完善审计日志展示与导出权限

backend/app/api/v1/subjects.py

@@ -1,3 +1,4 @@
+import json
 import uuid
 
 from fastapi import APIRouter, Depends, HTTPException, status
@@ -15,6 +16,29 @@ from app.schemas.subject import SubjectCreate, SubjectRead, SubjectUpdate
 router = APIRouter()
 
 
+def _format_date(value):
+    return value.isoformat() if value else None
+
+
+async def _subject_audit_snapshot(db: AsyncSession, subject) -> dict:
+    site_name = None
+    if subject.site_id:
+        site = await site_crud.get_site(db, subject.site_id)
+        site_name = site.name if site else None
+    return {
+        "subject_no": subject.subject_no,
+        "site_name": site_name,
+        "status": subject.status,
+        "screening_date": _format_date(subject.screening_date),
+        "consent_date": _format_date(subject.consent_date),
+        "enrollment_date": _format_date(subject.enrollment_date),
+        "baseline_date": _format_date(subject.baseline_date),
+        "completion_date": _format_date(subject.completion_date),
+        "actual_medication_count": subject.actual_medication_count,
+        "drop_reason": subject.drop_reason,
+    }
+
+
 async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
     study = await study_crud.get(db, study_id)
     if not study:
@@ -50,13 +74,22 @@ async def create_subject(
         subject = await subject_crud.create_subject(db, study_id, subject_in)
     except ValueError as exc:
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(exc)) from exc
+    after_snapshot = await _subject_audit_snapshot(db, subject)
     await audit_crud.log_action(
         db,
         study_id=study_id,
         entity_type="subject",
         entity_id=subject.id,
         action="CREATE_SUBJECT",
-        detail=f"参与者 {subject.subject_no} 已创建",
+        detail=json.dumps(
+            {
+                "targetName": subject.subject_no,
+                "description": f"创建参与者 {subject.subject_no}",
+                "before": None,
+                "after": after_snapshot,
+            },
+            ensure_ascii=False,
+        ),
         operator_id=current_user.id,
         operator_role=await get_operator_role_label(db, study_id, current_user),
     )
@@ -172,21 +205,29 @@ async def update_subject(
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
     await _ensure_subject_active(db, subject)
     old_status = subject.status
+    before_snapshot = await _subject_audit_snapshot(db, subject)
     updated = await subject_crud.update_subject(db, subject, subject_in)
     # 基线/治疗日期是访视计划的唯一推算基准，不能用入组日期替代。
     if updated.baseline_date:
         await subject_crud.sync_visits_from_baseline(db, updated)
         updated = await subject_crud.sync_subject_status(db, updated)
-    detail = None
-    if updated.status != old_status:
-        detail = f"参与者 {updated.subject_no} 状态 {old_status} -> {updated.status}"
+    after_snapshot = await _subject_audit_snapshot(db, updated)
+    description = f"变更参与者 {updated.subject_no} 状态" if updated.status != old_status else f"更新参与者 {updated.subject_no}"
     await audit_crud.log_action(
         db,
         study_id=study_id,
         entity_type="subject",
         entity_id=subject_id,
-        action="SUBJECT_STATUS_CHANGE" if detail else "UPDATE_SUBJECT",
-        detail=detail or "参与者已更新",
+        action="SUBJECT_STATUS_CHANGE" if updated.status != old_status else "UPDATE_SUBJECT",
+        detail=json.dumps(
+            {
+                "targetName": updated.subject_no,
+                "description": description,
+                "before": before_snapshot,
+                "after": after_snapshot,
+            },
+            ensure_ascii=False,
+        ),
         operator_id=current_user.id,
         operator_role=await get_operator_role_label(db, study_id, current_user),
     )
@@ -211,6 +252,8 @@ async def delete_subject(
     cra_scope = await get_cra_site_scope(db, study_id, current_user)
     if cra_scope and subject.site_id not in cra_scope[0]:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
+    before_snapshot = await _subject_audit_snapshot(db, subject)
+    target_name = subject.subject_no
     await subject_crud.delete_subject(db, subject)
     await audit_crud.log_action(
         db,
@@ -218,7 +261,15 @@ async def delete_subject(
         entity_type="subject",
         entity_id=subject_id,
         action="DELETE_SUBJECT",
-        detail=f"参与者 {subject_id} 已删除",
+        detail=json.dumps(
+            {
+                "targetName": target_name,
+                "description": f"删除参与者 {target_name}",
+                "before": before_snapshot,
+                "after": None,
+            },
+            ensure_ascii=False,
+        ),
         operator_id=current_user.id,
         operator_role=await get_operator_role_label(db, study_id, current_user),
     )