fix(audit): exclude authenticated principal from snapshots

common-audit/src/main/java/com/baiyue/common/audit/BusinessAuditAspect.java

@@ -41,7 +41,7 @@ public class BusinessAuditAspect {
     @Around("@annotation(audit)")
     public Object around(ProceedingJoinPoint pjp, BusinessAudit audit) throws Throwable {
         long start = System.nanoTime();
-        String before = audit.captureBefore() ? sanitizer.sanitize(pjp.getArgs()) : null;
+        String before = audit.captureBefore() ? sanitizer.sanitize(businessArguments(pjp.getArgs())) : null;
         Object result = null; Throwable failure = null;
         try { result = pjp.proceed(); return result; }
         catch (Throwable ex) { failure = ex; throw ex; }
@@ -79,6 +79,12 @@ public class BusinessAuditAspect {
         Authentication auth = SecurityContextHolder.getContext().getAuthentication();
         return auth != null && auth.getPrincipal() instanceof AuthenticatedUser u ? u : null;
     }
+    private Object[] businessArguments(Object[] arguments) {
+        if (arguments == null || arguments.length == 0) return new Object[0];
+        return java.util.Arrays.stream(arguments)
+            .filter(argument -> !(argument instanceof AuthenticatedUser))
+            .toArray();
+    }
     private String evaluateResourceId(ProceedingJoinPoint p, String expression) {
         if (expression == null || expression.isBlank()) return null;
         Object value = evaluate(p, expression);

common-audit/src/test/java/com/baiyue/common/audit/BusinessAuditAspectTest.java

@@ -29,12 +29,14 @@ class BusinessAuditAspectTest {
     @Test
     void platformOperationUsesTargetCustomerAndKeepsOperatorScope() throws Throwable {
         AuditEvent event = invoke(new AuthenticatedUser(7L, 0L, 0L, 1L,
-                "platform.admin", "PLATFORM", "WEB", Set.of()), 10001L);
+                "platform.admin", "PLATFORM", "WEB", Set.of("platform:customer:edit")), 10001L);
 
         assertThat(event.tenantId()).isEqualTo(10001L);
         assertThat(event.operatorTenantId()).isZero();
         assertThat(event.userId()).isEqualTo(7L);
         assertThat(event.appCode()).isEqualTo("PLATFORM");
+        assertThat(event.beforeData()).isEqualTo("[10001]");
+        assertThat(event.beforeData()).doesNotContain("platform.admin", "platform:customer:edit", "permissions");
     }
 
     @Test
@@ -57,7 +59,7 @@ class BusinessAuditAspectTest {
                 new UsernamePasswordAuthenticationToken(user, null, List.of()));
 
         TestOperations target = new TestOperations();
-        Method method = TestOperations.class.getDeclaredMethod("update", long.class);
+        Method method = TestOperations.class.getDeclaredMethod("update", AuthenticatedUser.class, long.class);
         MethodSignature signature = mock(MethodSignature.class);
         when(signature.getMethod()).thenReturn(method);
         when(signature.getParameterNames()).thenReturn(null);
@@ -65,7 +67,7 @@ class BusinessAuditAspectTest {
         ProceedingJoinPoint joinPoint = mock(ProceedingJoinPoint.class);
         when(joinPoint.getSignature()).thenReturn(signature);
         when(joinPoint.getTarget()).thenReturn(target);
-        when(joinPoint.getArgs()).thenReturn(new Object[]{requestedTenantId});
+        when(joinPoint.getArgs()).thenReturn(new Object[]{user, requestedTenantId});
         when(joinPoint.proceed()).thenReturn("ok");
 
         aspect.around(joinPoint, method.getAnnotation(BusinessAudit.class));
@@ -76,8 +78,8 @@ class BusinessAuditAspectTest {
     }
 
     private static final class TestOperations {
-        @BusinessAudit(event = "TEST_UPDATE", resourceType = "TEST", captureBefore = false, captureAfter = false)
-        public String update(long tenantId) {
+        @BusinessAudit(event = "TEST_UPDATE", resourceType = "TEST", captureAfter = false)
+        public String update(AuthenticatedUser user, long tenantId) {
             return "ok";
         }
     }