feat(监控): 完善系统监控、登录状态与访问审计能力

backend/app/api/v1/auth.py

@@ -9,7 +9,8 @@ import uuid
 
 from app.core.config import settings
 from app.core.login_crypto import create_login_challenge, decrypt_login_payload, get_public_key_pem
-from app.core.security import create_access_token, decode_token_allow_expired, oauth2_scheme, verify_password
+from app.core.request_context import resolve_ctms_client_type
+from app.core.security import create_access_token, decode_token, decode_token_allow_expired, oauth2_scheme, verify_password
 from app.core.deps import get_current_user, get_db_session
 from app.crud import user as user_crud
 from app.models.user import UserStatus
@@ -26,6 +27,12 @@ from app.schemas.email_settings import (
 )
 from app.schemas.user import Token, UserRead, UserRegisterRequest, UserSelfUpdate, UserUpdate
 from app.services import email_service
+from app.services.user_login_sessions import (
+    create_login_session,
+    end_login_session,
+    session_id_from_payload,
+    touch_login_session,
+)
 from fastapi.responses import FileResponse
 
 
@@ -95,7 +102,7 @@ def get_session_policy_for_client_type(client_type: str) -> SessionPolicy:
 
 
 def get_request_session_client_type(request: Request) -> str:
-    return normalize_session_client_type(request.headers.get("x-ctms-client-type"))
+    return normalize_session_client_type(resolve_ctms_client_type(request.headers))
 
 
 def policy_expires_at(issued_at: datetime, session_start: datetime, policy: SessionPolicy) -> datetime:
@@ -104,8 +111,9 @@ def policy_expires_at(issued_at: datetime, session_start: datetime, policy: Sess
     return min(access_expires_at, session_expires_at)
 
 
-def issue_user_token(db_user, request: Request) -> Token:
+async def issue_user_token(db_user, request: Request, db: AsyncSession) -> Token:
     session_start = datetime.now(timezone.utc)
+    session_id = uuid.uuid4()
     client_type = get_request_session_client_type(request)
     policy = get_session_policy_for_client_type(client_type)
     access_token = create_access_token(
@@ -115,6 +123,14 @@ def issue_user_token(db_user, request: Request) -> Token:
         max_age_seconds=policy.absolute_max_seconds,
         issued_at=session_start,
         client_type=client_type,
+        session_id=str(session_id),
+    )
+    await create_login_session(
+        db,
+        session_id=session_id,
+        user_id=db_user.id,
+        request=request,
+        login_at=session_start,
     )
     return Token(access_token=access_token, token_type="bearer")
 
@@ -284,7 +300,7 @@ async def login_for_access_token(
     db_user = await authenticate_encrypted_password(payload, db)
     ensure_user_active(db_user)
 
-    return issue_user_token(db_user, request)
+    return await issue_user_token(db_user, request, db)
 
 
 @router.post("/dev-login", response_model=Token)
@@ -295,7 +311,7 @@ async def dev_login_for_access_token(
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Not found")
     db_user = await authenticate_plain_password(payload, db)
     ensure_user_active(db_user)
-    return issue_user_token(db_user, request)
+    return await issue_user_token(db_user, request, db)
 
 
 @router.get("/me", response_model=UserRead)
@@ -339,11 +355,47 @@ async def extend_access_token(
         max_age_seconds=policy.absolute_max_seconds,
         issued_at=issued_at,
         client_type=normalize_session_client_type(payload.get("client_type")),
+        session_id=str(session_id_from_payload(payload)),
     )
     expires_at = policy_expires_at(issued_at, session_start, policy)
     return ExtendResponse(accessToken=new_token, expiresAt=expires_at)
 
 
+@router.post("/session/heartbeat")
+async def heartbeat_login_session(
+    request: Request,
+    token: str = Depends(oauth2_scheme),
+    current_user=Depends(get_current_user),
+    db: AsyncSession = Depends(get_db_session),
+) -> dict:
+    session = await touch_login_session(
+        db,
+        user_id=current_user.id,
+        payload=decode_token(token),
+        request=request,
+    )
+    if session is None:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="登录会话已结束")
+    return {
+        "status": "online",
+        "last_seen_at": session.last_seen_at.isoformat(),
+    }
+
+
+@router.post("/session/logout", status_code=status.HTTP_204_NO_CONTENT)
+async def logout_login_session(
+    token: str = Depends(oauth2_scheme),
+    current_user=Depends(get_current_user),
+    db: AsyncSession = Depends(get_db_session),
+) -> Response:
+    await end_login_session(
+        db,
+        user_id=current_user.id,
+        payload=decode_token(token),
+    )
+    return Response(status_code=status.HTTP_204_NO_CONTENT)
+
+
 @router.patch("/me", response_model=UserRead)
 async def update_me(
     payload: UserSelfUpdate,

backend/app/api/v1/users.py

@@ -9,7 +9,8 @@ from app.schemas.common import PaginatedResponse
 from app.crud import user as user_crud
 from app.crud import member as member_crud
 from app.utils.pagination import paginate
-from app.schemas.user import UserCreate, UserRead, UserStatus, UserUpdate
+from app.schemas.user import UserCreate, UserLoginActivityRead, UserRead, UserStatus, UserUpdate
+from app.services.user_login_sessions import get_login_summaries, list_login_activities
 
 router = APIRouter()
 
@@ -25,7 +26,35 @@ async def list_users(
 ) -> PaginatedResponse[UserRead]:
     users = await user_crud.list_users(db, skip=skip, limit=limit, keyword=keyword, status=user_status)
     total_users = await user_crud.count_users(db, keyword=keyword, status=user_status)
-    return paginate(list(users), total=total_users)
+    summaries = await get_login_summaries(db, [user.id for user in users])
+    items = []
+    for user in users:
+        summary = summaries.get(user.id)
+        item = UserRead.model_validate(user).model_dump()
+        if summary:
+            item.update(
+                {
+                    "login_status": summary.status,
+                    "last_login_at": summary.last_login_at,
+                    "last_seen_at": summary.last_seen_at,
+                    "last_client_type": summary.client_type,
+                    "active_session_count": summary.active_session_count,
+                }
+            )
+        items.append(item)
+    return paginate(items, total=total_users)
+
+
+@router.get("/{user_id}/login-activities", response_model=list[UserLoginActivityRead])
+async def read_user_login_activities(
+    user_id: uuid.UUID,
+    limit: int = Query(default=30, ge=1, le=100),
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(require_roles(["ADMIN"])),
+) -> list[UserLoginActivityRead]:
+    if not await user_crud.get_by_id(db, user_id):
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="用户不存在")
+    return await list_login_activities(db, user_id=user_id, limit=limit)
 
 
 @router.post("/", response_model=UserRead, status_code=status.HTTP_201_CREATED)

backend/app/core/config.py

@@ -33,6 +33,18 @@ class Settings(BaseSettings):
     )
     IP2REGION_XDB_PATH: Optional[str] = None
     IP2REGION_IPV6_XDB_PATH: Optional[str] = None
+    TRUSTED_PROXY_CIDRS: str = "127.0.0.1/32,::1/128,172.16.0.0/12"
+    MONITORING_SERVER_PUBLIC_IP: Optional[str] = None
+    MONITORING_PUBLIC_IP_DISCOVERY_URLS: str = (
+        "https://api64.ipify.org,https://icanhazip.com"
+    )
+    MONITORING_PUBLIC_IP_DISCOVERY_TIMEOUT_SECONDS: float = Field(default=2.5, ge=0.5, le=10)
+    MONITORING_SERVER_LOCATION_CACHE_SECONDS: int = Field(default=86400, ge=300, le=604800)
+    MONITORING_ACCESS_LOG_RETENTION_DAYS: int = Field(default=90, ge=7, le=3650)
+    MONITORING_METRIC_RETENTION_DAYS: int = Field(default=400, ge=30, le=3650)
+    MONITORING_RETENTION_INTERVAL_SECONDS: int = Field(default=86400, ge=60, le=604800)
+    USER_LOGIN_ACTIVITY_RETENTION_DAYS: int = Field(default=180, ge=30, le=3650)
+    USER_SESSION_ONLINE_SECONDS: int = Field(default=300, ge=60, le=3600)
 
 
 @lru_cache

backend/app/core/deps.py

@@ -286,8 +286,9 @@ def _enqueue_permission_log(
 
     writer = get_log_writer()
     if writer:
-        forwarded = request.headers.get("x-forwarded-for")
-        ip = forwarded.split(",")[0].strip() if forwarded else (request.client.host if request.client else None)
+        from app.core.request_context import build_request_audit_context, get_request_audit_context
+
+        context = get_request_audit_context() or build_request_audit_context(request)
         writer.enqueue({
             "study_id": study_id,
             "user_id": user_id,
@@ -295,7 +296,16 @@ def _enqueue_permission_log(
             "role": role,
             "allowed": allowed,
             "elapsed_ms": elapsed_ms,
-            "ip_address": ip,
+            "ip_address": context.client_ip,
+            "user_agent": context.user_agent,
+            "client_type": context.client_type,
+            "client_version": context.client_version,
+            "client_platform": context.client_platform,
+            "build_channel": context.build_channel,
+            "build_commit": context.build_commit,
+            "request_headers": context.request_headers,
+            "request_snapshot": context.request_snapshot,
+            "request_id": context.request_id,
         })
 
 

backend/app/core/request_context.py

@@ -2,14 +2,19 @@
 
 from __future__ import annotations
 
+import ipaddress
 import re
+import uuid
 from contextvars import ContextVar, Token
 from dataclasses import dataclass
 from typing import Any
 
+from app.core.config import settings
+
 
 @dataclass(frozen=True)
 class RequestAuditContext:
+    request_id: str | None = None
     client_ip: str | None = None
     user_agent: str | None = None
     client_type: str | None = None
@@ -17,6 +22,8 @@ class RequestAuditContext:
     client_platform: str | None = None
     build_channel: str | None = None
     build_commit: str | None = None
+    request_headers: dict[str, str] | None = None
+    request_snapshot: dict[str, Any] | None = None
 
 
 _request_audit_context: ContextVar[RequestAuditContext | None] = ContextVar(
@@ -25,11 +32,37 @@ _request_audit_context: ContextVar[RequestAuditContext | None] = ContextVar(
 )
 
 _SENSITIVE_TEXT_PATTERN = re.compile(
-    r"(?i)(bearer\s+)[A-Za-z0-9._~+/=-]+|((?:access_)?token|authorization)=([^&\s]+)"
+    r"(?i)(bearer\s+)[A-Za-z0-9._~+/=-]+|((?:access_)?token|authorization|password|passwd|secret|credential|api[-_]?key|session)=([^&\s]+)"
 )
+_SENSITIVE_HEADER_NAME_PATTERN = re.compile(
+    r"(?i)(authorization|cookie|set-cookie|token|password|passwd|secret|credential|api[-_]?key|session)"
+)
+_SAFE_REQUEST_HEADER_NAMES = frozenset(
+    {
+        "accept",
+        "accept-language",
+        "content-type",
+        "host",
+        "origin",
+        "user-agent",
+        "x-request-id",
+        "x-correlation-id",
+    }
+)
+_SAFE_REQUEST_HEADER_PREFIXES = ("x-ctms-",)
+_SENSITIVE_PARAMETER_NAME_PATTERN = re.compile(
+    r"(?i)(token|authorization|password|passwd|secret|credential|api[-_]?key|session|"
+    r"subject|participant|patient|user_?name|full_?name|email|phone|mobile|id_?card|"
+    r"identity|certificate|contact|address)"
+)
+_KNOWN_CLIENT_TYPES = frozenset({"web", "desktop"})
+_CTMS_CLIENT_SOURCE_TO_TYPE = {
+    "ctms-web": "web",
+    "ctms-desktop": "desktop",
+}
 
