feat：流水线查看和构建详情查看配置界面敏感字段展示优化

src/backend/ci/core/common/common-pipeline/src/main/kotlin/com/tencent/devops/common/pipeline/pojo/element/Element.kt

@@ -215,4 +215,6 @@ abstract class Element(
     }
 
     open fun initTaskVar(): MutableMap<String, Any> = mutableMapOf()
+
+    open fun transferSensitiveParam(params: List<String>) {}
 }

src/backend/ci/core/common/common-pipeline/src/main/kotlin/com/tencent/devops/common/pipeline/pojo/element/market/MarketBuildAtomElement.kt

@@ -75,5 +75,12 @@ data class MarketBuildAtomElement(
         )
     }
 
+    override fun transferSensitiveParam(params: List<String>) {
+        val input = data["input"] as MutableMap<String, Any>? ?: return
+        params.forEach {
+            input[it] = "******"
+        }
+    }
+
     override fun getClassType() = classType
 }

src/backend/ci/core/common/common-pipeline/src/main/kotlin/com/tencent/devops/common/pipeline/pojo/element/market/MarketBuildLessAtomElement.kt

@@ -72,5 +72,12 @@ data class MarketBuildLessAtomElement(
         )
     }
 
+    override fun transferSensitiveParam(params: List<String>) {
+        val input = data["input"] as MutableMap<String, Any>? ?: return
+        params.forEach {
+            input[it] = "******"
+        }
+    }
+
     override fun getClassType() = classType
 }

src/backend/ci/core/process/biz-base/src/main/kotlin/com/tencent/devops/process/engine/service/PipelineInfoService.kt

@@ -27,18 +27,64 @@
 
 package com.tencent.devops.process.engine.service
 
+import com.tencent.devops.common.api.constant.KEY_VERSION
+import com.tencent.devops.common.api.util.JsonUtil
+import com.tencent.devops.common.pipeline.pojo.element.Element
+import com.tencent.devops.common.pipeline.pojo.element.market.MarketBuildAtomElement
+import com.tencent.devops.common.pipeline.pojo.element.market.MarketBuildLessAtomElement
+import com.tencent.devops.common.redis.RedisOperation
 import com.tencent.devops.process.engine.dao.PipelineInfoDao
+import com.tencent.devops.store.pojo.common.ATOM_POST_VERSION_TEST_FLAG_KEY_PREFIX
+import com.tencent.devops.store.pojo.common.ATOM_SENSITIVE_PARAM_KEY_PREFIX
+import com.tencent.devops.store.pojo.common.STORE_NORMAL_PROJECT_RUN_INFO_KEY_PREFIX
+import com.tencent.devops.store.pojo.common.enums.StoreTypeEnum
 import org.jooq.DSLContext
 import org.springframework.beans.factory.annotation.Autowired
 import org.springframework.stereotype.Service
 
 @Service
 class PipelineInfoService @Autowired constructor(
     private val dslContext: DSLContext,
-    private val pipelineInfoDao: PipelineInfoDao
+    private val pipelineInfoDao: PipelineInfoDao,
+    private val redisOperation: RedisOperation
 ) {
 
     fun getPipelineName(projectId: String, pipelineId: String): String? {
         return pipelineInfoDao.getPipelineInfo(dslContext, projectId, pipelineId)?.pipelineName
     }
+
+    // 敏感入参解析
+    fun transferSensitiveParam(projectTestAtomCodes: List<String>, element: Element) {
+        if (element is MarketBuildAtomElement || element is MarketBuildLessAtomElement) {
+            val atomCode = element.getAtomCode()
+            val version = element.version
+            val hashKey = if (version.contains(".*")) {
+                var latestVersion: String? = null
+                val atomVersionTestFlag =
+                    redisOperation.hget("$ATOM_POST_VERSION_TEST_FLAG_KEY_PREFIX:$atomCode", version)
+                // 项目下调试插件处理
+                if (projectTestAtomCodes.contains(atomCode) && (atomVersionTestFlag == "true")) {
+                    latestVersion = version
+                }
+                if (latestVersion.isNullOrBlank()) {
+                    val atomRunInfoStr = redisOperation.hget(
+                        key = "$STORE_NORMAL_PROJECT_RUN_INFO_KEY_PREFIX:${StoreTypeEnum.ATOM.name}:$atomCode",
+                        hashKey = version
+                    )
+                    val atomRunInfo = atomRunInfoStr?.let { JsonUtil.toMap(it) }
+                    latestVersion = atomRunInfo?.get(KEY_VERSION).toString()
+                }
+                latestVersion
+            } else {
+                version
+            }
+            val param = redisOperation.hget(
+                key = "$ATOM_SENSITIVE_PARAM_KEY_PREFIX:$atomCode",
+                hashKey = hashKey
+            )
+            if (!param.isNullOrBlank()) {
+                element.transferSensitiveParam(param.split(","))
+            }
+        }
+    }
 }

