fix(审计): 移除共享库审计与预览噪声

2026-07-16 15:29:26 +08:00
parent 6b55c18610
commit 88bd0c5942
13 changed files with 134 additions and 377 deletions
@@ -77,6 +77,7 @@ FAQ_REPLY_ATTACHMENT_PERMISSION_BY_ACTION = {
    "read": "faq:read",
    "delete": "faq_attachments:delete",
 }
+SHARED_LIBRARY_ENTITY_TYPES = {"precaution", "faq_replies"}
 STARTUP_AUTH_ATTACHMENT_ENTITY_TYPES = {
    "startup_kickoff",
    "startup_kickoff_minutes",
@@ -239,16 +240,17 @@ async def upload_attachment(
        content_type=file.content_type,
        uploaded_by=current_user.id,
    )
-    await audit_crud.log_action(
-        db,
-        study_id=study_id,
-        entity_type=entity_type,
-        entity_id=entity_id,
-        action="UPLOAD_FILE",
-        detail=f"文件已上传：{file.filename}",
-        operator_id=current_user.id,
-        operator_role=await get_operator_role_label(db, study_id, current_user),
-    )
+    if entity_type not in SHARED_LIBRARY_ENTITY_TYPES:
+        await audit_crud.log_action(
+            db,
+            study_id=study_id,
+            entity_type=entity_type,
+            entity_id=entity_id,
+            action="UPLOAD_FILE",
+            detail=f"文件已上传：{file.filename}",
+            operator_id=current_user.id,
+            operator_role=await get_operator_role_label(db, study_id, current_user),
+        )
    return AttachmentRead(
        id=attachment.id,
        filename=attachment.filename,
@@ -442,16 +444,17 @@ async def global_delete_attachment(
    if not can_delete:
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="无权限删除附件")
    await attachment_crud.soft_delete_attachment(db, attachment)
-    await audit_crud.log_action(
-        db,
-        study_id=attachment.study_id,
-        entity_type=attachment.entity_type,
-        entity_id=attachment.entity_id,
-        action="DELETE_ATTACHMENT",
-        detail=f"文件已删除：{attachment.filename}",
-        operator_id=user.id,
-        operator_role=await get_operator_role_label(db, attachment.study_id, user),
-    )
+    if attachment.entity_type not in SHARED_LIBRARY_ENTITY_TYPES:
+        await audit_crud.log_action(
+            db,
+            study_id=attachment.study_id,
+            entity_type=attachment.entity_type,
+            entity_id=attachment.entity_id,
+            action="DELETE_ATTACHMENT",
+            detail=f"文件已删除：{attachment.filename}",
+            operator_id=user.id,
+            operator_role=await get_operator_role_label(db, attachment.study_id, user),
+        )


@router.delete(
@@ -494,13 +497,14 @@ async def delete_attachment(
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="无权限删除附件")

    await attachment_crud.soft_delete_attachment(db, attachment)
-    await audit_crud.log_action(
-        db,
-        study_id=study_id,
-        entity_type=entity_type,
-        entity_id=entity_id,
-        action="DELETE_ATTACHMENT",
-        detail=f"文件已删除：{attachment.filename}",
-        operator_id=current_user.id,
-        operator_role=await get_operator_role_label(db, study_id, current_user),
-    )
+    if entity_type not in SHARED_LIBRARY_ENTITY_TYPES:
+        await audit_crud.log_action(
+            db,
+            study_id=study_id,
+            entity_type=entity_type,
+            entity_id=entity_id,
+            action="DELETE_ATTACHMENT",
+            detail=f"文件已删除：{attachment.filename}",
+            operator_id=current_user.id,
+            operator_role=await get_operator_role_label(db, study_id, current_user),
+        )
@@ -1,15 +1,11 @@
 import uuid
-import json

