From 344c519209675695f12298170fc390cbaf9a8d05 Mon Sep 17 00:00:00 2001 From: logan Date: Mon, 25 May 2026 12:57:59 +0800 Subject: [PATCH] =?UTF-8?q?feat:=20P0=E7=94=9F=E4=BA=A7=E5=8A=A0=E5=9B=BA?= =?UTF-8?q?=20=E2=80=94=20=E8=AE=A4=E8=AF=81=E5=AE=89=E5=85=A8+=E6=93=8D?= =?UTF-8?q?=E4=BD=9C=E5=AE=A1=E8=AE=A1+=E9=94=99=E8=AF=AF=E6=8F=90?= =?UTF-8?q?=E7=A4=BA?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit P0-1 认证安全: - JWT secret 改为环境变量配置, 未设置则随机生成(重启失效) - 新增 LoginRateLimitMiddleware: 5次/分钟登录频率限制(滑动窗口) - 429 响应 + 前端 toast 提示 P0-2 操作审计日志: - 新增 OperationLog 模型 (user/username/action/resource/detail/ip) - 新增 AuditLogMiddleware 自动记录 POST/PUT/DELETE/PATCH 操作 - 新增 GET /audit-logs API (分页/过滤/统计) - 前端 AuditLogsPage 对接真实 API (字段/路径修正) P0-3 实例密码加密: - 已确认 crypto.py AES-256-GCM 加密存储, 无需修改 P1 前端错误提示: - 新增 useToast hook + ToastContainer 组件 - request.ts 拦截器: 4xx/5xx 错误 toast 显示后端 detail 信息 - 422 验证错误提取第一条 msg - 网络失败显示通用提示 1182 tests passed --- backend/app/api/v1/endpoints/audit_log.py | 94 +++++++++++++++ backend/app/api/v1/endpoints/auth.py | 14 ++- backend/app/api/v1/router.py | 3 +- backend/app/core/audit_middleware.py | 129 +++++++++++++++++++++ backend/app/core/config.py | 20 +++- backend/app/core/rate_limit.py | 50 ++++++++ backend/app/main.py | 4 + backend/app/models/__init__.py | 1 + backend/app/models/operation_log.py | 27 +++++ backend/app/services/audit_logger.py | 45 +++++++ frontend/src/App.tsx | 2 + frontend/src/api/request.ts | 33 +++--- frontend/src/components/ToastContainer.tsx | 42 +++++++ frontend/src/hooks/useToast.ts | 51 ++++---- frontend/src/pages/AuditLogsPage.tsx | 92 ++++++++------- 15 files changed, 510 insertions(+), 97 deletions(-) create mode 100644 backend/app/api/v1/endpoints/audit_log.py create mode 100644 backend/app/core/audit_middleware.py create mode 100644 backend/app/core/rate_limit.py create mode 100644 backend/app/models/operation_log.py create mode 100644 backend/app/services/audit_logger.py create mode 100644 frontend/src/components/ToastContainer.tsx diff --git a/backend/app/api/v1/endpoints/audit_log.py b/backend/app/api/v1/endpoints/audit_log.py new file mode 100644 index 0000000..e0fd5db --- /dev/null +++ b/backend/app/api/v1/endpoints/audit_log.py @@ -0,0 +1,94 @@ +"""操作审计日志 API。""" +from typing import Optional +from fastapi import APIRouter, Depends, Query +from sqlalchemy.ext.asyncio import AsyncSession +from sqlalchemy import select, func, desc + +from app.core.database import get_db +from app.core.security import require_role +from app.models.user import User +from app.models.operation_log import OperationLog + +router = APIRouter(prefix="/audit-logs", tags=["audit-logs"]) + + +@router.get("") +async def list_audit_logs( + page: int = Query(1, ge=1), + page_size: int = Query(20, ge=1, le=100), + action: Optional[str] = Query(None), + resource_type: Optional[str] = Query(None), + username: Optional[str] = Query(None), + db: AsyncSession = Depends(get_db), + current_user: User = Depends(require_role("admin")), +): + """查询操作审计日志（仅管理员）。""" + query = select(OperationLog) + count_query = select(func.count(OperationLog.id)) + + if action: + query = query.where(OperationLog.action == action) + count_query = count_query.where(OperationLog.action == action) + if resource_type: + query = query.where(OperationLog.resource_type == resource_type) + count_query = count_query.where(OperationLog.resource_type == resource_type) + if username: + query = query.where(OperationLog.username.contains(username)) + count_query = count_query.where(OperationLog.username.contains(username)) + + total = (await db.execute(count_query)).scalar() or 0 + query = query.order_by(desc(OperationLog.created_at)) + query = query.offset((page - 1) * page_size).limit(page_size) + + result = await db.execute(query) + logs = result.scalars().all() + + return { + "total": total, + "page": page, + "page_size": page_size, + "items": [ + { + "id": l.id, + "user_id": l.user_id, + "username": l.username, + "action": l.action, + "resource_type": l.resource_type, + "resource_id": l.resource_id, + "detail": l.detail, + "ip_address": l.ip_address, + "created_at": l.created_at.isoformat() if l.created_at else None, + } + for l in logs + ], + } + + +@router.get("/stats") +async def audit_log_stats( + db: AsyncSession = Depends(get_db), + current_user: User = Depends(require_role("admin")), +): + """审计日志统计概览。""" + # 最近7天操作分布 + from datetime import datetime, timedelta, timezone + since = datetime.now(timezone.utc) - timedelta(days=7) + + result = await db.execute( + select(OperationLog.action, func.count(OperationLog.id)) + .where(OperationLog.created_at >= since) + .group_by(OperationLog.action) + ) + action_stats = {row[0]: row[1] for row in result.all()} + + # 操作最多的用户 + result = await db.execute( + select(OperationLog.username, func.count(OperationLog.id)) + .where(OperationLog.created_at >= since) + .group_by(OperationLog.username) + .order_by(desc(func.count(OperationLog.id))) + .limit(5) + ) + top_users = [{"username": row[0], "count": row[1]} for row in result.all()] + + return {"action_stats": action_stats, "top_users": top_users} diff --git a/backend/app/api/v1/endpoints/auth.py b/backend/app/api/v1/endpoints/auth.py index 9a645f7..e6e17ff 100644 --- a/backend/app/api/v1/endpoints/auth.py +++ b/backend/app/api/v1/endpoints/auth.py @@ -1,5 +1,5 @@ from datetime import datetime, timezone -from fastapi import APIRouter, Depends, HTTPException, status +from fastapi import APIRouter, Depends, HTTPException, Request, status from sqlalchemy import select from sqlalchemy.ext.asyncio import AsyncSession @@ -12,11 +12,16 @@ router = APIRouter(prefix="/auth", tags=["认证"]) @router.post("/login", response_model=TokenResponse) -async def login(req: LoginRequest, db: AsyncSession = Depends(get_db)): +async def login(req: LoginRequest, request: Request, db: AsyncSession = Depends(get_db)): result = await db.execute(select(User).where(User.username == req.username)) user = result.scalar_one_or_none() if not user or not verify_password(req.password, user.hashed_password): + # 记录登录失败 + from app.services.audit_logger import log_operation + await log_operation(db, action="login_failed", username=req.username, + detail=f"登录失败: 用户名或密码错误", request=request) + await db.commit() raise HTTPException(status_code=401, detail="用户名或密码错误") if not user.is_active: @@ -26,6 +31,11 @@ async def login(req: LoginRequest, db: AsyncSession = Depends(get_db)): raise HTTPException(status_code=403, detail="访客账户已禁用，请联系管理员") user.last_login = datetime.now(timezone.utc) + + # 记录登录成功 + from app.services.audit_logger import log_operation + await log_operation(db, action="login", user_id=user.id, username=user.username, + detail=f"登录成功", request=request) await db.commit() token = create_access_token(data={"sub": str(user.id), "role": user.role}) diff --git a/backend/app/api/v1/router.py b/backend/app/api/v1/router.py index 1c06f70..9f71607 100644 --- a/backend/app/api/v1/router.py +++ b/backend/app/api/v1/router.py @@ -7,7 +7,7 @@ from app.api.v1.endpoints import ( instance_group, masking_rule, rollback, workflow, impact, schema_drift, pool, mongo, query_history, sql_assistant, db_types, - settings, scheduled_task, + settings, scheduled_task, audit_log, ) api_router = APIRouter(prefix="/api/v1") @@ -41,3 +41,4 @@ api_router.include_router(sql_assistant.router) api_router.include_router(db_types.router) api_router.include_router(settings.router, prefix="/settings", tags=["系统设置"]) api_router.include_router(scheduled_task.router) +api_router.include_router(audit_log.router) diff --git a/backend/app/core/audit_middleware.py b/backend/app/core/audit_middleware.py new file mode 100644 index 0000000..ac0e89b --- /dev/null +++ b/backend/app/core/audit_middleware.py @@ -0,0 +1,129 @@ +"""操作审计中间件 — 自动记录所有 POST/PUT/DELETE/PATCH 请求。""" +import time +import json +from fastapi import Request +from starlette.middleware.base import BaseHTTPMiddleware + +from app.core.database import async_session +from app.models.operation_log import OperationLog + + +# 不记录审计的路径（高频/非业务） +_EXCLUDE_PREFIXES = ( + "/api/v1/audit-logs", + "/api/v1/dashboard", + "/docs", + "/openapi", + "/redoc", + "/api/v1/query/execute", # 查询执行单独记录 +) + +# 资源类型映射: URL前缀 -> 资源类型 +_RESOURCE_MAP = { + "/api/v1/tickets": "ticket", + "/api/v1/instances": "instance", + "/api/v1/users": "user", + "/api/v1/audit-rules": "audit_rule", + "/api/v1/notifications": "notification", + "/api/v1/auth": "auth", + "/api/v1/workflows": "workflow", + "/api/v1/settings": "system_setting", +} + +# action 映射 +_ACTION_MAP = { + "POST": "create", + "PUT": "update", + "PATCH": "update", + "DELETE": "delete", +} + + +class AuditLogMiddleware(BaseHTTPMiddleware): + """自动审计中间件 — 记录所有写操作。""" + + async def dispatch(self, request: Request, call_next): + # 只审计写操作 + if request.method not in ("POST", "PUT", "PATCH", "DELETE"): + return await call_next(request) + + path = request.url.path + # 跳过排除列表 + if any(path.startswith(p) for p in _EXCLUDE_PREFIXES): + return await call_next(request) + + # 特殊: POST /auth/login 在 auth.py 中单独记录 + if path == "/api/v1/auth/login" or path == "/api/v1/auth/logout": + return await call_next(request) + + response = await call_next(request) + + # 异步记录审计日志（不阻塞响应） + try: + await self._record(request, response.status_code) + except Exception: + pass + + return response + + @staticmethod + async def _record(request: Request, status_code: int): + path = request.url.path + method = request.method + + # 确定 action + action = _ACTION_MAP.get(method, method.lower()) + if path.endswith("/review"): + action = "approve" if status_code < 300 else "reject" + elif path.endswith("/execute"): + action = "execute" + elif path.endswith("/cancel"): + action = "cancel" + + # 确定资源类型 + resource_type = "other" + for prefix, rtype in _RESOURCE_MAP.items(): + if path.startswith(prefix): + resource_type = rtype + break + + # 提取 resource_id + resource_id = None + parts = path.rstrip("/").split("/") + for p in parts: + if p.isdigit(): + resource_id = int(p) + break + + # 获取操作者信息 + user_id = None + username = None + try: + from app.core.security import decode_token + auth_header = request.headers.get("authorization", "") + if auth_header.startswith("Bearer "): + payload = decode_token(auth_header[7:]) + user_id = int(payload.get("sub", 0)) + username = payload.get("role", "unknown") + except Exception: + pass + + # IP + forwarded = request.headers.get("x-forwarded-for") + ip_address = forwarded.split(",")[0].strip() if forwarded else ( + request.client.host if request.client else None + ) + + # 写入DB + async with async_session() as db: + log = OperationLog( + user_id=user_id, + username=username, + action=action, + resource_type=resource_type, + resource_id=resource_id, + detail=f"{method} {path} -> {status_code}", + ip_address=ip_address, + ) + db.add(log) + await db.commit() diff --git a/backend/app/core/config.py