src/backend/ci/core/process/biz-base/src/main/kotlin/com/tencent/devops/process/engine/service/PipelineRepositoryService.kt

@@ -109,7 +109,6 @@ import com.tencent.devops.process.pojo.pipeline.TemplateInfo
 import com.tencent.devops.process.pojo.setting.PipelineModelVersion
 import com.tencent.devops.process.service.PipelineAsCodeService
 import com.tencent.devops.process.service.PipelineOperationLogService
-import com.tencent.devops.process.service.label.PipelineGroupService
 import com.tencent.devops.process.service.pipeline.PipelineSettingVersionService
 import com.tencent.devops.process.service.pipeline.PipelineTransferYamlService
 import com.tencent.devops.process.utils.PIPELINE_MATRIX_CON_RUNNING_SIZE_MAX
@@ -121,13 +120,14 @@ import com.tencent.devops.process.utils.PIPELINE_SETTING_WAIT_QUEUE_TIME_MINUTE_
 import com.tencent.devops.process.utils.PipelineVersionUtils
 import com.tencent.devops.process.yaml.utils.NotifyTemplateUtils
 import com.tencent.devops.project.api.service.ServiceAllocIdResource
+import com.tencent.devops.store.api.atom.ServiceAtomResource
+import java.time.LocalDateTime
+import java.util.concurrent.atomic.AtomicInteger
+import javax.ws.rs.core.Response
 import org.jooq.DSLContext
 import org.jooq.impl.DSL
 import org.slf4j.LoggerFactory
 import org.springframework.stereotype.Service
-import java.time.LocalDateTime
-import java.util.concurrent.atomic.AtomicInteger
-import javax.ws.rs.core.Response
 
 @Suppress(
     "LongParameterList",
@@ -165,8 +165,8 @@ class PipelineRepositoryService constructor(
     private val transferService: PipelineTransferYamlService,
     private val redisOperation: RedisOperation,
     private val pipelineYamlInfoDao: PipelineYamlInfoDao,
-    private val pipelineGroupService: PipelineGroupService,
-    private val pipelineAsCodeService: PipelineAsCodeService
+    private val pipelineAsCodeService: PipelineAsCodeService,
+    private val pipelineInfoService: PipelineInfoService
 ) {
 
     companion object {
@@ -1305,7 +1305,8 @@ class PipelineRepositoryService constructor(
         projectId: String,
         pipelineId: String,
         version: Int? = null,
-        includeDraft: Boolean? = false
+        includeDraft: Boolean? = false,
+        editPermission: Boolean? = true
     ): PipelineResourceVersion? {
         // TODO 取不到则直接从旧版本表读，待下架
         val resource = if (version == null) {
@@ -1333,6 +1334,7 @@ class PipelineRepositoryService constructor(
         // 3 所有插件ENV配置合并历史值，并过滤掉默认值
         var randomSeed = 1
         val jobIdSet = mutableSetOf<String>()
+        val testAtomCodes = client.get(ServiceAtomResource::class).getTestAtoms(projectId).data
         resource?.model?.stages?.forEachIndexed { index, s ->
             if (index == 0) (s.containers[0] as TriggerContainer).params.forEach { param ->
                 param.name = param.name ?: param.id
@@ -1349,6 +1351,9 @@ class PipelineRepositoryService constructor(
                             e.customEnv = (e.customEnv ?: emptyList()).plus(oldCustomEnv)
                         }
                         e.additionalOptions?.customEnv = null
+                        if (editPermission != true) {
+                            pipelineInfoService.transferSensitiveParam(testAtomCodes ?: emptyList(), e)
+                        }
                     }
                 }
             }

