feat: Phase 3 - AES encryption, SQL audit engine, audit logs (85 tests)

Phase 3.1: Instance password AES-256-GCM encryption
Phase 3.2: SQL audit rule engine (10 rules)
Phase 3.3: Auto-audit on ticket creation
Phase 3.4: Operation audit logs + GET /audit/logs
Tests: 44 -> 85 (41 new), Frontend: AuditLogsPage

backend/app/api/v1/endpoints/audit.py

@@ -0,0 +1,27 @@
+"""Audit log endpoints."""
+from typing import Optional
+from fastapi import APIRouter, Depends, Query
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.database import get_db
+from app.core.security import require_role
+from app.models.user import User
+from app.services.audit_log_service import AuditLogService
+
+router = APIRouter(prefix="/audit", tags=["审计日志"])
+
+
+@router.get("/logs")
+async def list_audit_logs(
+    page: int = Query(1, ge=1),
+    page_size: int = Query(20, ge=1, le=100),
+    user_id: Optional[int] = None,
+    action: Optional[str] = None,
+    target_type: Optional[str] = None,
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(require_role("admin", "dba")),
+):
+    return await AuditLogService.list_logs(
+        db, page=page, page_size=page_size,
+        user_id=user_id, action=action, target_type=target_type,
+    )

backend/app/api/v1/endpoints/instance.py

@@ -10,6 +10,8 @@ from app.models.user import User
 from app.models.instance import Instance
 from app.schemas.instance import InstanceCreate, InstanceUpdate, InstanceResponse, ConnectionTestResult
 from app.services.instance_service import InstanceService
+from app.core.crypto import encrypt_password, decrypt_password
+from app.services.audit_log_service import AuditLogService
 
 router = APIRouter(prefix="/instances", tags=["数据源管理"])
 
@@ -42,12 +44,18 @@ async def create_instance(
         host=data.host,
         port=data.port,
         username=data.username,
-        password=data.password,
+        password=encrypt_password(data.password),
         database=data.database,
         env=data.env,
         description=data.description,
     )
     db.add(instance)
+    await db.flush()
+    await AuditLogService.log(
+        db, user_id=current_user.id, action="CREATE_INSTANCE",
+        target_type="instance", target_id=instance.id,
+        detail=f"创建数据源: {data.name} ({data.db_type}@{data.host}:{data.port})",
+    )
     await db.commit()
     await db.refresh(instance)
     return instance
@@ -79,6 +87,8 @@ async def update_instance(
         raise HTTPException(status_code=404, detail="数据源不存在")
 
     update_data = data.model_dump(exclude_unset=True)
+    if "password" in update_data:
+        update_data["password"] = encrypt_password(update_data["password"])
     for key, value in update_data.items():
         setattr(instance, key, value)
     await db.commit()
@@ -97,6 +107,11 @@ async def delete_instance(
     if not instance:
         raise HTTPException(status_code=404, detail="数据源不存在")
 
+    await AuditLogService.log(
+        db, user_id=current_user.id, action="DELETE_INSTANCE",
+        target_type="instance", target_id=instance.id,
+        detail=f"删除数据源: {instance.name}",
+    )
     await db.delete(instance)
     await db.commit()
     return {"message": "数据源已删除"}
@@ -113,7 +128,18 @@ async def test_connection(
     if not instance:
         raise HTTPException(status_code=404, detail="数据源不存在")
 
-    return await InstanceService.test_connection(instance)
+    # Decrypt password for connection test
+    from app.models.instance import Instance as InstModel
+    decrypted = instance.__class__(
+        name=instance.name, db_type=instance.db_type, host=instance.host,
+        port=instance.port, username=instance.username,
+        password=decrypt_password(instance.password),
+        database=instance.database, env=instance.env,
+        description=instance.description, status=instance.status,
+        version=instance.version,
+    )
+    decrypted.id = instance.id
+    return await InstanceService.test_connection(decrypted)
 
 
 @router.get("/{instance_id}/databases")

backend/app/api/v1/endpoints/query.py

@@ -9,6 +9,7 @@ from app.models.instance import Instance
 from app.models.audit_log import AuditLog
 from app.schemas.query import QueryRequest, QueryResult
 from app.services.query_service import QueryService
+from app.core.crypto import decrypt_password
 
 router = APIRouter(prefix="/query", tags=["SQL 查询"])
 
@@ -27,6 +28,9 @@ async def execute_query(
     if not instance:
         raise HTTPException(status_code=404, detail="数据源不存在")
 
