手机号码优化

zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/controller/app/enforcement/AppEnfLoginController.java

@@ -94,10 +94,6 @@ public class AppEnfLoginController extends LoginController {
             return R.fail("用户名或密码错误");
         }
 
-        if (!verifyPassword(loginName, decryptedPassword, user.getSalt(), user.getPassword())) {
-            return R.fail("用户名或密码错误");
-        }
-
         // 6. 检查执法证件号是否为空
 //        if (user.getLawCertificateNum() == null || user.getLawCertificateNum().isBlank()) {
 //            return R.fail("该用户不是执法人员，无法登录执法端");
@@ -237,11 +233,9 @@ public class AppEnfLoginController extends LoginController {
                 return R.fail("部门ID查找错误!");
             }
 
-            // 8. 手机号解密处理(如是加密存储则返回明文以供前端展示与业务使用)
+
-            String phonenumber = user.getPhonenumber();
+        // 8. 手机号解密处理(双轨改造后 phonenumber 为 HSM 密文, 统一走备份字段解密返回明文)
-            if (CommonUtil.isPhoneEncrypted(phonenumber)) {
+            String phonenumber = CommonUtil.decryptPhoneForDisplay(user.getPhonenumber(), user.getCryptoRemarkTwo());
-                phonenumber = CommonUtil.decryptPhone(phonenumber);
-            }
 
             // 9. 构造返回数据
             Map<String, Object> data = new HashMap<>();

zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/controller/web/supervision/CommonController.java

@@ -91,18 +91,19 @@ public class CommonController  extends BaseController {
         return R.ok("同步操作日志密评成功", null);
     }
 
-
-
     /**
-     * 同步操作日志密评
+     * sys_user 敏感数据密评初始化
-     * @return
+     *
+     * @param loginName 可选, 指定登录账号则仅初始化该用户; 不传则初始化全部存量数据
      */
     @GetMapping("/initSysUserSensitiveData")
-    public R<Void> initSysUserSensitiveData() {
+    public R<Map<String, Integer>> initSysUserSensitiveData(@RequestParam(value = "loginName", required = false) String loginName) {
-        log.info("同步用户密评开始");
+        log.info("同步用户密评开始, loginName={}", loginName);
-        String loginName = "liufangyan1";
+        Map<String, Integer> stats = DataPermissionHelper.ignore(
-        DataPermissionHelper.ignore(() -> cryptoSensitiveHsmService.initSysUserSensitiveData(loginName));
+            () -> cryptoSensitiveHsmService.initSysUserSensitiveData(loginName));
-        return R.ok("同步操作日志密评成功", null);
+        log.info("同步用户密评结束: 扫描用户数={}, 成功字段数={}, 跳过字段数={}, 失败字段数={}",
+            stats.get("total"), stats.get("success"), stats.get("skip"), stats.get("fail"));
+        return R.ok("同步用户密评成功", stats);
     }
 
 

zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/quartz/job/SynUserInfoJob.java

@@ -67,7 +67,7 @@ public class SynUserInfoJob {
             while (true) {
                 SrzUserBo srzUserBo = new SrzUserBo();
                 srzUserBo.setNeedUpdate(0L);
-                srzUserBo.setUsername("liufangyan1");
+//                srzUserBo.setUsername("liufangyan1");
                 List<SrzUserVo> srzUserList = iSrzUserService.queryList(srzUserBo);
                 // 如果查出结果为空 或 长度为0 则跳出循环
                 if (srzUserList == null || srzUserList.isEmpty() || srzUserList.size() == 0) break;

zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/service/impl/NonEnforcementRegistrationServiceImpl.java