b/backend/app/core/config.py index 00726e6..4588003 100644 --- a/backend/app/core/config.py +++ b/backend/app/core/config.py @@ -2,12 +2,17 @@ from pydantic_settings import BaseSettings, SettingsConfigDict from functools import lru_cache +import secrets + + class Settings(BaseSettings): ENV: str = "development" DEBUG: bool = True - SECRET_KEY: str = "dev-secret-key-change-in-production" - ACCESS_TOKEN_EXPIRE_MINUTES: int = 30 + # JWT secret: 生产环境必须通过环境变量设置 + # 若未设置则每次启动随机生成（重启后旧 token 失效） + SECRET_KEY: str = "" + ACCESS_TOKEN_EXPIRE_MINUTES: int = 480 # 8小时 ALGORITHM: str = "HS256" DATABASE_URL: str = "sqlite+aiosqlite:///./sqlite3.db" @@ -18,9 +23,18 @@ class Settings(BaseSettings): # CORS: production comma-separated origins (e.g. "https://sql.example.com,https://sql2.example.com") CORS_ORIGINS: str = "" + # 登录频率限制: 每IP每分钟最多尝试次数 + LOGIN_RATE_LIMIT: int = 10 + model_config = SettingsConfigDict(env_file=".env", env_file_encoding="utf-8") @lru_cache() def get_settings() -> Settings: - return Settings() + s = Settings() + if not s.SECRET_KEY: + s.SECRET_KEY = secrets.token_urlsafe(32) + if s.ENV == "development": + import logging + logging.getLogger(__name__).info("SECRET_KEY 未设置，已自动生成（重启后失效）") + return s diff --git a/backend/app/core/rate_limit.py b/backend/app/core/rate_limit.py new file mode 100644 index 0000000..7626b23 --- /dev/null +++ b/backend/app/core/rate_limit.py @@ -0,0 +1,50 @@ +"""登录频率限制 — 基于IP的滑动窗口计数器。""" +import time +from collections import defaultdict +from typing import Dict, List, Tuple + +from fastapi import Request, HTTPException, status +from starlette.middleware.base import BaseHTTPMiddleware + +from app.core.config import get_settings + + +class LoginRateLimitMiddleware(BaseHTTPMiddleware): + """限制每IP每分钟的登录尝试次数。""" + + def __init__(self, app, **kwargs): + super().__init__(app, **kwargs) + self._attempts: Dict[str, List[float]] = defaultdict(list) + + async def dispatch(self, request: Request, call_next): + if request.url.path == "/api/v1/auth/login" and request.method == "POST": + client_ip = self._get_client_ip(request) + settings = get_settings() + max_attempts = settings.LOGIN_RATE_LIMIT + + now = time.time() + # 清理60秒前的记录 + self._attempts[client_ip] = [ + t for t in self._attempts[client_ip] if now - t < 60 + ] + + if len(self._attempts[client_ip]) >= max_attempts: + raise HTTPException( + status_code=status.HTTP_429_TOO_MANY_REQUESTS, + detail=f"登录尝试过于频繁，请稍后再试（限制: {max_attempts}次/分钟）", + ) + + response = await call_next(request) + # 只在登录失败时记录（成功不计入限制） + if response.status_code != 200: + self._attempts[client_ip].append(now) + return response + + return await call_next(request) + + @staticmethod + def _get_client_ip(request: Request) -> str: + forwarded = request.headers.get("x-forwarded-for") + if forwarded: + return forwarded.split(",")[0].strip() + return request.client.host if request.client else "unknown" diff --git a/backend/app/main.py b/backend/app/main.py index c6b2441..0e79cc8 100644 --- a/backend/app/main.py +++ b/backend/app/main.py @@ -7,6 +7,8 @@ from fastapi.middleware.cors import CORSMiddleware from sqlalchemy import select from app.core.config import get_settings +from app.core.rate_limit import LoginRateLimitMiddleware +from app.core.audit_middleware import AuditLogMiddleware from app.core.database import init_db, async_session from app.core.security import hash_password from app.models.user import User @@ -124,6 +126,8 @@ app = FastAPI( _cors_origins = ["*"] if settings.DEBUG else [ o.strip() for o in settings.CORS_ORIGINS.split(",") if