Adding audit log

app/api/audit_log.py

@@ -0,0 +1,19 @@
+from fastapi import APIRouter, Depends
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.database import get_db
+from app.crud import audit as audit_crud
+from app.deps import require_permission
+from app.models.user import User
+from app.schemas.audit_log import AuditLogRead
+
+router = APIRouter()
+
+
+@router.get("", response_model=list[AuditLogRead])
+async def list_audit_log(
+    limit: int = 200,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(require_permission("audit_log:read")),
+):
+    return await audit_crud.list_recent(db, limit=limit)

app/api/iso_threads.py

@@ -2,6 +2,7 @@ from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.database import get_db
+from app.crud import audit as audit_crud
 from app.crud import iso_thread as iso_thread_crud
 from app.deps import require_permission
 from app.models.user import User
@@ -24,14 +25,20 @@ async def list_iso_threads(
 async def create_iso_thread(
     payload: IsoThreadCreate,
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(require_permission("iso_threads:write")),
+    actor: User = Depends(require_permission("iso_threads:write")),
 ):
-    return await iso_thread_crud.create(
+    thread = await iso_thread_crud.create(
         db,
         diameter_mm=payload.diameter_mm,
         pitch_mm=payload.pitch_mm,
         depth_mm=payload.depth_mm,
     )
+    await audit_crud.log(
+        db, actor=actor, action="create", resource_type="IsoThread",
+        resource_id=thread.id,
+        description=audit_crud.describe_create("IsoThread", thread.id, f"M{thread.diameter_mm}×{thread.pitch_mm}"),
+    )
+    return thread
 
 
 @router.get("/{iso_thread_id}", response_model=IsoThreadRead)
@@ -51,21 +58,34 @@ async def update_iso_thread(
     iso_thread_id: int,
     payload: IsoThreadUpdate,
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(require_permission("iso_threads:write")),
+    actor: User = Depends(require_permission("iso_threads:write")),
 ):
     thread = await iso_thread_crud.get(db, iso_thread_id)
     if thread is None:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="ISO thread not found")
-    return await iso_thread_crud.update(db, thread, payload.model_dump(exclude_unset=True))
+    changes = payload.model_dump(exclude_unset=True)
+    thread = await iso_thread_crud.update(db, thread, changes)
+    await audit_crud.log(
+        db, actor=actor, action="update", resource_type="IsoThread",
+        resource_id=thread.id,
+        description=audit_crud.describe_update("IsoThread", thread.id, changes),
+    )
+    return thread
 
 
 @router.delete("/{iso_thread_id}", status_code=status.HTTP_204_NO_CONTENT)
 async def delete_iso_thread(
     iso_thread_id: int,
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(require_permission("iso_threads:delete")),
+    actor: User = Depends(require_permission("iso_threads:delete")),
 ):
     thread = await iso_thread_crud.get(db, iso_thread_id)
     if thread is None:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="ISO thread not found")
+    name = f"M{thread.diameter_mm}×{thread.pitch_mm}"
     await iso_thread_crud.delete(db, thread)
+    await audit_crud.log(
+        db, actor=actor, action="delete", resource_type="IsoThread",
+        resource_id=iso_thread_id,
+        description=audit_crud.describe_delete("IsoThread", iso_thread_id, name),
+    )

app/api/manufacturers.py

@@ -2,6 +2,7 @@ from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.database import get_db
+from app.crud import audit as audit_crud
 from app.crud import manufacturer as manufacturer_crud
 from app.deps import require_permission
 from app.models.user import User
@@ -24,14 +25,20 @@ async def list_manufacturers(
 async def create_manufacturer(
     payload: ManufacturerCreate,
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(require_permission("manufacturers:write")),
+    actor: User = Depends(require_permission("manufacturers:write")),
 ):
-    return await manufacturer_crud.create(
+    m = await manufacturer_crud.create(
         db,
         name=payload.name,
         url=str(payload.url),
         logo_url=str(payload.logo_url) if payload.logo_url else None,
     )
+    await audit_crud.log(
+        db, actor=actor, action="create", resource_type="Manufacturer",
+        resource_id=m.id,
+        description=audit_crud.describe_create("Manufacturer", m.id, m.name),
+    )
+    return m
 
