完善审计日志展示与导出权限

backend/app/api/v1/visits.py

@@ -1,4 +1,5 @@
 import uuid
+import json
 
 from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -15,6 +16,17 @@ from app.schemas.visit import EarlyTerminationCreate, VisitCreate, VisitRead, Vi
 router = APIRouter()
 
 
+def _visit_audit_name(subject, visit) -> str:
+    subject_no = getattr(subject, "subject_no", None) or "参与者"
+    visit_code = getattr(visit, "visit_code", None) or "访视"
+    return f"{subject_no} / {visit_code}"
+
+
+def _visit_audit_detail(action: str, subject, visit) -> str:
+    name = _visit_audit_name(subject, visit)
+    return json.dumps({"targetName": name, "description": f"{action}访视“{name}”"}, ensure_ascii=False)
+
+
 async def _ensure_subject(db: AsyncSession, study_id: uuid.UUID, subject_id: uuid.UUID):
     subject = await subject_crud.get_subject(db, subject_id)
     if not subject or subject.study_id != study_id:
@@ -105,7 +117,7 @@ async def create_visit(
         entity_type="visit",
         entity_id=visit.id,
         action="CREATE_VISIT",
-        detail=f"访视 {visit.visit_code} 已创建",
+        detail=_visit_audit_detail("创建", subject, visit),
         operator_id=current_user.id,
         operator_role=await get_operator_role_label(db, study_id, current_user),
     )
@@ -158,7 +170,10 @@ async def create_early_termination(
         entity_type="visit",
         entity_id=visit.id,
         action="CREATE_EARLY_TERMINATION",
-        detail=f"参与者 {subject.subject_no} 已提前终止",
+        detail=json.dumps(
+            {"targetName": subject.subject_no, "description": f"创建参与者 {subject.subject_no} 提前终止访视"},
+            ensure_ascii=False,
+        ),
         operator_id=current_user.id,
         operator_role=await get_operator_role_label(db, study_id, current_user),
     )
@@ -191,18 +206,27 @@ async def update_visit(
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="实际访视日期不能早于访视窗口开始日期")
     if visit_in.actual_date and visit.window_end and visit_in.actual_date > visit.window_end:
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="实际访视日期不能晚于访视窗口结束日期")
+    old_status = visit.status
     updated = await visit_crud.update_visit(db, visit, visit_in)
     await subject_crud.sync_subject_status(db, subject)
     detail = None
     if visit_in.status:
-        detail = f"访视 {visit.visit_code} {visit.status} -> {visit_in.status}"
+        detail = json.dumps(
+            {
+                "targetName": _visit_audit_name(subject, updated),
+                "description": f"变更访视“{_visit_audit_name(subject, updated)}”状态",
+                "before": {"status": old_status},
+                "after": {"status": visit_in.status},
+            },
+            ensure_ascii=False,
+        )
     await audit_crud.log_action(
         db,
         study_id=study_id,
         entity_type="visit",
         entity_id=visit_id,
         action="VISIT_STATUS_CHANGE" if detail else "UPDATE_VISIT",
-        detail=detail or "访视已更新",
+        detail=detail or _visit_audit_detail("更新", subject, updated),
         operator_id=current_user.id,
         operator_role=await get_operator_role_label(db, study_id, current_user),
     )
@@ -226,6 +250,7 @@ async def delete_visit(
     visit = await visit_crud.get_visit(db, visit_id)
     if not visit or visit.subject_id != subject_id or visit.study_id != study_id:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="访视不存在")
+    visit_detail = _visit_audit_detail("删除", subject, visit)
     await visit_crud.delete_visit(db, visit)
     await subject_crud.sync_subject_status(db, subject)
     await audit_crud.log_action(
@@ -234,7 +259,7 @@ async def delete_visit(
         entity_type="visit",
         entity_id=visit_id,
         action="DELETE_VISIT",
-        detail=f"访视 {visit_id} 已删除",
+        detail=visit_detail,
         operator_id=current_user.id,
         operator_role=await get_operator_role_label(db, study_id, current_user),
     )