union-ark-web 1.0.1

package/ark-control/src/main/java/com/union/control/service/impl/SensitiveDataDemoServiceImpl.java

@@ -0,0 +1,144 @@
+package com.union.control.service.impl;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.union.control.mapper.SensitiveAddressBookDemo;
+import com.union.control.mapper.SensitiveDataDemoMapper;
+import com.union.control.service.SensitiveDataDemoService;
+import com.union.control.utils.AgentSupport;
+import com.union.control.service.sensitive.SensitiveRevealService;
+import org.springframework.transaction.annotation.Transactional;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import org.springframework.stereotype.Service;
+
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+
+@Service("sensitiveDataDemoService")
+public class SensitiveDataDemoServiceImpl implements SensitiveDataDemoService {
+    private final SensitiveDataDemoMapper mapper;
+    private final ObjectMapper json;
+    private final SensitiveRevealService reveal;
+    private static final Pattern MARKER = Pattern.compile("\\[#([^\\]\\r\\n]*?)#VIEW:(rt_[A-Za-z0-9_-]{43})\\]");
+
+    public SensitiveDataDemoServiceImpl(SensitiveDataDemoMapper mapper, ObjectMapper json, SensitiveRevealService reveal) {
+        this.mapper = mapper;
+        this.json = json;
+        this.reveal = reveal;
+    }
+
+    public int insert(String input) {
+        Map<String, Object> payload = AgentSupport.request(json, input);
+        return mapper.insert(AgentSupport.text(payload, "phoneNumber", 64, true));
+    }
+
+    public List<Map<String, Object>> query(String input) {
+        AgentSupport.request(json, input);
+        return mapper.query();
+    }
+
+    public int insertAddressBook(String input) {
+        Map<String, Object> payload = AgentSupport.request(json, input);
+        SensitiveAddressBookDemo row = new SensitiveAddressBookDemo();
+        row.setName(AgentSupport.text(payload, "name", 64, true));
+        row.setRole(AgentSupport.text(payload, "role", 32, true));
+        row.setEmail(AgentSupport.text(payload, "email", 255, true));
+        row.setTelephone(AgentSupport.text(payload, "telephone", 32, true));
+        row.setMobileNumber(AgentSupport.text(payload, "mobileNumber", 32, true));
+        return mapper.insertAddressBook(row);
+    }
+
+    public List<Map<String, Object>> queryAddressBook(String input) {
+        AgentSupport.request(json, input);
+        List<Map<String, Object>> result = new ArrayList<>();
+        for (SensitiveAddressBookDemo row : mapper.queryAddressBook()) {
+            result.add(addressBookValue(row));
+        }
+        return result;
+    }
+
+    @Transactional
+    public Map<String, Object> save(String input) {
+        Map<String, Object> payload = AgentSupport.request(json, input);
+        AgentSupport.userId(payload);
+        Long id = id(payload);
+        Map<String, Object> row = new LinkedHashMap<>();
+        row.put("phoneNumber", editableText(payload, "phoneNumber", 64));
+        if (id == null) {
+            mapper.insertSaved(row);
+            id = AgentSupport.number(row.get("id"));
+        } else {
+            row.put("id", id);
+            if (mapper.update(row) != 1) throw new IllegalArgumentException("记录不存在");
+        }
+        Map<String, Object> saved = mapper.queryById(id);
+        if (saved == null) throw new IllegalStateException("保存结果不存在");
+        return saved;
+    }
+
+    @Transactional
+    public Map<String, Object> saveAddressBook(String input) {
+        Map<String, Object> payload = AgentSupport.request(json, input);
+        AgentSupport.userId(payload);
+        SensitiveAddressBookDemo row = new SensitiveAddressBookDemo();
+        row.setId(id(payload));
+        row.setName(AgentSupport.text(payload, "name", 64, true));
+        row.setRole(AgentSupport.text(payload, "role", 32, true));
+        row.setEmail(editableText(payload, "email", 255));
+        row.setTelephone(editableText(payload, "telephone", 32));
+        row.setMobileNumber(editableText(payload, "mobileNumber", 32));
+        if (row.getId() == null) mapper.insertAddressBook(row);
+        else if (mapper.updateAddressBook(row) != 1) throw new IllegalArgumentException("记录不存在");
+        SensitiveAddressBookDemo saved = mapper.queryAddressBookById(row.getId());
+        if (saved == null) throw new IllegalStateException("保存结果不存在");
+        return addressBookValue(saved);
+    }
+
+    private String editableText(Map<String, Object> payload, String key, int max) {
