初始化提交

backend/app/core/security.py

@@ -0,0 +1,44 @@
+"""敏感信息脱敏工具。"""
+
+import re
+from collections.abc import Mapping
+from typing import Any
+
+SENSITIVE_KEYS = {
+    "api_key",
+    "apikey",
+    "authorization",
+    "password",
+    "secret",
+    "token",
+    "access_token",
+    "refresh_token",
+    "private_key",
+}
+_REDACTED = "[REDACTED]"
+_BEARER_RE = re.compile(r"Bearer\s+[A-Za-z0-9._~+/-]+=*", re.IGNORECASE)
+
+
+def redact_text(value: str) -> str:
+    return _BEARER_RE.sub("Bearer [REDACTED]", value)
+
+
+def redact_mapping(data: Mapping[str, Any]) -> dict[str, Any]:
+    redacted: dict[str, Any] = {}
+    for key, value in data.items():
+        normalized = key.lower().replace("-", "_")
+        if normalized in SENSITIVE_KEYS or any(part in normalized for part in SENSITIVE_KEYS):
+            redacted[key] = _REDACTED
+        else:
+            redacted[key] = redact_value(value)
+    return redacted
+
+
+def redact_value(value: Any) -> Any:
+    if isinstance(value, str):
+        return redact_text(value)
+    if isinstance(value, Mapping):
+        return redact_mapping(value)
+    if isinstance(value, list):
+        return [redact_value(item) for item in value]
+    return value