o.strip() ] +app.add_middleware(AuditLogMiddleware) +app.add_middleware(LoginRateLimitMiddleware) app.add_middleware( CORSMiddleware, allow_origins=_cors_origins, diff --git a/backend/app/models/__init__.py b/backend/app/models/__init__.py index 8639b5e..1b78202 100644 --- a/backend/app/models/__init__.py +++ b/backend/app/models/__init__.py @@ -2,3 +2,4 @@ from app.models.instance_group import InstanceGroup, user_groups, instance_group from app.models.system_setting import SystemSetting # noqa: F401 from app.models.query_history import QueryHistory, QuickQueryModel # noqa: F401 from app.models.ticket_sql_item import TicketSqlItem # noqa: F401 +from app.models.operation_log import OperationLog # noqa: F401 diff --git a/backend/app/models/operation_log.py b/backend/app/models/operation_log.py new file mode 100644 index 0000000..669bc21 --- /dev/null +++ b/backend/app/models/operation_log.py @@ -0,0 +1,27 @@ +"""操作审计日志模型。""" +from sqlalchemy import Column, Integer, String, Text, DateTime, Index +from sqlalchemy.sql import func + +from app.core.database import Base + + +class OperationLog(Base): + __tablename__ = "operation_logs" + + id = Column(Integer, primary_key=True, autoincrement=True) + user_id = Column(Integer, nullable=True, comment="操作者ID（系统操作为空）") + username = Column(String(50), nullable=True, comment="操作者用户名") + action = Column(String(50), nullable=False, comment="操作类型: login/create/update/delete/execute/approve/reject") + resource_type = Column(String(50), nullable=True, comment="资源类型: ticket/instance/user/audit_rule/notification/workflow") + resource_id = Column(Integer, nullable=True, comment="资源ID") + detail = Column(Text, nullable=True, comment="操作详情") + ip_address = Column(String(50), nullable=True, comment="操作者IP") + user_agent = Column(String(255), nullable=True, comment="浏览器UA") + created_at = Column(DateTime(timezone=True), server_default=func.now()) + + __table_args__ = ( + Index("ix_oplog_user_id", "user_id"), + Index("ix_oplog_action", "action"), + Index("ix_oplog_resource", "resource_type", "resource_id"), + Index("ix_oplog_created_at", "created_at"), + ) diff --git a/backend/app/services/audit_logger.py b/backend/app/services/audit_logger.py new file mode 100644 index 0000000..a08ec33 --- /dev/null +++ b/backend/app/services/audit_logger.py @@ -0,0 +1,45 @@ +"""操作审计日志服务 — 轻量级，各 endpoint 直接调用。""" +from typing import Optional +from sqlalchemy.ext.asyncio import AsyncSession +from fastapi import Request + +from app.models.operation_log import OperationLog + + +async def log_operation( + db: AsyncSession, + *, + action: str, + resource_type: Optional[str] = None, + resource_id: Optional[int] = None, + detail: Optional[str] = None, + user_id: Optional[int] = None, + username: Optional[str] = None, + request: Optional[Request] = None, +) -> None: + """记录操作日志（fire-and-forget，不抛异常）。""" + try: + ip_address = None + user_agent = None + if request: + forwarded = request.headers.get("x-forwarded-for") + ip_address = forwarded.split(",")[0].strip() if forwarded else ( + request.client.host if request.client else None + ) + user_agent = request.headers.get("user-agent", "")[:255] + + log = OperationLog( + user_id=user_id, + username=username, + action=action, + resource_type=resource_type, + resource_id=resource_id, + detail=detail, + ip_address=ip_address, + user_agent=user_agent, + ) + db.add(log) + await db.flush() + except Exception: + # 审计日志不应影响业务流程 + pass diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx index 6d5f002..fe6e344 100644 --- a/frontend/src/App.tsx +++ b/frontend/src/App.tsx @@ -21,6 +21,7 @@ import MongoDBDetailPage from '@/pages/MongoDBDetailPage'; import TicketCreatePage from '@/pages/TicketCreatePage'; import