 
-def _clean_header_value(value: str | None, max_length: int) -> str | None:
+def _clean_audit_value(value: str | None, max_length: int) -> str | None:
     if value is None:
         return None
     cleaned = _SENSITIVE_TEXT_PATTERN.sub(lambda m: f"{m.group(1) or m.group(2) + '='}[redacted]", value.strip())
@@ -38,26 +71,174 @@ def _clean_header_value(value: str | None, max_length: int) -> str | None:
     return cleaned[:max_length]
 
 
+def _clean_header_value(value: str | None, max_length: int) -> str | None:
+    return _clean_audit_value(value, max_length)
+
+
+def resolve_ctms_client_type(headers: Any) -> str | None:
+    source = _clean_header_value(headers.get("x-ctms-client-source"), 32)
+    if source:
+        mapped_type = _CTMS_CLIENT_SOURCE_TO_TYPE.get(source.strip().lower())
+        if mapped_type:
+            return mapped_type
+
+    client_type = _clean_header_value(headers.get("x-ctms-client-type"), 16)
+    if not client_type:
+        return None
+    normalized = client_type.strip().lower()
+    return normalized if normalized in _KNOWN_CLIENT_TYPES else normalized[:16]
+
+
+def build_sanitized_request_headers(request: Any) -> dict[str, str] | None:
+    captured: dict[str, str] = {}
+    for raw_name, raw_value in request.headers.items():
+        name = str(raw_name).strip().lower()
+        if not name:
+            continue
+        if _SENSITIVE_HEADER_NAME_PATTERN.search(name):
+            captured[name] = "[redacted]"
+            continue
+        if name not in _SAFE_REQUEST_HEADER_NAMES and not name.startswith(_SAFE_REQUEST_HEADER_PREFIXES):
+            continue
+        value = _clean_header_value(str(raw_value), 500)
+        if value:
+            captured[name] = value
+    return captured or None
+
+
+def _sanitize_named_value(raw_name: Any, raw_value: Any, max_length: int = 500) -> dict[str, str] | None:
+    name = _clean_audit_value(str(raw_name), 120)
+    if not name:
+        return None
+    if _SENSITIVE_PARAMETER_NAME_PATTERN.search(name):
+        return {"name": name, "value": "[redacted]"}
+    value = _clean_audit_value(str(raw_value), max_length)
+    if value is None:
+        return {"name": name, "value": ""}
+    return {"name": name, "value": value}
+
+
+def _query_param_items(request: Any) -> list[dict[str, str]] | None:
+    query_params = getattr(request, "query_params", None)
+    if not query_params:
+        return None
+    if hasattr(query_params, "multi_items"):
+        raw_items = query_params.multi_items()
+    else:
+        raw_items = query_params.items()
+    items = [
+        item
+        for item in (_sanitize_named_value(name, value) for name, value in raw_items)
+        if item is not None
+    ][:50]
+    return items or None
+
+
+def _sanitized_query_string(items: list[dict[str, str]] | None) -> str | None:
+    if not items:
+        return None
+    value = "&".join(f"{item['name']}={item['value']}" for item in items)
+    return value[:2000] or None
+
+
+def _request_client_snapshot(request: Any) -> dict[str, str | int | None] | None:
+    client = getattr(request, "client", None)
+    if not client:
+        return None
+    host = _clean_audit_value(getattr(client, "host", None), 120)
+    port = getattr(client, "port", None)
+    if host is None and port is None:
+        return None
+    return {"host": host, "port": port}
+
+
+def build_request_snapshot(request: Any, *, request_id: str | None = None) -> dict[str, Any]:
+    headers = getattr(request, "headers", {})
+    scope = getattr(request, "scope", {}) or {}
+    url = getattr(request, "url", None)
+    query_params = _query_param_items(request)
+    path = getattr(url, "path", None) or scope.get("path")
+    method = getattr(request, "method", None) or scope.get("method")
+    snapshot: dict[str, Any] = {
+        "request_id": request_id,
+        "method": _clean_audit_value(str(method).upper() if method else None, 12),
+        "path": _clean_audit_value(path, 500),
+        "query_string": _sanitized_query_string(query_params),
+        "query_params": query_params,
+        "headers": build_sanitized_request_headers(request),
+        "http_version": _clean_audit_value(scope.get("http_version"), 16),
+        "scheme": _clean_audit_value(getattr(url, "scheme", None) or scope.get("scheme"), 16),
+        "client": _request_client_snapshot(request),
+        "content": {
+            "type": _clean_audit_value(headers.get("content-type"), 200),
+            "length": _clean_audit_value(headers.get("content-length"), 32),
+        },
+        "body": {
+            "captured": False,
+            "reason": "body_not_captured_by_audit_policy",
+        },
+    }
+    return {key: value for key, value in snapshot.items() if value not in (None, {}, [])}
+
+
+def _parse_ip(value: str | None):
+    try:
+        return ipaddress.ip_address((value or "").strip())
+    except ValueError:
+        return None
+
+
+def _trusted_proxy_networks():
+    networks = []
+    for value in settings.TRUSTED_PROXY_CIDRS.split(","):
+        candidate = value.strip()
+        if not candidate:
+            continue
+        try:
+            networks.append(ipaddress.ip_network(candidate, strict=False))
+        except ValueError:
+            continue
+    return tuple(networks)
+
+
+def _is_trusted_proxy(value: str | None) -> bool:
+    address = _parse_ip(value)
+    return bool(address and any(address in network for network in _trusted_proxy_networks()))
+
+
 def resolve_client_ip(request: Any) -> str | None:
+    peer_ip = request.client.host if request.client else None
+    if not _is_trusted_proxy(peer_ip):
+        return _clean_header_value(peer_ip, 45)
+
     forwarded = request.headers.get("x-forwarded-for")
     if forwarded:
-        return _clean_header_value(forwarded.split(",")[0].strip(), 45)
+        chain = [part.strip() for part in forwarded.split(",") if _parse_ip(part)]
+        chain.append(str(peer_ip))
+        for candidate in reversed(chain):
+            if not _is_trusted_proxy(candidate):
+                return _clean_header_value(candidate, 45)
+
     real_ip = request.headers.get("x-real-ip")
-    if real_ip:
+    if _parse_ip(real_ip):
         return _clean_header_value(real_ip.strip(), 45)
-    return _clean_header_value(request.client.host if request.client else None, 45)
+    return _clean_header_value(peer_ip, 45)
 
 
 def build_request_audit_context(request: Any) -> RequestAuditContext:
     headers = request.headers
+    request_id = str(uuid.uuid4())
     return RequestAuditContext(
+        request_id=request_id,
         client_ip=resolve_client_ip(request),
         user_agent=_clean_header_value(headers.get("user-agent"), 500),
-        client_type=_clean_header_value(headers.get("x-ctms-client-type"), 16),
+        client_type=resolve_ctms_client_type(headers),
         client_version=_clean_header_value(headers.get("x-ctms-client-version"), 32),
         client_platform=_clean_header_value(headers.get("x-ctms-client-platform"), 16),
         build_channel=_clean_header_value(headers.get("x-ctms-build-channel"), 16),
         build_commit=_clean_header_value(headers.get("x-ctms-build-commit"), 64),
+        request_headers=build_sanitized_request_headers(request),
+        request_snapshot=build_request_snapshot(request, request_id=request_id),
     )
 
 

backend/app/core/security.py

@@ -22,6 +22,7 @@ def create_access_token(
     max_age_seconds: Optional[int] = None,
     issued_at: Optional[datetime] = None,
     client_type: Optional[str] = None,
+    session_id: Optional[str] = None,
 ) -> str:
     now = issued_at or datetime.now(timezone.utc)
     if now.tzinfo is None:
@@ -42,6 +43,8 @@ def create_access_token(
     }
     if client_type:
         to_encode["client_type"] = client_type
+    if session_id:
+        to_encode["sid"] = session_id
     return jwt.encode(to_encode, settings.JWT_SECRET_KEY, algorithm=ALGORITHM)
 
 

backend/app/db/base.py

@@ -42,6 +42,8 @@ from app.models.permission_access_log import PermissionAccessLog  # noqa: F401
 from app.models.permission_metric_snapshot import PermissionMetricSnapshot  # noqa: F401
 from app.models.permission_template import PermissionTemplate, PermissionTemplateVersion  # noqa: F401
 from app.models.security_access_log import SecurityAccessLog  # noqa: F401
+from app.models.source_location_snapshot import SourceLocationSnapshot  # noqa: F401
+from app.models.user_login_session import UserLoginSession  # noqa: F401
 from app.models.desktop_notification import (  # noqa: F401
     DesktopNotificationDelivery,
     DesktopNotificationSubscription,

backend/app/main.py

@@ -5,8 +5,9 @@ import time
 from contextlib import asynccontextmanager
 from collections import defaultdict
 
-from fastapi import FastAPI
+from fastapi import Depends, FastAPI
 from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import JSONResponse
 from sqlalchemy import text
 
 from app.api.v1.router import api_router
@@ -19,15 +20,23 @@ from app.db.session import SessionLocal, engine
 from app.services.visit_scheduler import run_daily_lost_visit_job
 from app.services.permission_log_writer import start_log_writer, stop_log_writer
 from app.services.permission_metric_aggregator import run_hourly_metric_aggregation
+from app.services.source_location_aggregator import run_hourly_source_location_aggregation
+from app.services.monitoring_server_location import resolve_monitoring_server_location
+from app.services.monitoring_retention import run_monitoring_retention
 from app.services.security_access_log_writer import (
     get_security_log_writer,
     start_security_log_writer,
     stop_security_log_writer,
 )
 from app.core.security import decode_token
+from app.core.deps import get_db_session
 from app.core.request_context import (
     build_request_audit_context,
+    build_request_snapshot,
+    build_sanitized_request_headers,
+    get_request_audit_context,
     reset_request_audit_context,
+    resolve_ctms_client_type,
     resolve_client_ip,
     set_request_audit_context,
 )
@@ -42,8 +51,12 @@ setup_config_stats: dict[str, int] = defaultdict(int)
 @asynccontextmanager
 async def lifespan(_: FastAPI):
     stop_event = asyncio.Event()
+    await resolve_monitoring_server_location()
     scheduler_task = asyncio.create_task(run_daily_lost_visit_job(stop_event))
     aggregator_task = asyncio.create_task(run_hourly_metric_aggregation(stop_event))
+    source_location_aggregator_task = asyncio.create_task(
+        run_hourly_source_location_aggregation(stop_event)
+    )
     await start_log_writer()
     await start_security_log_writer()
     if settings.ENV == "development":
@@ -52,12 +65,15 @@ async def lifespan(_: FastAPI):
             await conn.run_sync(Base.metadata.create_all)
         async with SessionLocal() as session:
             await ensure_admin_exists(session)
+    retention_task = asyncio.create_task(run_monitoring_retention(stop_event))
     yield
     stop_event.set()
     await stop_log_writer()
     await stop_security_log_writer()
     await scheduler_task
     await aggregator_task
+    await source_location_aggregator_task
+    await retention_task
 
 
 async def _ensure_legacy_primary_keys(conn) -> None:
@@ -129,19 +145,23 @@ def create_app() -> FastAPI:
             "Accept",
             "Authorization",
             "Content-Type",
+            "X-CTMS-Client-Source",
             "X-CTMS-Client-Type",
             "X-CTMS-Client-Version",
             "X-CTMS-Client-Platform",
             "X-CTMS-Build-Channel",
             "X-CTMS-Build-Commit",
+            "X-Request-ID",
+            "X-Correlation-ID",
         ],
+        expose_headers=["X-Request-ID"],
     )
 
