logan
344c519209
P0-1 认证安全: - JWT secret 改为环境变量配置, 未设置则随机生成(重启失效) - 新增 LoginRateLimitMiddleware: 5次/分钟登录频率限制(滑动窗口) - 429 响应 + 前端 toast 提示 P0-2 操作审计日志: - 新增 OperationLog 模型 (user/username/action/resource/detail/ip) - 新增 AuditLogMiddleware 自动记录 POST/PUT/DELETE/PATCH 操作 - 新增 GET /audit-logs API (分页/过滤/统计) - 前端 AuditLogsPage 对接真实 API (字段/路径修正) P0-3 实例密码加密: - 已确认 crypto.py AES-256-GCM 加密存储, 无需修改 P1 前端错误提示: - 新增 useToast hook + ToastContainer 组件 - request.ts 拦截器: 4xx/5xx 错误 toast 显示后端 detail 信息 - 422 验证错误提取第一条 msg - 网络失败显示通用提示 1182 tests passed
46 lines
1.4 KiB
Python
46 lines
1.4 KiB
Python
"""操作审计日志服务 — 轻量级，各 endpoint 直接调用。"""
|
|
from typing import Optional
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
from fastapi import Request
|
|
|
|
from app.models.operation_log import OperationLog
|
|
|
|
|
|
async def log_operation(
|
|
db: AsyncSession,
|
|
*,
|
|
action: str,
|
|
resource_type: Optional[str] = None,
|
|
resource_id: Optional[int] = None,
|
|
detail: Optional[str] = None,
|
|
user_id: Optional[int] = None,
|
|
username: Optional[str] = None,
|
|
request: Optional[Request] = None,
|
|
) -> None:
|
|
"""记录操作日志（fire-and-forget，不抛异常）。"""
|
|
try:
|
|
ip_address = None
|
|
user_agent = None
|
|
if request:
|
|
forwarded = request.headers.get("x-forwarded-for")
|
|
ip_address = forwarded.split(",")[0].strip() if forwarded else (
|
|
request.client.host if request.client else None
|
|
)
|
|
user_agent = request.headers.get("user-agent", "")[:255]
|
|
|
|
log = OperationLog(
|
|
user_id=user_id,
|
|
username=username,
|
|
action=action,
|
|
resource_type=resource_type,
|
|
resource_id=resource_id,
|
|
detail=detail,
|
|
ip_address=ip_address,
|
|
user_agent=user_agent,
|
|
)
|
|
db.add(log)
|
|
await db.flush()
|
|
except Exception:
|
|
# 审计日志不应影响业务流程
|
|
pass
|