TicketDetailPage from '@/pages/TicketDetailPage'; import InstanceGroupPage from '@/pages/InstanceGroupPage'; +import { ToastContainer } from '@/components/ToastContainer'; // 路由守卫：未登录跳转登录页，无权限跳转仪表盘 function RouteGuard() { @@ -86,6 +87,7 @@ function App() { + diff --git a/frontend/src/api/request.ts b/frontend/src/api/request.ts index 90b5fc2..c82e2f3 100644 --- a/frontend/src/api/request.ts +++ b/frontend/src/api/request.ts @@ -1,4 +1,5 @@ import axios from 'axios'; +import { toast } from '@/hooks/useToast'; const request = axios.create({ baseURL: '/api/v1', @@ -10,40 +11,36 @@ request.interceptors.request.use((config) => { if (token) { config.headers.Authorization = `Bearer ${token}`; } - - // Debug logging - console.log( - `[API] ${config.method?.toUpperCase()} ${config.baseURL}${config.url}`, - config.params ? 'params=' + JSON.stringify(config.params) : '', - config.data ? 'data=' + JSON.stringify(config.data).substring(0, 200) : '' - ); - return config; }); request.interceptors.response.use( (response) => { - console.log( - `[API] ${response.status} ${response.config.url}`, - Array.isArray(response.data) ? `(${response.data.length} items)` : '' - ); return response.data; }, (error) => { const status = error.response?.status; - const url = error.config?.url; const detail = error.response?.data?.detail; + const msg = detail || error.message || '未知错误'; if (status === 401) { - console.warn(`[API] 401 Unauthorized: ${url} — redirecting to login`); localStorage.removeItem('token'); window.location.href = '/login'; - } else if (status === 500) { - console.error(`[API] 500 Internal Error: ${url}`, detail || error.message); + } else if (status === 429) { + toast('warning', msg); } else if (status === 422) { - console.warn(`[API] 422 Validation Error: ${url}`, error.response?.data); + // 验证错误 — 取第一个错误信息 + const errors = error.response?.data?.detail; + if (Array.isArray(errors)) { + const first = errors[0]; + toast('error', first?.msg || '请求参数错误'); + } else { + toast('error', typeof errors === 'string' ? errors : '请求参数错误'); + } + } else if (status && status >= 400) { + toast('error', msg); } else { - console.warn(`[API] ${status || 'NETWORK'} Error: ${url}`, detail || error.message); + toast('error', '网络连接失败'); } return Promise.reject(error); diff --git a/frontend/src/components/ToastContainer.tsx b/frontend/src/components/ToastContainer.tsx new file mode 100644 index 0000000..ae2518d --- /dev/null +++ b/frontend/src/components/ToastContainer.tsx @@ -0,0 +1,42 @@ +import { useToast } from '@/hooks/useToast'; +import { X, CheckCircle2, AlertCircle, AlertTriangle, Info } from 'lucide-react'; + +const ICONS = { + success: CheckCircle2, + error: AlertCircle, + warning: AlertTriangle, + info: Info, +}; + +const COLORS = { + success: 'bg-green-500/10 border-green-500/30 text-green-400', + error: 'bg-red-500/10 border-red-500/30 text-red-400', + warning: 'bg-yellow-500/10 border-yellow-500/30 text-yellow-400', + info: 'bg-blue-500/10 border-blue-500/30 text-blue-400', +}; + +export function ToastContainer() { + const { toasts, remove } = useToast(); + + if (toasts.length === 0) return null; + + return ( +
+ {toasts.map(t => { + const Icon = ICONS[t.type]; + return ( +
+ + {t.message} + +
+ ); + })} +