     @app.middleware("http")
     async def setup_config_monitoring_middleware(request, call_next):
         path = request.url.path
         is_setup_config_path = "/api/v1/studies/" in path and "/setup-config" in path
-        should_security_log = path.startswith("/api/")
+        should_security_log = path.startswith("/api/") and path != "/api/v1/auth/session/heartbeat"
         started_at = time.perf_counter()
         audit_context = build_request_audit_context(request)
         audit_context_token = set_request_audit_context(audit_context)
@@ -167,6 +187,8 @@ def create_app() -> FastAPI:
                 raise
 
             status_code = int(response.status_code)
+            if audit_context.request_id:
+                response.headers["X-Request-ID"] = audit_context.request_id
             if is_setup_config_path:
                 normalized_path = UUID_RE.sub("{study_id}", path)
                 duration_ms = int((time.perf_counter() - started_at) * 1000)
@@ -229,6 +251,36 @@ def create_app() -> FastAPI:
     async def health() -> dict[str, str]:
         return {"status": "ok"}
 
+    @app.get(
+        "/readyz",
+        tags=["health"],
+        summary="服务就绪检查",
+        description="验证应用可访问数据库；失败时返回 503。",
+    )
+    async def readiness(db=Depends(get_db_session)):
+        started_at = time.perf_counter()
+        try:
+            await db.execute(text("SELECT 1"))
+        except Exception as exc:
+            logger.exception("Readiness database check failed")
+            return JSONResponse(
+                status_code=503,
+                content={
+                    "status": "not_ready",
+                    "database": {
+                        "status": "unhealthy",
+                        "error_type": type(exc).__name__,
+                    },
+                },
+            )
+        return {
+            "status": "ready",
+            "database": {
+                "status": "healthy",
+                "latency_ms": round((time.perf_counter() - started_at) * 1000, 2),
+            },
+        }
+
     @app.get(
         "/health/setup-config-stats",
         tags=["health"],
@@ -271,6 +323,7 @@ def _enqueue_security_access_log(request, path: str, status_code: int, started_a
     if not writer:
         return
     auth_status, user_identifier = _resolve_auth_context(request)
+    context = get_request_audit_context()
     writer.enqueue(
         {
             "method": request.method,
@@ -279,11 +332,14 @@ def _enqueue_security_access_log(request, path: str, status_code: int, started_a
             "elapsed_ms": round((time.perf_counter() - started_at) * 1000, 2),
             "client_ip": resolve_client_ip(request),
             "user_agent": request.headers.get("user-agent"),
-            "client_type": request.headers.get("x-ctms-client-type"),
+            "client_type": resolve_ctms_client_type(request.headers),
             "client_version": request.headers.get("x-ctms-client-version"),
             "client_platform": request.headers.get("x-ctms-client-platform"),
             "build_channel": request.headers.get("x-ctms-build-channel"),
             "build_commit": request.headers.get("x-ctms-build-commit"),
+            "request_headers": context.request_headers if context else build_sanitized_request_headers(request),
+            "request_snapshot": context.request_snapshot if context else build_request_snapshot(request),
+            "request_id": context.request_id if context else None,
             "auth_status": auth_status,
             "user_identifier": user_identifier,
         }

backend/app/models/permission_access_log.py

@@ -6,13 +6,15 @@ import uuid
 from datetime import datetime
 from typing import Optional
 
-from sqlalchemy import Boolean, DateTime, Float, ForeignKey, Index, String
-from sqlalchemy.dialects.postgresql import UUID
+from sqlalchemy import JSON, Boolean, DateTime, Float, ForeignKey, Index, String
+from sqlalchemy.dialects.postgresql import JSONB, UUID
 from sqlalchemy.orm import Mapped, mapped_column
 from sqlalchemy.sql import func
 
 from app.db.base_class import Base
 
+JSONB_TYPE = JSON().with_variant(JSONB, "postgresql")
+
 
 class PermissionAccessLog(Base):
     __tablename__ = "permission_access_logs"
@@ -22,6 +24,9 @@ class PermissionAccessLog(Base):
         Index("ix_perm_log_endpoint_created", "endpoint_key", "created_at"),
         Index("ix_perm_log_created_at", "created_at"),
         Index("ix_perm_log_allowed", "allowed", "created_at"),
+        Index("ix_perm_log_ip_created", "ip_address", "created_at"),
+        Index("ix_perm_log_client_source_created", "client_type", "created_at"),
+        Index("ix_perm_log_request_id", "request_id"),
     )
 
     id: Mapped[uuid.UUID] = mapped_column(
@@ -38,6 +43,15 @@ class PermissionAccessLog(Base):
     allowed: Mapped[bool] = mapped_column(Boolean, nullable=False)
     elapsed_ms: Mapped[float] = mapped_column(Float, nullable=False)
     ip_address: Mapped[Optional[str]] = mapped_column(String(45), nullable=True)
+    user_agent: Mapped[Optional[str]] = mapped_column(String(500), nullable=True)
+    client_type: Mapped[Optional[str]] = mapped_column(String(16), nullable=True)
+    client_version: Mapped[Optional[str]] = mapped_column(String(32), nullable=True)
+    client_platform: Mapped[Optional[str]] = mapped_column(String(16), nullable=True)
+    build_channel: Mapped[Optional[str]] = mapped_column(String(16), nullable=True)
+    build_commit: Mapped[Optional[str]] = mapped_column(String(64), nullable=True)
+    request_headers: Mapped[Optional[dict]] = mapped_column(JSONB_TYPE, nullable=True)
+    request_snapshot: Mapped[Optional[dict]] = mapped_column(JSONB_TYPE, nullable=True)
+    request_id: Mapped[Optional[str]] = mapped_column(String(36), nullable=True)
     created_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True), nullable=False, server_default=func.now()
     )

backend/app/models/security_access_log.py

@@ -6,13 +6,15 @@ import uuid
 from datetime import datetime
 from typing import Optional
 
-from sqlalchemy import DateTime, Float, Index, Integer, String
-from sqlalchemy.dialects.postgresql import UUID
+from sqlalchemy import JSON, DateTime, Float, Index, Integer, String
+from sqlalchemy.dialects.postgresql import JSONB, UUID
 from sqlalchemy.orm import Mapped, mapped_column
 from sqlalchemy.sql import func
 
 from app.db.base_class import Base
 
+JSONB_TYPE = JSON().with_variant(JSONB, "postgresql")
+
 
 class SecurityAccessLog(Base):
     __tablename__ = "security_access_logs"
@@ -21,6 +23,9 @@ class SecurityAccessLog(Base):
         Index("ix_security_log_ip_created", "client_ip", "created_at"),
         Index("ix_security_log_status_created", "status_code", "created_at"),
         Index("ix_security_log_auth_created", "auth_status", "created_at"),
+        Index("ix_security_log_request_id", "request_id"),
+        Index("ix_security_log_category_created", "category", "created_at"),
+        Index("ix_security_log_severity_created", "severity", "created_at"),
     )
 
     id: Mapped[uuid.UUID] = mapped_column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
@@ -35,8 +40,13 @@ class SecurityAccessLog(Base):
     client_platform: Mapped[Optional[str]] = mapped_column(String(16), nullable=True)
     build_channel: Mapped[Optional[str]] = mapped_column(String(16), nullable=True)
     build_commit: Mapped[Optional[str]] = mapped_column(String(64), nullable=True)
+    request_headers: Mapped[Optional[dict]] = mapped_column(JSONB_TYPE, nullable=True)
+    request_snapshot: Mapped[Optional[dict]] = mapped_column(JSONB_TYPE, nullable=True)
     auth_status: Mapped[str] = mapped_column(String(30), nullable=False)
     user_identifier: Mapped[Optional[str]] = mapped_column(String(80), nullable=True)
+    request_id: Mapped[Optional[str]] = mapped_column(String(36), nullable=True)
+    category: Mapped[Optional[str]] = mapped_column(String(30), nullable=True)
+    severity: Mapped[Optional[str]] = mapped_column(String(16), nullable=True)
     created_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True), nullable=False, server_default=func.now()
     )

backend/app/models/source_location_snapshot.py

@@ -0,0 +1,48 @@
+"""Hourly source-location rollup for monitoring analytics."""
+
+from __future__ import annotations
+
+import uuid
+from datetime import datetime
+
+from sqlalchemy import DateTime, Float, Index, Integer, String, UniqueConstraint
+from sqlalchemy.dialects.postgresql import UUID
+from sqlalchemy.orm import Mapped, mapped_column
+from sqlalchemy.sql import func
+
+from app.db.base_class import Base
+
+
+class SourceLocationSnapshot(Base):
+    __tablename__ = "source_location_snapshots"
+    __table_args__ = (
+        UniqueConstraint("bucket_time", "ip_hash", "user_hash", name="uq_source_location_bucket_identity"),
+        Index("ix_source_location_bucket", "bucket_time"),
+        Index("ix_source_location_country_bucket", "country_code", "bucket_time"),
+        Index("ix_source_location_risk_bucket", "high_risk_count", "bucket_time"),
+    )
+
+    id: Mapped[uuid.UUID] = mapped_column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
+    bucket_time: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
+    ip_hash: Mapped[str] = mapped_column(String(64), nullable=False)
+    user_hash: Mapped[str] = mapped_column(String(64), nullable=False, default="")
+    country: Mapped[str] = mapped_column(String(100), nullable=False, default="")
+    country_code: Mapped[str] = mapped_column(String(16), nullable=False, default="")
+    province: Mapped[str] = mapped_column(String(100), nullable=False, default="")
+    region_code: Mapped[str] = mapped_column(String(24), nullable=False, default="")
+    city: Mapped[str] = mapped_column(String(100), nullable=False, default="")
+    isp: Mapped[str] = mapped_column(String(160), nullable=False, default="")
+    location: Mapped[str] = mapped_column(String(320), nullable=False, default="")
+    longitude: Mapped[float | None] = mapped_column(Float, nullable=True)
+    latitude: Mapped[float | None] = mapped_column(Float, nullable=True)
+    accuracy_level: Mapped[str] = mapped_column(String(16), nullable=False, default="unknown")
+    allowed_count: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    denied_count: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    security_event_count: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    high_risk_count: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    auth_failure_count: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    first_seen_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
+    last_seen_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, server_default=func.now()
+    )

