feat: 数据源口令传输改为固定 AES，禁止明文 password

packages/base/src/locale/en-US/dmsDataSource.ts

@@ -119,6 +119,11 @@ export default {
     returnModify: 'Back to Edit',
     continueSubmit: 'Continue Submit'
   },
+
+  passwordTransport: {
+    encryptFailed: 'Failed to encrypt password. Please try again later.'
+  },
+
   testConnectModal: {
     errorTitle: 'DB instance {{instanceName}} connectivity test failed'
   },

packages/base/src/locale/zh-CN/dmsDataSource.ts

@@ -111,6 +111,10 @@ export default {
     continueSubmit: '继续提交'
   },
 
+  passwordTransport: {
+    encryptFailed: '口令加密失败，请稍后重试'
+  },
+
   testConnectModal: {
     errorTitle: '数据源{{instanceName}}连通性测试失败'
   },

packages/base/src/page/DataSource/components/AddDataSource/index.test.tsx

@@ -15,6 +15,20 @@ import EmitterKey from '../../../../data/EmitterKey';
 import EventEmitter from '../../../../utils/EventEmitter';
 import { mockProjectList } from '@actiontech/shared/lib/testUtil/mockApi/base/project/data';
 import AddDataSource from '.';
+import { encryptPasswordForTransport } from '../../../../utils/passwordTransportEncryption';
+
+jest.mock('../../../../utils/passwordTransportEncryption', () => ({
+  encryptPasswordForTransport: jest.fn(async () => ({
+    secret_password: 'mocked-secret-password-b64'
+  })),
+  PasswordTransportError: class PasswordTransportError extends Error {
+    reason: string;
+    constructor(reason: string) {
+      super(reason);
+      this.reason = reason;
+    }
+  }
+}));
 
 jest.mock('react-router-dom', () => {
   return {
@@ -37,6 +51,9 @@ describe('page/DataSource/AddDataSource', () => {
 
   beforeEach(() => {
     jest.useFakeTimers();
+    (encryptPasswordForTransport as jest.Mock).mockResolvedValue({
+      secret_password: 'mocked-secret-password-b64'
+    });
     (useNavigate as jest.Mock).mockImplementation(() => navigateSpy);
     baseMockApi.global.mockAllApi();
     getProjectListSpy = baseMockApi.project.getProjectList();
@@ -178,7 +195,7 @@ describe('page/DataSource/AddDataSource', () => {
         db_type: 'mysql',
         host: '1.1.1.1',
         user: 'root',
-        password: 'root',
+        secret_password: 'mocked-secret-password-b64',
         port: '3306',
         additional_params: [
           {
@@ -205,7 +222,7 @@ describe('page/DataSource/AddDataSource', () => {
         host: '1.1.1.1',
         maintenance_times: [],
         name: 'name-database',
-        password: 'root',
+        secret_password: 'mocked-secret-password-b64',
         port: '3306',
         sqle_config: {
           audit_enabled: true,
@@ -431,7 +448,7 @@ describe('page/DataSource/AddDataSource', () => {
         host: '1.1.1.1',
         maintenance_times: [],
         name: 'name-database',
-        password: 'root',
+        secret_password: 'mocked-secret-password-b64',
         port: '3306',
         sqle_config: {
           audit_enabled: true,

packages/base/src/page/DataSource/components/AddDataSource/index.tsx

@@ -2,7 +2,7 @@
 import { useBoolean } from 'ahooks';
 import { useCallback } from 'react';
 import { useForm } from 'antd/es/form/Form';
-import { Space, Typography } from 'antd';
+import { Space, Typography, message } from 'antd';
 import { PageLayoutHasFixedHeaderStyleWrapper } from '@actiontech/dms-kit';
 import {
   BasicButton,
@@ -20,26 +20,53 @@
 import { DmsApi } from '@actiontech/shared/lib/api';
 import { DataSourceFormContextProvide } from '../../context';
 import useCheckConnectable from '../../hooks/useCheckConnectable';
+import {
+  encryptPasswordForTransport,
+  PasswordTransportError
+} from '../../../../utils/passwordTransportEncryption';
 const AddDataSource = () => {
   const { t } = useTranslation();
   const navigate = useTypedNavigate();
+  const [messageApi, messageContextHolder] = message.useMessage();
   const [form] = useForm<DataSourceFormField>();
   const { onCheckConnectable, loading, connectAble, connectErrorMessage } =
     useCheckConnectable(form);
   const [resultVisible, { setTrue: showResult, setFalse: hideResult }] =
     useBoolean();
   const [submitLoading, { setTrue: startSubmit, setFalse: submitFinish }] =
     useBoolean();
+
+  const resolveTransportErrorMessage = useCallback(
+    (error: unknown) => {
+      if (
+        error instanceof PasswordTransportError &&
+        error.reason === 'encrypt_failed'
+      ) {
+        return t('dmsDataSource.passwordTransport.encryptFailed');
+      }
+      return t('dmsDataSource.passwordTransport.encryptFailed');
+    },
+    [t]
+  );
+
   const addDatabase = async (values: DataSourceFormField) => {
     startSubmit();
+    let cipher;
+    try {
+      cipher = await encryptPasswordForTransport(values.password ?? '');
+    } catch (error) {
+      messageApi.error(resolveTransportErrorMessage(error));
+      submitFinish();
+      return;
+    }
     const dbService: IDBServiceV2 = {
       name: values.name,
       desc: values.describe,
       db_type: values.type,
       host: values.ip,
       port: values.port.toString(),
       user: values.user,
-      password: values.password,
+      secret_password: cipher.secret_password,
       environment_tag_uid: values.environmentTagId,
       maintenance_times:
         values.maintenanceTime?.map((time) => ({
@@ -104,6 +131,7 @@
   };
   return (
     <PageLayoutHasFixedHeaderStyleWrapper>
+      {messageContextHolder}
       <DataSourceFormContextProvide
         value={{
           loading,