@@ -267,7 +267,8 @@ public class NonEnforcementRegistrationServiceImpl implements INonEnforcementReg
                     if (sysUserVo != null) {
                         String lawCN = sysUserVo.getLawCertificateNum();
                         if (StringUtils.isEmpty(lawCN)) {
-                            lawCN = CommonUtil.encryptPhone(sysUserVo.getPhonenumber());
+                            // 修复: 双轨改造后 phonenumber 为 HSM 密文, 走备份字段解密后脱敏
+                            lawCN = CommonUtil.encryptPhone(sysUserVo.getPhonenumber(), sysUserVo.getCryptoRemarkTwo());
                         }
                         li.setLawEnforcer(sysUserVo.getUserName() + " " + lawCN);
                     } else {
@@ -288,7 +289,8 @@ public class NonEnforcementRegistrationServiceImpl implements INonEnforcementReg
                             if (u != null) {
                                 String temp = u.getLawCertificateNum();
                                 if (StringUtils.isEmpty(temp)) {
-                                    temp = CommonUtil.encryptPhone(u.getPhonenumber());
+                                    // 修复: 双轨改造后 phonenumber 为 HSM 密文, 走备份字段解密后脱敏
+                                    temp = CommonUtil.encryptPhone(u.getPhonenumber(), u.getCryptoRemarkTwo());
                                 }
                                 lawTwoList.add(u.getUserName() + " " + temp);
                             }

zdxt-modules/zdxt-system/src/main/java/org/dromara/system/service/impl/CryptoSensitiveHsmServiceImpl.java

@@ -829,7 +829,6 @@ public class CryptoSensitiveHsmServiceImpl implements ICryptoSensitiveHsmService
      * 使用 srnwg.secretKey 解密 AES 密文，返回明文
      */
     private String decryptAes(String value) {
-        log.info("开始AES解密 {}", value);
         return SecureUtil.aes(SecureUtil.decode(secretKey)).decryptStr(value);
     }
 

zdxt-modules/zdxt-system/src/main/java/org/dromara/system/service/impl/PasswordPartyServiceImpl.java

@@ -242,11 +242,11 @@ public class PasswordPartyServiceImpl implements IPasswordPartyService {
             // 一条日志打印完整请求信息：请求连接、请求头、请求参数
             // 注意：不能用 JSONObject.toJSONString(request) 序列化 HttpRequest，
             // Hutool 取请求头的方法是 headers()（非 getHeaders()），fastjson 序列化时拿不到头信息
-            log.info("HSM{}完整请求信息 >>> [URL]: {} [方法]: POST [超时]: {}ms [请求头]: {} [请求体]: {}",
+            log.debug("HSM{}完整请求信息 >>> [URL]: {} [方法]: POST [超时]: {}ms [请求头]: {} [请求体]: {}",
                 apiName, url, 10000, request.headers(), params.toJSONString());
 
             HttpResponse response = request.execute();
-            log.info("HSM请求响应: {}",  JSONObject.toJSONString(response.body()));
+            log.debug("HSM请求响应: {}",  JSONObject.toJSONString(response.body()));
 
             if (!response.isOk()) {
                 response.close();

zdxt-modules/zdxt-system/src/main/resources/mapper/system/SysUserMapper.xml

@@ -40,7 +40,7 @@
     </select>
 
     <select id="selectUserListByHave" parameterType="org.dromara.system.domain.bo.QuerySysUserBo" resultMap="SysUserResult">
-        select u.user_id, u.dept_id, u.login_name, u.user_name, u.email, u.avatar, u.phonenumber, u.password, u.sex,
+        select u.user_id, u.dept_id, u.login_name, u.user_name, u.email, u.avatar, u.phonenumber, u.password, u.sex, u.crypto_remark_two,
         u.salt, u.status, u.del_flag, u.login_ip, u.login_date, u.create_by, u.create_time, u.remark, u.type, d.dept_name,d.zzDisplayPath, u.law_certificate_num,
         d.leader,u.tenant_code,t.tenant_code, t.tenant_name, t.contact_man, t.contact_number, t.address
         from sys_user u
@@ -107,7 +107,7 @@
 
 
     <select id="queryUsersByPage" resultType="org.dromara.system.domain.vo.SysUserVo" parameterType="org.dromara.system.domain.bo.SysUserBo">
-        select u.user_id, u.dept_id, u.login_name, u.user_name, u.phonenumber, u.password, d.dept_name,u.law_certificate_num
+        select u.user_id, u.dept_id, u.login_name, u.user_name, u.phonenumber, u.password, d.dept_name, u.law_certificate_num, u.crypto_remark_two
         from sys_user u
         left join sys_dept d on u.dept_id = d.dept_id
         where u.del_flag = '0' and u.user_name != 'admin'
@@ -162,6 +162,7 @@
         u.email,
         u.avatar,
         u.phonenumber,
+        u.crypto_remark_two,
         u.sex,
         u.password,
         u.law_certificate_num,