backend/app/models/user_login_session.py

@@ -0,0 +1,32 @@
+from __future__ import annotations
+
+import uuid
+from datetime import datetime
+
+from sqlalchemy import DateTime, ForeignKey, String, func
+from sqlalchemy.dialects.postgresql import UUID
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.db.base_class import Base
+
+
+class UserLoginSession(Base):
+    """Server-side login activity record without storing credentials or raw IPs."""
+
+    __tablename__ = "user_login_sessions"
+
+    id: Mapped[uuid.UUID] = mapped_column(UUID(as_uuid=True), primary_key=True)
+    user_id: Mapped[uuid.UUID] = mapped_column(
+        UUID(as_uuid=True),
+        ForeignKey("users.id", ondelete="CASCADE"),
+        nullable=False,
+        index=True,
+    )
+    client_type: Mapped[str] = mapped_column(String(16), nullable=False, default="web")
+    client_platform: Mapped[str | None] = mapped_column(String(32), nullable=True)
+    client_version: Mapped[str | None] = mapped_column(String(64), nullable=True)
+    client_source: Mapped[str | None] = mapped_column(String(32), nullable=True)
+    login_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False, server_default=func.now())
+    last_seen_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False, server_default=func.now())
+    ended_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+    end_reason: Mapped[str | None] = mapped_column(String(32), nullable=True)

backend/app/schemas/user.py

@@ -6,6 +6,7 @@ from typing import Literal, Optional
 from pydantic import BaseModel, ConfigDict, EmailStr, Field, field_validator
 
 UserStatus = Literal["PENDING", "ACTIVE", "REJECTED", "DISABLED"]
+LoginStatus = Literal["ONLINE", "OFFLINE"]
 
 PASSWORD_REGEX = re.compile(r"^(?=.*[A-Za-z])(?=.*\d).{8,}$")
 
@@ -60,6 +61,11 @@ class UserRead(BaseModel):
     approved_at: Optional[datetime] = None
     approved_by: Optional[uuid.UUID] = None
     avatar_url: Optional[str] = None
+    login_status: LoginStatus = "OFFLINE"
+    last_login_at: Optional[datetime] = None
+    last_seen_at: Optional[datetime] = None
+    last_client_type: Optional[Literal["web", "desktop"]] = None
+    active_session_count: int = 0
 
     model_config = ConfigDict(from_attributes=True)
 
@@ -78,6 +84,19 @@ class UserResponse(UserRead):
     pass
 
 
+class UserLoginActivityRead(BaseModel):
+    id: uuid.UUID
+    client_type: Literal["web", "desktop"]
+    client_platform: Optional[str] = None
+    client_version: Optional[str] = None
+    login_at: datetime
+    last_seen_at: datetime
+    ended_at: Optional[datetime] = None
+    end_reason: Optional[str] = None
+
+    model_config = ConfigDict(from_attributes=True)
+
+
 class UserSelfUpdate(_PasswordValidator):
     full_name: Optional[str] = None
     clinical_department: Optional[str] = None

backend/app/services/geo_location_metadata.py

@@ -0,0 +1,175 @@
+"""Canonical map metadata for monitoring source locations.
+
+ip2region provides administrative names but no coordinates. This module keeps
+the normalization and centroid contract on the server so web and desktop
+clients render the same location semantics.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from app.services.ip_location import IpLocation
+
+
+@dataclass(frozen=True)
+class GeoLocationMetadata:
+    country: str
+    country_code: str
+    region_code: str
+    longitude: float | None
+    latitude: float | None
+    accuracy_level: str
+
+
+COUNTRY_ALIASES = {
+    "中国": "China",
+    "China": "China",
+    "Mainland China": "China",
+    "中国香港": "China",
+    "中国澳门": "China",
+    "中国台湾": "China",
+    "美国": "United States",
+    "United States": "United States",
+    "United States of America": "United States",
+    "USA": "United States",
+    "土耳其": "Türkiye",
+    "Turkey": "Türkiye",
+    "Türkiye": "Türkiye",
+}
+
+COUNTRY_CODES = {
+    "China": "CN",
+    "United States": "US",
+    "Netherlands": "NL",
+    "Türkiye": "TR",
+    "Australia": "AU",
+    "Japan": "JP",
+    "Singapore": "SG",
+    "Germany": "DE",
+    "France": "FR",
+    "United Kingdom": "GB",
+    "Canada": "CA",
+    "India": "IN",
+    "Russia": "RU",
+}
+
+COUNTRY_CENTROIDS = {
+    "China": (104.1954, 35.8617),
+    "United States": (-95.7129, 37.0902),
+    "Netherlands": (5.2913, 52.1326),
+    "Türkiye": (35.2433, 38.9637),
+    "Australia": (133.7751, -25.2744),
+    "Japan": (138.2529, 36.2048),
+    "Singapore": (103.8198, 1.3521),
+    "Germany": (10.4515, 51.1657),
+    "France": (2.2137, 46.2276),
+    "United Kingdom": (-3.436, 55.3781),
+    "Canada": (-106.3468, 56.1304),
+    "India": (78.9629, 20.5937),
+    "Russia": (105.3188, 61.524),
+}
+
+CHINA_REGION_METADATA = {
+    "北京市": ("CN-BJ", 116.4074, 39.9042),
+    "天津市": ("CN-TJ", 117.2008, 39.0842),
+    "河北省": ("CN-HE", 114.5025, 38.0455),
+    "山西省": ("CN-SX", 112.5492, 37.857),
+    "内蒙古自治区": ("CN-NM", 111.6708, 40.8183),
+    "辽宁省": ("CN-LN", 123.4315, 41.8057),
+    "吉林省": ("CN-JL", 125.3245, 43.8868),
+    "黑龙江省": ("CN-HL", 126.6424, 45.7567),
+    "上海市": ("CN-SH", 121.4737, 31.2304),
+    "江苏省": ("CN-JS", 118.7633, 32.0617),
+    "浙江省": ("CN-ZJ", 120.1551, 30.2741),
+    "安徽省": ("CN-AH", 117.2272, 31.8206),
+    "福建省": ("CN-FJ", 119.2965, 26.0745),
+    "江西省": ("CN-JX", 115.8582, 28.682),
+    "山东省": ("CN-SD", 117.1201, 36.6512),
+    "河南省": ("CN-HA", 113.6254, 34.7466),
+    "湖北省": ("CN-HB", 114.3055, 30.5928),
+    "湖南省": ("CN-HN", 112.9388, 28.2282),
+    "广东省": ("CN-GD", 113.2644, 23.1291),
+    "广西壮族自治区": ("CN-GX", 108.3669, 22.817),
+    "海南省": ("CN-HI", 110.3312, 20.0311),
+    "重庆": ("CN-CQ", 106.5516, 29.563),
+    "重庆市": ("CN-CQ", 106.5516, 29.563),
+    "四川省": ("CN-SC", 104.0665, 30.5723),
+    "贵州省": ("CN-GZ", 106.6302, 26.647),
+    "云南省": ("CN-YN", 102.8329, 24.8801),
+    "西藏自治区": ("CN-XZ", 91.1322, 29.6604),
+    "陕西省": ("CN-SN", 108.9398, 34.3416),
+    "甘肃省": ("CN-GS", 103.8343, 36.0611),
+    "青海省": ("CN-QH", 101.7782, 36.6171),
+    "宁夏回族自治区": ("CN-NX", 106.2309, 38.4872),
+    "新疆维吾尔自治区": ("CN-XJ", 87.6168, 43.8256),
+    "台湾省": ("CN-TW", 121.5654, 25.033),
+    "香港特别行政区": ("CN-HK", 114.1694, 22.3193),
+    "澳门特别行政区": ("CN-MO", 113.5439, 22.1987),
+}
+
+CITY_CENTROIDS = {
+    "南京": (118.7969, 32.0603),
+    "南京市": (118.7969, 32.0603),
+    "San Jose": (-121.8863, 37.3382),
+    "South Holland": (4.493, 52.0208),
+    "Istanbul": (28.9784, 41.0082),
+}
+
+
+def resolve_geo_location_metadata(location: IpLocation) -> GeoLocationMetadata:
+    if location.location in {"局域网", "本机"}:
+        return GeoLocationMetadata(
+            country="",
+            country_code="PRIVATE",
+            region_code="PRIVATE",
+            longitude=None,
+            latitude=None,
+            accuracy_level="private",
+        )
+
+    country = COUNTRY_ALIASES.get(location.country, location.country)
+    country_code = COUNTRY_CODES.get(country, "")
+
+    city_coordinate = CITY_CENTROIDS.get(location.city)
+    if city_coordinate:
+        return GeoLocationMetadata(
+            country=country,
+            country_code=country_code,
+            region_code="",
+            longitude=city_coordinate[0],
+            latitude=city_coordinate[1],
+            accuracy_level="city",
+        )
+
+    region_metadata = CHINA_REGION_METADATA.get(location.province)
+    if country in {"China", "中国"} and region_metadata:
+        region_code, longitude, latitude = region_metadata
+        return GeoLocationMetadata(
+            country="China",
+            country_code="CN",
+            region_code=region_code,
+            longitude=longitude,
+            latitude=latitude,
+            accuracy_level="region",
+        )
+
+    country_coordinate = COUNTRY_CENTROIDS.get(country)
+    if country_coordinate:
+        return GeoLocationMetadata(
+            country=country,
+            country_code=country_code,
+            region_code="",
+            longitude=country_coordinate[0],
+            latitude=country_coordinate[1],
+            accuracy_level="country",
+        )
+
+    return GeoLocationMetadata(
+        country=country,
+        country_code=country_code,
+        region_code="",
+        longitude=None,
+        latitude=None,
+        accuracy_level="unknown",
+    )

backend/app/services/ip_location.py

@@ -9,6 +9,7 @@ import ipaddress
 import logging
 import sys
 from dataclasses import dataclass
+from functools import lru_cache
 from pathlib import Path
 from typing import Optional
 
@@ -125,5 +126,6 @@ class Ip2RegionResolver:
 _resolver = Ip2RegionResolver()
 
