feat: publish sanitized custom.97 source

model/audit_log.go

@@ -102,7 +102,7 @@ func RecordAuditLog(c *gin.Context, entry AuditLog) {
 	switch entry.ActorRole {
 	case common.RoleCommonUser, common.RoleAdminUser, common.RoleRootUser:
 	default:
-		logger.LogError(ctx, fmt.Sprintf("audit actor role unavailable (request_id=%s, actor_role=%d)", entry.RequestId, entry.ActorRole))
+		logger.LogError(ctx, common.LogText("audit actor role unavailable (request_id=%s, actor_role=%d)", entry.RequestId, entry.ActorRole))
 		entry.ActorRole = 0 // Unknown actors remain visible to root only.
 	}
 	if entry.Username == "" {
@@ -113,14 +113,14 @@ func RecordAuditLog(c *gin.Context, entry AuditLog) {
 		entry.UserAgent = string(ua[:512])
 	}
 	if LOG_DB == nil {
-		logger.LogError(ctx, fmt.Sprintf("audit log write failed (request_id=%s): log database unavailable", entry.RequestId))
+		logger.LogError(ctx, common.LogText("audit log write failed (request_id=%s): log database unavailable", entry.RequestId))
 		return
 	}
 	var row any = &entry
 	if common.UsingLogDatabase(common.DatabaseTypeClickHouse) {
 		encoded, err := common.Marshal(entry.Other)
 		if err != nil {
-			logger.LogError(ctx, fmt.Sprintf("audit log write failed (request_id=%s): %v", entry.RequestId, err))
+			logger.LogError(ctx, common.LogText("audit log write failed (request_id=%s): %v", entry.RequestId, err))
 			return
 		}
 		// The ClickHouse GORM insert callback passes structs to the native
@@ -132,7 +132,7 @@ func RecordAuditLog(c *gin.Context, entry AuditLog) {
 		}{AuditLog: entry, EncodedOther: string(encoded)}
 	}
 	if err := LOG_DB.Table("audit_logs").Create(row).Error; err != nil {
-		logger.LogError(ctx, fmt.Sprintf("audit log write failed (request_id=%s): %v", entry.RequestId, err))
+		logger.LogError(ctx, common.LogText("audit log write failed (request_id=%s): %v", entry.RequestId, err))
 	}
 }
 
@@ -202,14 +202,21 @@ func GetAuditLogs(filter AuditLogFilter, start, limit, viewerRole int) ([]*Audit
 	return logs, total, nil
 }
 
+// UserAccessTokenStatus describes the legacy users.access_token credential.
+//
+// Deprecated: 旧版面板访问令牌，仅在升级后的过渡期内使用；删除 users.access_token 列时一并移除。
 type UserAccessTokenStatus struct {
 	Exists     bool   `json:"exists"`
+	TokenHint  string `json:"token_hint"`
 	TokenRef   string `json:"token_ref"`
 	CreatedAt  *int64 `json:"created_at"`
 	LastUsedAt *int64 `json:"last_used_at"`
 	LastUsedIp string `json:"last_used_ip"`
 }
 
+// GetUserAccessTokenStatus reads last use of the legacy token from the access audit.
+//
+// Deprecated: 旧版面板访问令牌，仅在升级后的过渡期内使用；删除 users.access_token 列时一并移除。
 func GetUserAccessTokenStatus(userId int) (*UserAccessTokenStatus, error) {
 	var user User
 	if err := DB.Select("id", "role", "access_token", "access_token_created_at").First(&user, userId).Error; err != nil {
@@ -220,6 +227,7 @@ func GetUserAccessTokenStatus(userId int) (*UserAccessTokenStatus, error) {
 		return status, nil
 	}
 	status.TokenRef = AccessTokenFingerprint(user.GetAccessToken())
+	status.TokenHint = AccessTokenHint(user.GetAccessToken())
 	status.CreatedAt = user.AccessTokenCreatedAt
 	var latest AuditLog
 	query := LOG_DB.Select("created_at", "ip").Where("user_id = ? AND token_ref = ? AND category = ?", userId, status.TokenRef, AuditCategoryAccessToken)