packages/base/src/page/DataSource/components/UpdateDataSource/index.test.tsx

@@ -14,6 +14,20 @@ import {
   mockProjectInfo
 } from '@actiontech/shared/lib/testUtil';
 import UpdateDataSource from '.';
+import { encryptPasswordForTransport } from '../../../../utils/passwordTransportEncryption';
+
+jest.mock('../../../../utils/passwordTransportEncryption', () => ({
+  encryptPasswordForTransport: jest.fn(async () => ({
+    secret_password: 'mocked-secret-password-b64'
+  })),
+  PasswordTransportError: class PasswordTransportError extends Error {
+    reason: string;
+    constructor(reason: string) {
+      super(reason);
+      this.reason = reason;
+    }
+  }
+}));
 
 jest.mock('react-router-dom', () => {
   return {
@@ -42,6 +56,9 @@ describe('page/DataSource/UpdateDataSource', () => {
 
   beforeEach(() => {
     jest.useFakeTimers();
+    (encryptPasswordForTransport as jest.Mock).mockResolvedValue({
+      secret_password: 'mocked-secret-password-b64'
+    });
     (useNavigate as jest.Mock).mockImplementation(() => navigateSpy);
     jest.spyOn(Router, 'useParams').mockReturnValue({
       dbServiceUid: uId
@@ -199,6 +216,10 @@ describe('page/DataSource/UpdateDataSource', () => {
     await act(async () => jest.advanceTimersByTime(3000));
     expect(updateDBServiceSpy).toHaveBeenCalledTimes(1);
     const firstCallParams = updateDBServiceSpy.mock.calls[0][0];
+    expect(firstCallParams.db_service.password).toBeUndefined();
+    expect(firstCallParams.db_service.secret_password).toBe(
+      'mocked-secret-password-b64'
+    );
     expect(
       firstCallParams.db_service.sqle_config.sql_query_config
         .workflow_exec_enabled
@@ -229,6 +250,8 @@ describe('page/DataSource/UpdateDataSource', () => {
     await act(async () => jest.advanceTimersByTime(0));
     expect(updateDBServiceSpy).toHaveBeenCalledTimes(1);
     const params = updateDBServiceSpy.mock.calls[0][0];
+    expect(params.db_service.password).toBeUndefined();
+    expect(params.db_service.secret_password).toBeUndefined();
     expect(
       params.db_service.sqle_config.sql_query_config.workflow_exec_enabled
     ).toBe(true);

packages/base/src/page/DataSource/components/UpdateDataSource/index.tsx

@@ -19,6 +19,10 @@
 import { DmsApi } from '@actiontech/shared/lib/api';
 import { DataSourceFormContextProvide } from '../../context';
 import useCheckConnectable from '../../hooks/useCheckConnectable';
+import {
+  encryptPasswordForTransport,
+  PasswordTransportError
+} from '../../../../utils/passwordTransportEncryption';
 const UpdateDataSource = () => {
   const { t } = useTranslation();
   const navigate = useTypedNavigate();
@@ -36,6 +40,20 @@
   const [instanceInfo, setInstanceInfo] = useState<
     IListDBServiceV2 | undefined
   >();
+
+  const resolveTransportErrorMessage = useCallback(
+    (error: unknown) => {
+      if (
+        error instanceof PasswordTransportError &&
+        error.reason === 'encrypt_failed'
+      ) {
+        return t('dmsDataSource.passwordTransport.encryptFailed');
+      }
+      return t('dmsDataSource.passwordTransport.encryptFailed');
+    },
+    [t]
+  );
+
   const updateDatabase = async (values: DataSourceFormField) => {
     startSubmit();
     const params: IUpdateDBServiceV2Params = {
@@ -91,7 +109,15 @@
     // #endif
 
     if (!!values.needUpdatePassword && !!values.password && params.db_service) {
-      params.db_service.password = values.password;
+      let cipher;
+      try {
+        cipher = await encryptPasswordForTransport(values.password);
+      } catch (error) {
+        messageApi.error(resolveTransportErrorMessage(error));
+        submitFinish();
+        return;
+      }
+      params.db_service.secret_password = cipher.secret_password;
     }
     return DmsApi.DBServiceService.UpdateDBServiceV2(params)
       .then((res) => {

packages/base/src/page/DataSource/hooks/useCheckConnectable.ts

@@ -1,5 +1,6 @@
 import { useCallback, useState } from 'react';
 import { Form, FormInstance } from 'antd';
+import { useTranslation } from 'react-i18next';
 import { DataSourceFormField } from '../components/Form/index.type';
 import { useBoolean } from 'ahooks';
 import { DmsApi } from '@actiontech/shared/lib/api/';
@@ -10,8 +11,13 @@
   getDbServiceIsConnectbale
 } from '../../../utils/common';
 import { mergeRedisConnectionModeIntoParams } from '../tool';
+import {
+  encryptPasswordForTransport,
+  PasswordTransportError
+} from '../../../utils/passwordTransportEncryption';
 
 const useCheckConnectable = (form: FormInstance<DataSourceFormField>) => {
+  const { t } = useTranslation();
   const projectID = Form.useWatch('project', form);
 
   const [loading, { setTrue: setLoadingTrue, setFalse: setLoadingFalse }] =
@@ -21,6 +27,19 @@
 
   const { mergeFromValueIntoParams } = useAsyncParams();
 
+  const resolveTransportErrorMessage = useCallback(
+    (error: unknown) => {
+      if (
+        error instanceof PasswordTransportError &&
+        error.reason === 'encrypt_failed'
+      ) {
+        return t('dmsDataSource.passwordTransport.encryptFailed');
+      }
+      return t('dmsDataSource.passwordTransport.encryptFailed');
+    },
+    [t]
+  );
+
   const onCheckConnectable = useCallback(
     async (currentAsyncParams?: BackendFormItemParams[]) => {
       const values = await form.validateFields([
@@ -48,13 +67,23 @@
       );
 
       setLoadingTrue();
+      let cipher;
+      try {
+        cipher = await encryptPasswordForTransport(values.password ?? '');
+      } catch (error) {
+        setConnectAble(false);
+        setConnectErrorMessage(resolveTransportErrorMessage(error));
+        setLoadingFalse();
+        return false;
+      }
+
       return DmsApi.DBServiceService.CheckDBServiceIsConnectable({
         db_service: {
           host: values.ip,
           port: `${values.port}`,
           user: values.user,
           db_type: values.type,
-          password: values.password,
+          secret_password: cipher.secret_password,
           additional_params: values.asyncParams ?? []
         },
         project_uid: projectID
@@ -75,7 +104,14 @@
           setLoadingFalse();
         });
     },
-    [form, projectID, mergeFromValueIntoParams, setLoadingTrue, setLoadingFalse]
+    [
+      form,
+      projectID,
+      mergeFromValueIntoParams,
+      setLoadingTrue,
+      setLoadingFalse,
+      resolveTransportErrorMessage
+    ]
   );
 
   return {

packages/base/src/utils/__tests__/passwordTransportEncryption.test.ts

@@ -0,0 +1,33 @@
+/**
+ * @jest-environment node
+ */
+import {
+  encryptPasswordForTransport,
+  PASSWORD_TRANSPORT_SECRET_KEY
+} from '../passwordTransportEncryption';
+
+describe('passwordTransportEncryption (fixed AES)', () => {
+  it('uses the backend compile-time SecretKey constant', () => {
+    expect(PASSWORD_TRANSPORT_SECRET_KEY).toBe(
+      '471F77D078C5994BD06B65B8B5B1935B'
+    );
+  });
+
+  it('encrypts to Base64 AES-256-CBC matching Go pkg/aes', async () => {
+    // Reference ciphertexts from dms-ee pkg/aes NewEncryptor(SecretKey).AesEncrypt
+    await expect(encryptPasswordForTransport('test')).resolves.toEqual({
+      secret_password: 'MbFLdPIZEb/G2QAHPMxSuQ=='
+    });
+    await expect(encryptPasswordForTransport('admin')).resolves.toEqual({
+      secret_password: 'lvwmEx6EhCnyMw9cEOKIXQ=='
+    });
+  });
+
+  it('returns only secret_password (no encryption_key_id)', async () => {
+    const cipher = await encryptPasswordForTransport('hello');
+    expect(cipher).toEqual({
+      secret_password: 'aFPI8tYp2iiuN/6Kk30TZw=='
+    });
+    expect(Object.keys(cipher)).toEqual(['secret_password']);
+  });
+});