 
+@lru_cache(maxsize=8192)
 def resolve_ip_location(ip: str | None) -> IpLocation:
     return _resolver.lookup(ip)

backend/app/services/monitoring_retention.py

@@ -0,0 +1,151 @@
+"""监测数据留存清理任务。"""
+
+from __future__ import annotations
+
+import asyncio
+import logging
+from dataclasses import dataclass, field
+from datetime import datetime, timedelta, timezone
+from typing import Any
+
+from sqlalchemy import delete
+
+from app.core.config import settings
+from app.db.session import SessionLocal
+from app.models.permission_access_log import PermissionAccessLog
+from app.models.permission_metric_snapshot import PermissionMetricSnapshot
+from app.models.security_access_log import SecurityAccessLog
+from app.models.source_location_snapshot import SourceLocationSnapshot
+from app.models.user_login_session import UserLoginSession
+
+logger = logging.getLogger("ctms.monitoring_retention")
+
+
+@dataclass
+class MonitoringRetentionState:
+    running: bool = False
+    last_run_started_at: datetime | None = None
+    last_success_at: datetime | None = None
+    last_error_at: datetime | None = None
+    last_error_type: str | None = None
+    error_count: int = 0
+    last_deleted: dict[str, int] = field(default_factory=dict)
+    total_deleted: dict[str, int] = field(default_factory=dict)
+
+    def snapshot(self) -> dict[str, Any]:
+        return {
+            "running": self.running,
+            "access_log_retention_days": settings.MONITORING_ACCESS_LOG_RETENTION_DAYS,
+            "metric_retention_days": settings.MONITORING_METRIC_RETENTION_DAYS,
+            "login_activity_retention_days": settings.USER_LOGIN_ACTIVITY_RETENTION_DAYS,
+            "interval_seconds": settings.MONITORING_RETENTION_INTERVAL_SECONDS,
+            "last_run_started_at": (
+                self.last_run_started_at.isoformat() if self.last_run_started_at else None
+            ),
+            "last_success_at": self.last_success_at.isoformat() if self.last_success_at else None,
+            "last_error_at": self.last_error_at.isoformat() if self.last_error_at else None,
+            "last_error_type": self.last_error_type,
+            "error_count": self.error_count,
+            "last_deleted": dict(self.last_deleted),
+            "total_deleted": dict(self.total_deleted),
+        }
+
+
+_state = MonitoringRetentionState()
+
+
+def get_monitoring_retention_status() -> dict[str, Any]:
+    return _state.snapshot()
+
+
+def _deleted_count(result: Any) -> int:
+    rowcount = getattr(result, "rowcount", 0)
+    return max(0, int(rowcount or 0))
+
+
+async def purge_expired_monitoring_data(
+    *, now: datetime | None = None
+) -> dict[str, int]:
+    reference_time = now or datetime.now(timezone.utc)
+    access_cutoff = reference_time - timedelta(
+        days=settings.MONITORING_ACCESS_LOG_RETENTION_DAYS
+    )
+    metric_cutoff = reference_time - timedelta(
+        days=settings.MONITORING_METRIC_RETENTION_DAYS
+    )
+    login_activity_cutoff = reference_time - timedelta(
+        days=settings.USER_LOGIN_ACTIVITY_RETENTION_DAYS
+    )
+
+    async with SessionLocal() as session:
+        permission_result = await session.execute(
+            delete(PermissionAccessLog).where(PermissionAccessLog.created_at < access_cutoff)
+        )
+        security_result = await session.execute(
+            delete(SecurityAccessLog).where(SecurityAccessLog.created_at < access_cutoff)
+        )
+        metric_result = await session.execute(
+            delete(PermissionMetricSnapshot).where(
+                PermissionMetricSnapshot.bucket_time < metric_cutoff
+            )
+        )
+        source_location_result = await session.execute(
+            delete(SourceLocationSnapshot).where(
+                SourceLocationSnapshot.bucket_time < access_cutoff
+            )
+        )
+        login_session_result = await session.execute(
+            delete(UserLoginSession).where(UserLoginSession.last_seen_at < login_activity_cutoff)
+        )
+        await session.commit()
+
+    return {
+        "permission_access_logs": _deleted_count(permission_result),
+        "security_access_logs": _deleted_count(security_result),
+        "permission_metric_snapshots": _deleted_count(metric_result),
+        "source_location_snapshots": _deleted_count(source_location_result),
+        "user_login_sessions": _deleted_count(login_session_result),
+    }
+
+
+async def run_monitoring_retention_once(
+    *, now: datetime | None = None
+) -> dict[str, int]:
+    _state.last_run_started_at = now or datetime.now(timezone.utc)
+    try:
+        deleted = await purge_expired_monitoring_data(now=now)
+    except Exception as exc:
+        _state.last_error_at = datetime.now(timezone.utc)
+        _state.last_error_type = type(exc).__name__
+        _state.error_count += 1
+        raise
+
+    _state.last_success_at = datetime.now(timezone.utc)
+    _state.last_deleted = deleted
+    for key, count in deleted.items():
+        _state.total_deleted[key] = _state.total_deleted.get(key, 0) + count
+    return deleted
+
+
+async def run_monitoring_retention(stop_event: asyncio.Event) -> None:
+    logger.info("Monitoring retention task started")
+    _state.running = True
+    try:
+        while not stop_event.is_set():
+            try:
+                deleted = await run_monitoring_retention_once()
+                if any(deleted.values()):
+                    logger.info("Purged expired monitoring data: %s", deleted)
+            except Exception:
+                logger.exception("Failed to purge expired monitoring data")
+
+            try:
+                await asyncio.wait_for(
+                    stop_event.wait(),
+                    timeout=settings.MONITORING_RETENTION_INTERVAL_SECONDS,
+                )
+            except asyncio.TimeoutError:
+                continue
+    finally:
+        _state.running = False
+        logger.info("Monitoring retention task stopped")

backend/app/services/monitoring_server_location.py

@@ -0,0 +1,164 @@
+"""Resolve the monitoring deployment's public network location.
+
+The map server marker is derived from the deployment's public IP instead of a
+frontend or configuration coordinate. An explicit public IP is accepted for
+restricted networks; otherwise the public frontend hostname and, finally, a
+small set of public-IP discovery endpoints are used. Results are cached so the
+monitoring API never performs per-request network discovery.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import ipaddress
+import logging
+import socket
+import time
+from dataclasses import dataclass
+from urllib.parse import urlparse
+
+import httpx
+
+from app.core.config import settings
+from app.services.geo_location_metadata import resolve_geo_location_metadata
+from app.services.ip_location import resolve_ip_location
+
+logger = logging.getLogger("ctms.monitoring_server_location")
+
+
+@dataclass(frozen=True)
+class MonitoringServerLocation:
+    name: str
+    longitude: float
+    latitude: float
+    accuracy_level: str
+    resolution_source: str
+
+    def to_public_dict(self) -> dict:
+        return {
+            "name": self.name,
+            "longitude": self.longitude,
+            "latitude": self.latitude,
+            "accuracy_level": self.accuracy_level,
+            "resolution_source": self.resolution_source,
+        }
+
+
+_cached_location: MonitoringServerLocation | None = None
+_cache_initialized = False
+_cache_expires_at = 0.0
+_cache_lock = asyncio.Lock()
+
+
+def _normalize_public_ip(value: str | None) -> str | None:
+    candidate = (value or "").strip().splitlines()[0] if (value or "").strip() else ""
+    try:
+        address = ipaddress.ip_address(candidate)
+    except ValueError:
+        return None
+    return str(address) if address.is_global else None
+
+
+async def _resolve_frontend_public_ip() -> str | None:
+    hostname = urlparse(settings.FRONTEND_PUBLIC_URL).hostname
+    if not hostname:
+        return None
+    literal_ip = _normalize_public_ip(hostname)
+    if literal_ip:
+        return literal_ip
+    try:
+        loop = asyncio.get_running_loop()
+        records = await loop.getaddrinfo(hostname, None, type=socket.SOCK_STREAM)
+    except (OSError, socket.gaierror):
+        return None
+    candidates = []
+    for _, _, _, _, socket_address in records:
+        candidate = _normalize_public_ip(str(socket_address[0]))
+        if candidate and candidate not in candidates:
+            candidates.append(candidate)
+    return next((item for item in candidates if ":" not in item), candidates[0] if candidates else None)
+
+
+async def _discover_public_ip() -> tuple[str | None, str]:
+    configured_ip = _normalize_public_ip(settings.MONITORING_SERVER_PUBLIC_IP)
+    if configured_ip:
+        return configured_ip, "configured_public_ip"
+
+    frontend_ip = await _resolve_frontend_public_ip()
+    if frontend_ip:
+        return frontend_ip, "frontend_dns"
+
+    if settings.ENV == "test":
+        return None, "unavailable"
+
+    urls = [
+        item.strip()
+        for item in settings.MONITORING_PUBLIC_IP_DISCOVERY_URLS.split(",")
+        if item.strip()
+    ]
+    timeout = httpx.Timeout(settings.MONITORING_PUBLIC_IP_DISCOVERY_TIMEOUT_SECONDS)
+    async with httpx.AsyncClient(timeout=timeout, follow_redirects=False) as client:
+        for url in urls:
+            try:
+                response = await client.get(url, headers={"Accept": "text/plain"})
+                response.raise_for_status()
+            except httpx.HTTPError:
+                logger.warning("Public IP discovery endpoint unavailable", extra={"endpoint": url})
+                continue
+            discovered_ip = _normalize_public_ip(response.text[:128])
+            if discovered_ip:
+                return discovered_ip, "public_ip_discovery"
+    return None, "unavailable"
+
+
+async def resolve_monitoring_server_location(*, force: bool = False) -> MonitoringServerLocation | None:
+    global _cached_location, _cache_initialized, _cache_expires_at
+
+    now = time.monotonic()
+    if not force and _cache_initialized and now < _cache_expires_at:
+        return _cached_location
+
+    async with _cache_lock:
+        now = time.monotonic()
+        if not force and _cache_initialized and now < _cache_expires_at:
+            return _cached_location
+
+        public_ip, resolution_source = await _discover_public_ip()
+        location = None
+        if public_ip:
+            ip_location = resolve_ip_location(public_ip)
+            metadata = resolve_geo_location_metadata(ip_location)
+            if metadata.longitude is not None and metadata.latitude is not None:
+                country = metadata.country or ip_location.country
+                name = " / ".join(
+                    part for part in [country, ip_location.province, ip_location.city] if part
+                ) or "公网服务器"
+                location = MonitoringServerLocation(
+                    name=name,
+                    longitude=metadata.longitude,
+                    latitude=metadata.latitude,
+                    accuracy_level=metadata.accuracy_level,
+                    resolution_source=resolution_source,
+                )
+                logger.info(
+                    "Monitoring server location resolved",
+                    extra={"resolution_source": resolution_source, "accuracy_level": metadata.accuracy_level},
+                )
+            else:
+                logger.warning("Deployment public IP has no usable geo coordinates")
+        else:
+            logger.warning("Unable to discover the deployment public IP")
+
+        _cached_location = location
+        _cache_initialized = True
+        cache_seconds = settings.MONITORING_SERVER_LOCATION_CACHE_SECONDS if location else 300
+        _cache_expires_at = now + cache_seconds
+        return location
+
+
+def reset_monitoring_server_location_cache() -> None:
+    """Reset process-local state for configuration reloads and tests."""
+    global _cached_location, _cache_initialized, _cache_expires_at
+    _cached_location = None
+    _cache_initialized = False
+    _cache_expires_at = 0.0

backend/app/services/permission_log_writer.py

@@ -13,6 +13,7 @@ import asyncio
 import logging
 import uuid
 from datetime import datetime, timezone
+from typing import Any
 
