【安全加密】数据脱敏：日志与取证导出的隐私处理

---数据的脱敏：按类型掩码
local function maskName(name)
    if #name <= 2 then return name:sub(1, 1) .. "*" end
    return name:sub(1, 1) ..
        string.rep("*", #name - 2) .. name:sub(-1)
end

local function maskPhone(phone)
    return phone:sub(1, 3) .. "****" .. phone:sub(-4)
end

---取证导出的脱敏通道
function Export.evidence(logs)
    local out = {}
    for _, l in ipairs(logs) do
        out[#out + 1] = {
            name = maskName(l.name),
            phone = l.phone and maskPhone(l.phone) or "",
            action = l.action,
            at = os.time(),
        }
    end
    return out
end

---查阅的权限：脱敏与明文的分权
function Export.query(actor, scope)
    local pos = Admin.levelOf(actor)
    if pos >= 8 then
        -- 高权限：明文实时查询，不落盘
        return Export.raw(scope)
    end
    -- 普通权限：脱敏结果，可留存
    return Export.evidence(Export.raw(scope))
end

---明文查询的告警与留痕
function Export.raw(scope)
    Ops.alert("明文数据查询", Admin.who(actor),
        scope, os.time())
    return DB.query(scope)
end