+    # Decrypt password for query execution
+    instance.password = decrypt_password(instance.password)
+
     try:
         query_result = await QueryService.execute_query(instance, req.database, req.sql, current_user.id)
     except ValueError as e:

backend/app/api/v1/endpoints/ticket.py

@@ -11,6 +11,10 @@ from app.models.user import User
 from app.models.ticket import Ticket
 from app.models.instance import Instance
 from app.schemas.ticket import TicketCreate, TicketReview, TicketResponse
+from app.core.crypto import decrypt_password
+from app.services.audit_engine import SQLAuditEngine
+from app.services.audit_log_service import AuditLogService
+import json
 
 router = APIRouter(prefix="/tickets", tags=["工单管理"])
 
@@ -104,6 +108,10 @@ async def create_ticket(
     if not inst.scalar_one_or_none():
         raise HTTPException(status_code=400, detail="数据源不存在")
 
+    # Auto-audit SQL before creating ticket
+    engine = SQLAuditEngine(env="production" if data.db_type == "mysql" else "development")
+    report = engine.audit(data.sql_content)
+
     ticket = Ticket(
         title=data.title,
         db_type=data.db_type,
@@ -115,11 +123,23 @@ async def create_ticket(
         priority=data.priority,
         applicant_id=current_user.id,
         status="pending",
+        audit_result=json.dumps(report.to_dict(), ensure_ascii=False) if report.findings else None,
     )
     db.add(ticket)
+    await db.flush()  # flush to get ticket.id for audit log
+
+    # Log ticket creation
+    await AuditLogService.log(
+        db, user_id=current_user.id, action="CREATE_TICKET",
+        target_type="ticket", target_id=ticket.id,
+        detail=f"SQL审核评分: {report.score}, 通过: {report.passed}",
+    )
+
     await db.commit()
     await db.refresh(ticket)
-    return await _enrich_ticket(ticket, db)
+    result = await _enrich_ticket(ticket, db)
+    result["audit_report"] = report.to_dict()
+    return result
 
 
 @router.get("/statistics")
@@ -184,6 +204,13 @@ async def review_ticket(
     ticket.approver_id = current_user.id
     ticket.review_time = datetime.now(timezone.utc)
     ticket.audit_result = data.comment
+
+    await AuditLogService.log(
+        db, user_id=current_user.id, action="REVIEW_TICKET",
+        target_type="ticket", target_id=ticket.id,
+        detail=f"审核动作: {data.action}, 备注: {data.comment}",
+    )
+
     await db.commit()
     await db.refresh(ticket)
     return await _enrich_ticket(ticket, db)
@@ -213,6 +240,7 @@ async def execute_ticket(
             raise HTTPException(status_code=400, detail="数据源不存在")
 
         from app.services.query_service import QueryService
+        instance.password = decrypt_password(instance.password)
         exec_result = await QueryService.execute_dml(instance, ticket.target_database, ticket.sql_content)
 
         ticket.status = "success"

backend/app/api/v1/endpoints/user.py

@@ -8,6 +8,7 @@ from app.core.database import get_db
 from app.core.security import get_current_user, hash_password, require_role
 from app.models.user import User
 from app.schemas.user import UserCreate, UserUpdate, UserResponse
+from app.services.audit_log_service import AuditLogService
 
 router = APIRouter(prefix="/users", tags=["用户管理"])
 
@@ -47,6 +48,12 @@ async def create_user(
         hashed_password=hash_password(data.password),
     )
     db.add(user)
+    await db.flush()
+    await AuditLogService.log(
+        db, user_id=current_user.id, action="CREATE_USER",
+        target_type="user", target_id=user.id,
+        detail=f"创建用户: {data.username} ({data.role})",
+    )
     await db.commit()
     await db.refresh(user)
     return user
@@ -99,6 +106,11 @@ async def delete_user(
     if not user:
         raise HTTPException(status_code=404, detail="用户不存在")
 
+    await AuditLogService.log(
+        db, user_id=current_user.id, action="DELETE_USER",
+        target_type="user", target_id=user.id,
+        detail=f"删除用户: {user.username}",
+    )
     await db.delete(user)
     await db.commit()
     return {"message": "用户已删除"}

backend/app/api/v1/router.py

@@ -1,6 +1,6 @@
 from fastapi import APIRouter
 
-from app.api.v1.endpoints import auth, user, instance, ticket, query, dashboard
+from app.api.v1.endpoints import auth, user, instance, ticket, query, dashboard, audit
 
 api_router = APIRouter(prefix="/api/v1")
 
