yumoqing/pipeline-sdlc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 补全审计接入点

Browse Source 
- deploy_account: account_create/account_remove/sandbox_run 审计
- work_env: org_key_gen/remote_bwrap 审计
This commit is contained in:
ymq 2026-08-14 13:37:53 +08:00
parent 66e7181b39
commit e33bd24227
2 changed files with 29 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
wwwroot/api/deploy_account.dspy
View File

@ -13,6 +13,13 @@ from pipeline_service.deploy_account import (
run_in_sandbox, write_file, read_file, list_dir, sanitize_username,
)
from pipeline_service.work_env import run_in_work_env
from app_audit.audit_service import audit_log
client_ip = ''
try:
client_ip = request.get('client_ip', '') or ''
except Exception:
pass
# 查当前用户 username（账号名 ag_<username>）
username = user_id
@ -29,6 +36,11 @@ if action == 'ensure':
try:
async with get_sor_context(request._run_ns, 'pipeline') as sor:
r = await ensure_account(sor, user_id, username)
await audit_log(sor, user_id, username, 'account_create',
target='ag_' + sanitize_username(username),
detail='created=' + str(r.get('created', '?')),
result='ok' if r.get('created') is not None else 'fail',
client_ip=client_ip)
return json.dumps({'ok': True, **r}, ensure_ascii=False)
except Exception as e:
return json.dumps({'ok': False, 'error': str(e)}, ensure_ascii=False)
@ -46,6 +58,10 @@ elif action == 'remove':
try:
async with get_sor_context(request._run_ns, 'pipeline') as sor:
r = await remove_account(sor, account_name)
await audit_log(sor, user_id, username, 'account_remove',
target=account_name, detail=str(r.get('error', '')),
result='ok' if r.get('ok') else 'fail',
client_ip=client_ip)
return json.dumps(r, ensure_ascii=False)
except Exception as e:
return json.dumps({'ok': False, 'error': str(e)}, ensure_ascii=False)
@ -64,6 +80,10 @@ elif action == 'run':
_u = await sor.sqlExe("SELECT orgid FROM users WHERE id=${u}$", {'u': user_id})
_org = getattr(_u[0], 'orgid', '') if _u else ''
r = await run_in_work_env(sor, account_name, user_id, _org, command, workdir, timeout, network)
await audit_log(sor, user_id, username, 'sandbox_run',
target=account_name, detail=str(command)[:500],
result='ok' if r.get('ok') else 'fail',
client_ip=client_ip)
return json.dumps({'ok': True, **r}, ensure_ascii=False)
except Exception as e:
return json.dumps({'ok': False, 'error': str(e)}, ensure_ascii=False)

9
wwwroot/api/work_env.dspy
View File

@ -92,6 +92,11 @@ elif action == 'ensure_remote_bwrap':
}
try:
r = await ensure_remote_bwrap(remote_config)
async with get_sor_context(request._run_ns, 'pipeline') as sor:
await audit_log(sor, user_id, username, 'remote_bwrap',
target=str(remote_config.get('remote_host', '')),
detail='部署/校验远程沙箱',
result='ok' if r.get('ok') else 'fail', client_ip=client_ip)
return json.dumps(r, ensure_ascii=False)
except Exception as e:
return json.dumps({'ok': False, 'error': str(e)}, ensure_ascii=False)
@ -107,6 +112,10 @@ elif action == 'get_org_pubkey':
return json.dumps({'ok': False, 'error': '只有平台管理员能获取机构公钥'}, ensure_ascii=False)
_oid = (params_kw or {}).get('org_id', '') or org_id
r = get_org_pubkey(_oid)
async with get_sor_context(request._run_ns, 'pipeline') as sor:
await audit_log(sor, user_id, username, 'org_key_gen',
target='org:' + str(_oid), detail='获取/生成机构公钥',
result='ok' if r.get('ok') else 'fail', client_ip=client_ip)
return json.dumps(r, ensure_ascii=False)
except Exception as e:
return json.dumps({'ok': False, 'error': str(e)}, ensure_ascii=False)