src/backend/ci/core/process/biz-base/src/main/kotlin/com/tencent/devops/process/engine/service/record/PipelineBuildRecordService.kt

@@ -30,6 +30,7 @@ package com.tencent.devops.process.engine.service.record
 import com.tencent.devops.common.api.pojo.ErrorInfo
 import com.tencent.devops.common.api.util.Watcher
 import com.tencent.devops.common.api.util.timestampmilli
+import com.tencent.devops.common.client.Client
 import com.tencent.devops.common.event.dispatcher.pipeline.PipelineEventDispatcher
 import com.tencent.devops.common.pipeline.Model
 import com.tencent.devops.common.pipeline.container.Container
@@ -66,6 +67,7 @@ import com.tencent.devops.process.engine.dao.PipelineTriggerReviewDao
 import com.tencent.devops.process.engine.pojo.BuildInfo
 import com.tencent.devops.process.engine.service.PipelineBuildDetailService
 import com.tencent.devops.process.engine.service.PipelineElementService
+import com.tencent.devops.process.engine.service.PipelineInfoService
 import com.tencent.devops.process.engine.service.PipelineRepositoryService
 import com.tencent.devops.process.engine.utils.ContainerUtils
 import com.tencent.devops.process.pojo.BuildStageStatus
@@ -78,6 +80,7 @@ import com.tencent.devops.process.service.StageTagService
 import com.tencent.devops.process.service.record.PipelineRecordModelService
 import com.tencent.devops.process.util.BuildMsgUtils
 import com.tencent.devops.process.utils.PipelineVarUtil
+import com.tencent.devops.store.api.atom.ServiceAtomResource
 import java.time.LocalDateTime
 import java.util.concurrent.TimeUnit
 import org.jooq.DSLContext
@@ -105,6 +108,8 @@ class PipelineBuildRecordService @Autowired constructor(
     private val recordStageDao: BuildRecordStageDao,
     private val recordContainerDao: BuildRecordContainerDao,
     private val recordTaskDao: BuildRecordTaskDao,
+    private val client: Client,
+    private val pipelineInfoService: PipelineInfoService,
     recordModelService: PipelineRecordModelService,
     pipelineResourceDao: PipelineResourceDao,
     pipelineBuildDao: PipelineBuildDao,
@@ -164,7 +169,8 @@ class PipelineBuildRecordService @Autowired constructor(
         buildInfo: BuildInfo,
         executeCount: Int?,
         refreshStatus: Boolean = true,
-        queryDslContext: DSLContext? = null
+        queryDslContext: DSLContext? = null,
+        sensitiveFlag: Boolean? = true
     ): ModelRecord? {
         // 直接取构建记录数据，防止接口传错
         val projectId = buildInfo.projectId
@@ -246,7 +252,7 @@ class PipelineBuildRecordService @Autowired constructor(
             if (!newVarName.isNullOrBlank()) newParams.add(it.copy(id = newVarName)) else newParams.add(it)
         }
         triggerContainer.params = newParams
-
+        val testAtomCodes = client.get(ServiceAtomResource::class).getTestAtoms(projectId).data ?: emptyList()
         // #4531 兼容历史构建的页面显示
         model.stages.forEach { stage ->
             stage.resetBuildOption()
@@ -256,6 +262,11 @@ class PipelineBuildRecordService @Autowired constructor(
                 container.fetchGroupContainers()?.forEach { groupContainer ->
                     fixContainerDetail(groupContainer)
                 }
+                if (sensitiveFlag != true) {
+                    container.elements.forEach { e ->
+                        pipelineInfoService.transferSensitiveParam(testAtomCodes, e)
+                    }
+                }
             }
             stage.elapsed = stage.elapsed ?: stage.timeCost?.totalCost
         }

src/backend/ci/core/process/biz-base/src/main/kotlin/com/tencent/devops/process/service/pipeline/PipelineTransferYamlService.kt

