feat: Phase 3 - AES encryption, SQL audit engine, audit logs (85 tests)

Phase 3.1: Instance password AES-256-GCM encryption
Phase 3.2: SQL audit rule engine (10 rules)
Phase 3.3: Auto-audit on ticket creation
Phase 3.4: Operation audit logs + GET /audit/logs
Tests: 44 -> 85 (41 new), Frontend: AuditLogsPage

backend/tests/test_audit_logs.py

@@ -0,0 +1,190 @@
+"""Tests for Audit Log API (Phase 3.4)."""
+import pytest
+from tests.conftest import auth_header
+
+
+class TestAuditLogAPI:
+    @pytest.mark.asyncio
+    async def test_list_audit_logs_admin(self, client, admin_token):
+        """Admin can list audit logs."""
+        resp = await client.get(
+            "/api/v1/audit/logs",
+            headers=auth_header(admin_token),
+        )
+        assert resp.status_code == 200
+        data = resp.json()
+        assert "items" in data
+        assert "total" in data
+        assert "page" in data
+
+    @pytest.mark.asyncio
+    async def test_list_audit_logs_dba(self, client, dba_token):
+        """DBA can also list audit logs."""
+        resp = await client.get(
+            "/api/v1/audit/logs",
+            headers=auth_header(dba_token),
+        )
+        assert resp.status_code == 200
+
+    @pytest.mark.asyncio
+    async def test_list_audit_logs_developer_forbidden(self, client, developer_token):
+        """Developer cannot access audit logs."""
+        resp = await client.get(
+            "/api/v1/audit/logs",
+            headers=auth_header(developer_token),
+        )
+        assert resp.status_code == 403
+
+    @pytest.mark.asyncio
+    async def test_create_instance_logs_audit(self, client, db, admin_token):
+        """Creating an instance produces an audit log entry."""
+        from app.models.audit_log import AuditLog
+        from sqlalchemy import select
+
+        resp = await client.post(
+            "/api/v1/instances",
+            json={
+                "name": "审计测试实例",
+                "db_type": "mysql",
+                "host": "10.0.0.100",
+                "port": 3306,
+                "username": "root",
+                "password": "test123",
+                "database": "test",
+            },
+            headers=auth_header(admin_token),
+        )
+        assert resp.status_code == 201
+
+        # Check audit log was created
+        result = await db.execute(
+            select(AuditLog).where(AuditLog.action == "CREATE_INSTANCE")
+        )
+        log = result.scalar_one_or_none()
+        assert log is not None
+        assert "审计测试实例" in log.detail
+
+    @pytest.mark.asyncio
+    async def test_create_user_logs_audit(self, client, db, admin_token):
+        """Creating a user produces an audit log entry."""
+        from app.models.audit_log import AuditLog
+        from sqlalchemy import select
+
+        resp = await client.post(
+            "/api/v1/users",
+            json={
+                "username": "audit_test_user",
+                "display_name": "审计测试",
+                "password": "123456",
+                "role": "developer",
+            },
+            headers=auth_header(admin_token),
+        )
+        assert resp.status_code == 201
+
+        result = await db.execute(
+            select(AuditLog).where(AuditLog.action == "CREATE_USER")
+        )
+        log = result.scalar_one_or_none()
+        assert log is not None
+        assert "audit_test_user" in log.detail
+
+    @pytest.mark.asyncio
+    async def test_create_ticket_logs_audit(self, client, db, admin_token, test_instance):
+        """Creating a ticket produces an audit log entry with SQL score."""
+        from app.models.audit_log import AuditLog
+        from sqlalchemy import select
+
+        resp = await client.post(
+            "/api/v1/tickets",
+            json={
+                "title": "审计日志工单测试",
+                "db_type": "mysql",
+                "instance_id": test_instance.id,
+                "target_database": "test_db",
+                "sql_content": "SELECT id FROM users LIMIT 10;",
+                "reason": "测试审计日志",
+            },
+            headers=auth_header(admin_token),
+        )
+        assert resp.status_code == 201
+
+        result = await db.execute(
+            select(AuditLog).where(AuditLog.action == "CREATE_TICKET")
+        )
+        log = result.scalar_one_or_none()
+        assert log is not None
+        assert "SQL审核评分" in log.detail
+
+    @pytest.mark.asyncio
+    async def test_audit_log_pagination(self, client, admin_token):
+        """Audit log pagination works."""
+        resp = await client.get(
+            "/api/v1/audit/logs?page=1&page_size=5",
+            headers=auth_header(admin_token),
+        )
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["page_size"] == 5
+
+    @pytest.mark.asyncio
+    async def test_audit_log_filter_by_action(self, client, admin_token, db, test_instance):
+        """Can filter audit logs by action."""
+        # Create a ticket first
+        await client.post(
+            "/api/v1/tickets",
+            json={
+                "title": "过滤测试工单",
+                "db_type": "mysql",
+                "instance_id": test_instance.id,
+                "target_database": "test_db",
+                "sql_content": "SELECT 1;",
+                "reason": "过滤测试用",
+            },
+            headers=auth_header(admin_token),
+        )
+
+        resp = await client.get(
+            "/api/v1/audit/logs?action=CREATE_TICKET",
+            headers=auth_header(admin_token),
+        )
+        assert resp.status_code == 200
+        data = resp.json()
+        for item in data["items"]:
+            assert item["action"] == "CREATE_TICKET"
+
+    @pytest.mark.asyncio
+    async def test_review_ticket_logs_audit(self, client, db, admin_token, dba_token, test_instance):
+        """Reviewing a ticket creates an audit log."""
+        from app.models.audit_log import AuditLog
+        from sqlalchemy import select
+
+        # Create ticket as admin
+        resp = await client.post(
+            "/api/v1/tickets",
+            json={
+                "title": "审核日志测试",
+                "db_type": "mysql",
+                "instance_id": test_instance.id,
+                "target_database": "test_db",
+                "sql_content": "SELECT 1;",
+                "reason": "审核日志测试",
+            },
+            headers=auth_header(admin_token),
+        )
+        ticket_id = resp.json()["id"]
+
+        # Review as DBA
+        resp = await client.post(
+            f"/api/v1/tickets/{ticket_id}/review",
+            json={"action": "approve", "comment": "批准"},
+            headers=auth_header(dba_token),
+        )
+        assert resp.status_code == 200
+
+        result = await db.execute(
+            select(AuditLog).where(AuditLog.action == "REVIEW_TICKET")
+        )
+        log = result.scalar_one_or_none()
+        assert log is not None
+        assert "approve" in log.detail