+        Object raw = payload.get(key);
+        if (!(raw instanceof String) || ((String) raw).length() > max * 100)
+            throw new IllegalArgumentException(key + " 非法");
+        String value = (String) raw;
+        Matcher matcher = MARKER.matcher(value);
+        StringBuffer resolved = new StringBuffer();
+        while (matcher.find()) {
+            Map<String, Object> tokenInput = new LinkedHashMap<>();
+            tokenInput.put("userId", payload.get("userId"));
+            tokenInput.put("orgCode", payload.get("orgCode"));
+            tokenInput.put("roleId", payload.get("roleId"));
+            tokenInput.put("token", matcher.group(2));
+            final String encoded;
+            try { encoded = json.writeValueAsString(tokenInput); }
+            catch (java.io.IOException error) { throw new IllegalStateException("请求参数非法", error); }
+            matcher.appendReplacement(resolved, Matcher.quoteReplacement(reveal.reveal(encoded)));
+        }
+        matcher.appendTail(resolved);
+        value = resolved.toString();
+        if (value.trim().isEmpty() || value.length() > max || value.contains("[#") || value.contains("#VIEW:"))
+            throw new IllegalArgumentException(key + " 非法或脱敏标记已失效，请刷新后重试");
+        return value;
+    }
+
+    private static Long id(Map<String, Object> payload) {
+        if (payload.get("id") == null) return null;
+        Object value = payload.get("id");
+        if (!(value instanceof Integer) && !(value instanceof Long)) throw new IllegalArgumentException("id 非法");
+        long id = ((Number) value).longValue();
+        if (id <= 0) throw new IllegalArgumentException("id 非法");
+        return id;
+    }
+
+    private static Map<String, Object> addressBookValue(SensitiveAddressBookDemo row) {
+        Map<String, Object> value = new LinkedHashMap<>();
+        value.put("id", row.getId());
+        value.put("name", row.getName());
+        value.put("role", row.getRole());
+        value.put("email", row.getEmail());
+        value.put("telephone", row.getTelephone());
+        value.put("mobileNumber", row.getMobileNumber());
+        value.put("createdAt", row.getCreatedAt());
+        return value;
+    }
+}

package/ark-control/src/main/java/com/union/control/service/sensitive/RedisRevealTokenStore.java

@@ -0,0 +1,90 @@
+package com.union.control.service.sensitive;
+
+import com.nucc.channel.ark.common.redis.RedisCacheService;
+import com.nucc.channel.ark.common.util.ResultUtil;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Component;
+
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.List;
+
+@Component
+public final class RedisRevealTokenStore {
+    private static final String PREFIX = "sensitive:reveal:";
+    private final RedisCacheService redis;
+    private final int ttlSeconds;
+
+    public RedisRevealTokenStore(RedisCacheService redis,
+            @Value("${sensitive.reveal.ttl-seconds:300}") long ttlSeconds) {
+        if (redis == null) throw new IllegalArgumentException("Redis service is required");
+        if (ttlSeconds <= 0 || ttlSeconds > Integer.MAX_VALUE) {
+            throw new IllegalArgumentException("Reveal TTL is out of range");
+        }
+        this.redis = redis;
+        this.ttlSeconds = (int) ttlSeconds;
+    }
+
+    boolean putAll(List<Entry> entries) {
+        if (entries.isEmpty()) return true;
+        try {
+            for (Entry entry : entries) {
+                if (!ResultUtil.SUCCESS_RESULT.equals(
+                        redis.setex(key(entry.token), ttlSeconds, entry.ciphertext))) return false;
+            }
+            return true;
+        } catch (RuntimeException error) {
+            throw new StoreUnavailableException(error);
+        }
+    }
+
+    String get(String token) {
+        try {
+            String ciphertext = redis.get(key(token));
+            if (ResultUtil.FAIL_RESULT.equals(ciphertext)) {
+                throw new StoreUnavailableException();
+            }
+            if (ciphertext != null && ciphertext.length() > 12000) {
+                throw new StoreUnavailableException();
+            }
+            return ciphertext;
+        } catch (StoreUnavailableException error) {
+            throw error;
+        } catch (RuntimeException error) {
+            throw new StoreUnavailableException(error);
+        }
+    }
+
+    static String key(String token) {
+        try {
+            byte[] hash = MessageDigest.getInstance("SHA-256")
+                    .digest(token.getBytes(StandardCharsets.UTF_8));