 
 @router.get("/{manufacturer_id}", response_model=ManufacturerRead)
@@ -51,7 +58,7 @@ async def update_manufacturer(
     manufacturer_id: int,
     payload: ManufacturerUpdate,
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(require_permission("manufacturers:write")),
+    actor: User = Depends(require_permission("manufacturers:write")),
 ):
     m = await manufacturer_crud.get(db, manufacturer_id)
     if m is None:
@@ -61,16 +68,28 @@ async def update_manufacturer(
         data["url"] = str(data["url"])
     if "logo_url" in data and data["logo_url"] is not None:
         data["logo_url"] = str(data["logo_url"])
-    return await manufacturer_crud.update(db, m, data)
+    m = await manufacturer_crud.update(db, m, data)
+    await audit_crud.log(
+        db, actor=actor, action="update", resource_type="Manufacturer",
+        resource_id=m.id,
+        description=audit_crud.describe_update("Manufacturer", m.id, data),
+    )
+    return m
 
 
 @router.delete("/{manufacturer_id}", status_code=status.HTTP_204_NO_CONTENT)
 async def delete_manufacturer(
     manufacturer_id: int,
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(require_permission("manufacturers:delete")),
+    actor: User = Depends(require_permission("manufacturers:delete")),
 ):
     m = await manufacturer_crud.get(db, manufacturer_id)
     if m is None:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Manufacturer not found")
+    name = m.name
     await manufacturer_crud.delete(db, m)
+    await audit_crud.log(
+        db, actor=actor, action="delete", resource_type="Manufacturer",
+        resource_id=manufacturer_id,
+        description=audit_crud.describe_delete("Manufacturer", manufacturer_id, name),
+    )

app/api/part_types.py

@@ -2,6 +2,7 @@ from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.database import get_db
+from app.crud import audit as audit_crud
 from app.crud import part_type as part_type_crud
 from app.deps import require_permission
 from app.models.user import User
@@ -24,9 +25,15 @@ async def list_part_types(
 async def create_part_type(
     payload: PartTypeCreate,
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(require_permission("part_types:write")),
+    actor: User = Depends(require_permission("part_types:write")),
 ):
-    return await part_type_crud.create(db, name=payload.name)
+    pt = await part_type_crud.create(db, name=payload.name)
+    await audit_crud.log(
+        db, actor=actor, action="create", resource_type="PartType",
+        resource_id=pt.id,
+        description=audit_crud.describe_create("PartType", pt.id, pt.name),
+    )
+    return pt
 
 
 @router.get("/{part_type_id}", response_model=PartTypeRead)
@@ -46,21 +53,34 @@ async def update_part_type(
     part_type_id: int,
     payload: PartTypeUpdate,
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(require_permission("part_types:write")),
+    actor: User = Depends(require_permission("part_types:write")),
 ):
     pt = await part_type_crud.get(db, part_type_id)
     if pt is None:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Part type not found")
-    return await part_type_crud.update(db, pt, payload.model_dump(exclude_unset=True))
+    changes = payload.model_dump(exclude_unset=True)
+    pt = await part_type_crud.update(db, pt, changes)
+    await audit_crud.log(
+        db, actor=actor, action="update", resource_type="PartType",
+        resource_id=pt.id,
+        description=audit_crud.describe_update("PartType", pt.id, changes),
+    )
+    return pt
 
 
 @router.delete("/{part_type_id}", status_code=status.HTTP_204_NO_CONTENT)
 async def delete_part_type(
     part_type_id: int,
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(require_permission("part_types:delete")),
+    actor: User = Depends(require_permission("part_types:delete")),
 ):
     pt = await part_type_crud.get(db, part_type_id)
     if pt is None:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Part type not found")
+    name = pt.name
     await part_type_crud.delete(db, pt)
+    await audit_crud.log(
+        db, actor=actor, action="delete", resource_type="PartType",
+        resource_id=part_type_id,
+        description=audit_crud.describe_delete("PartType", part_type_id, name),
+    )

app/api/roles.py

@@ -2,6 +2,7 @@ from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.database import get_db
+from app.crud import audit as audit_crud
 from app.crud import role as role_crud
 from app.deps import require_permission
 from app.models.user import User
@@ -22,18 +23,24 @@ async def list_roles(
 async def create_role(
     payload: RoleCreate,
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(require_permission("roles:write")),
+    actor: User = Depends(require_permission("roles:write")),
 ):
     if await role_crud.get_by_name(db, payload.name):
         raise HTTPException(
             status_code=status.HTTP_409_CONFLICT, detail="Role already exists"
         )
-    return await role_crud.create(
+    role = await role_crud.create(
         db,
         name=payload.name,
         description=payload.description,
         permission_ids=payload.permission_ids,
     )
+    await audit_crud.log(
+        db, actor=actor, action="create", resource_type="Role",
+        resource_id=role.id,
+        description=audit_crud.describe_create("Role", role.id, role.name),
+    )
+    return role
 
 
 @router.get("/permissions", response_model=list[PermissionRead])
@@ -63,25 +70,38 @@ async def update_role(
     role_id: int,
     payload: RoleUpdate,
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(require_permission("roles:write")),
+    actor: User = Depends(require_permission("roles:write")),
 ):
     role = await role_crud.get(db, role_id)
     if role is None:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND, detail="Role not found"
         )
-    return await role_crud.update(db, role, payload.model_dump(exclude_unset=True))
+    changes = payload.model_dump(exclude_unset=True)
+    role = await role_crud.update(db, role, changes)
+    await audit_crud.log(
+        db, actor=actor, action="update", resource_type="Role",
+        resource_id=role.id,
+        description=audit_crud.describe_update("Role", role.id, changes),
+    )
+    return role
 
 
 @router.delete("/{role_id}", status_code=status.HTTP_204_NO_CONTENT)
 async def delete_role(
     role_id: int,
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(require_permission("roles:write")),
+    actor: User = Depends(require_permission("roles:write")),
 ):
     role = await role_crud.get(db, role_id)
     if role is None:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND, detail="Role not found"
         )
+    name = role.name
     await role_crud.delete(db, role)
+    await audit_crud.log(
+        db, actor=actor, action="delete", resource_type="Role",
+        resource_id=role_id,
+        description=audit_crud.describe_delete("Role", role_id, name),
+    )

app/api/router.py

@@ -1,6 +1,6 @@
 from fastapi import APIRouter
 
-from app.api import auth, iso_threads, manufacturers, part_types, roles, scope_models, unc_threads, users
+from app.api import audit_log, auth, iso_threads, manufacturers, part_types, roles, scope_models, unc_threads, users
 
 api_router = APIRouter()
 api_router.include_router(auth.router, prefix="/auth", tags=["auth"])
@@ -11,3 +11,4 @@ api_router.include_router(unc_threads.router, prefix="/unc-threads", tags=["unc-
 api_router.include_router(manufacturers.router, prefix="/manufacturers", tags=["manufacturers"])
 api_router.include_router(scope_models.router, prefix="/scope-models", tags=["scope-models"])
 api_router.include_router(part_types.router, prefix="/part-types", tags=["part-types"])
+api_router.include_router(audit_log.router, prefix="/audit-log", tags=["audit-log"])

app/api/scope_models.py

@@ -2,6 +2,7 @@ from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.database import get_db
+from app.crud import audit as audit_crud
 from app.crud import scope_model as scope_model_crud
 from app.deps import require_permission
 from app.models.user import User
@@ -24,14 +25,20 @@ async def list_scope_models(
 async def create_scope_model(
     payload: ScopeModelCreate,
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(require_permission("scope_models:write")),
+    actor: User = Depends(require_permission("scope_models:write")),
 ):
-    return await scope_model_crud.create(
+    sm = await scope_model_crud.create(
         db,
         name=payload.name,
         manufacturer_id=payload.manufacturer_id,
         url=str(payload.url) if payload.url else None,
     )
+    await audit_crud.log(
+        db, actor=actor, action="create", resource_type="ScopeModel",
+        resource_id=sm.id,
+        description=audit_crud.describe_create("ScopeModel", sm.id, sm.name),
+    )
+    return sm
 
 
 @router.get("/{scope_model_id}", response_model=ScopeModelRead)
@@ -51,7 +58,7 @@ async def update_scope_model(
     scope_model_id: int,
     payload: ScopeModelUpdate,
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(require_permission("scope_models:write")),
+    actor: User = Depends(require_permission("scope_models:write")),
 ):
     sm = await scope_model_crud.get(db, scope_model_id)
     if sm is None:
@@ -59,16 +66,28 @@ async def update_scope_model(
     data = payload.model_dump(exclude_unset=True)
     if "url" in data and data["url"] is not None:
         data["url"] = str(data["url"])
-    return await scope_model_crud.update(db, sm, data)
+    sm = await scope_model_crud.update(db, sm, data)
+    await audit_crud.log(
+        db, actor=actor, action="update", resource_type="ScopeModel",
+        resource_id=sm.id,
+        description=audit_crud.describe_update("ScopeModel", sm.id, data),
+    )
+    return sm
 
 
 @router.delete("/{scope_model_id}", status_code=status.HTTP_204_NO_CONTENT)
 async def delete_scope_model(
     scope_model_id: int,
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(require_permission("scope_models:delete")),
+    actor: User = Depends(require_permission("scope_models:delete")),
 ):
     sm = await scope_model_crud.get(db, scope_model_id)
     if sm is None:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Scope model not found")
+    name = sm.name
     await scope_model_crud.delete(db, sm)
+    await audit_crud.log(
+        db, actor=actor, action="delete", resource_type="ScopeModel",
+        resource_id=scope_model_id,
+        description=audit_crud.describe_delete("ScopeModel", scope_model_id, name),
+    )

app/api/unc_threads.py

@@ -2,6 +2,7 @@ from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.database import get_db
+from app.crud import audit as audit_crud
 from app.crud import unc_thread as unc_thread_crud
 from app.deps import require_permission
 from app.models.user import User
@@ -24,15 +25,21 @@ async def list_unc_threads(
 async def create_unc_thread(
     payload: UncThreadCreate,
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(require_permission("unc_threads:write")),
+    actor: User = Depends(require_permission("unc_threads:write")),
 ):
-    return await unc_thread_crud.create(
+    thread = await unc_thread_crud.create(
         db,
         diameter_fraction=payload.diameter_fraction,
         tpi=payload.tpi,
         series=payload.series,
         depth_in=payload.depth_in,
     )
+    await audit_crud.log(
+        db, actor=actor, action="create", resource_type="UncThread",
+        resource_id=thread.id,
+        description=audit_crud.describe_create("UncThread", thread.id, f"{thread.diameter_fraction}-{thread.tpi} {thread.series.value}"),
+    )
+    return thread
 
 
 @router.get("/{unc_thread_id}", response_model=UncThreadRead)
@@ -52,21 +59,34 @@ async def update_unc_thread(
     unc_thread_id: int,
     payload: UncThreadUpdate,
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(require_permission("unc_threads:write")),
+    actor: User = Depends(require_permission("unc_threads:write")),
 ):
     thread = await unc_thread_crud.get(db, unc_thread_id)
     if thread is None:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="UNC thread not found")
-    return await unc_thread_crud.update(db, thread, payload.model_dump(exclude_unset=True))
+    changes = payload.model_dump(exclude_unset=True)
+    thread = await unc_thread_crud.update(db, thread, changes)
+    await audit_crud.log(
+        db, actor=actor, action="update", resource_type="UncThread",
+        resource_id=thread.id,
+        description=audit_crud.describe_update("UncThread", thread.id, changes),
+    )
+    return thread
 
 
 @router.delete("/{unc_thread_id}", status_code=status.HTTP_204_NO_CONTENT)
 async def delete_unc_thread(
     unc_thread_id: int,
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(require_permission("unc_threads:delete")),
+    actor: User = Depends(require_permission("unc_threads:delete")),
 ):
     thread = await unc_thread_crud.get(db, unc_thread_id)
     if thread is None:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="UNC thread not found")
+    name = f"{thread.diameter_fraction}-{thread.tpi} {thread.series.value}"
     await unc_thread_crud.delete(db, thread)
+    await audit_crud.log(
+        db, actor=actor, action="delete", resource_type="UncThread",
+        resource_id=unc_thread_id,
+        description=audit_crud.describe_delete("UncThread", unc_thread_id, name),
+    )

app/api/users.py

@@ -2,6 +2,7 @@ from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.database import get_db
+from app.crud import audit as audit_crud
 from app.crud import user as user_crud
 from app.deps import get_current_user, require_permission
 from app.models.user import User
@@ -29,13 +30,13 @@ async def list_users(
 async def create_user(
     payload: UserCreate,
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(require_permission("users:write")),
+    actor: User = Depends(require_permission("users:write")),
 ):
     if await user_crud.get_by_email(db, payload.email):
         raise HTTPException(
             status_code=status.HTTP_409_CONFLICT, detail="Email already registered"
         )
-    return await user_crud.create(
+    created = await user_crud.create(
         db,
         email=payload.email,
         password=payload.password,
@@ -43,6 +44,12 @@ async def create_user(
         is_superuser=payload.is_superuser,
         role_ids=payload.role_ids,
     )
+    await audit_crud.log(
+        db, actor=actor, action="create", resource_type="User",
+        resource_id=created.id,
+        description=audit_crud.describe_create("User", created.id, created.email),
+    )
+    return created
 
 
 @router.get("/{user_id}", response_model=UserRead)
@@ -51,12 +58,12 @@ async def get_user(
     db: AsyncSession = Depends(get_db),
     _: User = Depends(require_permission("users:read")),
 ):
-    user = await user_crud.get(db, user_id)
-    if user is None:
+    target = await user_crud.get(db, user_id)
+    if target is None:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND, detail="User not found"
         )
-    return user
+    return target
 
 
 @router.patch("/{user_id}", response_model=UserRead)
@@ -64,25 +71,38 @@ async def update_user(
     user_id: int,
     payload: UserUpdate,
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(require_permission("users:write")),
+    actor: User = Depends(require_permission("users:write")),
 ):
-    user = await user_crud.get(db, user_id)
-    if user is None:
+    target = await user_crud.get(db, user_id)
+    if target is None:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND, detail="User not found"
         )
-    return await user_crud.update(db, user, payload.model_dump(exclude_unset=True))
+    changes = payload.model_dump(exclude_unset=True)
+    target = await user_crud.update(db, target, changes)
+    await audit_crud.log(
+        db, actor=actor, action="update", resource_type="User",
+        resource_id=user_id,
+        description=audit_crud.describe_update("User", user_id, changes),
+    )
+    return target
 
 
 @router.delete("/{user_id}", status_code=status.HTTP_204_NO_CONTENT)
 async def delete_user(
     user_id: int,
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(require_permission("users:delete")),
+    actor: User = Depends(require_permission("users:delete")),
 ):
-    user = await user_crud.get(db, user_id)
-    if user is None:
+    target = await user_crud.get(db, user_id)
+    if target is None:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND, detail="User not found"
         )
-    await user_crud.delete(db, user)
+    email = target.email
+    await user_crud.delete(db, target)
+    await audit_crud.log(
+        db, actor=actor, action="delete", resource_type="User",
+        resource_id=user_id,
+        description=audit_crud.describe_delete("User", user_id, email),
+    )