@@ -34,6 +34,7 @@ import com.tencent.devops.common.api.enums.RepositoryType
 import com.tencent.devops.common.api.util.Watcher
 import com.tencent.devops.common.api.util.YamlUtil
 import com.tencent.devops.common.client.Client
+import com.tencent.devops.common.pipeline.container.Container
 import com.tencent.devops.common.pipeline.pojo.PipelineModelAndSetting
 import com.tencent.devops.common.pipeline.pojo.element.Element
 import com.tencent.devops.common.pipeline.pojo.transfer.ElementInsertBody
@@ -48,6 +49,7 @@ import com.tencent.devops.common.pipeline.pojo.transfer.TransferResponse
 import com.tencent.devops.common.pipeline.pojo.transfer.YamlWithVersion
 import com.tencent.devops.process.engine.dao.PipelineInfoDao
 import com.tencent.devops.process.engine.dao.PipelineYamlInfoDao
+import com.tencent.devops.process.engine.service.PipelineInfoService
 import com.tencent.devops.process.pojo.pipeline.PipelineResourceVersion
 import com.tencent.devops.process.yaml.pojo.TemplatePath
 import com.tencent.devops.process.yaml.pojo.YamlVersion
@@ -69,6 +71,7 @@ import com.tencent.devops.process.yaml.v3.parsers.template.YamlTemplateConf
 import com.tencent.devops.process.yaml.v3.parsers.template.models.GetTemplateParam
 import com.tencent.devops.process.yaml.v3.utils.ScriptYmlUtils
 import com.tencent.devops.repository.api.ServiceRepositoryResource
+import com.tencent.devops.store.api.atom.ServiceAtomResource
 import java.util.LinkedList
 import org.jooq.DSLContext
 import org.slf4j.LoggerFactory
@@ -86,7 +89,8 @@ class PipelineTransferYamlService @Autowired constructor(
     private val yamlIndexService: YamlIndexService,
     private val pipelineYamlInfoDao: PipelineYamlInfoDao,
     private val client: Client,
-    private val yamlSchemaCheck: CodeSchemaCheck
+    private val yamlSchemaCheck: CodeSchemaCheck,
+    private val pipelineInfoService: PipelineInfoService
 ) {
 
     companion object {
@@ -112,7 +116,8 @@ class PipelineTransferYamlService @Autowired constructor(
         pipelineId: String?,
         actionType: TransferActionType,
         data: TransferBody,
-        aspects: LinkedList<IPipelineTransferAspect> = LinkedList()
+        aspects: LinkedList<IPipelineTransferAspect> = LinkedList(),
+        editPermission: Boolean? = null
     ): TransferResponse {
         val watcher = Watcher(id = "yaml and model transfer watcher")
         // #8161 蓝盾PAC默认使用V3版本的YAML语言
@@ -126,6 +131,13 @@ class PipelineTransferYamlService @Autowired constructor(
                     aspects
                 )
             }
+            // 无编辑权限需要对流水线插件敏感参数做处理
+            if (editPermission == false) {
+                val projectTestAtomCodes = client.get(ServiceAtomResource::class).getTestAtoms(projectId).data
+                data.modelAndSetting?.model?.stages?.forEach {
+                    transferElementSensitiveParam(projectTestAtomCodes, it.containers)
+                }
+            }
             PipelineTransferAspectLoader.sharedEnvTransfer(aspects)
             when (actionType) {
                 TransferActionType.FULL_MODEL2YAML -> {
@@ -200,7 +212,6 @@ class PipelineTransferYamlService @Autowired constructor(
                     )
                     val model = modelTransfer.yaml2Model(input)
                     val setting = modelTransfer.yaml2Setting(input)
-
                     logger.info(watcher.toString())
                     return TransferResponse(
                         yamlWithVersion = YamlWithVersion(
@@ -216,6 +227,17 @@ class PipelineTransferYamlService @Autowired constructor(
         return TransferResponse()
     }
 