+            StringBuilder key = new StringBuilder(PREFIX);
+            for (byte value : hash) key.append(String.format("%02x", value & 0xff));
+            return key.toString();
+        } catch (NoSuchAlgorithmException impossible) {
+            throw new IllegalStateException(impossible);
+        }
+    }
+
+    static final class Entry {
+        final String token;
+        final String ciphertext;
+
+        Entry(String token, String ciphertext) {
+            this.token = token;
+            this.ciphertext = ciphertext;
+        }
+    }
+
+    public static final class StoreUnavailableException extends RuntimeException {
+        StoreUnavailableException() {
+            super("Sensitive reveal store unavailable");
+        }
+
+        StoreUnavailableException(Throwable cause) {
+            super("Sensitive reveal store unavailable", cause);
+        }
+    }
+}

package/ark-control/src/main/java/com/union/control/service/sensitive/SensitiveRevealProcessor.java

@@ -0,0 +1,319 @@
+package com.union.control.service.sensitive;
+
+import com.nucc.channel.ark.common.annotation.EnDecryptField;
+import com.nucc.channel.ark.common.annotation.EnDecryptFieldLong;
+import com.nucc.channel.ark.common.annotation.EnDecryptFieldWithTag;
+import com.nucc.channel.ark.common.exception.CheckException;
+import com.union.control.utils.security.SymmetricalSecurityUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+import java.lang.reflect.Array;
+import java.lang.reflect.Field;
+import java.lang.reflect.Modifier;
+import java.security.SecureRandom;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Base64;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.IdentityHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.function.Consumer;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import static com.nucc.channel.ark.common.util.Constant.REGEX_EMAIL;
+import static com.nucc.channel.ark.common.util.Constant.REGEX_MOBILE;
+import static com.nucc.channel.ark.common.util.Constant.REGEX_TELEPHONE;
+
+@SuppressWarnings({"rawtypes", "unchecked"})
+@Component
+public final class SensitiveRevealProcessor {
+    private static final Logger LOG = LoggerFactory.getLogger(SensitiveRevealProcessor.class);
+    private static final Pattern SENSITIVE = Pattern.compile(
+            "(" + REGEX_MOBILE + ")|(" + REGEX_EMAIL + ")|(" + REGEX_TELEPHONE + ")");
+    private static final Set<String> MAP_KEYS = new HashSet<>(Arrays.asList(
+            "mobileNumber", "phoneNumber", "telNumber", "email"));
+
+    private final SymmetricalSecurityUtils crypto;
+    private final RedisRevealTokenStore tokens;
+    private final SecureRandom random;
+
+    @Autowired
+    public SensitiveRevealProcessor(SymmetricalSecurityUtils crypto, RedisRevealTokenStore tokens) {
+        this(crypto, tokens, new SecureRandom());
+    }
+
+    public void encrypt(Object value) throws CheckException {
+        transform(value, true, null, visited());
+    }
+
+    public void decrypt(Object value) throws CheckException {
+        transform(value, false, null, visited());
+    }
+
+    SensitiveRevealProcessor(SymmetricalSecurityUtils crypto, RedisRevealTokenStore tokens,
+                             SecureRandom random) {
+        this.crypto = crypto;
+        this.tokens = tokens;
+        this.random = random;
+    }
+
+    public void process(Object result) {
+        List<ValueTarget> targets = new ArrayList<>();
+        try {
+            transform(result, false, targets, visited());
+        } catch (CheckException impossible) {
+            throw new IllegalStateException(impossible);
+        }
+        apply(targets);
+    }
+
+    private void apply(List<ValueTarget> targets) {
+        List<RedisRevealTokenStore.Entry> entries = new ArrayList<>();
+        List<Plan> plans = new ArrayList<>(targets.size());
+        for (ValueTarget target : targets) plans.add(plan(target, entries));
+
+        boolean clickable = entries.isEmpty();
+        if (!entries.isEmpty()) {
+            try {
+                clickable = tokens.putAll(entries);
+            } catch (RuntimeException error) {
+                clickable = false;
+                LOG.warn("Sensitive reveal token batch unavailable match_count={}", entries.size());
+            }
+        }
+        for (Plan plan : plans) plan.target.set(clickable ? plan.clickable : plan.masked);
+    }
+
+    private Plan plan(ValueTarget target, List<RedisRevealTokenStore.Entry> entries) {