 from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession

-from app.core.deps import get_current_user, get_db_session, get_operator_role_label, is_system_admin, require_study_not_locked, require_api_permission
-from app.core.project_permissions import role_has_api_permission
-from app.crud import audit as audit_crud
+from app.core.deps import get_current_user, get_db_session, is_system_admin, require_study_not_locked, require_api_permission
 from app.crud import faq_category as category_crud
 from app.crud import faq_item as item_crud
-from app.crud import member as member_crud
 from app.schemas.common import PaginatedResponse
 from app.schemas.faq import CategoryCreate, CategoryRead, CategoryUpdate
 from app.utils.pagination import paginate
@@ -47,16 +43,6 @@ async def create_category(
        if dup:
            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="该图标已被其他分类使用")
    category = await category_crud.create_category(db, payload)
-    await audit_crud.log_action(
-        db,
-        study_id=payload.study_id,
-        entity_type="faq_category",
-        entity_id=category.id,
-        action="CREATE_FAQ_CATEGORY",
-        detail=json.dumps({"targetName": category.name, "description": f"创建“{category.name}”分类"}, ensure_ascii=False),
-        operator_id=current_user.id,
-        operator_role=await get_operator_role_label(db, payload.study_id, current_user),
-    )
    return CategoryRead.model_validate(category)


@@ -112,16 +98,6 @@ async def update_category(
    if not target_study_id:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="必须提供项目 ID")
    updated = await category_crud.update_category(db, category, payload)
-    await audit_crud.log_action(
-        db,
-        study_id=updated.study_id,
-        entity_type="faq_category",
-        entity_id=category_id,
-        action="UPDATE_FAQ_CATEGORY",
-        detail=json.dumps({"targetName": updated.name, "description": f"更新“{updated.name}”分类"}, ensure_ascii=False),
-        operator_id=current_user.id,
-        operator_role=await get_operator_role_label(db, updated.study_id, current_user),
-    )
    return CategoryRead.model_validate(updated)


@@ -148,16 +124,5 @@ async def delete_category(
    item_count = await item_crud.count_items_by_category(db, category_id)
    if item_count > 0:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="分类下存在 FAQ，无法删除")
-    category_name = category.name
    await db.delete(category)
    await db.commit()
-    await audit_crud.log_action(
-        db,
-        study_id=category.study_id,
-        entity_type="faq_category",
-        entity_id=category_id,
-        action="DELETE_FAQ_CATEGORY",
-        detail=json.dumps({"targetName": category_name, "description": f"删除“{category_name}”分类"}, ensure_ascii=False),
-        operator_id=current_user.id,
-        operator_role=await get_operator_role_label(db, category.study_id, current_user),
-    )
@@ -1,12 +1,9 @@
-import json
 import uuid

 from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession

-from app.core.deps import get_current_user, get_db_session, get_operator_role_label, is_system_admin, require_study_not_locked, require_api_permission
-from app.core.project_permissions import role_has_api_permission
-from app.crud import audit as audit_crud
+from app.core.deps import get_current_user, get_db_session, is_system_admin, require_study_not_locked, require_api_permission
 from app.crud import faq_category as category_crud
 from app.crud import faq_item as faq_crud
 from app.crud import faq_reply as reply_crud
@@ -31,13 +28,6 @@ def _is_system_admin(current_user) -> bool:
    return is_system_admin(current_user)


-def _compact_text(value: str | None, max_length: int = 40) -> str:
-    text = " ".join(str(value or "").split())
-    if len(text) <= max_length:
-        return text
-    return f"{text[:max_length]}..."
-
-
@router.post(
    "/",
    response_model=FaqRead,
@@ -74,17 +64,6 @@ async def create_faq(
            reply_in=FaqReplyCreate(content=payload.answer),
        )
        await faq_crud.set_status(db, item.id, "PROCESSING")
-    question_name = _compact_text(item.question)
-    await audit_crud.log_action(
-        db,
-        study_id=payload.study_id,
-        entity_type="faq_item",
-        entity_id=item.id,
-        action="CREATE_FAQ_ITEM",
-        detail=json.dumps({"targetName": question_name, "description": f"创建医学咨询问题“{question_name}”"}, ensure_ascii=False),
-        operator_id=current_user.id,
-        operator_role=await get_operator_role_label(db, payload.study_id, current_user),
-    )
    return FaqRead.model_validate(item)


