Feature - add logs for admin user

backend/app/routers/users.py

@@ -1,12 +1,13 @@
 from typing import Annotated
 
-from fastapi import APIRouter, Depends, HTTPException, status
+from fastapi import APIRouter, Depends, HTTPException, Request, status
 from sqlalchemy.orm import Session
 
 from app.auth import get_current_admin, get_current_user, get_password_hash
 from app.database import get_db
 from app.models.user import User, UserRole
 from app.schemas import AdminUserCreate, UserResponse, UserUpdate
+from app.services.audit import get_client_ip, log_action
 from app.services.user_cleanup import cleanup_user_files
 
 router = APIRouter(prefix="/api/users", tags=["users"])
@@ -27,8 +28,9 @@ def list_users(
 @router.post("", response_model=UserResponse, status_code=status.HTTP_201_CREATED)
 def create_user(
     user_data: AdminUserCreate,
+    request: Request,
     db: Annotated[Session, Depends(get_db)],
-    _: Annotated[User, Depends(get_current_admin)],
+    current_user: Annotated[User, Depends(get_current_admin)],
 ):
     from app.auth import get_user_by_email, get_user_by_username
 
@@ -45,6 +47,16 @@ def create_user(
         is_active=True,
     )
     db.add(user)
+    db.flush()
+    log_action(
+        db,
+        "user.create",
+        user=current_user,
+        resource_type="user",
+        resource_id=user.id,
+        details={"username": user.username, "email": user.email, "role": user.role.value},
+        ip_address=get_client_ip(request),
+    )
     db.commit()
     db.refresh(user)
     return user
@@ -54,6 +66,7 @@ def create_user(
 def update_user(
     user_id: int,
     update: UserUpdate,
+    request: Request,
     db: Annotated[Session, Depends(get_db)],
     current_user: Annotated[User, Depends(get_current_admin)],
 ):
@@ -77,9 +90,11 @@ def update_user(
         if _count_admins(db) <= 1:
             raise HTTPException(status_code=400, detail="Cannot deactivate the last admin")
 
+    changes: dict = {}
     if update.email is not None and update.email != user.email:
         if get_user_by_email(db, update.email):
             raise HTTPException(status_code=400, detail="Email already registered")
+        changes["email"] = {"from": user.email, "to": update.email}
         user.email = update.email
 
     if update.username is not None and update.username != user.username:
@@ -87,15 +102,40 @@ def update_user(
 
         if get_user_by_username(db, update.username):
             raise HTTPException(status_code=400, detail="Username already taken")
+        changes["username"] = {"from": user.username, "to": update.username}
         user.username = update.username
 
-    if update.role is not None:
+    if update.role is not None and update.role != user.role:
+        changes["role"] = {"from": user.role.value, "to": update.role.value}
         user.role = update.role
-    if update.is_active is not None:
+
+    if update.is_active is not None and update.is_active != user.is_active:
         user.is_active = update.is_active
+        log_action(
+            db,
+            "user.activate" if update.is_active else "user.deactivate",
+            user=current_user,
+            resource_type="user",
+            resource_id=user.id,
+            details={"target_username": user.username},
+            ip_address=get_client_ip(request),
+        )
+
     if update.password:
+        changes["password"] = "changed"
         user.hashed_password = get_password_hash(update.password)
 
+    if changes:
+        log_action(
+            db,
+            "user.update",
+            user=current_user,
+            resource_type="user",
+            resource_id=user.id,
+            details={"target_username": user.username, "changes": changes},
+            ip_address=get_client_ip(request),
+        )
+
     db.commit()
     db.refresh(user)
     return user
@@ -104,6 +144,7 @@ def update_user(
 @router.delete("/{user_id}", status_code=status.HTTP_204_NO_CONTENT)
 def delete_user(
     user_id: int,
+    request: Request,
     db: Annotated[Session, Depends(get_db)],
     current_user: Annotated[User, Depends(get_current_admin)],
 ):
@@ -117,6 +158,15 @@ def delete_user(
     if user.role == UserRole.admin and _count_admins(db) <= 1:
         raise HTTPException(status_code=400, detail="Cannot delete the last admin")
 
+    log_action(
+        db,
+        "user.delete",
+        user=current_user,
+        resource_type="user",
+        resource_id=user.id,
+        details={"username": user.username, "email": user.email},
+        ip_address=get_client_ip(request),
+    )
     cleanup_user_files(db, user)
     db.delete(user)
     db.commit()