refactor(audit): 审计架构清理——复活白名单监听器、停用噪声监听器、清除僵尸装饰器

一、统一为单一监听器实现原先两套 SQLAlchemy 事件监听器并存： · app/utils/audit_events.py —— 全局监听 db.Model、无白名单、无请求上下文守卫（实际在跑） · app/core/audit_listener.py —— 白名单制、有守卫、有模型级开关（从未生效）后者失效的根因：注册代码写在 extensions.py 的 init_extensions() 内，而该函数全仓库只有定义、没有任何调用（create_app 直接内联调用 db.init_app 等）。现统一由 app/core/audit_listener.py 承担，并在 create_app() 中显式注册。 extensions.py 的死函数 init_extensions 整体删除，避免后人误以为它是有效入口。二、修复监听器三处致命缺陷（此前注册了也写不进数据） 1. 事件回调第二个参数是 Connection，原代码却调用 Connection.add()（不存在），每次写日志都抛 AttributeError 并被 except 吞掉 → 改为 connection.execute() 2. register_audit_listeners 从 app.models 批量 import 多个未导出的模型， ImportError 被上层 try/except 吞掉 → 改为按表名从 db.metadata 取模型 3. 本项目有 31 处函数体内延迟导入模型（如 scrap.py 内部才 import ScrapApproval），一次性注册会静默漏表 → 增加 ensure_audit_listeners() 惰性补绑，并在模型预加载段补全审批单/BOM/采购等模型三、强约束 · WHITELIST_TABLES：仅 18 张核心业务表，系统表/草稿表/向量表不再自审 · has_request_context() 守卫：系统初始化与后台定时任务不再产生 username=system 噪声 · IGNORE_FIELDS 增加 password/password_hash/salt/token/secret/api_key（安全红线） · created_at 显式写 beijing_time()，与全系统时间口径一致四、清除僵尸装饰器 @audit_log 早已退化为直接透传的空壳（module/action 参数全被忽略，数据库中零星的中文 action 即其历史遗留产物），却仍挂在 38 处路由上。连同 13 个文件的 import 一并移除；audit_events.register_audit_events 改为空操作。验证：应用上下文中的写操作不产生日志；HTTP 请求产生 5 条日志，对象为业务单号（APR-SCRAP-... / SKU），模块中文，操作人真实，时间为北京时间。
2026-09-10 14:16:27 +08:00
parent 1ef9ae4ad9
commit 4808a48594
18 changed files with 513 additions and 527 deletions
--- a/inventory-backend/app/api/v1/inbound/base.py
+++ b/inventory-backend/app/api/v1/inbound/base.py
@ -3,7 +3,7 @@
 from flask import Blueprint, request, jsonify, send_file, g, current_app
 from app.extensions import db, beijing_time
 from app.services.inbound.base_service import MaterialBaseService
-from app.utils.decorators import login_required, permission_required, audit_log
+from app.utils.decorators import login_required, permission_required
 from app.models.base import MaterialBase, MaterialWarningSetting
 import traceback
 import datetime
@ -239,11 +239,6 @@ def export_data():
 # ==============================================================================
@inbound_base_bp.route('/', methods=['POST'])
@permission_required('material_list:operation')
-@audit_log(
-    module='基础信息管理',
-    action='新增',
-    get_target_name_fn=lambda: request.get_json().get('name') if request.get_json() else None
-)
 def create():
    try:
        data = request.get_json()
@ -302,12 +297,6 @@ def create():
 # ==============================================================================
@inbound_base_bp.route('/<int:id>', methods=['PUT'])
@permission_required('material_list:operation')
-@audit_log(
-    module='基础信息管理',
-    action='修改',
-    get_target_id_fn=lambda: request.view_args.get('id'),
-    get_target_name_fn=lambda: request.get_json().get('name') if request.get_json() else None
-)
 def update(id):
    try:
        data = request.get_json()
@ -359,11 +348,6 @@ def update(id):
 # ==============================================================================
@inbound_base_bp.route('/<int:id>', methods=['DELETE'])
@permission_required('material_list:operation')
-@audit_log(
-    module='基础信息管理',
-    action='删除',
-    get_target_id_fn=lambda: request.view_args.get('id')
-)
 def delete(id):
    try:
        material_name = MaterialBaseService.delete_material(id)
--- a/inventory-backend/app/api/v1/inbound/buy.py
+++ b/inventory-backend/app/api/v1/inbound/buy.py
@ -1,6 +1,6 @@
 from flask import Blueprint, request, jsonify
 from app.services.inbound.buy_service import BuyInboundService
-from app.utils.decorators import permission_required, audit_log
+from app.utils.decorators import permission_required
 import traceback