 from app.db.session import SessionLocal
 from app.models.permission_access_log import PermissionAccessLog
@@ -22,85 +23,150 @@ logger = logging.getLogger("ctms.permission_log_writer")
 BATCH_SIZE = 50
 FLUSH_INTERVAL = 5.0
 QUEUE_MAX_SIZE = 10000
+WRITE_ATTEMPTS = 2
+_QUEUE_STOP = object()
 
 
 class PermissionLogWriter:
 
     def __init__(self):
-        self._queue: asyncio.Queue[dict] = asyncio.Queue(maxsize=QUEUE_MAX_SIZE)
+        self._queue: asyncio.Queue[dict | object] = asyncio.Queue(maxsize=QUEUE_MAX_SIZE)
         self._task: asyncio.Task | None = None
+        self._stopping = False
+        self._started_at: datetime | None = None
+        self._last_success_at: datetime | None = None
+        self._last_error_at: datetime | None = None
+        self._last_error_type: str | None = None
+        self._accepted_entries = 0
+        self._written_entries = 0
+        self._dropped_entries = 0
+        self._failed_batches = 0
+        self._failed_entries = 0
+        self._retry_count = 0
 
     def enqueue(self, entry: dict) -> None:
+        if self._stopping:
+            self._dropped_entries += 1
+            logger.warning("Permission log writer is stopping, dropping entry")
+            return
         try:
             self._queue.put_nowait(entry)
+            self._accepted_entries += 1
         except asyncio.QueueFull:
+            self._dropped_entries += 1
             logger.warning("Permission log queue full, dropping entry")
 
     async def start(self) -> None:
+        if self._task and not self._task.done():
+            return
+        self._stopping = False
+        self._started_at = datetime.now(timezone.utc)
         self._task = asyncio.create_task(self._flush_loop())
         logger.info("PermissionLogWriter started")
 
     async def stop(self) -> None:
-        if self._task:
-            self._task.cancel()
-            try:
-                await self._task
-            except asyncio.CancelledError:
-                pass
-        await self._drain()
+        if self._task and not self._task.done():
+            self._stopping = True
+            await self._queue.put(_QUEUE_STOP)
+            await self._task
+        self._task = None
         logger.info("PermissionLogWriter stopped")
 
     async def _flush_loop(self) -> None:
         while True:
-            batch = await self._collect_batch()
+            batch, should_stop = await self._collect_batch()
             if batch:
                 await self._write_batch(batch)
+            if should_stop:
+                break
 
-    async def _collect_batch(self) -> list[dict]:
+    async def _collect_batch(self) -> tuple[list[dict], bool]:
         batch: list[dict] = []
         try:
             first = await asyncio.wait_for(self._queue.get(), timeout=FLUSH_INTERVAL)
+            if first is _QUEUE_STOP:
+                return batch, True
             batch.append(first)
         except asyncio.TimeoutError:
-            return batch
+            return batch, False
 
         while len(batch) < BATCH_SIZE:
             try:
                 item = self._queue.get_nowait()
+                if item is _QUEUE_STOP:
+                    return batch, True
                 batch.append(item)
             except asyncio.QueueEmpty:
                 break
-        return batch
+        return batch, False
 
-    async def _write_batch(self, batch: list[dict]) -> None:
-        try:
-            async with SessionLocal() as session:
-                for entry in batch:
-                    log = PermissionAccessLog(
-                        id=uuid.uuid4(),
-                        study_id=entry["study_id"],
-                        user_id=entry["user_id"],
-                        endpoint_key=entry["endpoint_key"],
-                        role=entry["role"],
-                        allowed=entry["allowed"],
-                        elapsed_ms=entry["elapsed_ms"],
-                        ip_address=entry.get("ip_address"),
-                        created_at=entry.get("created_at", datetime.now(timezone.utc)),
-                    )
-                    session.add(log)
-                await session.commit()
-        except Exception:
-            logger.exception("Failed to write permission access log batch (%d entries)", len(batch))
-
-    async def _drain(self) -> None:
-        batch: list[dict] = []
-        while not self._queue.empty():
+    async def _write_batch(self, batch: list[dict]) -> bool:
+        for attempt in range(WRITE_ATTEMPTS):
             try:
-                batch.append(self._queue.get_nowait())
-            except asyncio.QueueEmpty:
-                break
-        if batch:
-            await self._write_batch(batch)
+                async with SessionLocal() as session:
+                    for entry in batch:
+                        log = PermissionAccessLog(
+                            id=uuid.uuid4(),
+                            study_id=entry["study_id"],
+                            user_id=entry["user_id"],
+                            endpoint_key=entry["endpoint_key"],
+                            role=entry["role"],
+                            allowed=entry["allowed"],
+                            elapsed_ms=entry["elapsed_ms"],
+                            ip_address=entry.get("ip_address"),
+                            user_agent=entry.get("user_agent"),
+                            client_type=entry.get("client_type"),
+                            client_version=entry.get("client_version"),
+                            client_platform=entry.get("client_platform"),
+                            build_channel=entry.get("build_channel"),
+                            build_commit=entry.get("build_commit"),
+                            request_headers=entry.get("request_headers"),
+                            request_snapshot=entry.get("request_snapshot"),
+                            request_id=entry.get("request_id"),
+                            created_at=entry.get("created_at", datetime.now(timezone.utc)),
+                        )
+                        session.add(log)
+                    await session.commit()
+            except Exception as exc:
+                self._last_error_at = datetime.now(timezone.utc)
+                self._last_error_type = type(exc).__name__
+                if attempt + 1 < WRITE_ATTEMPTS:
+                    self._retry_count += 1
+                    logger.warning(
+                        "Permission access log batch write failed; retrying (%d entries)",
+                        len(batch),
+                    )
+                    await asyncio.sleep(0)
+                    continue
+                self._failed_batches += 1
+                self._failed_entries += len(batch)
+                logger.exception(
+                    "Failed to write permission access log batch after retries (%d entries)",
+                    len(batch),
+                )
+                return False
+            self._written_entries += len(batch)
+            self._last_success_at = datetime.now(timezone.utc)
+            return True
+        return False
+
+    def stats(self) -> dict[str, Any]:
+        return {
+            "running": bool(self._task and not self._task.done()),
+            "stopping": self._stopping,
+            "queue_size": self._queue.qsize(),
+            "queue_capacity": self._queue.maxsize,
+            "accepted_entries": self._accepted_entries,
+            "written_entries": self._written_entries,
+            "dropped_entries": self._dropped_entries,
+            "failed_batches": self._failed_batches,
+            "failed_entries": self._failed_entries,
+            "retry_count": self._retry_count,
+            "started_at": self._started_at.isoformat() if self._started_at else None,
+            "last_success_at": self._last_success_at.isoformat() if self._last_success_at else None,
+            "last_error_at": self._last_error_at.isoformat() if self._last_error_at else None,
+            "last_error_type": self._last_error_type,
+        }
 
 
 _writer: PermissionLogWriter | None = None

backend/app/services/security_access_log_writer.py

@@ -6,99 +6,170 @@ import asyncio
 import logging
 import uuid
 from datetime import datetime, timezone
+from typing import Any
 
 from app.db.session import SessionLocal
 from app.models.security_access_log import SecurityAccessLog
+from app.services.ip_location import resolve_ip_location
+from app.services.security_events import classify_security_event
 
 logger = logging.getLogger("ctms.security_access_log_writer")
 
 BATCH_SIZE = 100
 FLUSH_INTERVAL = 3.0
 QUEUE_MAX_SIZE = 20000
+WRITE_ATTEMPTS = 2
+_QUEUE_STOP = object()
 
 
 class SecurityAccessLogWriter:
     def __init__(self) -> None:
-        self._queue: asyncio.Queue[dict] = asyncio.Queue(maxsize=QUEUE_MAX_SIZE)
+        self._queue: asyncio.Queue[dict | object] = asyncio.Queue(maxsize=QUEUE_MAX_SIZE)
         self._task: asyncio.Task | None = None
+        self._stopping = False
+        self._started_at: datetime | None = None
+        self._last_success_at: datetime | None = None
+        self._last_error_at: datetime | None = None
+        self._last_error_type: str | None = None
+        self._accepted_entries = 0
+        self._written_entries = 0
+        self._dropped_entries = 0
+        self._failed_batches = 0
+        self._failed_entries = 0
+        self._retry_count = 0
 
     def enqueue(self, entry: dict) -> None:
+        if self._stopping:
+            self._dropped_entries += 1
+            logger.warning("Security access log writer is stopping, dropping entry")
+            return
         try:
             self._queue.put_nowait(entry)
+            self._accepted_entries += 1
         except asyncio.QueueFull:
+            self._dropped_entries += 1
             logger.warning("Security access log queue full, dropping entry")
 
     async def start(self) -> None:
+        if self._task and not self._task.done():
+            return
+        self._stopping = False
+        self._started_at = datetime.now(timezone.utc)
         self._task = asyncio.create_task(self._flush_loop())
         logger.info("SecurityAccessLogWriter started")
 
     async def stop(self) -> None:
-        if self._task:
-            self._task.cancel()
-            try:
-                await self._task
-            except asyncio.CancelledError:
-                pass
-        await self._drain()
+        if self._task and not self._task.done():
+            self._stopping = True
+            await self._queue.put(_QUEUE_STOP)
+            await self._task
+        self._task = None
         logger.info("SecurityAccessLogWriter stopped")
 
     async def _flush_loop(self) -> None:
         while True:
-            batch = await self._collect_batch()
+            batch, should_stop = await self._collect_batch()
             if batch:
                 await self._write_batch(batch)
+            if should_stop:
+                break
 
-    async def _collect_batch(self) -> list[dict]:
+    async def _collect_batch(self) -> tuple[list[dict], bool]:
         batch: list[dict] = []
         try:
             first = await asyncio.wait_for(self._queue.get(), timeout=FLUSH_INTERVAL)
+            if first is _QUEUE_STOP:
+                return batch, True
             batch.append(first)
         except asyncio.TimeoutError:
-            return batch
+            return batch, False
 
         while len(batch) < BATCH_SIZE:
             try:
-                batch.append(self._queue.get_nowait())
+                item = self._queue.get_nowait()
+                if item is _QUEUE_STOP:
+                    return batch, True
+                batch.append(item)
             except asyncio.QueueEmpty:
                 break
-        return batch
+        return batch, False
 
-    async def _write_batch(self, batch: list[dict]) -> None:
-        try:
-            async with SessionLocal() as session:
-                for entry in batch:
-                    session.add(
-                        SecurityAccessLog(
-                            id=uuid.uuid4(),
-                            method=entry["method"],
+    async def _write_batch(self, batch: list[dict]) -> bool:
+        for attempt in range(WRITE_ATTEMPTS):
+            try:
+                async with SessionLocal() as session:
+                    for entry in batch:
+                        classification = classify_security_event(
                             path=entry["path"],
                             status_code=entry["status_code"],
-                            elapsed_ms=entry["elapsed_ms"],
-                            client_ip=entry.get("client_ip"),
-                            user_agent=entry.get("user_agent"),
-                            client_type=entry.get("client_type"),
-                            client_version=entry.get("client_version"),
-                            client_platform=entry.get("client_platform"),
-                            build_channel=entry.get("build_channel"),
-                            build_commit=entry.get("build_commit"),
                             auth_status=entry["auth_status"],
-                            user_identifier=entry.get("user_identifier"),
-                            created_at=entry.get("created_at", datetime.now(timezone.utc)),
+                            ip_location=resolve_ip_location(entry.get("client_ip")),
                         )
+                        session.add(
+                            SecurityAccessLog(
+                                id=uuid.uuid4(),
+                                method=entry["method"],
+                                path=entry["path"],
+                                status_code=entry["status_code"],
+                                elapsed_ms=entry["elapsed_ms"],
+                                client_ip=entry.get("client_ip"),
+                                user_agent=entry.get("user_agent"),
+                                client_type=entry.get("client_type"),
+                                client_version=entry.get("client_version"),
+                                client_platform=entry.get("client_platform"),
+                                build_channel=entry.get("build_channel"),
+                                build_commit=entry.get("build_commit"),
+                                request_headers=entry.get("request_headers"),
+                                request_snapshot=entry.get("request_snapshot"),
+                                request_id=entry.get("request_id"),
+                                category=classification["category"],
+                                severity=classification["severity"],
+                                auth_status=entry["auth_status"],
+                                user_identifier=entry.get("user_identifier"),
+                                created_at=entry.get("created_at", datetime.now(timezone.utc)),
+                            )
+                        )
+                    await session.commit()
+            except Exception as exc:
+                self._last_error_at = datetime.now(timezone.utc)
+                self._last_error_type = type(exc).__name__
+                if attempt + 1 < WRITE_ATTEMPTS:
+                    self._retry_count += 1
+                    logger.warning(
+                        "Security access log batch write failed; retrying (%d entries)",
+                        len(batch),
                     )
-                await session.commit()
-        except Exception:
-            logger.exception("Failed to write security access log batch (%d entries)", len(batch))
+                    await asyncio.sleep(0)
+                    continue
+                self._failed_batches += 1
+                self._failed_entries += len(batch)
+                logger.exception(
+                    "Failed to write security access log batch after retries (%d entries)",
+                    len(batch),
+                )
+                return False
+            self._written_entries += len(batch)
+            self._last_success_at = datetime.now(timezone.utc)
+            return True
+        return False
 
-    async def _drain(self) -> None:
-        batch: list[dict] = []
-        while not self._queue.empty():
-            try:
-                batch.append(self._queue.get_nowait())
-            except asyncio.QueueEmpty:
-                break
-        if batch:
-            await self._write_batch(batch)
+    def stats(self) -> dict[str, Any]:
+        return {
+            "running": bool(self._task and not self._task.done()),
+            "stopping": self._stopping,
+            "queue_size": self._queue.qsize(),
+            "queue_capacity": self._queue.maxsize,
+            "accepted_entries": self._accepted_entries,
+            "written_entries": self._written_entries,
+            "dropped_entries": self._dropped_entries,
+            "failed_batches": self._failed_batches,
+            "failed_entries": self._failed_entries,
+            "retry_count": self._retry_count,
+            "started_at": self._started_at.isoformat() if self._started_at else None,
+            "last_success_at": self._last_success_at.isoformat() if self._last_success_at else None,
+            "last_error_at": self._last_error_at.isoformat() if self._last_error_at else None,
+            "last_error_type": self._last_error_type,
+        }
 
 
 _writer: SecurityAccessLogWriter | None = None

backend/app/services/security_events.py

@@ -0,0 +1,37 @@
+"""Security event classification shared by writers and monitoring APIs."""
+
+from __future__ import annotations
+
+from app.services.ip_location import IpLocation
+
+
+SENSITIVE_PROBE_MARKERS = (
+    "/.env",
+    ".env",
+    "/.git",
+    ".git/config",
+    "backup",
+    "config.php",
+    "wp-config",
+    "database.yml",
+)
+
+def classify_security_event(
+    *,
+    path: str,
+    status_code: int,
+    auth_status: str,
+    ip_location: IpLocation | None = None,
+) -> dict[str, str]:
+    normalized_path = (path or "").lower()
+    if any(marker in normalized_path for marker in SENSITIVE_PROBE_MARKERS):
+        return {"category": "PROBE", "severity": "CRITICAL"}
+    if status_code >= 500:
+        return {"category": "SERVER_ERROR", "severity": "HIGH"}
+    if auth_status == "INVALID_TOKEN":
+        return {"category": "INVALID_TOKEN", "severity": "MEDIUM"}
+    if auth_status == "ANONYMOUS" and status_code in {401, 403}:
+        return {"category": "ANONYMOUS_API", "severity": "MEDIUM"}
+    if status_code == 404:
+        return {"category": "NOT_FOUND_NOISE", "severity": "LOW"}
+    return {"category": "OTHER", "severity": "LOW"}

backend/app/services/source_location_aggregator.py

@@ -0,0 +1,272 @@
+"""Hourly source-location aggregation and timeline reads."""
+
+from __future__ import annotations
+
+import asyncio
+import hashlib
+import hmac
+import logging
+import uuid
+from collections import defaultdict
+from datetime import datetime, timedelta, timezone
+from typing import Literal
+
+from sqlalchemy import delete, func, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.config import settings
+from app.db.session import SessionLocal
+from app.models.permission_access_log import PermissionAccessLog
+from app.models.security_access_log import SecurityAccessLog
+from app.models.source_location_snapshot import SourceLocationSnapshot
+from app.services.geo_location_metadata import resolve_geo_location_metadata
+from app.services.ip_location import resolve_ip_location
+
+logger = logging.getLogger("ctms.source_location_aggregator")
+
+
+def _normalize_datetime(value: datetime) -> datetime:
+    return value.replace(tzinfo=timezone.utc) if value.tzinfo is None else value.astimezone(timezone.utc)
+
+
+def _identity_hash(kind: str, value: str | None) -> str:
+    if not value:
+        return ""
+    payload = f"source-location:{kind}:{value}".encode("utf-8")
+    return hmac.new(settings.JWT_SECRET_KEY.encode("utf-8"), payload, hashlib.sha256).hexdigest()
+
+
+async def aggregate_source_location_hour(bucket_start: datetime, bucket_end: datetime) -> int:
+    bucket_start = _normalize_datetime(bucket_start)
+    bucket_end = _normalize_datetime(bucket_end)
+    async with SessionLocal() as session:
+        matching_security_request = select(SecurityAccessLog.id).where(
+            PermissionAccessLog.request_id.is_not(None),
+            SecurityAccessLog.request_id == PermissionAccessLog.request_id,
+        ).exists()
+        permission_rows = (
+            await session.execute(
+                select(
+                    PermissionAccessLog.ip_address,
+                    PermissionAccessLog.user_id,
+                    func.count().filter(PermissionAccessLog.allowed.is_(True)).label("allowed_count"),
+                    func.count().filter(PermissionAccessLog.allowed.is_(False)).label("denied_count"),
+                    func.min(PermissionAccessLog.created_at).label("first_seen_at"),
+                    func.max(PermissionAccessLog.created_at).label("last_seen_at"),
+                )
+                .where(
+                    PermissionAccessLog.created_at >= bucket_start,
+                    PermissionAccessLog.created_at < bucket_end,
+                    PermissionAccessLog.ip_address.is_not(None),
+                    ~matching_security_request,
+                )
+                .group_by(PermissionAccessLog.ip_address, PermissionAccessLog.user_id)
+            )
+        ).all()
+        security_rows = (
+            await session.execute(
+                select(
+                    SecurityAccessLog.client_ip,
+                    SecurityAccessLog.user_identifier,
+                    func.count().filter(SecurityAccessLog.status_code < 400).label("allowed_count"),
+                    func.count().filter(SecurityAccessLog.status_code >= 400).label("denied_count"),
+                    func.count()
+                    .filter(
+                        SecurityAccessLog.category.is_not(None),
+                        ~SecurityAccessLog.category.in_(("OTHER", "NOT_FOUND_NOISE")),
+                    )
+                    .label("security_event_count"),
+                    func.count()
+                    .filter(SecurityAccessLog.severity.in_(("HIGH", "CRITICAL")))
+                    .label("high_risk_count"),
+                    func.count()
+                    .filter(
+                        SecurityAccessLog.status_code >= 400,
+                        SecurityAccessLog.auth_status.in_(("INVALID_TOKEN", "ANONYMOUS")),
+                    )
+                    .label("auth_failure_count"),
+                    func.min(SecurityAccessLog.created_at).label("first_seen_at"),
+                    func.max(SecurityAccessLog.created_at).label("last_seen_at"),
+                )
+                .where(
+                    SecurityAccessLog.created_at >= bucket_start,
+                    SecurityAccessLog.created_at < bucket_end,
+                    SecurityAccessLog.client_ip.is_not(None),
+                )
+                .group_by(SecurityAccessLog.client_ip, SecurityAccessLog.user_identifier)
+            )
+        ).all()
+
+        aggregates: dict[tuple[str, str], dict] = {}
+
+        def merge_row(
+            ip_address: str,
+            user_identity: str,
+            allowed_count: int,
+            denied_count: int,
+            first_seen_at: datetime,
+            last_seen_at: datetime,
+            *,
+            security_event_count: int = 0,
+            high_risk_count: int = 0,
+            auth_failure_count: int = 0,
+        ) -> None:
+            key = (ip_address, user_identity)
+            row = aggregates.setdefault(
+                key,
+                {
+                    "ip_address": ip_address,
+                    "user_identity": user_identity,
+                    "allowed_count": 0,
+                    "denied_count": 0,
+                    "security_event_count": 0,
+                    "high_risk_count": 0,
+                    "auth_failure_count": 0,
+                    "first_seen_at": _normalize_datetime(first_seen_at),
+                    "last_seen_at": _normalize_datetime(last_seen_at),
+                },
+            )
+            row["allowed_count"] += int(allowed_count or 0)
+            row["denied_count"] += int(denied_count or 0)
+            row["security_event_count"] += int(security_event_count or 0)
+            row["high_risk_count"] += int(high_risk_count or 0)
+            row["auth_failure_count"] += int(auth_failure_count or 0)
+            row["first_seen_at"] = min(row["first_seen_at"], _normalize_datetime(first_seen_at))
+            row["last_seen_at"] = max(row["last_seen_at"], _normalize_datetime(last_seen_at))
+
+        for ip_address, user_id, allowed, denied, first_seen, last_seen in permission_rows:
+            merge_row(str(ip_address), str(user_id or ""), allowed, denied, first_seen, last_seen)
+        for ip_address, user_identifier, allowed, denied, security_events, high_risk, auth_failures, first_seen, last_seen in security_rows:
+            merge_row(
+                str(ip_address),
+                str(user_identifier or ""),
+                allowed,
+                denied,
+                first_seen,
+                last_seen,
+                security_event_count=security_events,
+                high_risk_count=high_risk,
+                auth_failure_count=auth_failures,
+            )
+
+        await session.execute(
+            delete(SourceLocationSnapshot).where(SourceLocationSnapshot.bucket_time == bucket_start)
+        )
+        for row in aggregates.values():
+            ip_info = resolve_ip_location(row["ip_address"])
+            metadata = resolve_geo_location_metadata(ip_info)
+            longitude = metadata.longitude
+            latitude = metadata.latitude
+            country = metadata.country or ip_info.country
+            location = " / ".join(
+                part for part in [country, ip_info.province, ip_info.city] if part
+            ) or ip_info.location or "未知"
+            session.add(
+                SourceLocationSnapshot(
+                    id=uuid.uuid4(),
+                    bucket_time=bucket_start,
+                    ip_hash=_identity_hash("ip", row["ip_address"]),
+                    user_hash=_identity_hash("user", row["user_identity"]),
+                    country=country,
+                    country_code=metadata.country_code,
+                    province=ip_info.province,
+                    region_code=metadata.region_code,
+                    city=ip_info.city,
+                    isp=ip_info.isp,
+                    location=location,
+                    longitude=longitude,
+                    latitude=latitude,
+                    accuracy_level=metadata.accuracy_level,
+                    allowed_count=row["allowed_count"],
+                    denied_count=row["denied_count"],
+                    security_event_count=row["security_event_count"],
+                    high_risk_count=row["high_risk_count"],
+                    auth_failure_count=row["auth_failure_count"],
+                    first_seen_at=row["first_seen_at"],
+                    last_seen_at=row["last_seen_at"],
+                )
+            )
+        await session.commit()
+        return len(aggregates)
+
+
+async def get_source_location_timeline(
+    db: AsyncSession,
+    *,
+    start_at: datetime,
+    end_at: datetime,
+    granularity: Literal["hour", "day"],
+) -> list[dict]:
+    rows = (
+        await db.execute(
+            select(SourceLocationSnapshot)
+            .where(
+                SourceLocationSnapshot.bucket_time >= start_at,
+                SourceLocationSnapshot.bucket_time < end_at,
+            )
+            .order_by(SourceLocationSnapshot.bucket_time)
+        )
+    ).scalars().all()
+    buckets: dict[datetime, dict] = defaultdict(
+        lambda: {
+            "allowed_count": 0,
+            "denied_count": 0,
+            "security_event_count": 0,
+            "high_risk_count": 0,
+            "ip_hashes": set(),
+            "user_hashes": set(),
+        }
+    )
+    for row in rows:
+        bucket = _normalize_datetime(row.bucket_time)
+        if granularity == "day":
+            bucket = bucket.replace(hour=0, minute=0, second=0, microsecond=0)
+        else:
+            bucket = bucket.replace(minute=0, second=0, microsecond=0)
+        item = buckets[bucket]
+        item["allowed_count"] += row.allowed_count
+        item["denied_count"] += row.denied_count
+        item["security_event_count"] += row.security_event_count
+        item["high_risk_count"] += row.high_risk_count
+        item["ip_hashes"].add(row.ip_hash)
+        if row.user_hash:
+            item["user_hashes"].add(row.user_hash)
+
+    return [
+        {
+            "bucket_time": bucket.isoformat(),
+            "total_count": item["allowed_count"] + item["denied_count"],
+            "allowed_count": item["allowed_count"],
+            "denied_count": item["denied_count"],
+            "security_event_count": item["security_event_count"],
+            "high_risk_count": item["high_risk_count"],
+            "unique_ip_count": len(item["ip_hashes"]),
+            "unique_user_count": len(item["user_hashes"]),
+        }
+        for bucket, item in sorted(buckets.items())
+    ]
+
+
+async def run_hourly_source_location_aggregation(stop_event: asyncio.Event) -> None:
+    logger.info("Source location aggregator started")
+    now = datetime.now(timezone.utc)
+    completed_hour = now.replace(minute=0, second=0, microsecond=0)
+    try:
+        await aggregate_source_location_hour(completed_hour - timedelta(hours=1), completed_hour)
+    except Exception:
+        logger.exception("Failed to backfill source location snapshot for %s", completed_hour)
+
+    while not stop_event.is_set():
+        now = datetime.now(timezone.utc)
+        next_hour = now.replace(minute=0, second=0, microsecond=0) + timedelta(hours=1)
+        try:
+            await asyncio.wait_for(stop_event.wait(), timeout=(next_hour - now).total_seconds())
+            break
+        except asyncio.TimeoutError:
+            pass
+        try:
+            await aggregate_source_location_hour(next_hour - timedelta(hours=1), next_hour)
+        except Exception:
+            logger.exception("Failed to aggregate source locations for %s", next_hour)
+
+    logger.info("Source location aggregator stopped")

