JiuContinent
19e59e83cc
feat: 添加数据库迁移脚本并更新Dockerfile配置 - 在Dockerfile中添加alembic配置文件和目录的复制指令 - 更新alembic/env.py注册新的模块模型：events、workflows、writebacks - 生成完整的初始数据库schema迁移脚本，包含以下表： - approval_requests, attendance_records, audit_logs, domain_events - expenses, feishu_event_receipts, fund_accounts, legacy_sync_runs - official_writeback_runs, performance_metrics, policies, procurements - projects, report_push_runs, risk_event_actions, risk_events - standards, suppliers, work_reports, work_tasks, workflow_actions - workflow_instances等21个数据表结构定义 - 在API路由器中添加新模块的路由：events、workflows、writebacks、observability ```
68 lines
2.1 KiB
Python
68 lines
2.1 KiB
Python
import json
|
|
from typing import Any
|
|
|
|
from sqlalchemy import select
|
|
from sqlalchemy.orm import Session
|
|
|
|
from app.core.pagination import bounded_limit
|
|
from app.core.request_context import get_request_id
|
|
from app.modules.audit.constants import AUDIT_REDACTED_VALUE, AUDIT_SENSITIVE_KEYS
|
|
from app.modules.audit.models import AuditLog
|
|
from app.modules.audit.schemas import AuditLogCreate
|
|
|
|
|
|
def _redact(value: Any) -> Any:
|
|
if isinstance(value, dict):
|
|
safe: dict[str, Any] = {}
|
|
for key, item in value.items():
|
|
key_text = str(key)
|
|
if key_text.lower() in AUDIT_SENSITIVE_KEYS:
|
|
safe[key_text] = AUDIT_REDACTED_VALUE
|
|
else:
|
|
safe[key_text] = _redact(item)
|
|
return safe
|
|
if isinstance(value, list):
|
|
return [_redact(item) for item in value]
|
|
if isinstance(value, tuple):
|
|
return [_redact(item) for item in value]
|
|
return value
|
|
|
|
|
|
def _dump(value: Any | None) -> str | None:
|
|
"""Serialize audit payloads while preserving existing strings."""
|
|
|
|
if value is None:
|
|
return None
|
|
if isinstance(value, str):
|
|
return value
|
|
return json.dumps(_redact(value), ensure_ascii=False, default=str)
|
|
|
|
|
|
class AuditService:
|
|
"""Persist and query audit log entries."""
|
|
|
|
def __init__(self, db: Session):
|
|
self.db = db
|
|
|
|
def log(self, payload: AuditLogCreate) -> AuditLog:
|
|
record = AuditLog(
|
|
actor=payload.actor,
|
|
source=payload.source,
|
|
action=payload.action,
|
|
target_type=payload.target_type,
|
|
target_id=payload.target_id,
|
|
risk_level=payload.risk_level,
|
|
request_payload=_dump(payload.request_payload),
|
|
response_payload=_dump(payload.response_payload),
|
|
status=payload.status,
|
|
request_id=payload.request_id or get_request_id(),
|
|
)
|
|
self.db.add(record)
|
|
self.db.commit()
|
|
self.db.refresh(record)
|
|
return record
|
|
|
|
def list_logs(self, limit: int = 100) -> list[AuditLog]:
|
|
stmt = select(AuditLog).order_by(AuditLog.id.desc()).limit(bounded_limit(limit))
|
|
return list(self.db.execute(stmt).scalars())
|