2adbcd0535
- Implemented comprehensive multi-tenant data isolation using database-level security - Built JWT authentication system with role-based access control (Super Admin, Org Admin, User, Viewer) - Created RESTful API endpoints for user and organization operations - Added complete audit logging for all data modifications with IP tracking - Implemented API rate limiting and input validation with security middleware - Built webhook processing engine with async event handling and retry logic - Created external API call handlers with circuit breaker pattern and error handling - Implemented data synchronization between external services and internal data - Added integration health monitoring and status tracking - Created three mock external services (User Management, Payment, Communication) - Implemented idempotency for webhook processing to handle duplicates gracefully - Added comprehensive security headers and XSS/CSRF protection - Set up Alembic database migrations with proper SQLite configuration - Included extensive documentation and API examples Architecture features: - Multi-tenant isolation at database level - Circuit breaker pattern for external API resilience - Async background task processing - Complete audit trail with user context - Role-based permission system - Webhook signature verification - Request validation and sanitization - Health monitoring endpoints Co-Authored-By: Claude <noreply@anthropic.com>
80 lines
2.3 KiB
Python
80 lines
2.3 KiB
Python
from sqlalchemy.orm import Session
|
|
from typing import Optional
|
|
from app.models.audit import AuditLog, AuditAction
|
|
from app.models.user import User
|
|
from app.models.tenant import Organization
|
|
import json
|
|
|
|
|
|
class AuditService:
|
|
def __init__(self, db: Session):
|
|
self.db = db
|
|
|
|
def log_action(
|
|
self,
|
|
organization_id: int,
|
|
action: AuditAction,
|
|
resource_type: str,
|
|
user_id: Optional[int] = None,
|
|
resource_id: Optional[str] = None,
|
|
details: Optional[dict] = None,
|
|
ip_address: Optional[str] = None,
|
|
user_agent: Optional[str] = None
|
|
):
|
|
audit_log = AuditLog(
|
|
organization_id=organization_id,
|
|
user_id=user_id,
|
|
action=action,
|
|
resource_type=resource_type,
|
|
resource_id=resource_id,
|
|
details=json.dumps(details) if details else None,
|
|
ip_address=ip_address,
|
|
user_agent=user_agent
|
|
)
|
|
|
|
self.db.add(audit_log)
|
|
self.db.commit()
|
|
return audit_log
|
|
|
|
def log_user_activity(
|
|
self,
|
|
user: User,
|
|
action: AuditAction,
|
|
resource_type: str,
|
|
resource_id: Optional[str] = None,
|
|
details: Optional[dict] = None,
|
|
ip_address: Optional[str] = None,
|
|
user_agent: Optional[str] = None
|
|
):
|
|
return self.log_action(
|
|
organization_id=user.organization_id,
|
|
user_id=user.id,
|
|
action=action,
|
|
resource_type=resource_type,
|
|
resource_id=resource_id,
|
|
details=details,
|
|
ip_address=ip_address,
|
|
user_agent=user_agent
|
|
)
|
|
|
|
def log_organization_activity(
|
|
self,
|
|
organization: Organization,
|
|
action: AuditAction,
|
|
resource_type: str,
|
|
user_id: Optional[int] = None,
|
|
resource_id: Optional[str] = None,
|
|
details: Optional[dict] = None,
|
|
ip_address: Optional[str] = None,
|
|
user_agent: Optional[str] = None
|
|
):
|
|
return self.log_action(
|
|
organization_id=organization.id,
|
|
user_id=user_id,
|
|
action=action,
|
|
resource_type=resource_type,
|
|
resource_id=resource_id,
|
|
details=details,
|
|
ip_address=ip_address,
|
|
user_agent=user_agent
|
|
) |