```

refactor(core): 重构核心模块结构并更新导入路径

- 将配置相关的设置从 app.core.config 移除
- 将常量定义从 app.core.constants 移除
- 将数据库相关功能从 app.core.database 移除
- 将基础数据库模型从 app.core.db_base 移除
- 将敏感信息掩码功能从 app.core.masking 移除
- 将中间件定义从 app.core.middleware 移除
- 将操作保护功能从 app.core.operation_guard 移除
- 将分页工具从 app.core.pagination 移除
- 将请求上下文管理从 app.core.request_context 移除
- 将调度器功能从 app.core.scheduler 移除
- 将安全认证逻辑从 app.core.security 移除
- 将任务队列相关功能从 app.core.task_queue 移除
- 将时间工具从 app.core.time 移除
- 更新 alembic 配置中的 Base 模型导入路径
- 更新各模块中对重构后组件的引用路径
```

app/core/http/__init__.py

@@ -0,0 +1 @@
+"""HTTP middleware, masking, pagination, and request context helpers."""

app/core/http/masking.py

@@ -0,0 +1,68 @@
+from typing import Any
+
+from app.core.config import get_settings
+
+
+MASKED_VALUE = "[MASKED]"
+SENSITIVE_RESPONSE_KEYS = frozenset(
+    {
+        "account_number",
+        "api_key",
+        "bank_account",
+        "card_no",
+        "direct_llm_api_key",
+        "email",
+        "feishu_app_secret",
+        "feishu_verification_token",
+        "hermes_api_key",
+        "id_card",
+        "mobile",
+        "openclaw_gateway_token",
+        "password",
+        "payment_account",
+        "phone",
+        "secret",
+        "tenant_access_token",
+        "token",
+    }
+)
+
+
+def mask_configured(value: Any, domain: str | None = None) -> Any:
+    """Mask sensitive response fields when response masking is enabled."""
+
+    settings = get_settings()
+    if not settings.mask_sensitive_responses:
+        return value
+    configured_fields = {item.lower() for item in settings.masked_response_fields}
+    return mask_sensitive(value, domain=domain, configured_fields=configured_fields)
+
+
+def mask_sensitive(
+    value: Any,
+    domain: str | None = None,
+    configured_fields: set[str] | None = None,
+) -> Any:
+    if isinstance(value, dict):
+        masked: dict[str, Any] = {}
+        for key, item in value.items():
+            key_text = str(key)
+            if _should_mask(key_text, domain, configured_fields or set()):
+                masked[key_text] = MASKED_VALUE
+            else:
+                masked[key_text] = mask_sensitive(item, domain, configured_fields)
+        return masked
+    if isinstance(value, list):
+        return [mask_sensitive(item, domain, configured_fields) for item in value]
+    if isinstance(value, tuple):
+        return [mask_sensitive(item, domain, configured_fields) for item in value]
+    return value
+
+
+def _should_mask(key: str, domain: str | None, configured_fields: set[str]) -> bool:
+    field = key.lower()
+    if field in SENSITIVE_RESPONSE_KEYS or field in configured_fields:
+        return True
+    if f"*.{field}" in configured_fields:
+        return True
+    return bool(domain and f"{domain.lower()}.{field}" in configured_fields)

app/core/http/middleware.py

@@ -0,0 +1,18 @@
+import uuid
+from collections.abc import Callable
+
+from fastapi import Request, Response
+
+from app.core.constants import HttpHeader
+from app.core.http.request_context import reset_request_id, set_request_id
+
+
+async def request_id_middleware(request: Request, call_next: Callable) -> Response:
+    request_id = request.headers.get(HttpHeader.X_REQUEST_ID) or uuid.uuid4().hex
+    token = set_request_id(request_id)
+    try:
+        response = await call_next(request)
+        response.headers[HttpHeader.X_REQUEST_ID] = request_id
+        return response
+    finally:
+        reset_request_id(token)

app/core/http/pagination.py

@@ -0,0 +1,14 @@
+DEFAULT_MAX_LIMIT = 500
+DEFAULT_MIN_LIMIT = 1
+
+
+def bounded_limit(limit: int, max_limit: int = DEFAULT_MAX_LIMIT) -> int:
+    """Clamp database query limits to a safe positive range."""
+
+    return max(DEFAULT_MIN_LIMIT, min(int(limit), max_limit))
+
+
+def bounded_offset(offset: int) -> int:
+    """Clamp pagination offsets to zero or above."""
+
+    return max(0, int(offset))

app/core/http/request_context.py

@@ -0,0 +1,16 @@
+from contextvars import ContextVar, Token
+
+
+_request_id: ContextVar[str | None] = ContextVar("request_id", default=None)
+
+
+def set_request_id(request_id: str) -> Token:
+    return _request_id.set(request_id)
+
+
+def reset_request_id(token: Token) -> None:
+    _request_id.reset(token)
+
+
+def get_request_id() -> str | None:
+    return _request_id.get()