso() -> str:
|
|||
|
|
from server.timeutil import fmt_dt
|
|||
|
|
return fmt_dt(datetime.now())
|