fix(security): harden deployment configuration boundaries

apps/api/src/audit/audit.service.ts

@@ -9,6 +9,14 @@ import { SensitiveDataService } from '../security/sensitive-data.service';
 const SENSITIVE_METADATA_KEY =
   /(password|token|secret|openid|unionid|mobile|phone|address|description|content)/i;
 
+// rawToken 严禁进入审计记录；此函数剥离敏感字段后再写入。
+function sanitizeActor(actor?: AuthContext): Omit<AuthContext, 'rawToken'> | undefined {
+  if (!actor) return undefined;
+  // 直接过滤掉 rawToken，避免解构产生未使用变量警告。
+  const filtered = Object.entries(actor).filter(([key]) => key !== 'rawToken');
+  return Object.fromEntries(filtered) as Omit<AuthContext, 'rawToken'>;
+}
+
 export interface AuditEvent {
   action: string;
   result: AuditResult;
@@ -32,6 +40,16 @@ export class AuditService {
     event: AuditEvent,
     client: Prisma.TransactionClient | PrismaService = this.prisma,
   ): Promise<void> {
+    // 防御性检查：确保 AuditEvent.actor 中的 rawToken 不会通过任何路径写入审计记录。
+    // 当前实现只写入 actorUserId/actorRole 标量字段，此处显式校验以防未来变更引入风险。
+    if (event.actor) {
+      const safe = sanitizeActor(event.actor);
+      if (!safe) throw new Error('Audit actor must not contain rawToken');
+      // 确认 sanitized actor 不包含 rawToken（防御性断言）
+      const keys = Object.keys(safe);
+      if (keys.includes('rawToken'))
+        throw new Error('Audit actor contains rawToken after sanitization');
+    }
     const metadata = this.safeMetadata(event.metadata);
     const userAgent =
       request