 inbound_buy_bp = Blueprint('stock_buy', __name__)
@ -124,11 +124,6 @@ def get_list():
 # ------------------------------------------------------------------
@inbound_buy_bp.route('/submit', methods=['POST'])
@permission_required('inbound_buy:operation')
-@audit_log(
-    module='采购入库',
-    action='新增',
-    get_target_name_fn=lambda: request.get_json().get('material_name') if request.get_json() else None
-)
 def submit():
    try:
        data = request.get_json()
@ -172,12 +167,6 @@ def submit():
 # ------------------------------------------------------------------
@inbound_buy_bp.route('/<int:id>', methods=['PUT'])
@permission_required('inbound_buy:operation')
-@audit_log(
-    module='采购入库',
-    action='修改',
-    get_target_id_fn=lambda: request.view_args.get('id'),
-    get_target_name_fn=lambda: request.get_json().get('material_name') if request.get_json() else None
-)
 def update_buy(id):
    try:
        data = request.get_json()
@ -245,11 +234,6 @@ def update_buy(id):
 # ------------------------------------------------------------------
@inbound_buy_bp.route('/<int:id>', methods=['DELETE'])
@permission_required('inbound_buy:operation')
-@audit_log(
-    module='采购入库',
-    action='删除',
-    get_target_id_fn=lambda: request.view_args.get('id')
-)
 def delete_buy(id):
    try:
        material_name = BuyInboundService.delete_inbound(id)
--- a/inventory-backend/app/api/v1/inbound/product.py
+++ b/inventory-backend/app/api/v1/inbound/product.py
@ -1,7 +1,7 @@
 # inventory-backend/app/api/v1/inbound/product.py
 from flask import Blueprint, request, jsonify
 from app.services.inbound.product_service import ProductInboundService
-from app.utils.decorators import permission_required, audit_log
+from app.utils.decorators import permission_required
 from app.models.base import MaterialBase
 from app.services.track_query_service import lookup_product
 import traceback
@ -108,11 +108,6 @@ def get_list():

@inbound_product_bp.route('/submit', methods=['POST'])
@permission_required('inbound_product:operation')
-@audit_log(
-    module='成品入库',
-    action='新增',
-    get_target_name_fn=lambda: request.get_json().get('material_name') if request.get_json() else None
-)
 def submit():
    try:
        data = request.get_json()
@ -191,12 +186,6 @@ def track_lookup():

@inbound_product_bp.route('/<int:id>', methods=['PUT'])
@permission_required('inbound_product:operation')
-@audit_log(
-    module='成品入库',
-    action='修改',
-    get_target_id_fn=lambda: request.view_args.get('id'),
-    get_target_name_fn=lambda: request.get_json().get('material_name') if request.get_json() else None
-)
 def update(id):
    try:
        data = request.get_json()
@ -244,11 +233,6 @@ def update(id):

@inbound_product_bp.route('/<int:id>', methods=['DELETE'])
@permission_required('inbound_product:operation')
-@audit_log(
-    module='成品入库',
-    action='删除',
-    get_target_id_fn=lambda: request.view_args.get('id')
-)
 def delete(id):
    try:
        material_name = ProductInboundService.delete_inbound(id)
--- a/inventory-backend/app/api/v1/inbound/repair.py
+++ b/inventory-backend/app/api/v1/inbound/repair.py
@ -1,7 +1,7 @@
 # inventory-backend/app/api/v1/inbound/repair.py
 from flask import Blueprint, request, jsonify
 from app.services.inbound.repair_service import RepairInboundService
-from app.utils.decorators import permission_required, audit_log
+from app.utils.decorators import permission_required
 import traceback