+        if (target.value == null || target.value.isEmpty()) return new Plan(target, target.value, target.value);
+        Matcher matcher = SENSITIVE.matcher(target.value);
+        StringBuilder masked = new StringBuilder();
+        StringBuilder clickable = new StringBuilder();
+        int end = 0;
+        while (matcher.find()) {
+            masked.append(target.value, end, matcher.start());
+            clickable.append(target.value, end, matcher.start());
+            String plaintext = matcher.group();
+            String mask = mask(plaintext);
+            masked.append("[#").append(mask).append(']');
+            String revealToken = null;
+            try {
+                String token = token();
+                entries.add(new RedisRevealTokenStore.Entry(
+                        token, crypto.encryptWithCheck(plaintext)));
+                revealToken = token;
+            } catch (CheckException error) {
+                LOG.warn("Sensitive reveal fragment encryption failed error_type={}",
+                        error.getClass().getSimpleName());
+            }
+            clickable.append("[#").append(mask);
+            if (revealToken != null) clickable.append("#VIEW:").append(revealToken);
+            clickable.append(']');
+            end = matcher.end();
+        }
+        if (end == 0) return new Plan(target, target.value, target.value);
+        masked.append(target.value, end, target.value.length());
+        clickable.append(target.value, end, target.value.length());
+        return new Plan(target, masked.toString(), clickable.toString());
+    }
+
+    private void addMapValue(final Map map, final Object key, String ciphertext,
+                             List<ValueTarget> targets) {
+        try {
+            targets.add(new ValueTarget(crypto.decryptWithCheckNoLog(ciphertext),
+                    value -> map.put(key, value)));
+        } catch (CheckException error) {
+            map.put(key, "****");
+            LOG.warn("Sensitive reveal field decryption failed field_kind=map error_type={}",
+                    error.getClass().getSimpleName());
+        }
+    }
+
+    private void addFieldValue(final Object owner, final Field field, List<ValueTarget> targets) {
+        validateField(field);
+        try {
+            String ciphertext = readField(owner, field);
+            final String plaintext = transformFieldValue(field, ciphertext, false);
+            targets.add(new ValueTarget(plaintext, value -> writeField(owner, field, value)));
+        } catch (CheckException | RuntimeException error) {
+            writeField(owner, field, "****");
+            LOG.warn("Sensitive reveal field decryption failed field_kind=pojo error_type={}",
+                    error.getClass().getSimpleName());
+        }
+    }
+
+    private void transform(Object value, boolean encrypt, List<ValueTarget> revealTargets,
+                           Set<Object> visited) throws CheckException {
+        if (value == null || isSimple(value.getClass()) || !visited.add(value)) return;
+        if (value instanceof Map<?, ?>) {
+            Map map = (Map) value;
+            IdentityHashMap<Object, Object> replacements = revealTargets == null
+                    ? new IdentityHashMap<>() : null;
+            for (Object item : map.entrySet()) {
+                Map.Entry entry = (Map.Entry) item;
+                Object child = entry.getValue();
+                if (entry.getKey() instanceof String && MAP_KEYS.contains(entry.getKey())
+                        && child instanceof String) {
+                    if (revealTargets == null) {
+                        replacements.put(child, encrypt ? crypto.encryptWithCheck((String) child)
+                                : crypto.decryptWithCheckNoLog((String) child));
+                    } else {
+                        addMapValue(map, entry.getKey(), (String) child, revealTargets);
+                    }
+                }
+            }
+            for (Object item : map.entrySet()) {
+                Map.Entry entry = (Map.Entry) item;
+                Object child = entry.getValue();
+                if (replacements != null && replacements.containsKey(child)) {
+                    entry.setValue(replacements.get(child));
+                } else if (!(entry.getKey() instanceof String && MAP_KEYS.contains(entry.getKey())
+                        && child instanceof String)) {
+                    transform(child, encrypt, revealTargets, visited);
+                }
