audit logging

app/routes/audit.py

@@ -0,0 +1,61 @@
+import html
+
+from fastapi import APIRouter, Depends, Request
+from fastapi.responses import HTMLResponse
+
+from app.auth import require_user
+from app.db.audit import get_audit_events
+from app.templates.layout import page
+
+router = APIRouter()
+
+
+@router.get("/audit", response_class=HTMLResponse)
+def audit_page(request: Request, user=Depends(require_user)):
+    rows = ""
+
+    for event in get_audit_events():
+        metadata = event.get("metadata") or "{}"
+        metadata_preview = metadata if len(metadata) <= 180 else f"{metadata[:177]}..."
+
+        rows += f"""
+        <tr>
+            <td>{html.escape(event.get("created_at", "") or "")}</td>
+            <td>{html.escape(event.get("username", "") or "")}</td>
+            <td><span class="pill pill-muted">{html.escape(event.get("action", "") or "")}</span></td>
+            <td>{html.escape(event.get("target_type", "") or "")}</td>
+            <td>{html.escape(str(event.get("target_id") or ""))}</td>
+            <td>{html.escape(event.get("source", "") or "")}</td>
+            <td><code>{html.escape(metadata_preview)}</code></td>
+        </tr>
+        """
+
+    if not rows:
+        rows = '<tr><td colspan="7">Zatím nejsou evidované žádné auditní události.</td></tr>'
+
+    return page(
+        "Audit",
+        f"""
+        <div class="card">
+            <h2>Audit</h2>
+            <p class="muted">Přehled interních akcí provedených v portálu.</p>
+        </div>
+
+        <div class="card">
+            <h2>Události</h2>
+            <table>
+                <tr>
+                    <th>Čas</th>
+                    <th>Uživatel</th>
+                    <th>Akce</th>
+                    <th>Typ cíle</th>
+                    <th>Cíl</th>
+                    <th>Zdroj</th>
+                    <th>Metadata</th>
+                </tr>
+                {rows}
+            </table>
+        </div>
+        """,
+        user=user,
+    )