+    private fun transferElementSensitiveParam(projectTestAtomCodes: List<String>?, containers: List<Container>) {
+        containers.forEach {
+            it.elements.forEach { e ->
+                pipelineInfoService.transferSensitiveParam(
+                    projectTestAtomCodes = projectTestAtomCodes ?: emptyList(),
+                    element = e
+                )
+            }
+        }
+    }
+
     fun modelTaskTransfer(
         userId: String,
         projectId: String,
@@ -244,7 +266,8 @@ class PipelineTransferYamlService @Autowired constructor(
         userId: String,
         projectId: String,
         pipelineId: String,
-        resource: PipelineResourceVersion
+        resource: PipelineResourceVersion,
+        editPermission: Boolean? = null
     ): PreviewResponse {
         val setting = pipelineSettingVersionService.getPipelineSetting(
             userId = userId,
@@ -261,15 +284,20 @@ class PipelineTransferYamlService @Autowired constructor(
         val triggerIndex = mutableListOf<TransferMark>()
         val noticeIndex = mutableListOf<TransferMark>()
         val settingIndex = mutableListOf<TransferMark>()
-        val yaml = resource.yaml ?: transfer(
-            userId = userId,
-            projectId = projectId,
-            pipelineId = pipelineId,
-            actionType = TransferActionType.FULL_MODEL2YAML,
-            data = TransferBody(modelAndSetting)
-        ).yamlWithVersion?.yamlStr ?: return PreviewResponse("")
+        val yaml = if (editPermission == false || resource.yaml.isNullOrBlank()) {
+            transfer(
+                userId = userId,
+                projectId = projectId,
+                pipelineId = pipelineId,
+                actionType = TransferActionType.FULL_MODEL2YAML,
+                data = TransferBody(modelAndSetting),
+                editPermission = editPermission
+            ).yamlWithVersion?.yamlStr ?: return PreviewResponse("")
+        } else {
+            resource.yaml
+        }
         try {
-            TransferMapper.getYamlLevelOneIndex(yaml).forEach { (key, value) ->
+            TransferMapper.getYamlLevelOneIndex(yaml!!).forEach { (key, value) ->
                 if (key in pipeline_key) pipelineIndex.add(value)
                 if (key in trigger_key) triggerIndex.add(value)
                 if (key in notice_key) noticeIndex.add(value)
@@ -278,7 +306,7 @@ class PipelineTransferYamlService @Autowired constructor(
         } catch (ignore: Throwable) {
             logger.warn("TRANSFER_YAML|$projectId|$userId", ignore)
         }
-        return PreviewResponse(yaml, pipelineIndex, triggerIndex, noticeIndex, settingIndex)
+        return PreviewResponse(yaml!!, pipelineIndex, triggerIndex, noticeIndex, settingIndex)
     }
 
     fun position(

src/backend/ci/core/process/biz-process/src/main/kotlin/com/tencent/devops/process/api/UserPipelineTransferResourceImpl.kt

@@ -80,8 +80,23 @@ class UserPipelineTransferResourceImpl @Autowired constructor(
                 )
             )
         }
+        val editPermission = pipelineId?.let {
+            pipelinePermissionService.checkPipelinePermission(
+                userId = userId,
+                projectId = projectId,
+                pipelineId = it,
+                permission = AuthPermission.EDIT
+            )
+        }
         val response = try {
-            transferService.transfer(userId, projectId, pipelineId, actionType, data)
+            transferService.transfer(
+                userId = userId,
+                projectId = projectId,
+                pipelineId = pipelineId,
+                actionType = actionType,
+                data = data,
+                editPermission = editPermission
+            )
         } catch (e: PipelineTransferException) {
             val elementMsg = I18nUtil.getCodeLanMessage(
                 messageCode = e.errorCode,