@@ -10,3 +10,4 @@ api_router.include_router(instance.router)
 api_router.include_router(ticket.router)
 api_router.include_router(query.router)
 api_router.include_router(dashboard.router)
+api_router.include_router(audit.router)

backend/app/core/crypto.py

@@ -0,0 +1,45 @@
+"""AES-256-GCM encryption for instance passwords."""
+import base64
+import os
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+
+from app.core.config import get_settings
+
+_NONCE_SIZE = 12  # 96-bit nonce for AES-GCM
+
+
+def _get_key() -> bytes:
+    """Derive a 32-byte AES key from settings.SECRET_KEY."""
+    settings = get_settings()
+    # Use first 32 bytes of utf-8 encoded secret key (padded if needed)
+    raw = settings.SECRET_KEY.encode("utf-8")
+    if len(raw) >= 32:
+        return raw[:32]
+    return raw.ljust(32, b"\x00")
+
+
+def encrypt_password(plain: str) -> str:
+    """Encrypt a password string, return base64-encoded ciphertext (nonce + ciphertext)."""
+    key = _get_key()
+    nonce = os.urandom(_NONCE_SIZE)
+    aesgcm = AESGCM(key)
+    ct = aesgcm.encrypt(nonce, plain.encode("utf-8"), None)
+    return base64.b64encode(nonce + ct).decode("ascii")
+
+
+def decrypt_password(encrypted: str) -> str:
+    """Decrypt a base64-encoded encrypted password back to plaintext.
+    If the value is not valid base64 (e.g., legacy plaintext), return as-is.
+    """
+    try:
+        key = _get_key()
+        raw = base64.b64decode(encrypted, validate=True)
+        if len(raw) <= _NONCE_SIZE:
+            return encrypted  # too short to be encrypted
+        nonce = raw[:_NONCE_SIZE]
+        ct = raw[_NONCE_SIZE:]
+        aesgcm = AESGCM(key)
+        return aesgcm.decrypt(nonce, ct, None).decode("utf-8")
+    except Exception:
+        # Not encrypted (legacy plaintext password) — return as-is
+        return encrypted

