fix: restrict devii user access to audit logs with read-only permissions

devplacepy/services/devii/actions/catalog.py

@@ -1044,6 +1044,49 @@ ACTIONS: tuple[Action, ...] = (
         ),
         requires_admin=True,
     ),
+    Action(
+        name="audit_log",
+        method="GET",
+        path="/admin/audit-log",
+        summary="Query the platform audit trail with filters (admin only)",
+        description=(
+            "Returns JSON: a paginated, newest-first list of audit events (every state-changing "
+            "action on the platform, with actor, origin, target, old/new value, and result), plus "
+            "pagination, the active filters, and an 'options' object listing every available value "
+            "for each filter (category, event_key, actor_role, origin, result) so you can both "
+            "filter and discover valid filter values from a single call. Use this for any audit, "
+            "history, 'who did X', 'what changed', or 'show denied/failed actions' question. Filter "
+            "by event_key (exact), category, actor_role, actor_uid, origin (web, api, devii, cli, "
+            "service, scheduler), or result (success, failure, denied); narrow by date_from/date_to "
+            "(ISO date bounds, inclusive) or free-text q over summary, event key, and target."
+        ),
+        params=(
+            query("page", "Page number (1-based)."),
+            query("event_key", "Filter by exact event key (e.g. admin.setting.update)."),
+            query("category", "Filter by category (auth, content, admin, container, ...)."),
+            query("actor_role", "Filter by actor role at action time."),
+            query("actor_uid", "Filter by acting user uid."),
+            query("origin", "Filter by origin (web, api, devii, cli, service, scheduler)."),
+            query("result", "Filter by result (success, failure, denied)."),
+            query("q", "Free-text search over summary, event key, and target."),
+            query("date_from", "ISO date lower bound (inclusive)."),
+            query("date_to", "ISO date upper bound (inclusive)."),
+        ),
+        requires_admin=True,
+    ),
+    Action(
+        name="audit_event",
+        method="GET",
+        path="/admin/audit-log/{uid}",
+        summary="Get one audit event with its related-object links (admin only)",
+        description=(
+            "Returns JSON: the full audit event row plus every related-object link (actor, target, "
+            "parent, project, instance, setting, ...). Use after audit_log to inspect a single event "
+            "in detail."
+        ),
+        params=(path("uid", "Audit event uid."),),
+        requires_admin=True,
+    ),
     Action(
         name="admin_list_users",
         method="GET",