@@ -178,19 +157,6 @@ async def update_faq(
    if not item:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
    updated = await faq_crud.update_item(db, item, payload)
-    action = "UPDATE_FAQ_ITEM"
-    question_name = _compact_text(updated.question)
-    detail = json.dumps({"targetName": question_name, "description": f"更新医学咨询问题“{question_name}”"}, ensure_ascii=False)
-    await audit_crud.log_action(
-        db,
-        study_id=item.study_id,
-        entity_type="faq_item",
-        entity_id=item_id,
-        action=action,
-        detail=detail,
-        operator_id=current_user.id,
-        operator_role=await get_operator_role_label(db, item.study_id, current_user),
-    )
    return FaqRead.model_validate(updated)


@@ -337,17 +303,6 @@ async def create_reply(
    if item.status != "RESOLVED":
        await faq_crud.set_status(db, item.id, "PROCESSING")
    await faq_crud.touch_item(db, item.id)
-    question_name = _compact_text(item.question)
-    await audit_crud.log_action(
-        db,
-        study_id=item.study_id,
-        entity_type="faq_reply",
-        entity_id=reply.id,
-        action="CREATE_FAQ_REPLY",
-        detail=json.dumps({"targetName": question_name, "description": f"回复医学咨询问题“{question_name}”"}, ensure_ascii=False),
-        operator_id=current_user.id,
-        operator_role=await get_operator_role_label(db, item.study_id, current_user),
-    )
    data = FaqReplyRead.model_validate(reply)
    if quote:
        if quote.is_deleted:
@@ -380,20 +335,9 @@ async def delete_faq(
    item = await faq_crud.get_item(db, item_id)
    if not item:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
-    question_name = _compact_text(item.question)
    await reply_crud.delete_replies_by_faq_id(db, item.id)
    await db.delete(item)
    await db.commit()
-    await audit_crud.log_action(
-        db,
-        study_id=item.study_id,
-        entity_type="faq_item",
-        entity_id=item_id,
-        action="DELETE_FAQ_ITEM",
-        detail=json.dumps({"targetName": question_name, "description": f"删除医学咨询问题“{question_name}”"}, ensure_ascii=False),
-        operator_id=current_user.id,
-        operator_role=await get_operator_role_label(db, item.study_id, current_user),
-    )


@router.delete(
@@ -415,7 +359,6 @@ async def delete_reply(
    item = await faq_crud.get_item(db, item_id)
    if not item:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
-    question_name = _compact_text(item.question)
    reply = await reply_crud.get_reply(db, reply_id)
    if not reply or reply.faq_id != item.id:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="回复不存在")
@@ -438,13 +381,3 @@ async def delete_reply(
                resolved_by_confirm=False,
            )
    await faq_crud.touch_item(db, item.id)
-    await audit_crud.log_action(
-        db,
-        study_id=item.study_id,
-        entity_type="faq_reply",
-        entity_id=reply_id,
-        action="DELETE_FAQ_REPLY",
-        detail=json.dumps({"targetName": question_name, "description": f"删除医学咨询问题“{question_name}”的回复"}, ensure_ascii=False),
-        operator_id=current_user.id,
-        operator_role=await get_operator_role_label(db, item.study_id, current_user),
-    )
@@ -1,6 +1,5 @@
 from __future__ import annotations

-import json
 import os
 import uuid
 from pathlib import Path
@@ -11,9 +10,8 @@ from fastapi.responses import FileResponse
 from sqlalchemy.ext.asyncio import AsyncSession

 from app.api.v1.attachments import _ensure_attachment_permission, _ensure_study_exists
-from app.core.deps import get_current_user, get_db_session, get_operator_role_label
+from app.core.deps import get_current_user, get_db_session
 from app.crud import attachment as attachment_crud
-from app.crud import audit as audit_crud
 from app.crud import document as document_crud
 from app.crud import document_version as version_crud
 from app.models.collaboration import CollaborationRevision
@@ -33,29 +31,6 @@ def _content_disposition(filename: str) -> str:
    return f'inline; filename="{fallback}"; filename*=UTF-8\'\'{encoded}'