backend/app/services/audit_engine.py

@@ -0,0 +1,234 @@
+"""SQL Audit Engine — rule-based SQL review for tickets.
+
+Checks SQL against configurable rules and returns structured results:
+  - level: "error" (must fix), "warning" (should review), "info" (FYI)
+  - rule: rule identifier
+  - message: human-readable description
+"""
+import re
+from dataclasses import dataclass, field
+from typing import List, Optional
+from enum import Enum
+
+
+class Severity(str, Enum):
+    ERROR = "error"
+    WARNING = "warning"
+    INFO = "info"
+
+
+@dataclass
+class AuditFinding:
+    rule: str
+    level: Severity
+    message: str
+
+
+@dataclass
+class AuditReport:
+    sql: str
+    findings: List[AuditFinding] = field(default_factory=list)
+
+    @property
+    def passed(self) -> bool:
+        return not any(f.level == Severity.ERROR for f in self.findings)
+
+    @property
+    def has_warnings(self) -> bool:
+        return any(f.level == Severity.WARNING for f in self.findings)
+
+    @property
+    def score(self) -> int:
+        """100 = clean, -10 per error, -5 per warning."""
+        s = 100
+        for f in self.findings:
+            if f.level == Severity.ERROR:
+                s -= 10
+            elif f.level == Severity.WARNING:
+                s -= 5
+        return max(0, s)
+
+    def to_dict(self) -> dict:
+        return {
+            "passed": self.passed,
+            "score": self.score,
+            "findings": [
+                {"rule": f.rule, "level": f.level.value, "message": f.message}
+                for f in self.findings
+            ],
+        }
+
+
+class SQLAuditEngine:
+    """Rule-based SQL audit engine."""
+
+    def __init__(self, env: str = "development"):
+        self.env = env
+
+    def audit(self, sql: str) -> AuditReport:
+        report = AuditReport(sql=sql)
+        clean = sql.strip()
+        upper = clean.upper()
+
+        # Rule 1: DDL without IF EXISTS
+        self._check_ddl_if_exists(clean, upper, report)
+
+        # Rule 2: DROP TABLE danger
+        self._check_drop_table(upper, report)
+
+        # Rule 3: UPDATE/DELETE without WHERE
+        self._check_missing_where(clean, upper, report)
+
+        # Rule 4: SELECT * usage
+        self._check_select_star(clean, upper, report)
+
+        # Rule 5: LIMIT on DML
+        self._check_limit_dml(clean, upper, report)
+
+        # Rule 6: Production env extra checks
+        if self.env == "production":
+            self._check_production_rules(clean, upper, report)
+
+        # Rule 7: Multiple statements (semicolon)
+        self._check_multiple_statements(clean, report)
+
+        # Rule 8: Large IN clause
+        self._check_large_in(clean, upper, report)
+
+        # Rule 9: No WHERE with LIKE '%...'
+        self._check_full_like(clean, upper, report)
+
+        # Rule 10: JOIN without ON
+        self._check_join_without_on(upper, report)
+
+        return report
+
+    def _check_ddl_if_exists(self, clean: str, upper: str, report: AuditReport):
+        """ALTER/DROP statements should use IF EXISTS where applicable."""
+        if re.search(r"\bDROP\s+TABLE\b", upper) and "IF EXISTS" not in upper:
+            report.findings.append(AuditFinding(
+                rule="DDL_IF_EXISTS",
+                level=Severity.WARNING,
+                message="DROP TABLE 建议添加 IF EXISTS 防止表不存在时报错",
+            ))
+
+    def _check_drop_table(self, upper: str, report: AuditReport):
+        """DROP TABLE is always dangerous in production."""
+        if re.search(r"\bDROP\s+TABLE\b", upper):
+            if self.env == "production":
+                report.findings.append(AuditFinding(
+                    rule="DROP_TABLE_PRODUCTION",
+                    level=Severity.ERROR,
+                    message="生产环境禁止 DROP TABLE 操作",
+                ))
+            else:
+                report.findings.append(AuditFinding(
+                    rule="DROP_TABLE",
+                    level=Severity.WARNING,
+                    message="DROP TABLE 操作不可逆，请确认已备份",
+                ))
+
+        if re.search(r"\bTRUNCATE\b", upper):
+            report.findings.append(AuditFinding(
+                rule="TRUNCATE",
+                level=Severity.ERROR if self.env == "production" else Severity.WARNING,
+                message="TRUNCATE 会清空表数据且不可回滚",
+            ))
+
+    def _check_missing_where(self, clean: str, upper: str, report: AuditReport):
+        """UPDATE/DELETE without WHERE clause affects all rows."""
+        if re.match(r"\s*UPDATE\s+", upper, re.IGNORECASE):
+            if "WHERE" not in upper:
+                report.findings.append(AuditFinding(
+                    rule="UPDATE_NO_WHERE",
+                    level=Severity.ERROR,
+                    message="UPDATE 缺少 WHERE 条件，将更新全表",
+                ))
+
+        if re.match(r"\s*DELETE\s+FROM\s+", upper, re.IGNORECASE):
+            if "WHERE" not in upper:
+                report.findings.append(AuditFinding(
+                    rule="DELETE_NO_WHERE",
+                    level=Severity.ERROR,
+                    message="DELETE 缺少 WHERE 条件，将删除全表数据",
+                ))
+
+    def _check_select_star(self, clean: str, upper: str, report: AuditReport):
+        """SELECT * is inefficient for large tables."""
+        if re.search(r"SELECT\s+\*(?:\s|,|\))", upper):
+            report.findings.append(AuditFinding(
+                rule="SELECT_STAR",
+                level=Severity.INFO,
+                message="SELECT * 可能返回过多列，建议明确指定字段",
+            ))
+
+    def _check_limit_dml(self, clean: str, upper: str, report: AuditReport):
+        """UPDATE/DELETE with LIMIT is MySQL-specific and risky."""
+        for kw in ("UPDATE", "DELETE"):
+            if re.match(rf"\s*{kw}\b", upper):
+                if "LIMIT" in upper:
+                    report.findings.append(AuditFinding(
+                        rule="DML_WITH_LIMIT",
+                        level=Severity.WARNING,
+                        message=f"{kw} 使用 LIMIT 可能导致部分数据变更，请确认意图",
+                    ))
+
+    def _check_production_rules(self, clean: str, upper: str, report: AuditReport):
+        """Extra strict rules for production."""
+        if re.search(r"\bALTER\s+TABLE\b", upper):
+            report.findings.append(AuditFinding(
+                rule="ALTER_TABLE_PRODUCTION",
+                level=Severity.ERROR,
+                message="生产环境 ALTER TABLE 需 DBA 特别审批",
+            ))
+
+        if re.search(r"\bCREATE\s+(TABLE|INDEX)\b", upper):
+            report.findings.append(AuditFinding(
+                rule="CREATE_DDL_PRODUCTION",
+                level=Severity.WARNING,
+                message="生产环境创建对象需确认影响范围",
+            ))
+
+    def _check_multiple_statements(self, clean: str, report: AuditReport):
+        """Multiple SQL statements separated by semicolons."""
+        # Count semicolons not at the end
+        stripped = clean.rstrip(";").strip()
+        if ";" in stripped:
+            report.findings.append(AuditFinding(
+                rule="MULTI_STATEMENT",
+                level=Severity.ERROR,
+                message="单次提交不支持多条 SQL 语句（分号分隔），请拆分为多个工单",
+            ))
+
+    def _check_large_in(self, clean: str, upper: str, report: AuditReport):
+        """IN clause with many values is slow."""
+        in_matches = re.findall(r"\bIN\s*\(([^)]+)\)", upper)
+        for m in in_matches:
+            count = m.count(",") + 1
+            if count > 100:
+                report.findings.append(AuditFinding(
+                    rule="LARGE_IN",
+                    level=Severity.WARNING,
+                    message=f"IN 子句包含 {count} 个值，建议使用临时表或 JOIN 替代",
+                ))
+
+    def _check_full_like(self, clean: str, upper: str, report: AuditReport):
+        """LIKE '%...' cannot use index."""
+        if re.search(r"\bLIKE\s+'%[^']*'", clean, re.IGNORECASE):
+            report.findings.append(AuditFinding(
+                rule="FULL_LIKE",
+                level=Severity.INFO,
+                message="LIKE '%...' 无法使用索引，大数据量下性能较差",
+            ))
+
+    def _check_join_without_on(self, upper: str, report: AuditReport):
+        """JOIN without ON produces cartesian product."""
+        # Match JOIN but not followed by ON (within reasonable distance)
+        if re.search(r"\bJOIN\b", upper) and "ON" not in upper:
+            # Could be NATURAL JOIN, allow that
+            if not re.search(r"\bNATURAL\s+JOIN\b", upper):
+                report.findings.append(AuditFinding(
+                    rule="JOIN_NO_ON",
+                    level=Severity.WARNING,
+                    message="JOIN 缺少 ON 条件，可能产生笛卡尔积",
+                ))