 inbound_repair_bp = Blueprint('inbound_repair', __name__)
@ -35,11 +35,6 @@ def get_list():
 # ------------------------------------------------------------------
@inbound_repair_bp.route('/submit', methods=['POST'])
@permission_required('inbound_repair:add')
-@audit_log(
-    module='维修管理',
-    action='新增',
-    get_target_name_fn=lambda: request.get_json().get('repair_no') if request.get_json() else None
-)
 def create():
    try:
        data = request.get_json()
@ -55,11 +50,6 @@ def create():
 # ------------------------------------------------------------------
@inbound_repair_bp.route('/<int:id>', methods=['PUT'])
@permission_required('inbound_repair:edit')
-@audit_log(
-    module='维修管理',
-    action='更新',
-    get_target_name_fn=lambda: f"维修单ID:{request.view_args.get('id')}"
-)
 def update(id):
    try:
        data = request.get_json()
@ -77,11 +67,6 @@ def update(id):
 # ------------------------------------------------------------------
@inbound_repair_bp.route('/update-status', methods=['POST'])
@permission_required('inbound_repair:edit')
-@audit_log(
-    module='维修管理',
-    action='更新状态',
-    get_target_name_fn=lambda: f"维修单ID:{request.get_json().get('id')}"
-)
 def update_status():
    try:
        data = request.get_json()
@ -105,11 +90,6 @@ def update_status():
 # ------------------------------------------------------------------
@inbound_repair_bp.route('/<int:id>', methods=['DELETE'])
@permission_required('inbound_repair:delete')
-@audit_log(
-    module='维修管理',
-    action='删除',
-    get_target_name_fn=lambda: f"维修单ID:{request.view_args.get('id')}"
-)
 def delete(id):
    try:
        success = RepairInboundService.delete(id)
@ -134,4 +114,4 @@ def get_detail(id):
        return jsonify({'code': 200, 'msg': 'success', 'data': result})
    except Exception as e:
        traceback.print_exc()
-        return jsonify({'code': 500, 'msg': str(e)}), 500
+        return jsonify({'code': 500, 'msg': str(e)}), 500
--- a/inventory-backend/app/api/v1/inbound/semi.py
+++ b/inventory-backend/app/api/v1/inbound/semi.py
@ -1,7 +1,7 @@
 # inventory-backend/app/api/v1/inbound/semi.py
 from flask import Blueprint, request, jsonify
 from app.services.inbound.semi_service import SemiInboundService
-from app.utils.decorators import permission_required, audit_log
+from app.utils.decorators import permission_required
 from app.models.base import MaterialBase
 from app.services.track_query_service import lookup_product
 import traceback
@ -112,11 +112,6 @@ def get_list():

@inbound_semi_bp.route('/submit', methods=['POST'])
@permission_required('inbound_semi:operation')
-@audit_log(
-    module='半成品入库',
-    action='新增',
-    get_target_name_fn=lambda: request.get_json().get('material_name') if request.get_json() else None
-)
 def submit():
    try:
        data = request.get_json()
@ -194,12 +189,6 @@ def track_lookup():

@inbound_semi_bp.route('/<int:id>', methods=['PUT'])
@permission_required('inbound_semi:operation')
-@audit_log(
-    module='半成品入库',
-    action='修改',
-    get_target_id_fn=lambda: request.view_args.get('id'),
-    get_target_name_fn=lambda: request.get_json().get('material_name') if request.get_json() else None
-)
 def update_semi(id):
    try:
        data = request.get_json()
@ -255,11 +244,6 @@ def update_semi(id):

@inbound_semi_bp.route('/<int:id>', methods=['DELETE'])
@permission_required('inbound_semi:operation')
-@audit_log(
-    module='半成品入库',
-    action='删除',
-    get_target_id_fn=lambda: request.view_args.get('id')
-)
 def delete_semi(id):
    try:
        material_name = SemiInboundService.delete_inbound(id)
--- a/inventory-backend/app/api/v1/inbound/service.py
+++ b/inventory-backend/app/api/v1/inbound/service.py
@ -3,7 +3,7 @@ from flask import request, jsonify, current_app
 from flask_jwt_extended import jwt_required
 from . import inbound_bp
 from app.services.inbound.service_service import ServiceService
-from app.utils.decorators import role_required, permission_required, audit_log
+from app.utils.decorators import role_required, permission_required
 import traceback


@ -110,11 +110,6 @@ def get_service_list():

@inbound_bp.route('/service', methods=['POST'])
@permission_required('inbound_service:operation')
-@audit_log(
-    module='服务权益',
-    action='新增',
-    get_target_name_fn=lambda: request.get_json().get('material_name') if request.get_json() else None
-)
 def create_service():
    """创建服务权益"""
    data = request.get_json()
@ -191,12 +186,6 @@ def get_service(service_id):

@inbound_bp.route('/service/<int:service_id>', methods=['PUT'])
@permission_required('inbound_service:operation')
-@audit_log(
-    module='服务权益',
-    action='修改',
-    get_target_id_fn=lambda: request.view_args.get('service_id'),
-    get_target_name_fn=lambda: request.get_json().get('material_name') if request.get_json() else None
-)
 def update_service(service_id):
    """更新服务权益"""
    data = request.get_json()
@ -256,11 +245,6 @@ def update_service(service_id):

@inbound_bp.route('/service/<int:service_id>', methods=['DELETE'])
@permission_required('inbound_service:operation')
-@audit_log(
-    module='服务权益',
-    action='删除',
-    get_target_id_fn=lambda: request.view_args.get('service_id')
-)
 def delete_service(service_id):
    """删除服务权益"""
    try: