feat(desktop): implement phase 2 native capabilities

backend/app/api/v1/permission_monitoring.py

@@ -14,7 +14,7 @@ from fastapi import APIRouter, Depends, HTTPException, Query, status
 from sqlalchemy import func, select, desc
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.deps import get_current_user, get_db_session, is_system_admin
+from app.core.deps import get_current_user, get_db_session, is_system_admin, list_active_pm_study_ids
 from app.core.permission_monitor import (
     CACHE_HIT_RATE_HEALTH_MIN_ACCESSES,
     CACHE_METRICS_WINDOW_SECONDS,
@@ -43,6 +43,11 @@ class MonitoringScope:
 async def resolve_monitoring_scope(db: AsyncSession, current_user) -> MonitoringScope:
     if is_system_admin(current_user):
         return MonitoringScope(is_admin=True, study_ids=set())
+    user_id = getattr(current_user, "id", None)
+    if user_id:
+        study_ids = await list_active_pm_study_ids(db, user_id)
+        if study_ids:
+            return MonitoringScope(is_admin=False, study_ids=study_ids)
     raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
 
 
@@ -479,6 +484,8 @@ async def get_security_access_logs(
     _=Depends(get_current_user),
     status_min: Optional[int] = Query(None, ge=100, le=599),
     auth_status: Optional[str] = Query(None),
+    client_type: Optional[str] = Query(None),
+    client_version: Optional[str] = Query(None),
     page: int = Query(1, ge=1),
     page_size: int = Query(50, ge=1, le=200),
 ) -> dict:
@@ -486,11 +493,17 @@ async def get_security_access_logs(
     scope = await resolve_monitoring_scope(db, _)
     if not scope.is_admin:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
+    client_type = client_type if isinstance(client_type, str) else None
+    client_version = client_version if isinstance(client_version, str) else None
     conditions = []
     if status_min is not None:
         conditions.append(SecurityAccessLog.status_code >= status_min)
     if auth_status:
         conditions.append(SecurityAccessLog.auth_status == auth_status)
+    if client_type:
+        conditions.append(SecurityAccessLog.client_type == client_type)
+    if client_version:
+        conditions.append(SecurityAccessLog.client_version == client_version)
 
     query = select(SecurityAccessLog)
     count_query = select(func.count()).select_from(SecurityAccessLog)
@@ -545,6 +558,11 @@ async def get_security_access_logs(
                 "ip_city": ip_location.city,
                 "ip_isp": ip_location.isp,
                 "user_agent": log.user_agent,
+                "client_type": log.client_type,
+                "client_version": log.client_version,
+                "client_platform": log.client_platform,
+                "build_channel": log.build_channel,
+                "build_commit": log.build_commit,
                 "auth_status": log.auth_status,
                 "user_identifier": log.user_identifier,
                 "account_label": _security_account_label(log.auth_status, log.user_identifier, user_names),