backend/app/services/user_login_sessions.py

@@ -0,0 +1,198 @@
+"""Server-authoritative login session activity for the admin account list."""
+
+from __future__ import annotations
+
+import uuid
+from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
+from typing import Any, Iterable
+
+from sqlalchemy import select, update
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.config import settings
+from app.models.user_login_session import UserLoginSession
+
+
+@dataclass(frozen=True)
+class UserLoginSummary:
+    status: str = "OFFLINE"
+    last_login_at: datetime | None = None
+    last_seen_at: datetime | None = None
+    client_type: str | None = None
+    active_session_count: int = 0
+
+
+def _now() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def _as_utc(value: datetime) -> datetime:
+    return value.replace(tzinfo=timezone.utc) if value.tzinfo is None else value.astimezone(timezone.utc)
+
+
+def _text_header(headers: Any, name: str, limit: int) -> str | None:
+    value = (headers.get(name) or "").strip()
+    return value[:limit] or None
+
+
+def session_id_from_payload(payload: dict[str, Any]) -> uuid.UUID:
+    raw_session_id = payload.get("sid")
+    try:
+        return uuid.UUID(str(raw_session_id))
+    except (TypeError, ValueError):
+        # Tokens issued before session tracking are mapped to a deterministic
+        # legacy session without persisting the token or a token-derived value.
+        legacy_key = ":".join(
+            [
+                str(payload.get("sub") or ""),
+                str(payload.get("orig_iat") or payload.get("iat") or ""),
+                str(payload.get("client_type") or "web"),
+            ]
+        )
+        return uuid.uuid5(uuid.NAMESPACE_URL, f"ctms:legacy-session:{legacy_key}")
+
+
+def session_client_type(payload: dict[str, Any], headers: Any) -> str:
+    from_payload = (payload.get("client_type") or "").strip().lower()
+    from_header = (headers.get("x-ctms-client-type") or "").strip().lower()
+    return "desktop" if "desktop" in {from_payload, from_header} else "web"
+
+
+async def create_login_session(
+    db: AsyncSession,
+    *,
+    session_id: uuid.UUID,
+    user_id: uuid.UUID,
+    request: Any,
+    login_at: datetime | None = None,
+) -> UserLoginSession:
+    occurred_at = login_at or _now()
+    session = UserLoginSession(
+        id=session_id,
+        user_id=user_id,
+        client_type=session_client_type({}, request.headers),
+        client_platform=_text_header(request.headers, "x-ctms-client-platform", 32),
+        client_version=_text_header(request.headers, "x-ctms-client-version", 64),
+        client_source=_text_header(request.headers, "x-ctms-client-source", 32),
+        login_at=occurred_at,
+        last_seen_at=occurred_at,
+    )
+    db.add(session)
+    await db.commit()
+    await db.refresh(session)
+    return session
+
+
+async def touch_login_session(
+    db: AsyncSession,
+    *,
+    user_id: uuid.UUID,
+    payload: dict[str, Any],
+    request: Any,
+) -> UserLoginSession | None:
+    session_id = session_id_from_payload(payload)
+    session = await db.get(UserLoginSession, session_id)
+    now = _now()
+    if session is None:
+        session = UserLoginSession(
+            id=session_id,
+            user_id=user_id,
+            client_type=session_client_type(payload, request.headers),
+            client_platform=_text_header(request.headers, "x-ctms-client-platform", 32),
+            client_version=_text_header(request.headers, "x-ctms-client-version", 64),
+            client_source=_text_header(request.headers, "x-ctms-client-source", 32),
+            login_at=now,
+            last_seen_at=now,
+        )
+        db.add(session)
+    elif session.user_id != user_id or session.ended_at is not None:
+        return None
+    else:
+        session.last_seen_at = now
+        session.client_platform = _text_header(request.headers, "x-ctms-client-platform", 32) or session.client_platform
+        session.client_version = _text_header(request.headers, "x-ctms-client-version", 64) or session.client_version
+    await db.commit()
+    await db.refresh(session)
+    return session
+
+
+async def end_login_session(
+    db: AsyncSession,
+    *,
+    user_id: uuid.UUID,
+    payload: dict[str, Any],
+    reason: str = "logout",
+) -> bool:
+    session_id = session_id_from_payload(payload)
+    result = await db.execute(
+        update(UserLoginSession)
+        .where(
+            UserLoginSession.id == session_id,
+            UserLoginSession.user_id == user_id,
+            UserLoginSession.ended_at.is_(None),
+        )
+        .values(ended_at=_now(), end_reason=reason, last_seen_at=_now())
+    )
+    await db.commit()
+    return bool(result.rowcount)
+
+
+async def get_login_summaries(
+    db: AsyncSession,
+    user_ids: Iterable[uuid.UUID],
+) -> dict[uuid.UUID, UserLoginSummary]:
+    ids = list(user_ids)
+    if not ids:
+        return {}
+    rows = (
+        await db.execute(
+            select(UserLoginSession)
+            .where(UserLoginSession.user_id.in_(ids))
+            .order_by(UserLoginSession.user_id, UserLoginSession.login_at.desc())
+        )
+    ).scalars().all()
+    cutoff = _now() - timedelta(seconds=settings.USER_SESSION_ONLINE_SECONDS)
+    summaries: dict[uuid.UUID, UserLoginSummary] = {}
+    mutable: dict[uuid.UUID, dict[str, Any]] = {}
+    for row in rows:
+        current = mutable.setdefault(
+            row.user_id,
+            {
+                "last_login_at": row.login_at,
+                "last_seen_at": row.last_seen_at,
+                "client_type": row.client_type,
+                "active_session_count": 0,
+            },
+        )
+        row_last_seen_at = _as_utc(row.last_seen_at)
+        if row_last_seen_at and (
+            current["last_seen_at"] is None or row_last_seen_at > _as_utc(current["last_seen_at"])
+        ):
+            current["last_seen_at"] = row_last_seen_at
+        if row.ended_at is None and row_last_seen_at >= cutoff:
+            current["active_session_count"] += 1
+    for user_id, item in mutable.items():
+        summaries[user_id] = UserLoginSummary(
+            status="ONLINE" if item["active_session_count"] else "OFFLINE",
+            last_login_at=item["last_login_at"],
+            last_seen_at=item["last_seen_at"],
+            client_type=item["client_type"],
+            active_session_count=item["active_session_count"],
+        )
+    return summaries
+
+
+async def list_login_activities(
+    db: AsyncSession,
+    *,
+    user_id: uuid.UUID,
+    limit: int,
+) -> list[UserLoginSession]:
+    result = await db.execute(
+        select(UserLoginSession)
+        .where(UserLoginSession.user_id == user_id)
+        .order_by(UserLoginSession.login_at.desc())
+        .limit(limit)
+    )
+    return list(result.scalars().all())