feat: add audit log tables, indexes, and CLI/content recording hooks

devplacepy/routers/uploads.py

@@ -13,6 +13,8 @@ from devplacepy.attachments import (
     is_extension_allowed,
     RemoteFetchError,
 )
+from urllib.parse import urlparse
+from devplacepy.services.audit import record as audit
 
 logger = logging.getLogger(__name__)
 router = APIRouter()
@@ -49,6 +51,17 @@ async def upload_file(request: Request):
     logger.info(
         f"File uploaded: {file.filename} ({len(content)} bytes) -> {result['url']}"
     )
+    audit.record(
+        request,
+        "attachment.upload",
+        user=user,
+        target_type="attachment",
+        target_uid=result.get("uid"),
+        target_label=file.filename,
+        metadata={"size": len(content), "mime": result.get("mime_type")},
+        summary=f"{user['username']} uploaded attachment {file.filename}",
+        links=[audit.attachment_link(result.get("uid"), file.filename)],
+    )
     return JSONResponse(result, status_code=201)
 
 
@@ -63,6 +76,17 @@ async def upload_from_url(request: Request, data: Annotated[UploadUrlForm, Form(
     logger.info(
         f"URL attached: {data.url} ({result['file_size']} bytes) -> {result['url']}"
     )
+    audit.record(
+        request,
+        "attachment.upload_url",
+        user=user,
+        target_type="attachment",
+        target_uid=result.get("uid"),
+        target_label=result.get("filename"),
+        metadata={"source_host": urlparse(data.url).hostname, "size": result.get("file_size"), "mime": result.get("mime_type")},
+        summary=f"{user['username']} attached a remote file from {urlparse(data.url).hostname}",
+        links=[audit.attachment_link(result.get("uid"), result.get("filename"))],
+    )
     return JSONResponse(result, status_code=201)
 
 
@@ -76,4 +100,14 @@ async def delete_attachment_route(request: Request, attachment_uid: str):
         return JSONResponse({"error": "Not authorized"}, status_code=403)
     _delete_attachment(attachment_uid)
     logger.info(f"Attachment {attachment_uid} deleted by {user['username']}")
+    audit.record(
+        request,
+        "attachment.delete",
+        user=user,
+        target_type="attachment",
+        target_uid=attachment_uid,
+        target_label=att.get("filename"),
+        summary=f"{user['username']} deleted attachment {att.get('filename') or attachment_uid}",
+        links=[audit.attachment_link(attachment_uid, att.get("filename"))],
+    )
     return JSONResponse({"status": "deleted"})