《互联网产品的服务端架构·产品、流量与基础能力》4.2 个人信息分级与最小化

// file: internal/profile/pii.go
// tier: L1
// verify: go test ./internal/profile/

package profile

import "fmt"

// Class 是个人信息的分级。分级决定字段在某个目的下是否保留。
type Class string

const (
	ClassPublic    Class = "public"
	ClassInternal  Class = "internal"
	ClassSensitive Class = "sensitive"
)

// Field 是一个待裁剪的资料字段。RetainDays 是业务承诺的保留天数。
type Field struct {
	Name       string
	Class      Class
	RetainDays int
}

// Purpose 是收集字段的业务目的。没有目的就没有默认采集权。
type Purpose string

const (
	PurposeRegister  Purpose = "register"
	PurposeRecommend Purpose = "recommend"
	PurposeSupport   Purpose = "support"
	PurposeRisk      Purpose = "risk"
)

// purposeClasses 是目的与分级的对照表。推荐只需要公开和内部字段，
// 注册、客服、风控才允许触碰敏感字段。
var purposeClasses = map[Purpose]map[Class]bool{
	PurposeRegister:  {ClassPublic: true, ClassInternal: true, ClassSensitive: true},
	PurposeRecommend: {ClassPublic: true, ClassInternal: true},
	PurposeSupport:   {ClassPublic: true, ClassInternal: true, ClassSensitive: true},
	PurposeRisk:      {ClassPublic: true, ClassInternal: true, ClassSensitive: true},
}

// Minimize 按目的裁剪字段，保持输入顺序。空目的只保留公开和内部字段；
// 未知目的、未知分级和负数保留期都返回错误。
func Minimize(fields []Field, purpose Purpose) ([]Field, error) {
	for _, f := range fields {
		if f.RetainDays < 0 {
			return nil, fmt.Errorf("profile: field %q has negative retain days", f.Name)
		}
		switch f.Class {
		case ClassPublic, ClassInternal, ClassSensitive:
		default:
			return nil, fmt.Errorf("profile: field %q has unknown class %q", f.Name, f.Class)
		}
	}

	allowed, ok := purposeClasses[purpose]
	if !ok {
		if purpose != "" {
			return nil, fmt.Errorf("profile: unknown purpose %q", purpose)
		}
		allowed = map[Class]bool{ClassPublic: true, ClassInternal: true}
	}

	out := make([]Field, 0, len(fields))
	for _, f := range fields {
		if allowed[f.Class] {
			out = append(out, f)
		}
	}
	return out, nil
}

// file: internal/profile/pii_test.go
// tier: L1
// verify: go test ./internal/profile/

package profile

import (
	"reflect"
	"testing"
)

func testFields() []Field {
	return []Field{
		{Name: "nickname", Class: ClassPublic, RetainDays: 365},
		{Name: "email", Class: ClassSensitive, RetainDays: 365},
		{Name: "risk_score", Class: ClassInternal, RetainDays: 180},
		{Name: "phone", Class: ClassSensitive, RetainDays: 365},
	}
}

func TestMinimizeCropsSensitiveForRecommend(t *testing.T) {
	got, err := Minimize(testFields(), PurposeRecommend)
	if err != nil {
		t.Fatal(err)
	}
	want := []Field{
		{Name: "nickname", Class: ClassPublic, RetainDays: 365},
		{Name: "risk_score", Class: ClassInternal, RetainDays: 180},
	}
	if !reflect.DeepEqual(got, want) {
		t.Fatalf("recommend = %+v, want %+v", got, want)
	}
}

func TestMinimizeKeepsOrderAndSensitiveWithPurpose(t *testing.T) {
	got, err := Minimize(testFields(), PurposeRegister)
	if err != nil {
		t.Fatal(err)
	}
	if !reflect.DeepEqual(got, testFields()) {
		t.Fatalf("register = %+v, want all fields in input order", got)
	}
}

func TestMinimizeEmptyPurposeDropsSensitive(t *testing.T) {
	got, err := Minimize(testFields(), "")
	if err != nil {
		t.Fatal(err)
	}
	if len(got) != 2 || got[0].Name != "nickname" || got[1].Name != "risk_score" {
		t.Fatalf("empty purpose = %+v, want public and internal only", got)
	}
}

func TestMinimizeRejectsBadInput(t *testing.T) {
	if _, err := Minimize([]Field{{Name: "phone", Class: ClassSensitive, RetainDays: -1}}, PurposeSupport); err == nil {
		t.Fatal("want error for negative retain days")
	}
	if _, err := Minimize([]Field{{Name: "x", Class: Class("secret"), RetainDays: 1}}, PurposeSupport); err == nil {
		t.Fatal("want error for unknown class")
	}
	if _, err := Minimize(testFields(), Purpose("ads")); err == nil {
		t.Fatal("want error for unknown purpose")
	}
}

func TestMinimizeDoesNotMutateInput(t *testing.T) {
	fields := testFields()
	before := append([]Field(nil), fields...)
	if _, err := Minimize(fields, PurposeRecommend); err != nil {
		t.Fatal(err)
	}
	if !reflect.DeepEqual(fields, before) {
		t.Fatalf("input mutated: %+v", fields)
	}

	empty, err := Minimize(nil, PurposeRisk)
	if err != nil {
		t.Fatal(err)
	}
	if empty == nil || len(empty) != 0 {
		t.Fatalf("nil input = %#v, want non-nil empty slice", empty)
	}
}

cd .local/checks/webapp-lab && go test ./internal/profile/ -run 'TestMinimize' -count=1 -v

=== RUN   TestMinimizeCropsSensitiveForRecommend
--- PASS: TestMinimizeCropsSensitiveForRecommend (0.00s)
=== RUN   TestMinimizeKeepsOrderAndSensitiveWithPurpose
--- PASS: TestMinimizeKeepsOrderAndSensitiveWithPurpose (0.00s)
=== RUN   TestMinimizeEmptyPurposeDropsSensitive
--- PASS: TestMinimizeEmptyPurposeDropsSensitive (0.00s)
=== RUN   TestMinimizeRejectsBadInput
--- PASS: TestMinimizeRejectsBadInput (0.00s)
=== RUN   TestMinimizeDoesNotMutateInput
--- PASS: TestMinimizeDoesNotMutateInput (0.00s)
PASS
ok  	webapp/internal/profile	0.269s