+            }
+            return;
+        }
+        if (value instanceof Iterable<?>) {
+            for (Object child : (Iterable<?>) value) {
+                transform(child, encrypt, revealTargets, visited);
+            }
+            return;
+        }
+        if (value.getClass().isArray()) {
+            for (int i = 0; i < Array.getLength(value); i++) {
+                transform(Array.get(value, i), encrypt, revealTargets, visited);
+            }
+            return;
+        }
+        for (Class<?> type = value.getClass(); type != null && type != Object.class;
+             type = type.getSuperclass()) {
+            for (Field field : type.getDeclaredFields()) {
+                if (!isSensitive(field)) continue;
+                if (revealTargets == null) transformField(value, field, encrypt);
+                else addFieldValue(value, field, revealTargets);
+            }
+        }
+    }
+
+    private void transformField(Object owner, Field field, boolean encrypt) throws CheckException {
+        validateField(field);
+        writeField(owner, field, transformFieldValue(field, readField(owner, field), encrypt));
+    }
+
+    private static void validateField(Field field) {
+        if (Modifier.isStatic(field.getModifiers()) || Modifier.isFinal(field.getModifiers())
+                || field.getType() != String.class) {
+            throw new IllegalStateException("Sensitive field must be a writable String: "
+                    + field.getDeclaringClass().getName() + "." + field.getName());
+        }
+    }
+
+    private static String readField(Object owner, Field field) {
+        boolean accessible = field.isAccessible();
+        try {
+            field.setAccessible(true);
+            return (String) field.get(owner);
+        } catch (IllegalAccessException error) {
+            throw new IllegalStateException("Sensitive field is not accessible", error);
+        } finally {
+            field.setAccessible(accessible);
+        }
+    }
+
+    private static void writeField(Object owner, Field field, String value) {
+        boolean accessible = field.isAccessible();
+        try {
+            field.setAccessible(true);
+            field.set(owner, value);
+        } catch (IllegalAccessException error) {
+            throw new IllegalStateException("Sensitive field is not accessible", error);
+        } finally {
+            field.setAccessible(accessible);
+        }
+    }
+
+    private String transformFieldValue(Field field, String value, boolean encrypt)
+            throws CheckException {
+        if (value == null) return null;
+        if (field.isAnnotationPresent(EnDecryptField.class)) {
+            return encrypt ? crypto.encryptWithCheck(value) : crypto.decryptWithCheckNoLog(value);
+        }
+        if (field.isAnnotationPresent(EnDecryptFieldWithTag.class)) {
+            return encrypt ? crypto.encryptWithTag(value) : crypto.decryptWithTag(value);
+        }
+        EnDecryptFieldLong longField = field.getAnnotation(EnDecryptFieldLong.class);
+        return encrypt ? crypto.encryptLongString(value, longField.chunkSize())
+                : crypto.decryptLongString(value);
+    }
+
+    private static boolean isSensitive(Field field) {
+        return field.isAnnotationPresent(EnDecryptField.class)
+                || field.isAnnotationPresent(EnDecryptFieldLong.class)
+                || field.isAnnotationPresent(EnDecryptFieldWithTag.class);
+    }
+
+    private static boolean isSimple(Class<?> type) {
+        return type.isPrimitive() || CharSequence.class.isAssignableFrom(type)
+                || Number.class.isAssignableFrom(type) || Boolean.class == type
+                || Character.class == type || Enum.class.isAssignableFrom(type);
+    }
+
+    private static Set<Object> visited() {
+        return Collections.newSetFromMap(new IdentityHashMap<Object, Boolean>());
+    }
+
+    private String token() {
+        byte[] bytes = new byte[32];
+        random.nextBytes(bytes);
+        return "rt_" + Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);
+    }
+
+    private static String mask(String value) {
+        int at = value.indexOf('@');
+        if (at > 0) {
+            return value.substring(0, 1) + "***" + value.substring(at);
+        }
+        String digits = value.replace("-", "");
+        if (digits.length() == 11 && digits.charAt(0) == '1') {
+            return digits.substring(0, 3) + "****" + digits.substring(7);
+        }
+        if (digits.length() > 7) {