backend/app/services/audit_log_service.py

@@ -0,0 +1,78 @@
+"""Audit log service — centralized logging for all operations."""
+from typing import Optional, List, Dict, Any
+from sqlalchemy import select, func
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.models.audit_log import AuditLog
+
+
+class AuditLogService:
+    @staticmethod
+    async def log(
+        db: AsyncSession,
+        user_id: int,
+        action: str,
+        target_type: str,
+        target_id: Optional[int] = None,
+        detail: Optional[str] = None,
+        ip_address: Optional[str] = None,
+    ) -> AuditLog:
+        """Create an audit log entry."""
+        entry = AuditLog(
+            user_id=user_id,
+            action=action,
+            target_type=target_type,
+            target_id=target_id,
+            detail=detail[:500] if detail else None,
+            ip_address=ip_address,
+        )
+        db.add(entry)
+        # Don't commit — let the caller's transaction handle it
+        await db.flush()
+        return entry
+
+    @staticmethod
+    async def list_logs(
+        db: AsyncSession,
+        page: int = 1,
+        page_size: int = 20,
+        user_id: Optional[int] = None,
+        action: Optional[str] = None,
+        target_type: Optional[str] = None,
+    ) -> Dict[str, Any]:
+        """List audit logs with pagination and filters."""
+        stmt = select(AuditLog)
+
+        if user_id:
+            stmt = stmt.where(AuditLog.user_id == user_id)
+        if action:
+            stmt = stmt.where(AuditLog.action == action)
+        if target_type:
+            stmt = stmt.where(AuditLog.target_type == target_type)
+
+        total_stmt = select(func.count()).select_from(stmt.subquery())
+        total = (await db.execute(total_stmt)).scalar()
+
+        stmt = stmt.order_by(AuditLog.created_at.desc())
+        stmt = stmt.offset((page - 1) * page_size).limit(page_size)
+        result = await db.execute(stmt)
+        logs = result.scalars().all()
+
+        return {
+            "total": total,
+            "page": page,
+            "page_size": page_size,
+            "items": [
+                {
+                    "id": log.id,
+                    "user_id": log.user_id,
+                    "action": log.action,
+                    "target_type": log.target_type,
+                    "target_id": log.target_id,
+                    "detail": log.detail,
+                    "ip_address": log.ip_address,
+                    "created_at": log.created_at.isoformat() if log.created_at else None,
+                }
+                for log in logs
+            ],
+        }