-async def _log_preview_open(
-    db: AsyncSession,
-    *,
-    study_id: uuid.UUID,
-    resource_type: str,
-    resource_id: uuid.UUID,
-    current_user,
-) -> None:
-    await audit_crud.log_action(
-        db,
-        study_id=study_id,
-        entity_type="ATTACHMENT" if resource_type == "attachment" else "DOCUMENT_VERSION",
-        entity_id=resource_id,
-        action="OFFICE_PREVIEW_OPEN",
-        detail=json.dumps(
-            {"resource_type": resource_type, "resource_id": str(resource_id), "result": "issued"},
-            ensure_ascii=True,
-        ),
-        operator_id=current_user.id,
-        operator_role=await get_operator_role_label(db, study_id, current_user),
-    )
-
-
@router.get(
    "/attachments/{attachment_id}/config",
    response_model=OnlyOfficePreviewConfigRead,
@@ -98,13 +73,6 @@ async def get_attachment_preview_config(
        user_id=current_user.id,
        user_name=current_user.full_name,
    )
-    await _log_preview_open(
-        db,
-        study_id=attachment.study_id,
-        resource_type="attachment",
-        resource_id=attachment.id,
-        current_user=current_user,
-    )
    response.headers["Cache-Control"] = "no-store"
    return result

@@ -151,13 +119,6 @@ async def get_version_preview_config(
        user_id=current_user.id,
        user_name=current_user.full_name,
    )
-    await _log_preview_open(
-        db,
-        study_id=document.trial_id,
-        resource_type="version",
-        resource_id=version.id,
-        current_user=current_user,
-    )
    response.headers["Cache-Control"] = "no-store"
    return result

@@ -1,11 +1,9 @@
 import uuid
-import json

 from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession

-from app.core.deps import get_operator_role_label, get_current_user, get_db_session, require_study_not_locked, require_api_permission
-from app.crud import audit as audit_crud
+from app.core.deps import get_current_user, get_db_session, require_study_not_locked, require_api_permission
 from app.crud import precaution as precaution_crud
 from app.crud import site as site_crud
 from app.crud import study as study_crud
@@ -29,11 +27,6 @@ async def _ensure_site_name_active(db: AsyncSession, study_id: uuid.UUID, site_n
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="中心已停用")


-def _precaution_audit_detail(action: str, precaution) -> str:
-    title = str(precaution.title or "").strip() or "注意事项"
-    return json.dumps({"targetName": title, "description": f"{action}注意事项“{title}”"}, ensure_ascii=False)
-
-
@router.post(
    "/precautions",
    response_model=PrecautionRead,
@@ -49,16 +42,6 @@ async def create_precaution(
    await _ensure_study_exists(db, study_id)
    await _ensure_site_name_active(db, study_id, precaution_in.site_name)
    precaution = await precaution_crud.create_precaution(db, study_id, precaution_in, created_by=current_user.id)
-    await audit_crud.log_action(
-        db,
-        study_id=study_id,
-        entity_type="precaution",
-        entity_id=precaution.id,
-        action="CREATE_PRECAUTION",
-        detail=_precaution_audit_detail("创建", precaution),
-        operator_id=current_user.id,
-        operator_role=await get_operator_role_label(db, study_id, current_user),
-    )
    return PrecautionRead.model_validate(precaution)


@@ -115,16 +98,6 @@ async def update_precaution(
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="注意事项不存在")
    await _ensure_site_name_active(db, study_id, precaution.site_name)
    precaution = await precaution_crud.update_precaution(db, precaution, precaution_in)
-    await audit_crud.log_action(
-        db,
-        study_id=study_id,
-        entity_type="precaution",
-        entity_id=precaution_id,
-        action="UPDATE_PRECAUTION",
-        detail=_precaution_audit_detail("更新", precaution),
-        operator_id=current_user.id,
-        operator_role=await get_operator_role_label(db, study_id, current_user),
-    )
    return PrecautionRead.model_validate(precaution)


@@ -144,15 +117,4 @@ async def delete_precaution(
    if not precaution or precaution.study_id != study_id:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="注意事项不存在")
    await _ensure_site_name_active(db, study_id, precaution.site_name)
-    precaution_detail = _precaution_audit_detail("删除", precaution)
    await precaution_crud.delete_precaution(db, precaution)
-    await audit_crud.log_action(
-        db,
-        study_id=study_id,
-        entity_type="precaution",
-        entity_id=precaution_id,
-        action="DELETE_PRECAUTION",
-        detail=precaution_detail,
-        operator_id=current_user.id,
-        operator_role=await get_operator_role_label(db, study_id, current_user),
-    )