+ ); +} diff --git a/frontend/src/hooks/useToast.ts b/frontend/src/hooks/useToast.ts index 29da11f..f4882e0 100644 --- a/frontend/src/hooks/useToast.ts +++ b/frontend/src/hooks/useToast.ts @@ -1,40 +1,33 @@ -import { useState, useEffect, useCallback } from 'react'; -import { CheckCircle, XCircle, X } from 'lucide-react'; +import { useCallback, useState } from 'react'; export interface Toast { + id: number; + type: 'success' | 'error' | 'warning' | 'info'; message: string; - type: 'success' | 'error'; +} + +let toastId = 0; +let _addToast: ((t: Toast) => void) | null = null; + +export function toast(type: Toast['type'], message: string) { + if (_addToast) { + _addToast({ id: ++toastId, type, message }); + } } export function useToast() { - const [toast, setToast] = useState(null); + const [toasts, setToasts] = useState([]); - useEffect(() => { - if (!toast) return; - const t = setTimeout(() => setToast(null), 3000); - return () => clearTimeout(t); - }, [toast]); - - const showToast = useCallback((message: string, type: 'success' | 'error' = 'success') => { - setToast({ message, type }); + _addToast = useCallback((t: Toast) => { + setToasts(prev => [...prev, t]); + setTimeout(() => { + setToasts(prev => prev.filter(x => x.id !== t.id)); + }, 4000); }, []); - const ToastComponent = () => { - if (!toast) return null; - const isSuccess = toast.type === 'success'; - return ( -
- {isSuccess ? : } - {toast.message} - -
- ); - }; + const remove = useCallback((id: number) => { + setToasts(prev => prev.filter(x => x.id !== id)); + }, []); - return { toast, showToast, ToastComponent }; + return { toasts, remove }; } diff --git a/frontend/src/pages/AuditLogsPage.tsx b/frontend/src/pages/AuditLogsPage.tsx index 9d3ca78..2c6a2eb 100644 --- a/frontend/src/pages/AuditLogsPage.tsx +++ b/frontend/src/pages/AuditLogsPage.tsx @@ -17,11 +17,10 @@ interface AuditLog { user_id: number; username: string; action: string; - target_type: string; - target_id: number | null; + resource_type: string; + resource_id: number | null; detail: string | null; ip_address: string | null; - result_status: 'success' | 'failed' | 'warning'; created_at: string | null; } @@ -35,29 +34,27 @@ interface AuditLogResponse { /* ───────── Constants ───────── */ const ACTION_COLORS: Record = { - CREATE_TICKET: 'bg-blue-500/15 text-blue-400', - REVIEW_TICKET: 'bg-yellow-500/15 text-yellow-400', - EXECUTE_TICKET: 'bg-green-500/15 text-green-400', - CREATE_INSTANCE: 'bg-purple-500/15 text-purple-400', - DELETE_INSTANCE: 'bg-red-500/15 text-red-400', - CREATE_USER: 'bg-indigo-500/15 text-indigo-400', - DELETE_USER: 'bg-red-500/15 text-red-400', - QUERY: 'bg-cyan-500/15 text-cyan-400', - LOGIN: 'bg-emerald-500/15 text-emerald-400', - LOGOUT: 'bg-[var(--dg-text-muted)]/15 text-[var(--dg-text-muted)]', + create: 'bg-blue-500/15 text-blue-400', + approve: 'bg-yellow-500/15 text-yellow-400', + execute: 'bg-green-500/15 text-green-400', + update: 'bg-purple-500/15 text-purple-400', + delete: 'bg-red-500/15 text-red-400', + login: 'bg-emerald-500/15 text-emerald-400', + login_failed: 'bg-red-500/15 text-red-400', + cancel: 'bg-orange-500/15 text-orange-400', + reject: 'bg-red-500/15 text-red-400', }; const ACTION_LABELS: Record = { - CREATE_TICKET: '创建工单', - REVIEW_TICKET: '审批工单', - EXECUTE_TICKET: '执行工单', - CREATE_INSTANCE: '创建实例', - DELETE_INSTANCE: '删除实例', - CREATE_USER: '创建用户', - DELETE_USER: '删除用户', - QUERY: '执行查询', - LOGIN: '登录', - LOGOUT: '登出', + create: '创建', + update: '更新', + delete: '删除', + approve: '审批', + execute: '执行', + cancel: '取消', + reject: '拒绝', + login: '登录', + login_failed: '登录失败', }; const STATUS_CONFIG: Record = { @@ -70,8 +67,12 @@ const TARGET_ICONS: Record = { ticket: FileText, instance: Globe, user: User, - query: Search, - system: AlertTriangle, + auth: User, + audit_rule: Search, + notification: AlertTriangle, + workflow: FileText, + system_setting: AlertTriangle, + other: FileText, }; const CHART_COLORS = ['#6366f1', '#a855f7', '#ec4899', '#f43f5e', '#f97316', '#eab308', '#22c55e', '#06b6d4', '#3b82f6']; @@ -81,9 +82,9 @@ const CHART_COLORS = ['#6366f1', '#a855f7', '#ec4899', '#f43f5e', '#f97316', '#e function exportLogsToCSV(logs: AuditLog[]) { const headers = ['ID', '操作人', '操作类型', '目标类型', '目标ID', '详情', 'IP地址', '结果', '时间']; const rows = logs.map(l => [ - l.id, l.username, ACTION_LABELS[l.action] || l.action, l.target_type, - l.target_id || '', l.detail || '', l.ip_address || '', - l.result_status === 'success' ? '成功' : l.result_status === 'failed' ? '失败' : '警告', + l.id, l.username, ACTION_LABELS[l.action] || l.action, l.resource_type, + l.resource_id || '', l.detail || '', l.ip_address || '', + l.action.includes('fail') || l.action === 'reject' ? '失败' : '成功', l.created_at || '', ]); const csv = [headers, ...rows].map(r => r.map(c => `"${String(c).replace(/"/g, '""')}"`).join(',')).join('\n'); @@ -123,7 +124,7 @@ export default function AuditLogsPage() { try { const params = new URLSearchParams({ page: String(page), page_size: String(pageSize) }); if (filterAction) params.set('action', filterAction); - const res = await request.get(`/audit/logs?${params}`); + const res = await request.get(`/audit-logs?${params}`); const data = (res?.data ?? res ?? {}) as AuditLogResponse; const items = data.items || []; setLogs(items); @@ -141,8 +142,8 @@ export default function AuditLogsPage() { // Client-side filtering for advanced filters const filteredLogs = useMemo(() => { return logs.filter(log => { - if (filterTarget && log.target_type !== filterTarget) return false; - if (filterStatus && log.result_status !== filterStatus) return false; + if (filterTarget && log.resource_type !== filterTarget) return false; + if (filterStatus && log.action.includes('fail') !== (filterStatus === 'failed')) return false; if (filterDateRange && log.created_at) { const days = Math.floor((Date.now() - new Date(log.created_at).getTime()) / 86400000); if (filterDateRange === '1d' && days > 1) return false; @@ -184,12 +185,14 @@ export default function AuditLogsPage() { }, [logs]); const statusDistribution = useMemo(() => { - const map: Record = { success: 0, failed: 0, warning: 0 }; - logs.forEach(l => { map[l.result_status] = (map[l.result_status] || 0) + 1; }); + let success = 0, failed = 0; + logs.forEach(l => { + if (l.action.includes('fail') || l.action === 'reject') failed++; + else success++; + }); return [ - { name: '成功', value: map.success, color: '#22c55e' }, - { name: '失败', value: map.failed, color: '#f43f5e' }, - { name: '警告', value: map.warning, color: '#eab308' }, + { name: '成功', value: success, color: '#22c55e' }, + { name: '失败', value: failed, color: '#f43f5e' }, ]; }, [logs]); @@ -349,8 +352,9 @@ export default function AuditLogsPage() { - - + + + {/* Status filter */} @@ -362,7 +366,6 @@ export default function AuditLogsPage() { - {/* Date range */} @@ -436,9 +439,10 @@ export default function AuditLogsPage() { ) : ( paginatedLogs.map(log => { const isExpanded = expandedId === log.id; - const statusConfig = STATUS_CONFIG[log.result_status] || STATUS_CONFIG.success; + const isFailed = log.action.includes('fail') || log.action === 'reject'; + const statusConfig = isFailed ? STATUS_CONFIG.failed : STATUS_CONFIG.success; const StatusIcon = statusConfig.icon; - const TargetIcon = TARGET_ICONS[log.target_type] || FileText; + const TargetIcon = TARGET_ICONS[log.resource_type] || FileText; return (
- {log.target_type} - {log.target_id && #{log.target_id}} + {log.resource_type} + {log.resource_id && #{log.resource_id}}
@@ -505,7 +509,7 @@ export default function AuditLogsPage() {
目标ID
-
{log.target_id || 'N/A'}
+
{log.resource_id || 'N/A'}
时间