1.优化ws返回参数不包含敏感字段user_id等

app/common/service/GameWebSocketPayloadHelper.php

@@ -21,6 +21,22 @@ final class GameWebSocketPayloadHelper
         'bet.accepted',
     ];
 
+    /**
+     * 下发给客户端前从 data 中移除的字段（服务端入队/路由仍保留完整载荷）。
+     *
+     * @var list<string>
+     */
+    public const OUTBOUND_STRIP_KEYS = [
+        'user_id',
+        'uuid',
+        'phone',
+        'balance_before',
+        'channel_id',
+        'review_admin_id',
+        'operator_admin_id',
+        'idempotency_key',
+    ];
+
     /**
      * @return array{user_id: int, current_streak: int, streak_level: int, odds_factor: int, is_jackpot: bool}
      */
@@ -53,6 +69,53 @@ final class GameWebSocketPayloadHelper
         ];
     }
 
+    /**
+     * 出站 WebSocket 帧 data 脱敏：移除 user_id 等（连接已绑定用户，无需在载荷中重复暴露）。
+     *
+     * @param array<string, mixed> $data
+     * @return array<string, mixed>
+     */
+    public static function sanitizeOutboundData(array $data): array
+    {
+        return self::stripSensitiveKeysRecursive($data, 0);
+    }
+
+    /**
+     * @param array<string, mixed> $data
+     * @return array<string, mixed>
+     */
+    private static function stripSensitiveKeysRecursive(array $data, int $depth): array
+    {
+        if ($depth > 8) {
+            return $data;
+        }
+        $out = [];
+        foreach ($data as $key => $value) {
+            if (!is_string($key)) {
+                continue;
+            }
+            if (in_array($key, self::OUTBOUND_STRIP_KEYS, true)) {
+                continue;
+            }
+            if (is_array($value)) {
+                $isList = array_is_list($value);
+                $child = [];
+                foreach ($value as $k => $item) {
+                    if (is_array($item)) {
+                        $child[$k] = self::stripSensitiveKeysRecursive($item, $depth + 1);
+                    } else {
+                        $child[$k] = $item;
+                    }
+                }
+                $out[$key] = $isList ? array_values($child) : $child;
+                continue;
+            }
+            $out[$key] = $value;
+        }
+
+        return $out;
+    }
+
     /**
      * @param array<string, mixed> $payload
      * @return array<string, mixed>