+            return digits.substring(0, 3) + "****" + digits.substring(digits.length() - 4);
+        }
+        return "****";
+    }
+
+    private static final class ValueTarget {
+        final String value;
+        final Consumer<String> setter;
+
+        ValueTarget(String value, Consumer<String> setter) {
+            this.value = value;
+            this.setter = setter;
+        }
+
+        void set(String value) {
+            setter.accept(value);
+        }
+    }
+
+    private static final class Plan {
+        final ValueTarget target;
+        final String masked;
+        final String clickable;
+
+        Plan(ValueTarget target, String masked, String clickable) {
+            this.target = target;
+            this.masked = masked;
+            this.clickable = clickable;
+        }
+    }
+}

package/ark-control/src/main/java/com/union/control/service/sensitive/SensitiveRevealServiceImpl.java

@@ -0,0 +1,72 @@
+package com.union.control.service.sensitive;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nucc.channel.ark.common.exception.CheckException;
+import com.union.control.utils.security.SymmetricalSecurityUtils;
+import com.union.control.utils.AgentSupport;
+import com.union.control.service.sensitive.SensitiveRevealService.ExpiredTokenException;
+import com.union.control.service.sensitive.SensitiveRevealService.InvalidTokenException;
+import com.union.control.service.sensitive.SensitiveRevealService.RevealDecryptionException;
+import com.union.control.service.sensitive.SensitiveRevealService.StoreUnavailableException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.stereotype.Service;
+
+import java.util.Map;
+import java.util.regex.Pattern;
+import java.util.UUID;
+
+@Service("sensitiveRevealService")
+public final class SensitiveRevealServiceImpl implements SensitiveRevealService {
+    private static final Logger LOG = LoggerFactory.getLogger(SensitiveRevealServiceImpl.class);
+    private static final Pattern TOKEN = Pattern.compile("rt_[A-Za-z0-9_-]{43}");
+    private final RedisRevealTokenStore tokens;
+    private final SymmetricalSecurityUtils crypto;
+    private final ObjectMapper json;
+
+    public SensitiveRevealServiceImpl(RedisRevealTokenStore tokens, SymmetricalSecurityUtils crypto,
+                                  ObjectMapper json) {
+        this.tokens = tokens;
+        this.crypto = crypto;
+        this.json = json;
+    }
+
+    public String reveal(String input) {
+        long started = System.nanoTime();
+        Map<String, Object> request = AgentSupport.request(json, input);
+        Object rawRequestId = request.get("revealRequestId");
+        String requestId = rawRequestId instanceof String
+                && ((String) rawRequestId).matches("[A-Za-z0-9-]{1,64}")
+                ? (String) rawRequestId : UUID.randomUUID().toString();
+        LOG.info("Sensitive reveal Control received request_id={}", requestId);
+        Object rawToken = request.get("token");
+        String token = rawToken instanceof String ? (String) rawToken : null;
+        if (token == null || !TOKEN.matcher(token).matches()) {
+            LOG.info("Sensitive reveal Control rejected request_id={} reason=invalid_token", requestId);
+            throw new InvalidTokenException();
+        }
+        String ciphertext;
+        try {
+            ciphertext = tokens.get(token);
+        } catch (RedisRevealTokenStore.StoreUnavailableException error) {
+            LOG.info("Sensitive reveal Control failed request_id={} stage=token_lookup reason=store_unavailable", requestId);
+            throw new StoreUnavailableException();
+        }
+        if (ciphertext == null) {
+            LOG.info("Sensitive reveal Control rejected request_id={} reason=token_expired", requestId);
+            throw new ExpiredTokenException();
+        }
+        LOG.info("Sensitive reveal Control token resolved request_id={}", requestId);
+        try {
+            String plaintext = crypto.decryptWithCheckNoLog(ciphertext);
+            LOG.info("Sensitive reveal Control completed request_id={} elapsed_ms={}",
+                    requestId, (System.nanoTime() - started) / 1000000);
+            return plaintext;
+        } catch (CheckException | RuntimeException error) {
+            LOG.info("Sensitive reveal Control failed request_id={} stage=decrypt error_type={}",
+                    requestId, error.getClass().getSimpleName());
+            throw new RevealDecryptionException();
+        }
+    }
+
+}