dd8c04001d
决策 M6-1–M6-10（docs/architecture/m6-plan.md、docs/decisions.md）。 用户端： - 额度与套餐页：本期额度、按功能分布、扣点规则、流水（逐条余额、关联项目和任务、导出 CSV） - 开通 / 续费申请（对公转账，运营确认到账后开通），80% / 100% 提醒 - 专业版到期：整个账号只读、额度清零，到期前 30 / 7 / 0 天提醒（worker 每小时 billing_tick） - 删除项目（彻底删除、销毁数据密钥），注销账号（企业名称 + 短信验证码） - 通知铃铛、账号页 运营后台： - 独立进程 bid-doctor ops（/ops/v1）和 apps/admin；用户名 + 密码 + TOTP + IP 白名单 - 开通申请（到账 / 开通 / 退回 / 发票）、企业查询和调额度、误报 / 漏报、失败任务、审计；不看业务内容 - 左侧菜单（标准 logo、可展开收起的分组、图标、待办数、环境标签） - 运营人员角色只留结构：ops_admin.role、权限点、每个接口的检查点、菜单按权限过滤 数据库：迁移 0010（排队的订阅、申请单号、通知类型、billing_due）、0011（bd_ops 权限）、0012（运营角色）。 另修：取消解析 / 检查接口报 500；uuid7 进程内单调；data_key 销毁后不再新建；审计 None 存 SQL NULL。 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
77 lines
2.5 KiB
Python
77 lines
2.5 KiB
Python
"""审计：和业务修改在同一个事务里写入，写失败整个操作就失败（架构 §3.10）。"""
|
||
|
||
from __future__ import annotations
|
||
|
||
import json
|
||
from typing import Any
|
||
from uuid import UUID
|
||
|
||
from sqlalchemy import select
|
||
from sqlalchemy.ext.asyncio import AsyncSession
|
||
|
||
from bid_doctor.audit.models import AuditEvent
|
||
from bid_doctor.core.crypto import sha256
|
||
from bid_doctor.core.db import TenantContext
|
||
from bid_doctor.core.ids import uuid7
|
||
|
||
|
||
async def record(
|
||
session: AsyncSession,
|
||
ctx: TenantContext,
|
||
action: str,
|
||
object_type: str,
|
||
object_id: UUID | None,
|
||
*,
|
||
project_id: UUID | None = None,
|
||
before: dict[str, Any] | None = None,
|
||
after: dict[str, Any] | None = None,
|
||
actor_kind: str = "user",
|
||
actor_ops_id: UUID | None = None,
|
||
) -> None:
|
||
digest = (
|
||
sha256(json.dumps([before, after], ensure_ascii=False, sort_keys=True, default=str))
|
||
if before or after
|
||
else None
|
||
)
|
||
session.add(
|
||
AuditEvent(
|
||
id=uuid7(),
|
||
tenant_id=ctx.tenant_id,
|
||
actor_kind=actor_kind,
|
||
actor_user_id=ctx.user_id if actor_kind == "user" else None,
|
||
actor_ops_id=actor_ops_id,
|
||
actor_name=ctx.actor_name or None,
|
||
action=action,
|
||
object_type=object_type,
|
||
object_id=object_id,
|
||
project_id=project_id,
|
||
before=before,
|
||
after=after,
|
||
content_digest=digest,
|
||
request_id=ctx.request_id or None,
|
||
)
|
||
)
|
||
|
||
|
||
async def events_for(session: AsyncSession, object_type: str, object_id: UUID) -> list[AuditEvent]:
|
||
"""某个对象的修改记录，按时间倒序（FR-M2-08「谁在何时改了什么」）。"""
|
||
rows = await session.execute(
|
||
select(AuditEvent)
|
||
.where(AuditEvent.object_type == object_type, AuditEvent.object_id == object_id)
|
||
.order_by(AuditEvent.created_at.desc(), AuditEvent.id.desc())
|
||
)
|
||
return list(rows.scalars().all())
|
||
|
||
|
||
async def last_before(session: AsyncSession, action: str, object_id: UUID) -> dict[str, Any] | None:
|
||
"""某个对象最近一次某种操作之前的状态（例如撤销归档时回到归档前的项目状态）。"""
|
||
row = (
|
||
await session.execute(
|
||
select(AuditEvent.before)
|
||
.where(AuditEvent.action == action, AuditEvent.object_id == object_id)
|
||
.order_by(AuditEvent.id.desc())
|
||
.limit(1)
|
||
)
|
||
).scalar_one_or_none()
|
||
return row if isinstance(row, dict) else None
|